# Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data

SafePay used a FortiGate SSL VPN flaw plus a weak admin account to breach a network, then exfiltrated data via the legitimate OneDrive client and encrypted 60+ servers.

- Payout: Real-world hack
- Severity: critical
- Program: SafePay
- Analysis by: Sygnia
- Disclosed: 2026-08-31
- Write-up quality: 7/10
- Original: https://www.sygnia.co/blog/how-the-safepay-ransomware-group-abused-onedrive-to-steal-data/
- Library page: https://bugbountylibrary.com/r/blog%3Asygnia-co-blog-how-the-safepay-ransomware-group-abused-onedrive-to-steal-data
- Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:funds-loss impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:chained vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** Internet-facing FortiGate SSL VPN appliance and Windows servers with OneDrive sync client
**Root cause:** Initial access combined a vulnerability in an internet-facing FortiGate SSL VPN appliance with a weak, overprivileged administrative account lacking MFA, letting the attacker reach domain admin within hours. Exfiltration relied on the legitimate Microsoft-signed OneDrive client syncing staged RAR archives to an attacker-controlled M365 tenant over HTTPS.
**Steps:**
1. Exploit FortiGate SSL VPN vulnerability and log in with weak overprivileged admin account lacking MFA
2. Escalate to domain administrator; use RDP, admin shares, PowerShell and open-source tools for recon and lateral movement
3. Target Veeam/backup and virtualization infrastructure; locate valuable file shares and credentials
4. Stage data on a central server, compress and split into multipart RAR archives
5. Attempt FTP exfiltration with FileZilla to external IP; egress filtering blocks it
6. Install legitimate Microsoft OneDrive sync client on compromised server and authenticate to attacker-controlled M365 tenant
7. Place staged RAR archives in the OneDrive sync directory; OneDrive uploads them over HTTPS
8. Delete archives after transfer; MFT retains evidence
9. Deliver ransomware DLL and execute via `regsvr32.exe`; persist via Windows Run registry key
10. Encrypt 60+ servers from central server, including backup, virtualization, file storage and identity systems
**How found:** Investigators correlated browser history showing an unauthorized OneDrive tenant, ShellBag artifacts showing navigation in the local OneDrive folder with staged RARs, sustained HTTPS traffic to Microsoft during staging, and MFT records of deleted archives. Bidirectional sync also pulled other victims' data from the attacker tenant onto the server, which was cross-referenced with SafePay's leak site.
**Exploitation:** After FTP egress was blocked, attacker pivoted to the signed OneDrive client authenticated to their own tenant, turning normal HTTPS sync into the exfil channel with no custom malware or suspicious infrastructure. Post-exfil, a malicious DLL was loaded via regsvr32.exe with Run-key persistence, and ransomware encrypted 60+ servers including backup and identity systems.
**Escalation:** Weak overprivileged no-MFA admin account plus FortiGate flaw yielded domain admin in hours, enabling access to backup/virtualization infrastructure and broad encryption impact.
**Insight:** OneDrive sync is bidirectional: when an attacker authenticates their tenant on a victim host, their cloud files land on the victim disk, so MFT/ShellBag artifacts can reveal other victims and campaign scope. Hunt for unknown OneDrive tenant directories on servers and correlate with archive staging and Microsoft traffic volume.