OneDrive syncs in both directions. That detail turned a ransomware crew's own exfiltration channel into evidence against it.
Investigating a SafePay intrusion, incident response firm Sygnia found that after the attacker connected their own Microsoft 365 tenant to a compromised server, OneDrive did not only upload the victim's stolen files. It also pulled the contents of the attacker's own cloud storage down onto that same server. Those files referenced other organizations. Sygnia checked the names against SafePay's leak site, matched several to victims the crew had already published, and found others never named publicly. It moved to notify them.
The firewall worked, and it did not matter
The first attempt to move data out was ordinary: FileZilla over FTP to an external address. Egress filtering blocked it. The operation did not stop. The crew installed the genuine, Microsoft signed OneDrive client on an already compromised server, signed it in to their own tenant, and dropped the staged archives into the sync folder. OneDrive did the rest over normal HTTPS.
Sygnia's lesson for defenders is blunt. A blocked exfiltration attempt is a starting signal, not a closed incident. The attacker still had access, still had data staged, and simply looked for another way out.
Living off the land at the cloud layer
Every individual signal in the second attempt looked benign. The destination was Microsoft. The protocol was HTTPS. The binary was signed by Microsoft and doing exactly what it was written to do. No custom malware handled the transfer.
The anomalies sat elsewhere: a Microsoft 365 tenant with no business relationship to the company, a OneDrive sync directory appearing on a server, multipart RAR archives being staged, and sustained Microsoft traffic from a host with no reason to generate it. The useful question, Sygnia argues, is not whether a service is trusted but whether it makes sense on this host, for this identity, with this tenant, at this volume, right now.
Proving it after the files were deleted
No single artifact settled it. Browser history showed access to the unfamiliar tenant. Windows ShellBag artifacts showed navigation inside the local OneDrive folder, including the staged RAR files. Network telemetry showed sustained HTTPS to Microsoft across the staging window. And the NTFS Master File Table still held records of the archives after the attacker deleted them. Correlated, the four built a coherent timeline.
Getting in was the unremarkable part
Initial access came from two weaknesses working together: a vulnerability in an internet facing FortiGate SSL VPN appliance and a weak, overprivileged administrative account with no MFA. The attacker reached domain administrator within hours, then used RDP, administrative shares and PowerShell, focusing on virtualization and backup infrastructure including Veeam. Encryption came last, delivered as a DLL loaded through the signed Windows utility regsvr32.exe with persistence in a Run registry key. More than 60 servers were encrypted from a single central host.
Restrict the tenant, alert on the sync
Sygnia's recommendations are narrow and testable. Enforce Microsoft tenant restrictions so managed systems can authenticate only to approved tenants, which defeats this technique directly. Restrict outbound access to cloud applications servers do not need. Alert on OneDrive synchronization from any server where OneDrive has no operational purpose, and inventory authorized tenant registrations. Audit privileged accounts that can reach VPNs, enforce MFA, and remove legacy privileges.
SafePay has run double extortion since the second half of 2024, and IntelFusions tracks its leak site claims on the SafePay actor profile. The interest in backup platforms lands alongside a recent finding that Veeam wrote backup credentials into plain text logs, and the tenant abuse rhymes with extortion crews that steal from cloud service accounts without encrypting anything at all. The through line is that the trusted thing is now the delivery mechanism, and trust alone has stopped being a verdict.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.