BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys via Sphynx Encryptor to Mass-Encrypt Cloud Storage

BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys (TL-2026-1712), also tracked as Sphynx Encryptor Azure Storage Campaign, is a high-severity ransomware operation, first published 2026-07-26. It is attributed to BlackCat with high confidence, affects Microsoft Azure Storage (Blob/Table services), references 7 CVEs (CVE-2023-27532, CVE-2021-34473, CVE-2021-34523), maps to 40 MITRE ATT&CK techniques (T1003.001, T1016, T1018), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-1712

Threat ID
TL-2026-1712
Also known as
Sphynx Encryptor Azure Storage Campaign, BlackCat 3.0 Cloud Storage Attacks
Severity
HIGH
Status
ACTIVE
Category
RANSOMWARE
First published
2026-07-26
Last reviewed
2026-07-26
Attribution
BlackCat
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
cloud infrastructure, managed security service providers, hospitality, gaming casino, health, government administration, education, manufacturing, energy, financial services
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
30

Malware and tooling in BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys

Malware and tooling: BlackCat/ALPHV, Sphynx (BlackCat 3.0), AdFind - S0552, AnyDesk, Atera, BITSAdmin - S0190, Cobalt Strike, ExMatter, Impacket - S0357, Mimikatz, Remcom, Splashtop

BlackCat/ALPHV affiliates compromised a Sophos Central MSSP console via a LastPass-stolen OTP, then used the updated Sphynx (BlackCat 3.0) encryptor with an embedded, Base64-encoded Azure Storage account key to mass-download, locally encrypt, and re-upload objects across 39 Azure Storage accounts, appending the .zk09cvt extension, while separately abusing Azure Key Vault to generate and then delete encryption keys and prevent recovery.

How BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys works

In September 2023, Sophos X-Ops incident responders investigated a BlackCat/ALPHV (RaaS, active since November 2021, Rust-based, tracked by Secureworks as GOLD BLAZER) intrusion in which affiliates gained access to a customer's Sophos Central management console using a one-time password stolen from the victim's LastPass password-vault Chrome browser extension. With console access, the attackers disabled Sophos Tamper Protection and altered security policies, then deployed an updated variant of the group's 'Sphynx' encryptor (internally called BlackCat 3.0, first introduced February 2023) that had gained support for custom/embedded credentials in an August 2023 update. That variant embeds the Impacket networking framework and the Remcom remote-execution tool for lateral movement across already-compromised networks -- techniques Microsoft first documented in mid-August 2023 as used by the affiliate cluster Microsoft tracks as Storm-0875 (active with this build since July 2023).

The distinguishing behavior for this threat is Azure-specific: rather than only encrypting on-host filesystems, the attackers embedded a Base64-encoded Azure Storage account access key directly inside the ransomware binary, giving it standing authentication to Storage data-plane APIs independent of RBAC session tokens. Using that key (and, per Mitiga's parallel analysis, keys obtained via RBAC roles such as Storage Blob Data Contributor, Storage Blob Data Owner, and Storage Table Data Contributor, or any role holding the Microsoft.Storage/storageAccounts/listKeys/action permission), the ransomware mass-downloaded blob/table objects, encrypted them locally, and re-uploaded the encrypted copies, appending the .zk09cvt file extension. A second, related technique abused Azure Key Vault to generate encryption keys used for the operation and then deleted those keys afterward, denying the victim any path to recovery even if backups or blob versions existed. The Sophos-investigated incident encrypted 39 Azure Storage accounts. Detection-relevant precursor activity documented by Mitiga includes enabling public container access, disabling Blob Versioning, deleting blob versions prior to encryption, anomalous key-listing calls by users, and high-volume StorageRead operations immediately followed by StorageWrite operations.

