unsafe is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 14 public victims claimed by this operator between December 21, 2022 and January 14, 2024. The "unsafe" ransomware group is a relatively new threat actor that emerged in December 2022, operating with primarily financial motivations through ransomware deployment and extortion schemes. Based on limited public documentation, the group's origin and specific affiliations remain unclear, though their operational patterns suggest they function as an independent ransomware operation rather than a established Ransomware-as-a-Service model. With 14 documented victims since their emergence, the group has demonstrated a focused targeting approach, primarily concentrating their attacks on manufacturing organizations, transportation and logistics companies, and government entities across the United States, Switzerland, and France. Their attack methodology and specific technical capabilities have not been extensively documented by major security research organizations such as CISA, FBI, or Mandiant, limiting detailed analysis of their initial access vectors, encryption methods, or data exfiltration practices. No major high-profile campaigns or significant law enforcement actions have been publicly reported against this group, likely due to their relatively recent emergence and smaller scale of operations compared to more established ransomware families. Current intelligence suggests the group remains active as of available reporting, though their limited public footprint makes definitive status assessment challenging without additional threat intelligence sources.
How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.