Exfiltration in Plain Sight: SafePay’s OneDrive Play

SafePay is a relatively new highly active, ransomware group that surfaced around September 2024. It gained increasing notoriety over the course of 2025 for its aggressive and often high-speed operations. This blog highlights the tactics, techniques, and procedures (TTPs) observed, as well as a novel, OneDrive-based, exfiltration technique.

Executive Summary

• In 2025, Sygnia investigated a double extortion ransomware attack conducted by the SafePay ransomware group.
• Containment actions implemented by the client, including restricting inbound and outbound network traffic and shutting down corporate servers, successfully limited the incident’s spread to approximately 60 systems within the IT environment. This article provides a high-level overview of the phases of this attack that Sygnia’s Incident Response team identified as part of the investigation.
• This attack involved an uncommon OneDrive-based exfiltration technique that has not previously been associated with the SafePay ransomware group.

On-Demand Webinar

Exfiltration in Plain Sight:
SafePay’s OneDrive Play

Watch the Replay

SafePay Background

The SafePay ransomware group has been active since September 2024 and significantly ramped up activity in 2025, targeting companies all over the world. They engage in double extortion campaigns by exfiltrating data prior to deploying encryption. Encrypted files are renamed to append “.safepay” and the ransom notes are named “readme_safepay.txt”.

Incident Overview

Sygnia’s investigation into the SafePay ransomware attack identified a multi-stage, rapid intrusion into the client’s enterprise IT environment. SafePay gained initial access by exploiting a firewall misconfiguration, which enabled them to obtain local administrative credentials. They rapidly escalated discovery and enumeration activities to identify high-value targets for lateral movement, demonstrating a structured and methodical approach to mapping the environment. Within a matter of hours, SafePay escalated to domain administrator access.

Over a seven-day period, the threat actors staged and exfiltrated data via Microsoft OneDrive—an approach not previously attributed to SafePay. The attack ultimately culminated in the deployment of ransomware, encrypting more than 60 servers.

The following tactics, techniques, and procedures (TTPs) were identified during the investigation.

Initial Access

SafePay gained access via the organization’s SSL VPN by leveraging a FortiGate firewall flaw and a misconfigured administrative account.
Shortly after initial access, they rapidly escalated privileges, ultimately accessing the domain controller interactively via RDP and obtaining domain administrator credentials.

The exact method of account compromise was not identified. The targeted account was intended solely for local administrative use on the appliance. We determined the account had the following characteristics that may have facilitated a password-based attack:

• Protected by a weak password
• Lacked multi-factor authentication (MFA)
• Permitted VPN authentication
• Domain-enabled account

Discovery

Following initial access, the threat actors conducted a structured and methodical enumeration of identity, network, file infrastructure, and credentials using native utilities, scripted tooling, and open-source tooling:

• Native windows utilities like nslookup.exe, ping.exe, powershell.exe, dsa.msc, ServerManager.exe were used.
• Python and Batch scripts, RouteCIDR.py, p.bat_S.bat, and p.bat_W.bat, were executed with associated tool outputs suggesting they were used for additional domain and host enumeration.
• PowerShell script check.ps1 was executed to enumerate active directory objects with helper scripts, search.ps1 and sorted.ps1, designed to organize and filter the outputs.
• Open-source Advanced IP Scanner, SharpShares, ShareFinder, Netscan, and Snaffler were also observed in additional discovery activities.

Lateral Movement

Domain administrator credentials were used to expand access across identity, file, virtualization, and backup systems with Remote Desktop Protocol (RDP) used as the primary lateral movement mechanism:

• Administrative share access (C$, ADMIN$) and traversal across internal host as evidence by high volume of Shellbag and other file access artifacts
• Access and interaction with Hyper-V (virtualization) utilities
• Access and interaction with local vCenter (ESXI) console

Defense Evasion

SafePay used trusted binaries to minimize forensic artifacts throughout the intrusion, removing tooling and artifacts after execution and leveraging Microsoft OneDrive to disguise exfiltration traffic. Specific tactics used include:

• Use of living-off-the-land binaries
• Removal of scripts and outputs after execution
• Removal of staged .rar archives after transfer
• Leveraging trusted services (OneDrive, HTTPS, Microsoft IPs) for exfiltration

Credential Access

Privileged domain administrator credentials were obtained through the early-stage enumeration. The attackers then shifted focus to the backup infrastructure, seeking to access and extract additional high-value Veeam service credentials.

