SafePay Ransomware Recovery: What's Recoverable

SafePay emerged in September 2024 and, unusually, avoids the affiliate/RaaS model most other groups use, operating as an internal outfit instead. It gained attention through a breach of UK telematics firm Microlise, exfiltrating around 1.2 TB of data before encrypting.

Entry is typically via valid credentials over RDP, phishing, or public-facing vulnerabilities, with WMI used for lateral movement and WinRAR plus MEGASync for exfiltration. Encryption appends a .safepay extension, with a readme_safepay.txt ransom note, and — like most active groups — includes deliberate deletion of volume shadow copies.

That shadow-copy deletion step is exactly why a Windows built-in "restore previous version" usually isn't available after a SafePay incident — but it doesn't mean the underlying data is gone. File-level and storage-level recovery works independently of shadow copies, so an assessment of the affected disks and databases directly is the right next step rather than assuming shadow-copy deletion equals total loss.