Back Cybersecuritynews

CamelClone Spy Campaign Abuses Public File-Sharing Sites and Rclone in Government

Cybersecuritynews •Tushar Subhra Dutta • March 17, 2026

A sophisticated espionage campaign, tracked as Operation CamelClone, has been actively targeting government agencies, defense institutions, and diplomatic bodies across multiple countries, including Algeria, Mongolia, Ukraine, and Kuwait. The operation relies on spear-phishing emails carrying malicious ZIP archives disguised as official government correspondence, tricking recipients into triggering a multi-stage infection chain that ultimately leads to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation CamelClone Targets Governments with Sophisticated Espionage Tactics Operation CamelClone is a sophisticated cyber espionage campaign targeting government agencies and defense institutions in Algeria, Mongolia, Ukraine, and Kuwait. The attackers use spear-phishing emails containing malicious ZIP files disguised as official correspondence to initiate a multi-stage infection process. This method allows them to exploit public file-sharing sites and tools like Rclone to deliver malware and extract sensitive data. The campaign is particularly focused on organizations linked to national security, making detection challenging for defenders. The operation's scope spans multiple countries, indicating a coordinated effort to undermine governmental cybersecurity. Current status remains active as investigations continue. No specific CVEs or numbers of affected systems were mentioned in the articles. 2 sources 73

Extracted Entities

CamelClone Spy Campaign Abuses Public File-Sharing Sites and Rclone in Government

The full story

Extracted Entities

Attack Types (1)

Campaigns (2)

Countries (4)

Industries (1)

MITRE ATT&CK (1)

Tools (1)