Recent cybersecurity reports reveal a troubling trend: ransomware gangs, including BianLian and Rhysida, are increasingly leveraging Microsoft Azure tools—specifically Azure Storage Explorer and AzCopy—for data theft operations. These tools, typically used for legitimate data management and transfer tasks, are now being repurposed by attackers to exfiltrate stolen data and store it in Azure Blob storage.
Abuse of Azure Tools:
-
- Azure Storage Explorer: A graphical management tool for Azure storage.
- AzCopy: A command-line tool for large-scale data transfers to and from Azure storage.
- Attackers are using these tools to upload stolen data to Azure Blob containers, which can later be moved to their own storage locations.
Increased Focus on Data Theft:
-
- This shift signifies ransomware gangs’ increased emphasis on data theft as a primary leverage point for extortion. By exfiltrating and storing large volumes of data in Azure Blob storage, attackers can efficiently manage and later retrieve their loot.
Why Azure?:
-
- Unlikely to be Blocked: Azure is widely used and trusted by enterprises, making it less likely to be blocked by corporate firewalls or security tools.
- Scalability and Performance: Azure’s ability to handle large volumes of unstructured data is advantageous for attackers needing to exfiltrate significant amounts of information quickly.
Detection and Defense:
-
- Logging and Monitoring: Attackers often use default ‘Info’ level logging with Storage Explorer and AzCopy, which can be valuable for incident responders. Logs can reveal file operations, helping to identify stolen data and any additional threats.
- Recommended Measures:
- Monitor for AzCopy executions and outbound traffic to Azure Blob Storage endpoints.
- Set up alerts for unusual file copying or access patterns on critical servers.
- If Azure is used within an organization, enable the ‘Logout on Exit’ option to prevent unauthorized use of active sessions.
As ransomware operations evolve, so too must defensive strategies. Awareness and proactive measures are critical in mitigating the risks associated with the misuse of cloud-based tools for data theft.
Stay vigilant and ensure your organization’s cloud configurations and monitoring practices are up to date to protect against these emerging threats.