Possible Bulk Data Exfiltration via rclone to S3-Compatible Storage

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•0

Detects high-frequency PUT requests to known S3-compatible cloud storage providers using the rclone user-agent, which is a common indicator of bulk data exfiltration or unauthorized backup activity by attackers.