• Reused of compromised domain administrator credentials
• Attempted execution of credential discovery tool Snaffler
• Performed Veeam credential dumping using native PowerShell

Data Staging

After identifying high-value repositories, SafePay prepared for exfiltration by aggregated and compressed targeted datasets.

• Compressed and split data using WinRAR, producing multiple staged .rar archives

Exfiltration

When initial FTP-based exfiltration was blocked by firewall controls, they pivoted to a cloud-based exfiltration mechanism leveraging Microsoft OneDrive.

• Blocked FileZilla traffic to 192[.]166[.]225[.]69.
• Exfiltrated data over HTTPS and Microsoft OneDrive to an attacker-controlled OneDrive instance that was configured locally on compromised server

Execution

Following exfiltration, the SafePay threat actors used a living-off-the-land mechanism to execute ransomware across the targeted infrastructure.

• The ransomware payload (locker.dll) was executed via regsvr32.exe.
• Persistence and execution were configured through a registry-based mechanism using HKCU\Software\Microsoft\Windows\CurrentVersion\Run, which executed the ransomware at user logon.

This configuration allowed the ransomware to be executed from a centralized server, enabling remote encryption of accessible files across the network.

Impact

The attack culminated in a coordinated ransomware deployment that caused significant operational disruption, consistent with a double extortion model. More than 60 servers were encrypted, primarily targeting backup, virtualization, file, and identity infrastructure. Prior to encryption, the attackers exfiltrated data to strengthen their leverage.

Data Exfiltration via OneDrive

After outbound FTP traffic was blocked by firewall controls, SafePay pivoted to cloud-based exfiltration using the Microsoft OneDrive sync client installed on the compromised server. They authenticated to an attacker-controlled Microsoft 365 tenant and synchronized the host with their OneDrive for Business instance (hosted on SharePoint Online). Data was staged within the synced OneDrive directory and automatically transmitted over legitimate HTTPS connections to the remote tenant, effectively exfiltrating data via trusted Microsoft 365 infrastructure.

• Chrome history artifacts reflected authentication and access to the operators personal SharePoint/OneDrive tenant https[://]jjvq-my-sharepoint.com.

• Shellbag and Chrome history artifacts showed operators repeatedly accessing their OneDrive tenant locally with the path ‘C:\Users\\OneDrive – jjvq\TXXXXK\.com’, including interaction with victim themed .rar files.

Network Correlation

Firewall telemetry confirmed sustained outbound HTTPS traffic to Microsoft-owned IP address space during the staging window. The timing and volume of this traffic directly aligned with observed archive and OneDrive interaction.

• No suspicious outbound FTP or uncommon destination IPs.
• Traffic pattern consistent with legitimate OneDrive synchronization behavior.
• Data transfer occurring entirely over standard TLS-encrypted Microsoft infrastructure.

MFT Artifacts

Although the threat actors logged out of the local OneDrive client after completing the upload, several forensic artifacts persisted on disk. These artifacts suggest that data from other SafePay victims may have been stored within the same attacker-controlled OneDrive account.

Specifically, the Master File Table (MFT) contained hundreds of orphaned entries corresponding to .RAR archive files that closely matched the naming convention of the staged exfiltration data observed in this case. Notable characteristics include:

• Multi-part .RAR archives with names such as “Data”, “SQL”, “Accounting”, or containing IP addresses
• Parent paths referencing other organization names, domains, or similar Directory names (e.g., “KXXXXR”, “TXXXXK”)

These file entries were marked as unallocated (e.g., is_allocated=false), and the associated files were not recoverable, preventing validation of their contents. However, many of the organizations referred to in the orphaned file paths were publicly claimed to be SafePay victims on the leak site.

Implications

The use of OneDrive as an exfiltration channel is notable because it allows malicious activity to blend into legitimate Microsoft network traffic, potentially evading traditional perimeter-based detection mechanisms. Unlike more commonly observed methods such as FTP clients or bespoke exfiltration utilities, this approach leverages trusted cloud services and standard HTTPS traffic, significantly complicating detection and prevention efforts.

Indicators of Compromise

Recommendations

• Review MFT for Orphan paths if exfiltration via OneDrive observed
• Track registry events for registering OneDrive for a OneDrive not associated with the organization
• Create file access alerts for accessing OneDrive not belonging to the organization

Citations

• https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/safepay-ransomware
• https://www.huntress.com/blog/its-not-safe-to-pay-safepay
• https://www.quorumcyber.com/wp-content/uploads/2025/04/QC-SafePay-Ransomware-Report-TI-1.pdf