Loading malware…
Rclone is a legitimate, open-source, cross-platform command-line utility for synchronizing and transferring files between local systems, remote servers, and cloud storage. It is not inherently malware, but is widely abused for data exfiltration during ransomware and other intrusions. Supported destinations include Dropbox, Google Drive, Amazon S3, MEGA, Wasabi, and SFTP servers. Its scripting support, concurrent transfers, bandwidth controls, file-selection filters, and broad storage compatibility facilitate large-scale transfers. Its chunker overlay can split large files during upload to accommodate storage size limits.
Threat actors commonly introduce preconfigured Rclone binaries after compromising an environment and use copy operations to transfer sensitive files from servers and network shares to attacker-controlled storage. Operators frequently rename the executable to resemble trusted system processes or legitimate applications; some have also stripped binary metadata to hinder detection. Rclone configuration files can contain destination details, credentials, and transfer settings. Its abuse is associated with ransomware operations including Akira, Qilin, Conti, Black Basta, and ALPHV affiliates. Observed deployments include Windows enterprise environments and Linux-based transfer infrastructure. Rclone use alone does not establish malicious activity because the same functionality supports legitimate backup and synchronization workflows.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
16 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
SafePay operators script the staging and upload of high-value directories using customized, standalone builds of the open-source utility rclone and command-line interfaces for Mega and Wasabi cloud storage services.
Threat Actor 1 tried to masquerade the Rclone executable under different system and legitimate software executable names.
Rclone appeared in 57% of investigated incidents. In the detailed case study, attackers renamed its binary to "firefox.exe" and exfiltrated sensitive data to Dropbox.
Rclone appeared in 57% of investigated incidents. In the detailed case study, attackers renamed its binary to "firefox.exe" and exfiltrated sensitive data to Dropbox.
Rclone appeared in 57% of investigated incidents. In the detailed case study, attackers renamed its binary to "firefox.exe" and exfiltrated sensitive data to Dropbox.
“The group uses rclone for cloud-based exfiltration” and “rclone to MEGA, RcloneView GUI.”
+10 more in the app. View in Mallory
54 distinct techniques documented for this family, organized by ATT&CK tactic.
k0t acquired accounts for numerous web services such as Wasabi S3 buckets and MEGA cloud storage for exfiltration.
PhantomCore buys commercial software XenArmor All‑In‑One Password Recovery Pro and uploads the free utilities MeshAgent, RSocx, and Rclone
PhantomCore uploads MeshAgent and RSocx to directories on compromised legitimate sites and phishing sites, and uploads XenArmor All‑In‑One Password Recovery Pro and RClone to VPS servers
“Attackers ... can capture reusable IBM IAM tokens ... to access protected S3 objects.”
Rclone... used to sync data to cloud and file hosting services such as Amazon Web Services and China-based UCloud Information Technology Limited. | An additional data exfiltration technique observed includes use of Rclone [S1040]—a command line tool used to sync data to cloud and file hosting services such as Amazon Web Services and China-based UCloud Information Technology Limited.
After bypassing signature verification, the application queries the external --auth-proxy script, passing the arbitrary access key ID. The script maps the request to a virtual filesystem (VFS) and grants full access.
Victim receives link to filebulldogs[.]com Downloads: "Weapons requirements for the Kuwait Air Force.zip"
Подозрительным назван запуск PowerShell/Rclone с родительским процессом wmiprvse.exe.
../../etc/cron.d/exploit
A few simple commands to RClone are all attackers need to exfiltrate entire directories to Mega.
«Rclone, запущенный через powershell.exe -enc ... с parent process wmiprvse.exe — аномалия».
When backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path... os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink.
../../etc/cron.d/exploit
“Attackers ... can capture reusable IBM IAM tokens ... to access protected S3 objects.”
Rclone... used to sync data to cloud and file hosting services such as Amazon Web Services and China-based UCloud Information Technology Limited. | An additional data exfiltration technique observed includes use of Rclone [S1040]—a command line tool used to sync data to cloud and file hosting services such as Amazon Web Services and China-based UCloud Information Technology Limited.
../../etc/cron.d/exploit
“Attackers ... can capture reusable IBM IAM tokens ... to access protected S3 objects.”
Cobalt Strike encoded data was concealed in a jQuery script, and legitimate tools were renamed to appear benign.
The activity used update-themed staging and a renamed Bun executable.
Downloads a.zip (22 MB) → extracts l.exe (rclone) ... The binary is ... renamed from rclone.exe to l.exe to reduce suspicion in process listings.
