Holding blobs for ransom: Four methods for Azure Storage ransomware

This report analyzes four methods attackers can use to render Azure Blob Storage data inaccessible—downloading/reuploading blobs to overwrite them, abusing customer-provided encryption keys (CPK), creating/using encryption scopes, and switching storage to customer-managed keys (CMK)—provides example API calls and logging details, cites real-world incidents (BlackCat/Sphynx and Microsoft STORM-0501), highlights detection/logging gaps, and gives mitigation and monitoring recommendations.