BlackCat/ALPHV affiliates additionally relied on legitimate remote-monitoring-and-management (RMM) tools -- AnyDesk, Splashtop, and Atera -- for persistent access, and on the .NET exfiltration tool ExMatter (used exclusively by the Microsoft-tracked affiliate cluster DEV-0504, capable of self-deleting/'melting' after exfiltrating multi-terabyte volumes of data over SFTP and WebDAV) to support the group's double-extortion model, posting stolen data to a Tor-hosted dedicated leak site with a unique .onion access token per victim. Separately from this specific Sophos Central/Azure incident, the FBI/CISA/HHS joint #StopRansomware advisory AA23-353A (19 Dec 2023, revised 27 Feb 2024) documents the broader ALPHV affiliate ecosystem's TTPs -- Mimikatz and OS credential dumping from LSASS, Cobalt Strike Beacon and SystemBC/Coroxy for C2, Adfind and Nmap for AD/network reconnaissance, BITSAdmin for payload transfer, and vssadmin.exe/wevtutil.exe for shadow-copy deletion and event-log clearing -- and lists initial-access exploitation of CVE-2023-27532 (Veeam Backup & Replication), the ProxyShell Exchange chain (CVE-2021-34473/34523/31207), and Veritas Backup Exec vulnerabilities (CVE-2021-27876/27877/27878) by other ALPHV affiliates (e.g., UNC4466).

The same RaaS operation was behind the high-profile September 2023 MGM Resorts intrusion, in which the affiliate group Scattered Spider (UNC3944) identified an MGM employee via LinkedIn, impersonated them in a ten-minute vishing call to MGM's IT helpdesk, obtained Okta/Azure administrator access, and within days deployed ALPHV ransomware against more than 100 ESXi hypervisors alongside 6 TB of exfiltrated customer data. On 19 December 2023 the FBI/DOJ announced a technical operation that seized ALPHV Tor leak-site infrastructure (946 encryption keys) after the group's infrastructure had already gone dark on 6-7 December 2023; despite the takedown, GOLD BLAZER retained operational capacity, posted new victims within days, and continued operating -- the source Mitiga article itself was updated 22 July 2026, reflecting Sophos X-Ops' observation of a continuing broader surge in cloud-targeted ransomware activity.

MITRE ATT&CK techniques used in TL-2026-1712

Credential Access

T1003.001 LSASS Memory; T1552.001 Credentials In Files; T1555.005 Password Managers

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1069.001 Local Groups; T1083 File and Directory Discovery; T1087.001 Local Account; T1135 Network Share Discovery; T1526 Cloud Service Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1078.004 Cloud Accounts

Execution

T1047 Windows Management Instrumentation; T1059.001 PowerShell

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools

Collection

T1074.001 Local Data Staging; T1560 Archive Collected Data

Initial Access

T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Persistence

T1078.004 Cloud Accounts

Privilege Escalation

T1078.004 Cloud Accounts

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Impact

T1485 Data Destruction; T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft

Resource Development

T1583.004 Server; T1588.002 Tool

Reconnaissance

T1589.003 Employee Names; T1598.004 Spearphishing Voice

stealth

T1684.001 Impersonation

Affected products and versions in BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys

  • Microsoft — Azure Storage (Blob/Table services)
    Vulnerable versions: N/A - technique abuses valid Storage account keys and RBAC role grants, not a software version
    Fixed in: N/A - mitigated via shared-key auth disablement, key rotation, least-privilege RBAC, immutable/versioned storage, Microsoft Defender for Storage
  • Microsoft — Azure Key Vault
    Vulnerable versions: N/A - legitimate key-generation service abused for attacker-controlled key creation and deletion
    Fixed in: N/A - mitigated via soft-delete + purge protection and restrictive access policies
  • Sophos — Sophos Central (MSSP management console)
    Vulnerable versions: Accounts protected only by password + software/password-manager-stored OTP without hardware-bound MFA
    Fixed in: N/A - mitigated via phishing-resistant MFA and IP allow-listing for console access

Remediation for BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys

Patches

  • Apply the Veeam Backup & Replication patch for CVE-2023-27532
  • Apply Microsoft Exchange Server patches for the ProxyShell chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)
  • Apply Veritas Backup Exec patches for CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878

