NightSpire Ransomware MEGAsync Exfiltration

Duo Tech@duotech

•updated Jun 9, 2026•1•0•2

Detects the execution of MEGAsync.exe with the /upload argument, a technique used by NightSpire ransomware operators to exfiltrate staged data to MEGA cloud storage.