Anomaly-Based Threat Hunting: Darktrace's Approach in Action
This blog outlines Darktrace's model-based anomaly detection and how security teams can leverage custom models for targeted threat hunts. Recently, Darktrace's Threat Research team applied this method in their report, "AI & Cybersecurity: The State of Cyber in UK and US Energy Sectors."
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Nathaniel Jones
VP, Security & AI Strategy, Field CISO
Share
08
May 2025
What is threat hunting?
Threat hunting in cybersecurity involves proactively and iteratively searching through networks and datasets to detect threats that evade existing automated security solutions. It is an important component of a strong cybersecurity posture.
There are several frameworks that Darktrace analysts use to guide how threat hunting is carried out, some of which are:
MITRE Attack
Tactics, Techniques, Procedures (TTPs)
Diamond Model for Intrusion Analysis
Adversary, Infrastructure, Victims, Capabilities
Threat Hunt Model – Six Steps
Purpose, Scope, Equip, Plan, Execute, Feedback
Pyramid of Pain
These frameworks are important in baselining how to run a threat hunt. There are also a combination of different methods that allow defenders diversity– regardless of whether it is a proactive or reactive threat hunt. Some of these are:
Hypothesis-based threat hunting
Analytics-driven threat hunting
Automated/machine learning hunting
Indicator of Compromise (IoC) hunting
Victim-based threat hunting
Threat hunting with Darktrace
At its core, Darktrace relies on anomaly-based detection methods. It combines various machine learning types that allows it to characterize what constitutes ‘normal’, based on the analysis of many different measures of a device or actor’s behavior. Those types of learning are then curated into what are called models.
Darktrace models leverage anomaly detection and integrate outputs from Darktrace Deep Packet Inspection, telemetry inputs, and additional modules, creating tailored activity detection.
This dynamic understanding allows Darktrace to identify, with a high degree of precision, events or behaviors that are both anomalous and unlikely to be benign. On top of machine learning models for detection, there is also the ability to change and create models showcasing the tool’s diversity. The Model Editor allows security teams to specify values, priorities, thresholds, and actions they want to detect. That means a team can create custom detection models based on specific use cases or business requirements. Teams can also increase the priority of existing detections based on their own risk assessments to their environment.
This level of dexterity is particularly useful when conducting a threat hunt. As described above, and in previous ‘Inside the SOC’ blogs such a threat hunt can be on a specific threat actor, specific sector, or a hypothesis-based threat hunt combined with ‘experimenting’ with some of Darktrace’s models.
Conducting a threat hunt in the energy sector with experimental models
In Darktrace’s recent Threat Research report “AI & Cybersecurity: The state of cyber in UK and US energy sectors” Darktrace’s Threat Research team crafted hypothesis-driven threat hunts, building experimental models and investigating existing models to test them and detect malicious activity across Darktrace customers in the energy sector.
For one of the hunts, which hypothesised utilization of PerfectData software and multi-factor authentication (MFA) bypass to compromise user accounts and destruct data, an experimental model was created to detect a Software-as-a-Service (SaaS) user performing activity relating to 'PerfectData Software’, known to allow a threat actor to exfiltrate whole mailboxes as a PST file. Experimental model alerts caused by this anomalous activity were analyzed, in conjunction with existing SaaS and email-related models that would indicate a multi-stage attack in line with the hypothesis.
Whilst hunting, Darktrace researchers found multiple model alerts for this experimental model associated with PerfectData software usage, within energy sector customers, including an oil and gas investment company, as well as other sectors. Upon further investigation, it was also found that in June 2024, a malicious actor had targeted a renewable energy infrastructure provider via a PerfectData Software attack and demonstrated intent to conduct an Operational Technology (OT) attack.
The actor logged into Azure AD from a rare US IP address. They then granted Consent to ‘eM Client’ from the same IP. Shortly after, the actor granted ‘AddServicePrincipal’ via Azure to PerfectData Software. Two days later, the actor created a new email rule from a London IP to move emails to an RSS Feed Folder, stop processing rules, and mark emails as read. They then accessed mail items in the “\Sent” folder from a malicious IP belonging to anonymization network, Private Internet Access Virtual Private Network (PIA VPN) [1]. The actor then conducted mass email deletions, deleting multiple instances of emails with subject “[Name] shared "[Company Name] Proposal" With You” from the “\Sent folder”. The emails’ subject suggests the email likely contains a link to file storage for phishing purposes. The mass deletion likely represented an attempt to obfuscate a potential outbound phishing email campaign.
Figure 1: The Darktrace Model Alert that triggered for the mass deletes of the likely phishing email containing a file storage link.
