S1040 Rclone

toolEnterprise

platformsLinux · Windows · macOS

also known asRclone

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. Rclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.

techniques used (6)

ATT&CK techniques this enables or maps to.

T1030Data Transfer Size Limits
T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1083File and Directory Discovery
T1560.001Archive via Utility
T1567.002Exfiltration to Cloud Storage

used by groups (9)

Threat groups associated with this.

G1024Akira
G1021Cinnamon Tempest
G1003Ember Bear
G1032INC Ransom
G1051Medusa Group
G0069MuddyWater
G1015Scattered Spider
G1053Storm-0501
G0090WIRTE

used by campaigns (1)

Campaigns that use this.

C0015C0015

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan