Skip to content
Threat Feed
Subscribe

Tag

Cloud-Abuse

2 briefs RSS
medium advisory

Detecting Rclone Execution with Network Activity for Data Exfiltration

This detection identifies the malicious use of 'rclone', a legitimate file synchronization utility, for data exfiltration or cloud abuse by flagging `rclone.exe` execution when specific suspicious command-line arguments are used, such as those indicating synchronization to remote cloud storage providers like `mega:`, `ftp:`, or generic `remote:`, especially in conjunction with flags like `--transfers`, `--ignore-existing`, or `--auto-confirm`, which is a critical indicator of compromise abused by threat actors for stealthy data exfiltration.

data-exfiltration rclone cloud-abuse endpoint-detection network-detection threat-actor-tool
1r 1t
high threat

UNC6692 Combines Social Engineering, Malware, and Cloud Abuse

UNC6692 is a newly discovered, financially motivated threat actor that combines social engineering via Microsoft Teams, custom malware named SNOWBELT, and abuse of legitimate AWS S3 cloud infrastructure in its attack campaigns to steal credentials and prepare for data exfiltration.

Microsoft Teams +1 UNC6692 social-engineering malware cloud-abuse credential-theft lateral-movement
2r 12t