Loading story…
SafePay ransomware operators abused Microsoft OneDrive to exfiltrate sensitive victim data, blending theft activity into legitimate cloud-storage use. The group used standard HTTPS connections and ordinary business-cloud workflows, allowing outbound transfers to appear as trusted OneDrive traffic.
The technique can evade controls focused on malicious domains, unfamiliar cloud services, or anomalous network protocols, because the data moves through an authorized and widely used platform. Organizations should investigate unusual OneDrive upload volumes, atypical account behavior, and anomalous data-access patterns, and apply monitoring and data-loss-prevention controls to sanctioned cloud services.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
SafePay ransomware operators reportedly used Microsoft OneDrive and legitimate HTTPS cloud traffic to exfiltrate sensitive data while blending activity into ordinary business-cloud operations and bypassing traditional security controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesygnia.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A PAYLOAD ransomware affiliate compromised a Middle Eastern manufacturing organization in April 2026 using a valid domain credential through a FortiGate SSL VPN. After obtaining domain-admin-equivalent Group Policy permissions, the actor linked malicious GPOs at the Active Directory domain root to distribute ransom notes, alter endpoint wallpapers and lock screens, set a ransom logon banner, disable local Administrator accounts, and disable Windows Firewall. Investigators found no encrypted Windows files, persistent endpoint malware, or active malicious processes; Active Directory and SYSVOL served as the attack control plane. The attackers exfiltrated data from file servers and other systems, later publishing it on the dark web, while an ESXi-targeting PAYLOAD sample was identified on Linux servers. The intrusion reflects the growth of **encryptionless extortion**, in which operators steal data and coerce victims without necessarily deploying file-encrypting malware. Extortion activity reached 6,182 reported incidents in 2025, while ransomware leak sites claimed 4,737 victims; attackers commonly combine stolen credentials, privilege escalation, legitimate administrative tooling, and centralized deployment mechanisms such as Group Policy. Organizations should prioritize MFA and monitoring for remote access, least-privilege controls over GPO administration, auditing of domain-root GPO changes and SYSVOL, rapid credential containment, and defenses against data exfiltration alongside endpoint ransomware controls.
Sep 24, 2026
Several new ransomware groups and campaigns have emerged, demonstrating increased sophistication and targeting a range of organizations globally. The SafePay group has established itself as a major threat by operating as a centralized, closed ransomware operation, eschewing the typical Ransomware-as-a-Service (RaaS) model. SafePay employs double extortion tactics, exfiltrating sensitive data before encrypting systems, and leverages rapid attack chains that often move from initial access to full encryption within 24 hours. Their methods include exploiting compromised credentials, misconfigured firewalls, and deploying backdoors for persistence, with a focus on operational security to avoid law enforcement detection. Other notable threats include the CrazyHunter ransomware, which has aggressively targeted healthcare organizations in Taiwan using advanced evasion techniques and multi-stage attacks that exploit Active Directory and propagate via Group Policy Objects. Meanwhile, the Ransomhouse group, operated by Jolly Scorpius, has upgraded its capabilities with a dual-key encryption system and automated attacks on VMware ESXi hypervisors, particularly focusing on German enterprises. These campaigns highlight a trend toward more targeted, technically advanced ransomware operations that prioritize both data theft and rapid system disruption, posing significant risks to critical infrastructure and sensitive industries.
Jun 29, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026