S1040LinuxWindowsmacOS
S1040Rclone
Platforms
3
ATT&CK
14.1
References
6
Description
[Rclone](https://attack.mitre.org/software/S1040) is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. [Rclone](https://attack.mitre.org/software/S1040) has been used in a number of ransomware campaigns, including those associated with the [Conti](https://attack.mitre.org/software/S0575) and DarkSide Ransomware-as-a-Service operations.(Citation: Rclone)(Citation: Rclone Wars)(Citation: Detecting Rclone)(Citation: DarkSide Ransomware Gang)(Citation: DFIR Conti Bazar Nov 2021)
Platforms· 3
LinuxWindowsmacOS
References
- https://attack.mitre.org/software/S1040
- https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
- https://redcanary.com/blog/rclone-mega-extortion/
- https://rclone.org
- https://unit42.paloaltonetworks.com/darkside-ransomware/
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.