Rclone is renamed to mimic Windows binaries, including svhost.exe and scvhost.exe.
The tool was not found on the server and it was probably eliminated with the intention of covering its traces by the malicious actor.
“Attackers ... can capture reusable IBM IAM tokens ... to access protected S3 objects.”
XOR-decodes MEGA credentials (key=56) ... The MEGA account password is embedded in the PowerShell payload as an integer array and decoded with a single-byte XOR key
部署签名的rclone.exe执行同步命令
The Payouts King ransomware is using the QEMU emulator as a reverse SSH backdoor to run hidden virtual machines on compromised systems and bypass endpoint security.
A scheduled task named TPMProfiler launched qemu-system-x86_64.exe as SYSTEM against a disguised vault.db disk image; operators then worked from the hidden QEMU guest.
Rclone renommé ( lsp.exe , ngconf.txt ) placé dans dossiers exclus de Defender [T1564.012]
When backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path... os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink.
It invokes raw standard library calls such as os.Chmod, os.Chown, and os.Chtimes directly on the path... modifications [are] applied directly to the external target instead of the link itself.
“Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects.”
Telegram Desktop session %APPDATA%\Telegram Desktop\tdata (full session) → remote:backup\%USERNAME%\tdata ... An attacker who possesses this folder can clone the victim's Telegram session
“Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects.”
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
[The flaw allows an attacker] to make the privileged rclone plugin process create a directory and mount a remote filesystem specified in the same request at an arbitrary host path, shadowing or disrupting system directories.
The Payouts King ransomware is using the QEMU emulator as a reverse SSH backdoor to run hidden virtual machines on compromised systems and bypass endpoint security.
Using RDP, the ransomware gang then went hands-on-keyboard, dropping and executing the RClone utility to copy data off the server to a Dropbox account...
Mount ADMIN$, C$, or IPC$ on the target host using a stolen admin credential, then copy the tool or payload into a staging directory.
"SFTP: 193.228.128.2:2222 user d0wnloAd1 (rclone config posted in plaintext by zeta88)."
T1570 — Lateral Tool Transfer (Lateral Movement)
The threat actors look to identify sensitive files for exfiltration before encrypting devices by using tools such as Rclone to automate data extraction to cloud storage.
The attacker employed an Rclone command early in the intrusion to exfiltrate data from a mapped network drive (z:)... [and] a specific network share.
The report describes a "Synology NAS staging" workflow and identifies the NAS at 193.228.128.2:2222 as an intermediary between victim data and the MEGA account.
In multiple incidents analyzed by CTU researchers, the attackers staged tools in the C:\PerfLogs directory.
Вредонос использует утилиту rclone для кражи данных и автоматически выгружает на серверы операторов документы, фотографии, видео, архивы и другие файлы.
The transfer log records a completed copy of 68.837 GiB across 27 files in 23 minutes 46 seconds.
The VHDX files were compressed with zstd and transferred to cloud storage services such as Wasabi using rclone.
WinRAR ... used to split compromised data into segments and to compress files into a .RAR format prior to exfiltration.
Protocol HTTPS to MEGA API endpoints ... The traffic is HTTPS to a legitimate, widely-used cloud storage service.
The threat actor has exfiltrated data over SFTP using Rclone to systems in cloud hosting environments
BianLian group actors transferred tools or other files from an external system into a compromised environment.
"INC Ransom affiliates utilise legitimate remote access tools to maintain interactive access to the victim environment."
Exfiltration WinScp FileZilla Rclone
AppleSeed has divided files if the size is 0x1000000 bytes or more. APT28 has split archived exfiltration files into chunks smaller than 1MB. APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.
“The threat actors employ the command-line tool ‘rclone’ to steal sensitive files ... This tactic aligns with MITRE ATT&CK technique T1041.”
WinSCP and RClone move data to actor-controlled accounts; RClone syncs to cloud storage such as Mega.
Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.
Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV.
TrendFileSecurityCheck.exe copy ... :s3:REDACTED/src
BianLian group actors used Rclone to exfiltrate data to a cloud account they control on the same service.
T1567 Exfiltration Over Web Service ... Unknown ... Transfer completed; external destination and channel not established.
Karakurt has been observed downloading and using command-line tool, Rclone, to exfiltrate files to ‘Mega.io’ or other cloud providers.
To prepare for that scenario, attackers also exfiltrate sensitive information and study the victim’s network so they can up the ante if a target refuses to pay. Then they threaten to release the data or launch a DDoS attack.
43 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.