What happens when ransomware operators stop relying on obvious exfiltration channels and start hiding inside the cloud tools your business already trusts?

Josh Geise, Incident Response Team Lead at Sygnia, breaks down the attack path, the forensic evidence that exposed the OneDrive exfiltration technique, and practical detection opportunities defenders can use to uncover similar activity before it becomes a full-scale extortion event.

You’ll gain practical insights into:

• How SafePay operators adapted their exfiltration approach in real time.
• Why trusted SaaS platforms create blind spots for traditional monitoring.
• Which endpoint, network, and MFT artifacts can reveal unauthorized data movement.
• How SOC, IR, and threat hunting teams can improve detection for cloud-based exfiltration.
• Practical steps to strengthen ransomware response readiness.

This session is built for incident responders, SOC analysts, threat hunters, and security leaders who need to understand how modern ransomware groups are evolving, and how to detect exfiltration when it’s hiding in plain sight.