Rclone Data Exfiltration to Wasabi Cloud Storage via HTTP PUT

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects HTTP PUT requests directed at Wasabi Cloud Storage domains that originate from an Rclone user agent. This pattern is commonly indicative of data exfiltration activities where an attacker uses the Rclone utility to synchronize or upload sensitive data to unauthorized cloud storage.