AzCopy

Tool

Threat entity extracted from intelligence sources

Frequency

4

occurrences

First Seen

November 11, 2025

Last Seen

August 18, 2026

AzCopy is a Microsoft command-line utility used to copy data to and from Azure Storage services.

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (2)

AzCopy Utility Exploited in Ransomware Data Exfiltration Campaigns

Mar 4·3 sources

Storm-0501 Cybercrime Group Targets Azure with Ransomware Tactics

Aug 17·2 sources

Related Articles (3)

Trusted Azure Utility AzCopy Turned into Data Exfiltration Tool in Active Ransomware Campaigns

Cybersecuritynews·Mar 4

AzCopy Utility Misused for Data Exfiltration in Ongoing Ransomware Attacks

Gbhackers·Mar 4

How a CPU spike led to uncovering a RansomHub ransomware attack

Bleepingcomputer·Nov 11

Related Entities

Ransomware Azure Microsoft Azure Russia CWE-287 - Improper Authentication CWE-200 - Exposure of Sensitive Information Cobalt Strike Embargo SocGhoulish T1567 - Exfiltration Over Web Service T1003 - OS Credential Dumping T1021.006 - Windows Remote Management