CamelClone Uses Public File-Sharing Sites in Government Cyberattacks

Why It Matters

The attack demonstrates how cyber‑espionage groups can weaponize everyday cloud utilities, complicating detection for critical‑infrastructure defenders. It underscores the urgency of monitoring legitimate tool usage and public file‑sharing traffic in high‑risk environments.

Key Takeaways

• Spear‑phishing ZIPs deliver LNK shortcuts executing PowerShell
• Malware loads from filebulldogs.com, avoiding traditional C2 servers
• Rclone used to exfiltrate data to MEGA cloud storage
• Targets include government, defense, diplomatic, and energy sectors
• Campaign spans Algeria, Mongolia, Ukraine, Kuwait, indicating geopolitical focus

Pulse Analysis

The rise of “living‑off‑the‑land” tactics has pushed threat actors toward public file‑sharing platforms and legitimate utilities. By hosting malicious payloads on filebulldogs.com, the CamelClone operators sidestep conventional command‑and‑control servers, making network‑based signatures far less effective. Coupled with Rclone—a trusted synchronization tool—this approach blends malicious activity with normal traffic, forcing defenders to rethink detection models that rely on binary reputation alone.

Operation CamelClone’s geopolitical focus reveals a strategic intelligence‑gathering campaign. The chosen lures—Arabic, Mongolian and Arabic‑English zip files—mirror the diplomatic and energy interests of Algeria, Mongolia, Ukraine and Kuwait, suggesting state‑backed actors seeking insight into policy shifts, defence procurement and regional alliances. The use of MEGA for exfiltration, coupled with anonymous onionmail.org email accounts, adds layers of anonymity, complicating attribution and response efforts across multiple jurisdictions.

For organizations in the public sector, the lesson is clear: trusted tools can become covert data‑exfiltration channels. Implementing strict application allowlists, monitoring outbound traffic to cloud storage endpoints, and employing behavior‑based analytics for Rclone usage are essential safeguards. Regular phishing awareness training and verification of ZIP attachments can disrupt the initial infection vector, while threat‑intel sharing on IOCs such as the listed SHA‑256 hashes helps accelerate detection across the supply chain. Proactive controls and continuous visibility are now mandatory to counter these sophisticated, tool‑abuse campaigns.