STAC4713/STAC3725 rclone Cloud Exfiltration to mega.nz or SFTP

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects the execution of rclone.exe with command-line arguments indicative of data exfiltration to cloud storage providers (mega.nz, Dropbox, OneDrive) or via SFTP. This behavior is commonly associated with ransomware threat actors, such as those observed in the STAC4713 and STAC3725 campaigns (GOLD ENCOUNTER), who utilize rclone to stage and exfiltrate sensitive data prior to deploying ransomware.