Rclone

S1040

About this tool

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. Rclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.

Techniques used6

Procedure examples6

Technique	Procedure example
T1030 Data Transfer Size Limits	The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits. DFIR Conti Bazar Nov 2021 Rclone
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Rclone can exfiltrate data over SFTP or HTTPS via WebDAV. Rclone
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol	Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV. Rclone
T1083 File and Directory Discovery	Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands. Rclone
T1560.001 Archive via Utility	Rclone can compress files using `gzip` prior to exfiltration. Rclone
T1567.002 Exfiltration to Cloud Storage	Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. DFIR Conti Bazar Nov 2021 Rclone

Groups that use it9

Akira Cinnamon Tempest Ember Bear INC Ransom Medusa Group MuddyWater Scattered Spider Storm-0501 WIRTE

Campaigns1

C0015

References5

DFIR Conti Bazar Nov 2021 Open source
DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
DarkSide Ransomware Gang Open source
Ramarcus Baylor. (2021, May 12). DarkSide Ransomware Gang: An Overview. Retrieved August 30, 2022.
Detecting Rclone Open source
Aaron Greetham. (2021, May 27). Detecting Rclone – An Effective Tool for Exfiltration. Retrieved August 30, 2022.
Rclone Open source
Nick Craig-Wood. (n.d.). Rclone syncs your files to cloud storage. Retrieved August 30, 2022.
Rclone Wars Open source
Justin Schoenfeld and Aaron Didier. (2021, May 4). Rclone Wars: Transferring leverage in a ransomware attack. Retrieved August 30, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.