Data Exfiltration via MinIO Client (mc.exe) with Attacker-Supplied Bucket Args

Duo Tech@duotech

•updated Jul 21, 2026•2•0•3

Detects the execution of the MinIO Client (mc.exe) on Windows with command-line arguments indicating the interaction with external or arbitrary bucket and endpoint locations. This behavior is indicative of an attacker staging or exfiltrating data to an external S3-compatible cloud storage provider.