The Gentlemen - Rclone SFTP Data Exfiltration

Georg Lauenstein@gsec

•updated Mar 30, 2026•1•0•60

Detects rclone execution with exfiltration patterns consistent with The Gentlemen operations. They use rclone copy with multi-threaded streams, bandwidth limits, and file type exclusions (exe, msi, mp3, avi, iso) for organized data theft via SFTP.