Ransomware groups continue to evolve their tactics, but few have made as sharp an impact in 2025 as SafePay. Once a lesser-known player, the group has surged into prominence by quietly amassing hundreds of victims across the globe. In June, SafePay topped Bitdefender’s Threat Debrief rankings after claiming 73 victim organizations in a single month, and the group followed up with 42 more victims in July—its second-highest monthly tally to date.

As organizations face increasing ransomware activity in the final months of 2024, the importance of maintaining robust cybersecurity strategies has never been clearer. Understanding how threat actors evolve their tactics is crucial to protecting critical data and systems. In this month’s Threat Debrief, we examined ransomware group activity from November 1 to November 30, uncovering 647 claimed victims across their leak sites.