Safepay was the third most active threat group in March, with 42 attacks.