Ransomware Group: SAFEPAY

VICTIM NAME: sander-doll[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The leak page pertains to the website sander-doll.com, which was compromised on May 29, 2025, in Germany. The incident is attributed to the ransomware group “safepay.” The attackers have leaked information related to multiple information stealer malware families, including Azorult, Lumma, Raccoon, and RedLine, indicating a focus on data theft involving these malicious tools. The page features a screenshot showing internal documents or related content, providing visual evidence of the breach. The attackers also claim to have data associated with a small number of users and to have targeted various malware families, emphasizing the scope of their data exfiltration activities.

Currently, there is no publicly available information about the specific impact on the victim’s operations or data, but the leak suggests that sensitive information has been compromised and is possibly being shared or sold. The group claims responsibility through a claim URL hosted on the dark web, reinforcing the ongoing threat posed by such ransomware and info-stealer groups. The incident highlights the importance of cybersecurity vigilance, especially in regions like Germany, where cybercriminal activity continues to escalate. The leak page provides visual evidence and details about the malware involved, offering cybersecurity professionals insight into the threat landscape regarding this breach.