Threat reportRansomwareTL-2026-1728
SafePay Ransomware Abuses OneDrive Sync Client for Covert Data Exfiltration
SafePay Ransomware Abuses OneDrive Sync Client for Covert (TL-2026-1728) is a high-severity ransomware operation, first published 2026-07-27. It is attributed to Safepay (Russia) with low confidence, affects Fortinet FortiGate SSL-VPN appliance, maps to 32 MITRE ATT&CK techniques (T1003.001, T1005, T1018), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 32MITRE ATT&CK
- Actors
- 1Safepay
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1728
- Threat ID
- TL-2026-1728
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Safepay
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- professional-services, construction, health, manufacturing, education, government administration, agriculture, energy, finance, hospitality, insurance, retail
- Target regions
- united states of america, germany, North America, 155 - Western Europe, Europe, Asia, Middle East, Oceania, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in SafePay Ransomware Abuses OneDrive Sync Client for Covert
Malware and tooling: safepay, Advanced IP Scanner, FileZilla, QDoor, ScreenConnect, ShareFinder, SharpShares, Snaffler, WinRAR
How SafePay Ransomware Abuses OneDrive Sync Client for Covert works
SafePay ransomware operators breached a victim network via a FortiGate SSL-VPN misconfiguration that allowed a weak, MFA-lacking local-admin account to authenticate remotely, then after their FileZilla FTP exfiltration attempt was blocked, installed the OneDrive sync client and synced staged data to an attacker-controlled Microsoft 365 tenant (OneDrive for Business / SharePoint Online) to blend exfiltration traffic with trusted cloud services. The intrusion encrypted more than 60 servers via a locker.dll payload executed through regsvr32.exe, and orphaned MFT entries in the attacker's OneDrive account indicate data from other SafePay victims was staged there too.
Sygnia's DFIR investigation documents a SafePay ransomware intrusion spanning roughly seven days, from initial VPN access to full-network encryption. The threat actor gained initial access through a FortiGate SSL-VPN account that was intended only for local appliance administration but was, contrary to its design intent, both domain-enabled and permitted to authenticate over VPN — with a weak password and no multi-factor authentication. Within hours of that initial foothold, the actor escalated to domain administrator. They then conducted methodical Active Directory and network discovery using native Windows utilities (nslookup.exe, ping.exe, powershell.exe, dsa.msc, ServerManager.exe), custom Python/PowerShell/batch scripts (RouteCIDR.py, p.bat_S.bat, p.bat_W.bat, check.ps1, search.ps1, sorted.ps1), and open-source AD attack tooling — Snaffler for credential and sensitive-file discovery, SharpShares and ShareFinder for network share enumeration, and Advanced IP Scanner for host discovery. Lateral movement was carried out primarily via RDP, supplemented by administrative share traversal (C$, ADMIN$) and direct interaction with Hyper-V hosts and the vCenter console, giving the actor reach across backup, virtualization, file, and identity infrastructure.
Having staged victim data, the actor first attempted exfiltration via FileZilla FTP to 192.166.225.69; this outbound connection was blocked by the victim's egress controls. Rather than retry a conspicuous channel, the actor pivoted to a technique that is materially new for SafePay: they installed the legitimate OneDrive sync client on a compromised host, authenticated to an attacker-controlled Microsoft 365 tenant (surfaced in browser history as jjvq-sharepoint.com / jjvq-my-sharepoint.com), and synchronized staged data into that tenant's OneDrive for Business instance (backed by SharePoint Online). Because the resulting traffic is HTTPS to a Microsoft cloud endpoint, it blends with routine, trusted enterprise cloud usage and is far less likely to trip egress-based DLP or network-anomaly detections than FTP or a bespoke exfiltration tool. Forensic recovery of orphaned MFT entries in the attacker's OneDrive account included RAR archives referencing other organizations' names (e.g., partially-redacted identifiers matching publicly claimed SafePay victims), indicating this same attacker-controlled tenant was used as shared staging infrastructure across multiple, separate SafePay intrusions — a durable piece of cross-victim correlation infrastructure rather than a one-off channel.
