Trusted Azure Utility AzCopy Turned into Data Exfiltration Tool in Active Ransomware Campaigns

Recent developments in cybersecurity have highlighted a concerning trend where legitimate software is being exploited for malicious purposes. Microsoft’s AzCopy, a command-line tool designed for data transfer to and from Azure Storage, is being misused by ransomware operators to exfiltrate sensitive data from organizations.

AzCopy: A Tool Re-purposed for Data Exfiltration

AzCopy facilitates large-scale data operations in cloud environments and operates as a standalone executable, transferring data over standard HTTPS connections to Azure. Its widespread use and recognition in business operations often result in Endpoint Detection and Response (EDR) platforms not flagging its activity as suspicious.

Ransomware operators exploit this by using AzCopy to move stolen data to legitimate cloud providers, making detection difficult. The data transfer is masked as normal business traffic, complicating efforts to identify exfiltration activities.

Incident Analysis and Ransomware Tactics

Research by Varonis Threat Labs has documented multiple cases where AzCopy was employed as a data exfiltration tool, often undetected by EDR systems. This reflects a tactical shift by ransomware operators who now utilize Azure Blob Storage accounts set up swiftly with minimal credentials.

In double extortion ransomware attacks, sensitive data is first exfiltrated, then systems are encrypted, with the threat of public disclosure unless a ransom is paid. Utilizing Microsoft’s infrastructure allows threat actors to blend malicious activities with legitimate traffic, delaying detection.

Attackers generate a Shared Access Signature (SAS) token to facilitate unauthorized access to Azure Storage accounts. This token, embedded in the AzCopy command, includes permissions and time constraints, typically active for a short period to minimize detection risk.

The AzCopy command is finely tuned with parameters like --include-after and --cap-mbps to limit data transfer to recent files and control upload speed, thus avoiding network detection triggers.

Logs generated by AzCopy, which are crucial for forensic investigation, are often deleted by attackers post-exfiltration to erase evidence of data theft.

Monitor outbound connections to *.blob.core.windows.net for unusual activities. Implement User and Entity Behavior Analytics (UEBA) to detect anomalies in file access patterns. Apply application whitelisting to restrict AzCopy use to authorized systems and accounts. Ensure incident response plans are well-documented and tested, particularly for network containment strategies during ransomware incidents.

Based on reporting by Cyber Security News.