Threat Actors Exploiting Azure Blob Storage to Breach Organizational Repositories

Threat actors are increasingly targeting Azure Blob Storage to infiltrate organisational repositories and disrupt critical workloads. The campaigns exploit misconfigurations, leaked credentials, and weak access controls to breach Blob Storage accounts, with publicly exposed containers routinely enumerated through DNS and HTTP header probing, brute-forced subdomain permutations, and dedicated indexers cataloguing exposed endpoints.

Once valid storage account names or container URLs are found, adversaries search code repositories, configuration files, and version histories for storage account keys, SAS tokens, or service principal credentials, which can grant full read, write, and delete permissions and help establish footholds and privilege escalation.

Beyond data theft, attackers host malicious payloads and spoofed login pages, injecting macro-enabled documents, executables, or poisoned datasets into containers left open or protected by overly permissive SAS tokens. The attack chain includes reconnaissance with Goblob and QuickAZ, malicious file delivery via blob-triggered workflows, and exfiltration using AzCopy, Azure Storage Explorer, or REST API calls to move data into staging containers.

Defences emphasise least-privilege access, disabling anonymous access, private endpoints, TLS, versioning, soft delete, and integrating Defender for Storage for real-time threat intelligence and automated scanning.