Storm-2570 S3 exfiltration via s5cmd/Rclone

Ankit Mehta@Secvyn

•updated Sep 25, 2026•10•0•27

Detects the use of legitimate data transfer utilities (s5cmd, rclone) configured to exfiltrate sensitive document types (.doc, .pdf, .sql, etc.) to S3-compatible cloud storage. The rule correlates this activity with recent access to files containing sensitive credentials or configuration data, a pattern observed in double-extortion campaigns.