A month later, the same user was observed downloading mass mLog CSV files related to proprietary and Operational Technology information. In September, three months after the initial attack, another mass download of operational files occurred by this actor, pertaining to operating instructions and measurements, The observed patience and specific file downloads seemingly demonstrated an intent to conduct or research possible OT attack vectors. An attack on OT could have significant impacts including operational downtime, reputational damage, and harm to everyday operations. Darktrace alerted the impacted customer once findings were verified, and subsequent actions were taken by the internal security team to prevent further malicious activity.
Conclusion
Harnessing the power of different tools in a security stack is a key element to cyber defense. The above hypothesis-based threat hunt and custom demonstrated intent to conduct an experimental model creation demonstrates different threat hunting approaches, how Darktrace’s approach can be operationalized, and that proactive threat hunting can be a valuable complement to traditional security controls and is essential for organizations facing increasingly complex threat landscapes.
Credit to Nathaniel Jones (VP, Security & AI Strategy, Field CISO at Darktrace) and Zoe Tilsiter (EMEA Consultancy Lead)
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
When Open Source Is Weaponized: Analysis of a Trojanized 7 Zip Installer
Attackers abused a trojanized 7‑Zip installer distributed via a typo‑squatted domain to establish proxyware infections worldwide. This blog analyzes how social engineering, trusted open‑source software, and stealthy command‑and‑control activity enabled widespread compromise, highlighting the importance of software validation, user awareness, and proactive network‑level detection.
Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
When Trust Becomes the Attack Surface: Supply-Chain Attacks in an Era of Automation and Implicit Trust
Software supply-chain attacks dominate the threat landscape in 2026, as adversaries exploit trusted build systems, CI/CD pipelines, and management tools to gain access to target environments. This blog examines Axios, Trivy and Quest Kace compromises observed in the Darktrace customer base, highlighting the need for anomaly detection, assumed breach and continuous visibility.
AI is a contributing member of nearly every modern cybersecurity team. As we discussed earlier in this blog series, rapid AI adoption is expanding the attack surface in ways that security professionals have never before experienced while also empowering attackers to operate at unprecedented speed and scale. It’s only logical that defenders are harnessing the power of AI to fight back.
After all, AI can help cybersecurity teams spot the subtle signs of novel threats before humans can, investigate events more quickly and thoroughly, and automate response. But although AI has been widely adopted, this technology is also frequently misunderstood, and occasionally viewed with suspicion.
For CISOs, the cybersecurity marketplace can be noisy. Making sense of competing vendors’ claims to distinguish the solutions that truly deliver on AI’s full potential from those that do not isn’t always easy. Without a nuanced understanding of the different types of AI used across the cybersecurity stack, it is difficult to make informed decisions about which vendors to work with or how to gain the most value from their solutions. Many security leaders are turning to Managed Security Service Providers (MSSPs) for guidance and support.
The right kinds of AI in the right places?
Back in 2024, when we first conducted this annual survey, more than a quarter of respondents were only vaguely familiar with generative AI or hadn’t heard of it at all. Today, GenAI plays a role in 77% of security stacks. This percentage marks a rapid increase in both awareness and adoption over a relatively short period of time.
According to security professionals, different types of AI are widely integrated into cybersecurity tooling:
67% report that their organization’s security stack uses supervised machine learning
67% report that theirs uses agentic AI
58% report that theirs uses natural language processing (NLP)
35% report that theirs uses unsupervised machine learning
But their responses suggest that organizations aren’t always using the most valuable types of AI for the most relevant use cases.
Despite all the recent attention AI has gotten, supervised machine learning isn’t new. Cybersecurity vendors have been experimenting with models trained on hand-labeled datasets for over a decade. These systems are fed large numbers of examples of malicious activity – for instance, strains of ransomware – and use these examples to generalize common indicators of maliciousness – such as the TTPs of multiple known ransomware strains – so that the models can identify similar attacks in the future. This approach is more effective than signature-based detection, since it isn’t tied to an individual byte sequence or file hash. However, supervised machine learning models can miss patterns or features outside the training data set. When adversarial behavior shifts, these systems can’t easily pivot.
Unsupervised machine learning, by contrast, can identify key patterns and trends in unlabeled data without human input. This enables it to classify information independently and detect anomalies without needing to be taught about past threats. Unsupervised learning can continuously learn about an environment and adapt in real time.
One key distinction between supervised and unsupervised machine learning is that supervised learning algorithms require periodic updating and re-training, whereas unsupervised machine learning trains itself while it works.
The question of trust
Even as AI moves into the mainstream, security professionals are eyeing it with a mix of enthusiasm and caution. Although 89% say they have good visibility into the reasoning behind AI-generated outputs, 74% are limiting AI’s ability to take autonomous action in their SOC until explainability improves. 86% do not allow AI to take even small remediation actions without human oversight.
