AzCopy Utility Misused for Data Exfiltration in Ongoing Ransomware Attacks

**Executive Summary:** Ransomware operators are increasingly abusing Microsoft's AzCopy utility to stealthily exfiltrate sensitive data to attacker-controlled Azure Blob storage before encrypting systems; observed groups (e.g., BianLian, Rhysida) use valid credentials/SAS tokens, throttling, and log deletion to evade detection, and organizations should adopt data-centric controls, UEBA, network restrictions, application control, and incident plans to detect and respond to cloud-based exfiltration.