# BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys via Sphynx Encryptor to Mass-Encrypt Cloud Storage

> BlackCat/ALPHV affiliates compromised a Sophos Central MSSP console via a LastPass-stolen OTP, then used the updated Sphynx (BlackCat 3.0) encryptor with an embedded, Base64-encoded Azure Storage account key to mass-download, locally encrypt, and re-upload objects across 39 Azure Storage accounts, appending the .zk09cvt extension, while separately abusing Azure Key Vault to generate and then delete encryption keys and prevent recovery.

- **Published:** 2026-07-26T00:00:00Z
- **Last reviewed:** 2026-07-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1712
- **ID:** TL-2026-1712
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** BlackCat
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-27532, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2021-27876, CVE-2021-27877, CVE-2021-27878

## Description

In September 2023, Sophos X-Ops incident responders investigated a BlackCat/ALPHV (RaaS, active since November 2021, Rust-based, tracked by Secureworks as GOLD BLAZER) intrusion in which affiliates gained access to a customer's Sophos Central management console using a one-time password stolen from the victim's LastPass password-vault Chrome browser extension. With console access, the attackers disabled Sophos Tamper Protection and altered security policies, then deployed an updated variant of the group's 'Sphynx' encryptor (internally called BlackCat 3.0, first introduced February 2023) that had gained support for custom/embedded credentials in an August 2023 update. That variant embeds the Impacket networking framework and the Remcom remote-execution tool for lateral movement across already-compromised networks -- techniques Microsoft first documented in mid-August 2023 as used by the affiliate cluster Microsoft tracks as Storm-0875 (active with this build since July 2023).

The distinguishing behavior for this threat is Azure-specific: rather than only encrypting on-host filesystems, the attackers embedded a Base64-encoded Azure Storage account access key directly inside the ransomware binary, giving it standing authentication to Storage data-plane APIs independent of RBAC session tokens. Using that key (and, per Mitiga's parallel analysis, keys obtained via RBAC roles such as Storage Blob Data Contributor, Storage Blob Data Owner, and Storage Table Data Contributor, or any role holding the Microsoft.Storage/storageAccounts/listKeys/action permission), the ransomware mass-downloaded blob/table objects, encrypted them locally, and re-uploaded the encrypted copies, appending the .zk09cvt file extension. A second, related technique abused Azure Key Vault to generate encryption keys used for the operation and then deleted those keys afterward, denying the victim any path to recovery even if backups or blob versions existed. The Sophos-investigated incident encrypted 39 Azure Storage accounts. Detection-relevant precursor activity documented by Mitiga includes enabling public container access, disabling Blob Versioning, deleting blob versions prior to encryption, anomalous key-listing calls by users, and high-volume StorageRead operations immediately followed by StorageWrite operations.

BlackCat/ALPHV affiliates additionally relied on legitimate remote-monitoring-and-management (RMM) tools -- AnyDesk, Splashtop, and Atera -- for persistent access, and on the .NET exfiltration tool ExMatter (used exclusively by the Microsoft-tracked affiliate cluster DEV-0504, capable of self-deleting/'melting' after exfiltrating multi-terabyte volumes of data over SFTP and WebDAV) to support the group's double-extortion model, posting stolen data to a Tor-hosted dedicated leak site with a unique .onion access token per victim. Separately from this specific Sophos Central/Azure incident, the FBI/CISA/HHS joint #StopRansomware advisory AA23-353A (19 Dec 2023, revised 27 Feb 2024) documents the broader ALPHV affiliate ecosystem's TTPs -- Mimikatz and OS credential dumping from LSASS, Cobalt Strike Beacon and SystemBC/Coroxy for C2, Adfind and Nmap for AD/network reconnaissance, BITSAdmin for payload transfer, and vssadmin.exe/wevtutil.exe for shadow-copy deletion and event-log clearing -- and lists initial-access exploitation of CVE-2023-27532 (Veeam Backup & Replication), the ProxyShell Exchange chain (CVE-2021-34473/34523/31207), and Veritas Backup Exec vulnerabilities (CVE-2021-27876/27877/27878) by other ALPHV affiliates (e.g., UNC4466).

The same RaaS operation was behind the high-profile September 2023 MGM Resorts intrusion, in which the affiliate group Scattered Spider (UNC3944) identified an MGM employee via LinkedIn, impersonated them in a ten-minute vishing call to MGM's IT helpdesk, obtained Okta/Azure administrator access, and within days deployed ALPHV ransomware against more than 100 ESXi hypervisors alongside 6 TB of exfiltrated customer data. On 19 December 2023 the FBI/DOJ announced a technical operation that seized ALPHV Tor leak-site infrastructure (946 encryption keys) after the group's infrastructure had already gone dark on 6-7 December 2023; despite the takedown, GOLD BLAZER retained operational capacity, posted new victims within days, and continued operating -- the source Mitiga article itself was updated 22 July 2026, reflecting Sophos X-Ops' observation of a continuing broader surge in cloud-targeted ransomware activity.

## MITRE ATT&CK

- T1598.004 Spearphishing Voice
- T1589.003 Employee Names
- T1583.004 Server
- T1588.002 Tool
- T1190 Exploit Public-Facing Application
- T1078.004 Cloud Accounts
- T1199 Trusted Relationship
- T1059.001 PowerShell
- T1047 Windows Management Instrumentation
- T1078.004 Cloud Accounts
- T1078.004 Cloud Accounts
- T1685 Disable or Modify Tools
- T1684.001 Impersonation
- T1685.005 Clear Windows Event Logs
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1078.004 Cloud Accounts
- T1555.005 Password Managers
- T1003.001 LSASS Memory
- T1552.001 Credentials In Files
- T1087.001 Local Account
- T1069.001 Local Groups
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1016 System Network Configuration Discovery
- T1049 System Network Connections Discovery
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1526 Cloud Service Discovery
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1074.001 Local Data Staging
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1071.001 Web Protocols
- T1090 Proxy
- T1048 Exfiltration Over Alternative Protocol
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact

## Sources

- [Ransomware Strikes Azure Storage: Are You Ready?](https://www.mitiga.io/blog/ransomware-strikes-azure-storage-are-you-ready)
- [BlackCat ransomware hits Azure Storage with Sphynx encryptor](https://www.bleepingcomputer.com/news/security/blackcat-ransomware-hits-azure-storage-with-sphynx-encryptor/)
- [Microsoft: BlackCat's Sphynx ransomware embeds Impacket, RemCom](https://www.bleepingcomputer.com/news/microsoft/microsoft-blackcats-sphynx-ransomware-embeds-impacket-remcom/)
- [New BlackCat Ransomware Variant Adopts Advanced Impacket and RemCom Tools](https://thehackernews.com/2023/08/new-blackcat-ransomware-variant-adopts.html)
- [#StopRansomware: ALPHV Blackcat (AA23-353A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a)
- [AA23-353A #StopRansomware: ALPHV Blackcat (Updated)](https://www.hhs.gov/sites/default/files/aa23-353a-stopransomware-alphv-blackcat-update.pdf)
- [BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration](https://www.ibm.com/think/x-force/blackcat-ransomware-levels-up-stealth-speed-exfiltration)
- [Law Enforcement Takes Action Against ALPHV/BlackCat Ransomware](https://www.sophos.com/en-us/blog/law-enforcement-takes-action-against-alphv-blackcat-ransomware)
- [Response to CISA Advisory (AA23-353A)](https://www.attackiq.com/2023/12/29/response-to-cisa-advisory-aa23-353a/)
- [The many lives of BlackCat ransomware](https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1712