SafePay rises to become largest ransomware and international effort is made against Russian hackers

The IT security company Check Point Software has released its May Security Landscape Report. SafePay, a new ransomware group, has suddenly become the most prominent threat in ransomwareHealthcare and communications are the most vulnerable sectors, while FakeUpdates continues to dominate as the most widespread malware in Sweden.

SafePay was identified in late 2024 and has since grown rapidly. The ransomware group, with potential Russian connections, uses a so-called double extortion model, where data is both encrypted and stolen to increase pressure on victims. Unlike many other ransomware actors, SafePay is not run as a service (RaaS), but operates with an internal team and a clear structureThis has resulted in consistent and effective attacks against both large and small businesses.

At the same time, an international crackdown was carried out in May against the malware platform Lumma, involving, among others, Europol, the FBI and Microsoft participated. Thousands of domains were seized and the platform's infrastructure was temporarily knocked out. Although their central servers were quickly restored in Russia, the crackdown has caused damage, including by creating distrust and uncertainty among users.

The most vulnerable industries in Sweden were healthcare and communications, with an average of 2,729 and 2,543 attacks per week per organization, respectively. This shows a continued high load on critical infrastructure. Fakeupdates continue to be biggest threat in Sweden with a country impact of 5.16 percent, followed by AndroRAT (3.07 percent) and Remcos (1.39 percent).

“The threat landscape continues to evolve rapidly,” says Mats Ekdahl, security expert at Check Point SoftwareNew players like SafePay are emerging, major efforts are being made against organized cybercrime, and established threats like FakeUpdates are persisting. In these times, it is important to keep your systems updated because changes happen so quickly.

For more information, read Check Point Software's blog: https://blog.checkpoint.com/research/may-2025-malware-spotlight-safepay-surges-to-the-forefront-of-cyber-threats/