Ransomware gangs like BianLian and Rhysida more and more use Microsoft’s Azure Storage Explorer and AzCopy to steal information from breached networks and retailer it in Azure Blob storage.
Storage Explorer is a GUI administration instrument for Microsoft Azure, whereas AzCopy is a command-line instrument that may facilitate large-scale information transfers to and from Azure storage.
In assaults noticed by cybersecurity agency modePUSH, the stolen information is then saved in an Azure Blob container within the cloud, the place it could possibly later be transferred by the menace actors to their very own storage.
Supply: modePUSH
Nonetheless, the researchers famous that the attackers needed to put in further work to get Azure Storage Explorer working, together with putting in dependencies and upgrading .NET to model 8.
That is indicative of the rising concentrate on information theft in ransomware operations, which is the primary leverage for menace actors within the ensuing extortion section.
Why Azure?
Although every ransomware gang has its personal set of exfiltration instruments, ransomware gangs generally use Rclone for syncing information with numerous cloud suppliers and MEGAsync for syncing with MEGA cloud.
Azure, being a trusted enterprise-grade service that’s typically utilized by firms, is unlikely to be blocked by company firewalls and safety instruments. Subsequently, information switch makes an attempt by way of it usually tend to undergo and cross undetected.
Moreover, Azure’s scalability and efficiency, permitting it to deal with giant volumes of unstructured information, is extremely useful when attackers try to exfiltrate giant numbers of information within the shortest potential time.
modePUSH says it noticed ransomware actors utilizing a number of situations of Azure Storage Explorer to add information to a blob container, dashing up the method as a lot as potential.
Detecting ransomware exfiltration
The researchers discovered that the menace actors enabled default ‘Data’ stage logging when utilizing Storage Explorer and AzCopy, which creates a log file at %USERPROFILE%.azcopy.
This log file is of explicit worth to incident responders, because it incorporates data on file operations, permitting investigators to rapidly decide what information was stolen (UPLOADSUCCESSFUL) and what different payloads have been doubtlessly launched (DOWNLOADSUCCESSFUL).
Supply: modePUSH
Protection measures embody monitoring for AzCopy execution, outbound community visitors to Azure Blob Storage endpoints at “.blob.core.home windows.web” or Azure IP ranges, and setting alarms for uncommon patterns in file copying or entry on essential servers.
If Azure is already utilized in a company, it is strongly recommended to test the ‘Logout on Exit’ choice to mechanically signal out upon exiting the appliance, in order to stop attackers from utilizing the energetic session for file theft.