Immediate actions

  • Rotate all Azure Storage account access keys and migrate consumers from shared-key auth to Azure AD (Entra ID) / SAS-token-based access
  • Disable 'Allow storage account key access' (shared key authorization) on Storage accounts where feasible
  • Enforce phishing-resistant MFA (FIDO2/hardware token) on Sophos Central and every MSSP/Azure/Microsoft 365 admin console, and remove OTP/password-manager-extension-based MFA as a sole factor
  • Enable Azure Key Vault soft-delete and purge protection so deleted encryption keys can be recovered
  • Audit and restrict RBAC role assignments (Storage Blob Data Contributor/Owner, Storage Table Data Contributor, and any role with Microsoft.Storage/storageAccounts/listKeys/action) to least privilege
  • Enable immutable blob storage (WORM) with locked retention and enforce Blob Versioning on critical containers

Workarounds

  • Where immediate key rotation is not possible, restrict Storage account network access to trusted VNets/firewall rules and disable public blob container access
  • Remove Blob Versioning/version-delete permissions from non-administrative roles to prevent pre-encryption version wiping
  • Disable the LastPass (or any password manager) browser extension on machines with access to security-management consoles, or require a hardware-bound second factor independent of the password vault

Longer-term hardening

  • Deploy Microsoft Defender for Storage across all subscriptions for malware and anomalous-access alerting
  • Implement Conditional Access policies restricting Azure Portal/Storage management-plane access by location and device compliance
  • Establish helpdesk identity-verification procedures resistant to vishing/pretexting (callback to a pre-registered number, manager attestation, video verification) to blunt Scattered-Spider-style social engineering
  • Alert on anomalous listKeys action calls and on high-volume StorageRead operations immediately followed by StorageWrite operations via Azure Monitor/Microsoft Sentinel
  • Allow-list and monitor RMM tool usage (AnyDesk, Splashtop, Atera); alert on newly installed or unrecognized RMM agents

CVEs associated with BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys

CVE-2023-27532, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2021-27876, CVE-2021-27877, CVE-2021-27878

Weaknesses (CWE) in BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys

CWE-798, CWE-522, CWE-306

Timeline of BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys

  • BlackCat/ALPHV Ransomware-as-a-Service, a Rust-based ransomware family, is first identified operating in the criminal ecosystem.
  • The Microsoft-tracked affiliate cluster DEV-0504 deploys BlackCat ransomware against energy-sector organizations.
  • The 'Sphynx' encryptor variant (internally BlackCat 3.0) is first introduced, adding detection-evasion improvements over prior BlackCat builds.
  • CVE-2023-27532 is published for Veeam Backup & Replication; the credential-disclosure flaw is later exploited by ALPHV affiliates for initial access.
  • The Microsoft-tracked affiliate 'Storm-0875' begins using the updated Sphynx encryptor build.
  • Microsoft and Sophos document a new Sphynx build embedding the Impacket networking framework and the Remcom remote-execution tool for lateral movement, and adding support for custom/embedded credentials.
  • Scattered Spider (UNC3944) impersonates an MGM Resorts employee identified via LinkedIn in a vishing call to the IT helpdesk, obtaining administrator access to MGM's Okta and Azure tenant.
  • ALPHV ransomware is deployed against MGM Resorts, encrypting more than 100 ESXi hypervisors after roughly 6 TB of customer data is exfiltrated.
  • Sophos X-Ops discloses that a Sphynx variant with custom-credential support was used, after a stolen Sophos Central OTP, to encrypt 39 Azure Storage accounts with the .zk09cvt file extension.
  • Mitiga publishes 'Ransomware Strikes Azure Storage: Are You Ready?', documenting the Storage account key theft, RBAC role abuse (Storage Blob Data Contributor/Owner), and Azure Key Vault key generation/deletion technique.
  • ALPHV/BlackCat Tor-based infrastructure goes offline ahead of a coordinated law-enforcement action.
  • The FBI/DOJ announce a technical operation seizing ALPHV Tor leak-site infrastructure (946 encryption keys); the FBI/CISA/HHS jointly release #StopRansomware advisory AA23-353A with IOCs and TTPs.
  • CISA revises advisory AA23-353A with additional IOCs and TTPs identified through FBI investigations continuing into February 2024.
  • Mitiga updates its Azure Storage ransomware analysis, citing Sophos X-Ops observations of a continuing broader surge in cloud-targeted ransomware activity.

Sources cited for BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys

Threats related to BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys

Detection coverage for TL-2026-1712

As of 2026-07-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1712 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats