Data Leak Detected by AhnLab EDR (vs. Ransomware Threat Actors)

This report outlines how ransomware groups exfiltrate data prior to encryption by abusing legitimate file transfer and cloud-sync tools—WinSCP, FileZilla, MegaSync, and Rclone—and describes how AhnLab EDR detects these activities through behavior-based monitoring and signatures. It references multiple ransomware families (e.g., Hive, Akira, Maze, LockBit, Conti, BlackCat/ALPHV, Nefilim, Money Message, REvil, BlackBasta, Cactus, DarkSide, Royal) and provides guidance for administrators to identify, investigate, and respond to these data-leak TTPs using EDR telemetry.