hxxps://aka[.]ms/downloadazcopy-v10-linuxURL
Reported by 2 independent sources · first reported by Microsoft Security Blog · last reported
Last reported 24 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets“"The actor then downloaded AzCopy from hxxps://aka[.]ms/downloadazcopy-v10-linux and invoked it with an operator-supplied Azure Blob SAS URL targeting wsweb03.blob.core.windows.net/log/windows.log."”
-
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570“The actor then downloaded AzCopy from hxxps://aka[.]ms/downloadazcopy-v10-linux and invoked it with an operator-supplied Azure Blob SAS URL targeting wsweb03.blob.core.windows.net/log/windows.log.”
Indicators reported together
named in the same reports- wsweb03.blob.core.windows[.]netin 2 reports
- oast[.]onlinein 1 report
- oast[.]funin 1 report
- requestrepo[.]comin 1 report
- credentials[.]microsoftin 1 report
- process[.]microsoftin 1 report
- it[.]microsoftin 1 report
- processes[.]microsoftin 1 report
- attributes[.]microsoftin 1 report
- infrastructure[.]microsoftin 1 report
- psk1zim.abrdns[.]comin 1 report
- 117.107.25[.]243in 1 report
- 192.255.193[.]111in 1 report
- wslogzimbra.linkpc[.]netin 1 report
- mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws[.]comin 1 report
- 45.32.30[.]235in 1 report
- 193.42.40[.]135in 1 report
- 3.209.137[.]175in 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2026-73570
Thanks — we review every report.