Threat intelligence / Tool

Rclone

[Rclone](https://attack.mitre.org/software/S1040) is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. [Rclone](https://attack.mitre.org/software/S1040) has been used in a number of ransomware campaigns, including those associated with the [Conti](https://attack.mitre.org/software/S0575) and DarkSide Ransomware-as-a-Service operations.(Citation: Rclone)(Citation: Rclone Wars)(Citation: Detecting Rclone)(Citation: DarkSide Ransomware Gang)(Citation: DFIR Conti Bazar Nov 2021)

Tool

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Rclone](https://attack.mitre.org/software/S1040) is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. [Rclone](https://attack.mitre.org/software/S1040) has been used in a number of ransomware campaigns, including those associated with the [Conti](https://attack.mitre.org/software/S0575) and DarkSide Ransomware-as-a-Service operations.(Citation: Rclone)(Citation: Rclone Wars)(Citation: Detecting Rclone)(Citation: DarkSide Ransomware Gang)(Citation: DFIR Conti Bazar Nov 2021)

Labels

tool

16 recorded

Relationships

uses

from Akira

Group

uses

from C0015

Campaign

uses

from Cinnamon Tempest

Group

uses

from Ember Bear

Group

uses

from INC Ransom

Group

uses

from Medusa Group

Group

uses

from MuddyWater

Group

uses

to Archive via Utility

Technique

uses

to Data Transfer Size Limits

Technique

uses

to Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to File and Directory Discovery

Technique

uses

from Scattered Spider

Group

uses

from Storm-0501

Group

uses

from WIRTE

Group

6 external

References

mitre-attack

S1040

Detecting Rclone

https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/

DFIR Conti Bazar Nov 2021

https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/

Rclone Wars

https://redcanary.com/blog/rclone-mega-extortion/

Rclone

https://rclone.org

DarkSide Ransomware Gang

https://unit42.paloaltonetworks.com/darkside-ransomware/