# SafePay Ransomware Abuses OneDrive Sync Client for Covert Data Exfiltration

> SafePay ransomware operators breached a victim network via a FortiGate SSL-VPN misconfiguration that allowed a weak, MFA-lacking local-admin account to authenticate remotely, then after their FileZilla FTP exfiltration attempt was blocked, installed the OneDrive sync client and synced staged data to an attacker-controlled Microsoft 365 tenant (OneDrive for Business / SharePoint Online) to blend exfiltration traffic with trusted cloud services. The intrusion encrypted more than 60 servers via a locker.dll payload executed through regsvr32.exe, and orphaned MFT entries in the attacker's OneDrive account indicate data from other SafePay victims was staged there too.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1728
- **ID:** TL-2026-1728
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Safepay (Russia)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Sygnia's DFIR investigation documents a SafePay ransomware intrusion spanning roughly seven days, from initial VPN access to full-network encryption. The threat actor gained initial access through a FortiGate SSL-VPN account that was intended only for local appliance administration but was, contrary to its design intent, both domain-enabled and permitted to authenticate over VPN — with a weak password and no multi-factor authentication. Within hours of that initial foothold, the actor escalated to domain administrator. They then conducted methodical Active Directory and network discovery using native Windows utilities (nslookup.exe, ping.exe, powershell.exe, dsa.msc, ServerManager.exe), custom Python/PowerShell/batch scripts (RouteCIDR.py, p.bat_S.bat, p.bat_W.bat, check.ps1, search.ps1, sorted.ps1), and open-source AD attack tooling — Snaffler for credential and sensitive-file discovery, SharpShares and ShareFinder for network share enumeration, and Advanced IP Scanner for host discovery. Lateral movement was carried out primarily via RDP, supplemented by administrative share traversal (C$, ADMIN$) and direct interaction with Hyper-V hosts and the vCenter console, giving the actor reach across backup, virtualization, file, and identity infrastructure.

Having staged victim data, the actor first attempted exfiltration via FileZilla FTP to 192.166.225.69; this outbound connection was blocked by the victim's egress controls. Rather than retry a conspicuous channel, the actor pivoted to a technique that is materially new for SafePay: they installed the legitimate OneDrive sync client on a compromised host, authenticated to an attacker-controlled Microsoft 365 tenant (surfaced in browser history as jjvq-sharepoint.com / jjvq-my-sharepoint.com), and synchronized staged data into that tenant's OneDrive for Business instance (backed by SharePoint Online). Because the resulting traffic is HTTPS to a Microsoft cloud endpoint, it blends with routine, trusted enterprise cloud usage and is far less likely to trip egress-based DLP or network-anomaly detections than FTP or a bespoke exfiltration tool. Forensic recovery of orphaned MFT entries in the attacker's OneDrive account included RAR archives referencing other organizations' names (e.g., partially-redacted identifiers matching publicly claimed SafePay victims), indicating this same attacker-controlled tenant was used as shared staging infrastructure across multiple, separate SafePay intrusions — a durable piece of cross-victim correlation infrastructure rather than a one-off channel.

Impact was delivered via a locker.dll payload executed through regsvr32.exe (a signed-binary proxy execution technique that evades application allowlisting focused on standalone executables), persisted via an HKCU Run-key registry entry, and resulted in encryption of more than 60 servers with the .safepay extension and readme_safepay.txt ransom notes dropped throughout. SafePay itself is an independent (non-RaaS, non-affiliate) ransomware operation first observed in September–October 2024 that rapidly scaled through 2025 to become, for a period, the most active ransomware operation globally; its leak site had publicly claimed over 500 victims by mid-2026 (517 as of 2026-07-20, including 42 published that month and 73 in the preceding month), with victims skewing heavily toward small-and-mid-sized businesses in the United States and Germany across professional services, construction, healthcare, manufacturing, education, and government. Its encryptor is built on leaked LockBit 3.0 source with substantial rework and incorporates hybrid ChaCha20/AES file encryption with RSA/x25519 key wrapping; the group is broadly assessed (with low confidence) as Russia/CIS-linked based on a keyboard-locale kill switch that halts execution on Cyrillic-configured systems, though no confirmed nation-state attribution exists. Beyond this incident's specific tooling, SafePay's broader arsenal documented across vendor reporting includes the QDoor backdoor, ScreenConnect for remote-access persistence, PsExec and WinRM for lateral execution, Mimikatz for credential dumping, and WinRAR/Rclone/7-Zip for archival and transfer — several of which (WinRAR archiving of staged RAR files, RDP, admin-share traversal) are directly corroborated in this specific intrusion.

## MITRE ATT&CK

- T1650 Acquire Access
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078.002 Domain Accounts
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1218.010 Regsvr32
- T1685 Disable or Modify Tools
- T1490 Inhibit System Recovery
- T1003.001 LSASS Memory
- T1552.001 Credentials In Files
- T1087.002 Domain Account
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1069.002 Domain Groups
- T1614.001 System Language Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1072 Software Deployment Tools
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1039 Data from Network Shared Drive
- T1219 Remote Access Tools
- T1071.001 Web Protocols
- T1102 Web Service
- T1567.002 Exfiltration to Cloud Storage
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1486 Data Encrypted for Impact

## Sources

- [Exfiltration in Plain Sight: SafePay's OneDrive Play](https://www.sygnia.co/blog/safepay-onedrive-exfiltration-technique/)
- [When Ransomware Hides in OneDrive: Inside SafePay's Exfiltration Play (webinar)](https://www.sygnia.co/webinars/when-ransomware-hides-in-onedrive-inside-safepay-exfiltration-play/)
- [SafePay Ransomware — Threat Actor Profile](https://fortiguard.fortinet.com/threat-actor/6331/safepay-ransomware)
- [Inside SafePay: Analyzing the New Centralized Ransomware Group](https://www.picussecurity.com/resource/blog/inside-safepay-analyzing-the-new-centralized-ransomware-group)
- [SafePay Ransomware: How a Non-RaaS Group Executes Rapid Fire Attacks](https://businessinsights.bitdefender.com/safepay-ransomware-attacks-ttps)
- [SafePay — Threat Group Profile](https://www.halcyon.ai/threat-group/safepay)
- [SafePay Ransomware: An Emerging Threat in 2025](https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/safepay-ransomware/)
- [SafePay Ransomware: Mapping the Real Victims Behind the Leak Sites](https://flare.io/learn/resources/safepay-ransomware-victims-analysis)
- [SafePay Ransomware Hits 73 Organizations in a Single Month](https://cyberpress.org/safepay-ransomware/)
- [Flare Researchers Analyze SafePay Ransomware Leak Data](https://www.esecurityplanet.com/threats/flare-researchers-analyze-safepay-ransomware-leak-data/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1728