Impact was delivered via a locker.dll payload executed through regsvr32.exe (a signed-binary proxy execution technique that evades application allowlisting focused on standalone executables), persisted via an HKCU Run-key registry entry, and resulted in encryption of more than 60 servers with the .safepay extension and readme_safepay.txt ransom notes dropped throughout. SafePay itself is an independent (non-RaaS, non-affiliate) ransomware operation first observed in September–October 2024 that rapidly scaled through 2025 to become, for a period, the most active ransomware operation globally; its leak site had publicly claimed over 500 victims by mid-2026 (517 as of 2026-07-20, including 42 published that month and 73 in the preceding month), with victims skewing heavily toward small-and-mid-sized businesses in the United States and Germany across professional services, construction, healthcare, manufacturing, education, and government. Its encryptor is built on leaked LockBit 3.0 source with substantial rework and incorporates hybrid ChaCha20/AES file encryption with RSA/x25519 key wrapping; the group is broadly assessed (with low confidence) as Russia/CIS-linked based on a keyboard-locale kill switch that halts execution on Cyrillic-configured systems, though no confirmed nation-state attribution exists. Beyond this incident's specific tooling, SafePay's broader arsenal documented across vendor reporting includes the QDoor backdoor, ScreenConnect for remote-access persistence, PsExec and WinRM for lateral execution, Mimikatz for credential dumping, and WinRAR/Rclone/7-Zip for archival and transfer — several of which (WinRAR archiving of staged RAR files, RDP, admin-share traversal) are directly corroborated in this specific intrusion.
MITRE ATT&CK techniques used in TL-2026-1728
Credential Access
T1003.001 LSASS Memory; T1552.001 Credentials In Files
Collection
T1005 Data from Local System; T1039 Data from Network Shared Drive; T1560.001 Archive via Utility
Discovery
T1018 Remote System Discovery; T1069.002 Domain Groups; T1087.002 Domain Account; T1135 Network Share Discovery; T1614.001 System Language Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1072 Software Deployment Tools; T1570 Lateral Tool Transfer
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1567.002 Exfiltration to Cloud Storage
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.006 Python
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1219 Remote Access Tools
Initial Access
T1078.002 Domain Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Defense Evasion
Impact
T1486 Data Encrypted for Impact
impact
Persistence
T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1548.002 Bypass User Account Control
Resource Development
defense-impairment
Affected products and versions in SafePay Ransomware Abuses OneDrive Sync Client for Covert
- Fortinet — FortiGate SSL-VPN appliance
Vulnerable versions: Any FortiGate configuration where a local-appliance-administration account is domain-enabled and permitted to authenticate via SSL-VPN without MFA
Fixed in: No firmware fix applicable — remediate via configuration: disable VPN auth for local-admin-only accounts and enforce MFA on all VPN accounts - Microsoft — OneDrive for Business / SharePoint Online
Vulnerable versions: N/A — the legitimate, fully-patched OneDrive sync client and SharePoint Online service were abused as a trusted exfiltration channel, not exploited via a software vulnerability
Fixed in: N/A — mitigated via Conditional Access / tenant restrictions / DLP policy, not a product patch
Remediation for SafePay Ransomware Abuses OneDrive Sync Client for Covert
Patches
- N/A — this intrusion's initial access exploited a credential/configuration weakness (a non-MFA, VPN-enabled local-admin account), not a software vulnerability; no vendor patch applies to the access vector itself
Immediate actions
- Enforce MFA on every VPN and administrative account, including accounts nominally scoped for local firewall/appliance administration only — this account's ability to authenticate over VPN at all was the root-cause misconfiguration
- Deploy Microsoft 365 Conditional Access / tenant-restriction policies to block OneDrive/SharePoint sync to non-sanctioned external tenant IDs; alert on new OneDrive sync-client installs authenticating to unfamiliar tenants
- Hunt for regsvr32.exe loading non-standard DLLs (e.g., locker.dll) and for HKCU\Software\Microsoft\Windows\CurrentVersion\Run persistence entries pointing to unsigned binaries
- Block egress to the FTP/network IOCs identified in this intrusion and alert on FileZilla execution from server-tier hosts
Workarounds
- Disable VPN/remote authentication capability entirely on accounts intended solely for local FortiGate appliance administration
- Require Conditional Access policies that restrict OneDrive/SharePoint Online sync to the organization's own managed tenant ID and block consumer/foreign tenant sign-in from corporate endpoints
Longer-term hardening
- Implement DLP/CASB monitoring for OneDrive/SharePoint sync activity against non-corporate tenant IDs, not just outbound volume
- Segment and closely monitor administrative share access (C$, ADMIN$) and restrict RDP to jump hosts requiring MFA
- Deploy EDR behavioral detection tuned to AD-enumeration tooling (Snaffler, SharpShares, ShareFinder, Advanced IP Scanner) rather than static signatures alone
- Maintain immutable, network-isolated (offline) backups for virtualization (Hyper-V/vCenter) and identity infrastructure specifically, since those were the actor's priority encryption targets
Timeline of SafePay Ransomware Abuses OneDrive Sync Client for Covert
- SafePay ransomware first observed as an independent (non-affiliate, non-RaaS) operation, emerging September-October 2024 per multiple vendor trackers (Fortinet, Halcyon, Picus).
