The Unsafe group is a financially motivated cybercrime group republishing data leaked by other ransomware groups.
The Unsafe group is a financially motivated cybercrime group that recycles leaked data from other ransomware groups. It primarily targets the Technology, Professional Services, Manufacturing, Healthcare, and Financial Services sectors in the United States, India, Germany, and Canada. Their main TTPs revolve around republishing previously exfiltrated data, indicating a reliance on existing leaks rather than novel intrusion tools. Defenders should monitor for recycled leaked data relevant to their organization and prioritize network segmentation and backup strategies to mitigate ransomware-related risks.
A group which seems to recycle leak from other ransomware groups
The Unsafe group primarily targets organizations in the United States, India, Germany, and Canada.
The primary TTPs of the Unsafe group revolve around republishing previously exfiltrated data obtained from other ransomware groups.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.