🧰 RClone

The items that name it 8

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  writeupas tools2026-10-30

  Used by the attacker, renamed SearchApp.exe, to copy file-server data to an external SFTP destination with 20 concurrent transfers.

• IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
  articleas classification.technologies2026-10-29
• Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | Huntress
  writeupas tools2026-10-06

  Launched from C:\PerfLogs for data exfiltration by syncing files to the cloud

• The First 24 Hours: What Happens When Ransomware Lands
  writeupas tools2026-10-02

  Named in CISA's Akira advisory as used for data transfer during exfiltration

• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
  articleas tools2026-09-17

  File transfer tool used to exfiltrate compressed VHDX backup data to cloud storage (Wasabi).

• SETTRA RANSOMWARE
  writeupas tools2026-09-14

  Assumed to be the exfiltration tool used by Settra to move large victim data volumes quickly; described as currently the fastest exfiltration tool available.

• Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft | Huntress
  writeupas tools2026-05-20

  Tool used for data exfiltration

• Threats Plague Educational Organizations
  writeupas tools2025-11-13

  File sync tool abused by threat actor to attempt exfiltration of data from a high school's directories