Staged and Gone: Rclone Bulk Upload to MEGA From a File Server

A pre-ransomware bulk data-exfiltration investigation. After a perimeter foothold and hands-on command and control, the operator pivoted to a Windows file share server, recovered a domain-administrator password from a plaintext file, staged finance data into a single archive, and bulk-uploaded it to a MEGA cloud remote with a renamed rclone client over HTTPS before any encryptor ran. The organization also runs rclone legitimately on its backup server, so the challenge is separating the sanctioned job from the theft. Reconstruct the staging-then-upload chain from SIEM and perimeter firewall telemetry.