Safepay Ransomware Claims New Victim: German Company Niemann Targeted in Latest Dark Web Activity

Cybersecurity threat monitoring group ThreatMon has flagged a new ransomware incident involving the group known as Safepay, which has allegedly targeted the German company Niemann.de. The attack was documented on April 16, 2025, as part of the ongoing surveillance of ransomware-related activity on the dark web.

Ransomware groups continue to adapt, and Safepay is one of the increasingly active actors leveraging double extortion tactics — encrypting files and simultaneously threatening to leak sensitive information if a ransom is not paid. The group’s latest victim, Niemann.de, is a company with a strong presence in industrial automation and engineering, making it a valuable target for attackers interested in operational disruption or intellectual property theft.

This incident was reported publicly by ThreatMon Ransomware Monitoring (@TMRansomMon), an account that tracks real-time cyber threats, including ransomware attacks sourced from the dark web and threat intelligence channels. The post identifies Safepay as the actor behind the attack, with the official timestamp of April 16, 2025, at 19:26 UTC+3.

Safepay has been known in cybersecurity circles for its aggressive posturing and stealthy distribution tactics, often avoiding detection until encryption has already occurred. Niemann.de’s appearance on their victim list suggests a significant breach, potentially involving data exfiltration, critical service disruption, or both.

What Undercode Say:

From an infosec perspective, the attack on Niemann.de reveals several key trends and threats shaping today’s ransomware landscape:

Target Selection: Ransomware groups like Safepay continue to prioritize industrial and engineering firms due to their low tolerance for operational downtime. Companies such as Niemann.de are critical infrastructure in many supply chains, increasing the odds that they might pay to recover operations quickly.
Double Extortion Methodology: Safepay typically adopts a double extortion model — encrypting systems and simultaneously threatening to leak sensitive corporate data. This technique pressures victims beyond standard business recovery timelines.
Visibility on Dark Web: The inclusion of Niemann.de on ransomware leak sites is a strategic move. It publicly marks the organization as compromised, further damaging reputation and raising stakes for ransom negotiations.
Dark Web Monitoring as a Defensive Measure: Platforms like ThreatMon play a critical role in early detection of ransomware disclosures. Their intelligence allows organizations and the cybersecurity community to react faster and more effectively.
Timing and Reporting: The attack was timestamped at 19:26 UTC+3 — a likely operational window for threat actors targeting European companies during post-business hours when monitoring is reduced.
German Targets on the Rise: Germany continues to be a prime target due to its industrial backbone. This attack fits a wider trend of ransomware groups zeroing in on EU manufacturing and engineering firms.
Safepay’s Signature: While not among the most notorious ransomware groups (e.g., LockBit, BlackCat), Safepay’s activity has grown in 2024 and 2025. Their methods involve phishing vectors and vulnerable remote services like RDP (Remote Desktop Protocol).
Supply Chain Ripple Effects: If Niemann.de operates within a larger industrial supply chain, this breach might pose risks not just to the company but to its partners and clients.
Financial Motivations: Ransomware remains a business. Attacks like this are often calculated based on the victim’s potential ability to pay — either through cyber insurance or operational urgency.
Post-Attack Fallout: Should Niemann.de refuse payment, expect follow-up actions such as data leaks or public exposure of internal documents to escalate pressure.
Ransom Demands: While not disclosed in this report, Safepay’s previous demands have ranged from $250,000 to $1.5 million, depending on company size and data volume.
Threat Attribution: No specific country of origin has been officially linked to Safepay, but analysts suggest it may operate from Eastern Europe, based on infrastructure patterns.
Mitigation Strategy: Proactive patch management, employee phishing simulations, and endpoint detection remain the most effective countermeasures to ransomware threats.
Potential Legal Ramifications: Companies that experience data breaches may face lawsuits or regulatory penalties, especially under GDPR or similar privacy legislation.
Safepay’s Leak Portal: Like other ransomware groups, Safepay operates a leak portal where stolen data is published if victims refuse to pay. These platforms function like a digital extortion board.
Threat Landscape Context: 2025 has seen a rise in ransomware targeting mid-sized enterprises — a shift from previous years where Fortune 500 companies were primary targets.
Social Engineering Vectors: Safepay is known to employ spear-phishing campaigns aimed at compromising employees in administrative or IT roles.
Encryption Methods: The malware used typically employs strong AES encryption algorithms, making decryption without keys nearly impossible.
Global Collaboration: Law enforcement agencies across Europe and North America have ramped up coordination against ransomware groups, but decentralized ransomware-as-a-service (RaaS) models complicate takedowns.
Insurance Impacts: A successful attack might spike cyber insurance premiums or invalidate coverage if security protocols were not properly followed.
Incident Disclosure: Niemann.de’s public response (if any) will be critical in understanding the breach scope. Silence might indicate internal investigations or negotiations.
Threat Actor Evolution: Safepay is a relatively newer group, but its rapid rise suggests seasoned operators possibly spinning off from larger ransomware syndicates.
Threat Intel Integration: Tools like ThreatMon demonstrate the value of open-source intelligence (OSINT) in keeping tabs on cybercriminal ecosystems.
Employee Training: Human error remains the 1 attack vector. Awareness training should be ongoing and part of every security strategy.
Attack Surface Expansion: With more IoT and cloud-connected services, even traditional manufacturing companies like Niemann.de are increasingly vulnerable.
Incident Response Planning: Organizations that have a rehearsed playbook for ransomware scenarios can mitigate losses and recovery time significantly.
Zero-Day Exploits: While it’s unclear how Safepay breached Niemann.de, the use of unpatched zero-day vulnerabilities is a growing concern in enterprise environments.
Crypto Payments & Anonymity: Ransom demands typically involve Bitcoin or Monero, helping actors obscure financial trails.
Media & Investor Relations: Cyber incidents have reputational consequences. Niemann.de’s handling of communications may affect shareholder trust and market presence.
Community Alerts: Sharing such attacks publicly, as ThreatMon does, benefits the entire infosec community — raising awareness and forcing accountability.

Fact Checker Results

Claim Validity: Verified — ThreatMon listed Niemann.de on April 16, 2025.
Threat Actor: Confirmed to be associated with Safepay via leak site monitoring.
Company Status: Niemann.de website remains live as of this writing; no public statement yet.