Threat Actors Attacking Azure Blob Storage to Compromise Organizational Repositories

Cybersecurity researchers have identified a campaign where threat actors are using compromised credentials to infiltrate Azure Blob Storage containers, targeting organizations' critical code repositories and sensitive data.

This threat exploits misconfigured storage access controls to establish persistence and exfiltrate intellectual property.

The attack vector signifies a shift in threat actors' approach to cloud infrastructure, focusing on enterprise storage systems instead of traditional endpoint attacks.

The campaign involves multiple threat groups across various sectors, including finance, technology, and critical infrastructure.

Microsoft analysts noted that attacks typically start with credential harvesting through phishing campaigns and malware-based information stealers.

Once initial access is established, operators perform reconnaissance to identify accessible Azure Blob Storage instances with weak or default access policies.

Threat actors then systematically enumerate containers to find valuable repositories, configuration files, and backup data.

Microsoft researchers identified a critical component of this operation involving SharkStealer, a Golang-based infostealer that uses an advanced communication technique called EtherHiding to evade traditional detection mechanisms.

Technical Analysis of EtherHiding Pattern in Azure Attacks

The sophistication of these operations lies in combining traditional credential theft with blockchain-based obfuscation techniques. SharkStealer initiates contact with BNB Smart Chain nodes using Ethereum JSON-RPC calls targeting specific smart contracts.

The malware executes eth_call requests to predetermined contract addresses, receiving tuples containing an initialization vector and encrypted payload.

Using a hardcoded AES-CFB encryption key embedded within the binary, the malware decrypts the returned data to extract current C2 server coordinates.

This methodology poses detection challenges since network traffic analysis reveals only legitimate blockchain node communications, making it difficult to distinguish malicious activity from benign cryptocurrency wallet interactions.

Using public blockchain infrastructure as a dead-drop mechanism provides threat actors with resilience against traditional takedown operations and domain blocking strategies.

In observed campaigns, once SharkStealer compromises a system, it harvests Azure credentials stored in browser caches, configuration files, and credential managers.

These stolen credentials grant direct access to Azure Blob Storage containers without triggering standard access controls.

Threat actors then establish secondary connections to Azure Storage, downloading entire repositories containing source code, API keys, and sensitive configuration data.

The combination of EtherHiding-based command infrastructure with Azure Storage access creates a dangerous threat profile that organizations must defend against through credential rotation, access reviews, and monitoring for anomalous blockchain-based communications from internal networks.

Organizations should implement strict Azure Storage authentication policies, enforce multi-factor authentication on administrative accounts, and deploy behavioral monitoring to detect unusual API access patterns.

Based on reporting by Cyber Security News.