// THREAT ACTOR
UNSAFE_
ActiveUNSAFE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of UNSAFE — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 4
- 2024 3
- 2023 3
- 2022 8
Leak site mirrors
1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
unsafeipw6wbkzzmj7yqp7bz6j7ivzynggmwxsm6u2wwfmfqrxqrrhyd.onionUnSafe snapshot · 2026-08-06 21:41
Recent victims
The 50 most recent victims claimed by UNSAFE. Total in the index: 18.
| Date listed | Victim | Description |
|---|---|---|
| 2026-07-30 | https://straightperformance.de/ | Revenue: 2 million | Views: 16727 | Posted: 6/28/2026, 10:31:51 PM | S… |
| 2026-07-30 | Deutsche Bank | Revenue: 30 billion | Views: 17629 | Posted: 7/4/2026, 6:15:19 PM | St… |
| 2026-07-30 | CCR Solutions | Revenue: 41 million | Views: 9012 | Posted: 7/20/2026, 2:30:10 AM | St… |
| 2026-07-30 | Jiva Health | Revenue: 9 million | Views: 6037 | Posted: 7/25/2026, 4:21:02 AM | Sta… |
| 2024-01-14 | Hartl European Transport Company | |
| 2024-01-14 | American International College | |
| 2024-01-14 | SPARTAN Light Metal Products | |
| 2023-06-10 | TAG Aviation | |
| 2023-04-17 | SPARTAN Light Metal Products Inc | |
| 2023-04-14 | Invenergy | |
| 2022-12-22 | G.R. Sponaugle | |
| 2022-12-22 | Horwitz Horwitz & Associates | |
| 2022-12-22 | Wings Etc | |
| 2022-12-22 | Dooly County School System | |
| 2022-12-22 | Whatcom County Library System | |
| 2022-12-22 | The Chedi Muscat | |
| 2022-12-22 | Barakat Travel Co | |
| 2022-12-22 | Ucar |