- SafePay scales rapidly through 2025, becoming for a period the most active ransomware operation globally by around May 2025.
- SafePay's leak site claims 73 victim organizations within a single month (June 2026), one of its highest monthly tallies to date.
- SafePay's public leak site reaches 517 total claimed victims, including 12 in the preceding 30 days and 42 published during July 2026 (its second-highest monthly tally), per leak-site tracking analysis (Flare/eSecurityPlanet).
- locker.dll ransomware payload is executed via regsvr32.exe, encrypting more than 60 servers (backup, virtualization, file, and identity infrastructure) with the .safepay extension and readme_safepay.txt ransom notes; recovered orphaned MFT entries in the attacker's OneDrive account contain RAR archives referencing other organizations, indicating the same tenant was used as shared staging infrastructure across multiple SafePay victims.
- Actor installs the OneDrive sync client, authenticates to an attacker-controlled Microsoft 365 tenant (jjvq-sharepoint.com / jjvq-my-sharepoint.com), and synchronizes staged victim data into that tenant's OneDrive for Business (SharePoint Online-backed) instance, blending exfiltration traffic with trusted Microsoft cloud HTTPS traffic.
- Actor's outbound FileZilla FTP exfiltration attempt to 192.166.225.69 is blocked by the victim's network egress controls, forcing a pivot to a covert exfiltration channel.
- Actor conducts AD/network discovery (native tools plus Snaffler, SharpShares, ShareFinder, Advanced IP Scanner, and custom RouteCIDR.py/p.bat/check.ps1/search.ps1/sorted.ps1 scripts) and moves laterally primarily via RDP, plus administrative share traversal (C$/ADMIN$) and direct Hyper-V/vCenter console access.
- Within hours of initial VPN access, the actor escalates to domain administrator privileges.
- Sygnia publicly discloses (blog report; webinar dated 2026-08-12) that in this intrusion, initial access was obtained via a FortiGate SSL-VPN account intended for local appliance administration only, but which was domain-enabled, weakly-passworded, and lacked MFA. Exact calendar dates of the underlying intrusion are not disclosed in the source report, which describes it only as occurring over roughly a seven-day period; entries below are ordered per the report's described sequence.
Sources cited for SafePay Ransomware Abuses OneDrive Sync Client for Covert
- Exfiltration in Plain Sight: SafePay's OneDrive Play
- When Ransomware Hides in OneDrive: Inside SafePay's Exfiltration Play (webinar)
- SafePay Ransomware — Threat Actor Profile
- Inside SafePay: Analyzing the New Centralized Ransomware Group
- SafePay Ransomware: How a Non-RaaS Group Executes Rapid Fire Attacks
- SafePay — Threat Group Profile
- SafePay Ransomware: An Emerging Threat in 2025
- SafePay Ransomware: Mapping the Real Victims Behind the Leak Sites
- SafePay Ransomware Hits 73 Organizations in a Single Month
- Flare Researchers Analyze SafePay Ransomware Leak Data
Detection coverage for TL-2026-1728
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1728 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1728
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.