Rclone
- ID
- S1040
- Type
- Tool
- Platforms
- Linux, Windows, macOS
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. Rclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.[1][2][3][4][5]
Techniques used (6)
- T1030 Data Transfer Size Limits
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1083 File and Directory Discovery
- T1560.001 Archive via Utility
- T1567.002 Exfiltration to Cloud Storage
Groups using it (9)
- G0069 MuddyWater
- G0090 WIRTE
- G1003 Ember Bear
- G1015 Scattered Spider
- G1021 Cinnamon Tempest
- G1024 Akira
- G1032 INC Ransom
- G1051 Medusa Group
- G1053 Storm-0501