Analysis msp-it-servicesprofessional-services
SafePay: How a LockBit Code Derivative Became 2026's Most Active Ransomware Group
SafePay went from an obscure late-2024 leak site to the most active ransomware operation tracked in 2026, built on leaked LockBit code, a centralized non-affiliate model, and a deliberate focus on MSPs and their downstream clients.