AzCopy: Living off the Land Data Exfiltration in Modern Ransomware

Du'aine Davis

Observed in the wild

• In incidents investigated and published by Varonis Threat Labs (March 2026), ransomware operators were observed exfiltrating large volumes of sensitive enterprise data using Microsoft’s AzCopy utility prior to encryption. Multiple victim organisations were impacted, with at least one confirmed case bypassing EDR detection entirely. This mirrors earlier Storm‑0501 cloud‑based extortion patterns but focuses specifically on stealthy data theft rather than destructive ransomware.
• Threat actors abused AzCopy, a legitimate Azure Storage command‑line tool, to “live off the land” and blend exfiltration into normal cloud operations. Using stolen credentials or SAS tokens, attackers transferred data over trusted HTTPS connections to attacker‑controlled Azure Blob storage. Techniques included throttling transfer speeds, targeting recently modified files, and deleting AzCopy artefacts, making activity difficult for EDR and network tools to distinguish from legitimate Azure usage.
• Organisations are advised to treat AzCopy and Azure Storage access as high‑risk and actively monitor for abnormal usage. Using Microsoft Defender for Endpoint, Defender for Cloud, and Sentinel, defenders should hunt for unexpected AzCopy executions, large outbound transfers to *.blob.core.windows.net, unusual SAS token usage, and off‑hours data movement. Strong identity protection, least privilege, and rapid containment are critical, as exfiltration typically precedes encryption by minutes or hours.

Copy, Paste, Ransom: Making Data Exfiltration As Easy as AzCopy