RcloneTool
Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. Rclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.From MITRE ATT&CK
Last reported yesterday, by The Hacker News20 reports
ATT&CK techniques
6 of 158 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…er 2026 Akira ransomware attack undertaken by Huntress found that "the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
- T1053.005Scheduled Task
“T1053.005”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1003.001LSASS Memory
“T1003.001”
- T1059.001PowerShell
“T1059.001”
- T1110Brute Force
“…Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or perform brute-force attacks using common username and password combinations, to obtain initial access.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
20 reports, newest first · the exact sentence from each-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials“Exfiltrate harvested data using Rclone into Wasabi S3 buckets and MEGA cloud drives.”
-
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge“…e agents were used for live interactive access only (shell and RDP relay) rather than for data transfer, which was handled separately by Rclone.”
-
Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew“No use of WinSCP or Rclone, the exfiltration tools named in the FBI notice.”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“…found that "the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
-
hxxps://www.huntress.com/blog/mapping-akira-ransomware-attack“…vealed that the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
-
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments“Data collection and exfiltration tools, including s5cmd and Rclone”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“The popular open source file transfer utility Rclone was used when exfiltration was attempted.”
-
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use“…ccess to internal networks from external systems; the tunneling tool chisel; the remote desktop tool AnyDesk; and the file transfer tool Rclone.”
-
Ungentlemanly behavior: Insights into a ransomware operation“While MEGAsync and FileZilla occasionally appeared on victims’ systems, Rclone was clearly the preferred exfiltration tool as it was observed in five of the incidents.”
-
Over 500 Critical Infrastructure Organizations Hit by Medusa Ransomware“Medusa actors install and use Bandizip to create archives of exfiltration files and Rclone to facilitate exfiltration of data to the Medusa C2 servers, while obfuscating rclone.exe and associated rclone.conf files by renaming the files.”
-
Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms“They frequently use portable versions of WinSCP or Rclone.”
-
Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware“Concurrently, the actor staged and executed Rclone to exfiltrate large volumes of sensitive data to Wasabi cloud storage before deploying additional TukTuk implants across critical infrastructure.”
-
How Hastalamuerte Operates: Group-IB’s Analysis of The Gentlemen’s Attack Methods“Context: Shared Rclone commands allegedly used during exfiltration.”
-
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack“…t servers to deploy LockBit-derived ransomware with the .x2anylock extension, using Cloudflare tunnels for command and control (C&C) and Rclone for data exfiltration.”
-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“Twenty days into the intrusion data was exfiltrated using Rclone and FTP.”
-
Getting to the Crux (Ransomware) of the Matter“…ered canary reports, while on others, further activity was detected, such as remote Registry dumps, driver installations, and the use of Rclone.”
-
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies“Before being exfiltrated, data is archived using 7-Zip and uploaded to the MEGA file sharing service using the Rclone utility.”
-
The Locking Egregor“In addition, they used Rclone for data exfiltration – the same masquerading technique was used, they renamed its binary to svchost.exe and placed it to C:Windows.”
-
Lock Like a Pro“To do so, they use Rclone, a command-line tool for managing files on cloud storage, which supports a large number of such storage providers.”
-
ATT&CKing ProLock Ransomware“For exfiltration, ProLock operators use Rclone, a command line tool capable of synching files to and from different cloud storage providers, such as OneDrive, Google Drive, Mega, etc.”
Thanks — we review every report.