Executive Summary
A recent analysis of cloud-native tradecraft reveals four primary methods used by threat actors to target Azure Blob Storage for ransomware operations. While traditional methods involve downloading, encrypting, and re-uploading data (as seen with BlackCat and the Sphynx encryptor), newer tactics exploit Azure-native features like Customer-Provided Keys (CPK), Encryption Scopes, and Customer-Managed Keys (CMK).
Notably, actors like STORM-0501 have been observed using Encryption Scopes to render data inaccessible, while the Codefinger group has pioneered similar techniques in AWS S3 that translate directly to Azure's CPK functionality. These methods are particularly dangerous because some native encryption actions, such as the use of CPKs, are not fully captured in standard Azure resource logs, making them difficult for SOC teams to detect using traditional SIEM monitoring. Furthermore, attackers can evade built-in protections like soft-delete and purge protection by using cross-tenant CMK configurations, effectively placing the decryption keys in attacker-controlled infrastructure where the victim has no recovery rights.