Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data

The SafePay ransomware group evaded traditional defenses by abusing Microsoft OneDrive—a trusted, legitimate cloud service—to stealthily exfiltrate sensitive data over normal business traffic, highlighting the urgent need for security teams to detect trusted services behaving abnormally within their business context.