Gamaredon PteroBox rclone Exfiltration to Dropbox via api.dropbox.com

Ethan Andrews@eandrews

•updated Jun 25, 2026•5•0•9

Detects the use of rclone.exe to exfiltrate files to Dropbox, specifically looking for process execution patterns and network connections to Dropbox API endpoints consistent with the Gamaredon PteroBox exfiltration module.