MITRE ATT&CKsoftware (tool)

S1040 Rclone

Published 2022-08-30 Modified 2026-05-12 Official page ↗

Domain: enterprise
Platforms: Linux, Windows, macOS
Version: 1.3
Created: 2022-08-30

Description

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. Rclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.

Uses · MITRE ATT&CK (6)

T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
T1567.002 Exfiltration to Cloud Storage sub-technique
T1560.001 Archive via Utility sub-technique
T1030 Data Transfer Size Limits technique
T1083 File and Directory Discovery technique

Referenced by MITRE ATT&CK · uses (10)

G1053 Storm-0501 group
G1051 Medusa Group group
G1032 INC Ransom group
G1024 Akira group
G1021 Cinnamon Tempest group
G1015 Scattered Spider group
C0015 C0015 campaign
G1003 Ember Bear group
G0090 WIRTE group
G0069 MuddyWater group

References

https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ Detecting Rclone
https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ DFIR Conti Bazar Nov 2021
https://redcanary.com/blog/rclone-mega-extortion/ Rclone Wars
https://rclone.org Rclone
https://unit42.paloaltonetworks.com/darkside-ransomware/ DarkSide Ransomware Gang

S1040 Rclone

Description

Related

Uses · MITRE ATT&CK (6)

Referenced by MITRE ATT&CK · uses (10)

References