Ransomware gangs now abuse Microsoft Azure tool for data theft

Ransomware gangs including BianLian and Rhysida are increasingly using Azure Storage Explorer and AzCopy to steal and stage exfiltrated files in Azure Blob storage — attackers may install dependencies and upgrade .NET, run multiple instances to accelerate uploads, and leverage Azure's trusted status to evade detection; the report highlights detection points such as AzCopy logs at %USERPROFILE%\.azcopy and outbound traffic to *.blob.core.windows.net, and recommends monitoring AzCopy execution, Azure blob endpoints/IP ranges, and enabling session logout to prevent reuse.