This model, commonly known as “human in the loop,” is currently the norm across the industry. It seems like a best-of-both-worlds approach that allows teams to experience the benefits of AI-accelerated response without relinquishing control – or needing to trust an AI system.
Keeping humans somewhat in the loop is essential for getting the best out of AI. Analysts will always need to review alerts, make judgement calls, and set guardrails for AI's behavior. Their input helps AI models better understand what “normal” looks like, improving their accuracy over time.
However, relying on human confirmation has real costs – it delays response, increases the cognitive burden analysts must bear, and creates potential coverage gaps when security teams are overwhelmed or unavailable. The traditional model, in which humans monitor and act on every alert, is no longer workable at scale.
If organizations depend too heavily on in-the-loop humans, they risk recreating the very problem AI is meant to solve: backlogs of alerts waiting for analyst review. Removing the human from the loop can buy back valuable time, which analysts can then invest in building a proactive security posture. They can also focus more closely on the most critical incidents, where human attention is truly needed.
Allowing AI to operate autonomously requires trust in its decision-making. This trust can be built gradually over time, with autonomous operations expanding as trust grows. But it also requires knowledge and understanding of AI — what it is, how it works, and how best to deploy it at enterprise scale.
Looking for help in all the right places
To gain access to these capabilities in a way that’s efficient and scalable, growing numbers of security leaders are looking for outsourced support. In fact, 85% of security professionals prefer to obtain new SOC capabilities in the form of a managed service.
This makes sense: Managed Security Service Providers (MSSPs) can deliver deep, continuously available expertise without the cost and complexity of building an in-house team. Outsourcing also allows organizations to scale security coverage up or down as needs change, stay current with evolving threats and regulatory requirements, and leverage AI-native detection and response without needing to manage the AI tools themselves.
Preferences for MSSP-delivered security operations are particularly strong in the education, energy (87%), and healthcare sectors. This makes sense: all are high-value targets for threat actors, and all tend to have limited cybersecurity budgets, so the need for a partner who can deliver affordable access to expertise at scale is strong. Retailers also voiced a strong preference for MSSP-delivered services. These companies are tasked with managing large volumes of consumer personal and financial data, and with transforming an industry traditionally thought of as a late adopter to a vanguard of cyber defense. Technology companies, too, have a marked preference for SOC capabilities delivered by MSSPs. This may simply be because they understand the complexity of the threat landscape – and the advantages of specialized expertise — so well.
In order to help as many organizations as possible – from major enterprises to small and midmarket companies – benefit from enterprise-grade, AI-native security, Darktrace is making it easier for MSSPs to deliver its technology. The ActiveAI Security Portal introduces an alert dashboard designed to increase the speed and efficiency of alert triage, while a new AI-powered managed email security solution is giving MSSPs an edge in the never-ending fight against advanced phishing attacks – helping partners as well as organizations succeed on the frontlines of cyber defense.
Explore the full State of AI Cybersecurity 2026 report for deeper insights into how security leaders are responding to AI-driven risks.
When Open Source Is Weaponized: Analysis of a Trojanized 7 Zip Installer
Background of the malicious 7-Zip installer, and assessing its Impact
Early in 2026, external researchers disclosed a malicious distribution campaign leveraging a trojanized installer masquerading itself as a legitimate 7‑Zip utility. Evidence suggests the campaign was active as of January 2026, during which victims were served a fake installer from 7zip[.]com, a highly convincing typo-squatted domain impersonating the official 7‑Zip distribution site (7-zip[.]org).
Initial access is typically achieved through social engineering and search‑engine abuse, including YouTube tutorial content that explicitly referenced the impersonated domain as the download source. Notably, several reports observed the installer delivered a modified but functional build of 7‑Zip (7zfm.exe) to reduce suspicion and preserve expected user behavior.
However, the installer also dropped additional payloads, such as Uphero.exe, hero.exe, and hero.dll, which are not part of the legitimate 7‑Zip software package. Once installed and executed, these payloads allow the attacker to establish persistence and configure the infected host as a proxy node under their control. This facilitates malicious activities such as traffic relaying, anonymizing infrastructure, and the delivery of secondary payloads [1] [2].
Overall, this attack illustrates a proxyware-style attack that abuses implicit trust in widely deployed third‑party tools while exploiting unconventional delivery vectors such as instructional media. By closely imitating legitimate software behavior and branding, the threat actors significantly reduced user suspicion and increased the likelihood of widespread, undetected compromise.
Threat overview
Darktrace observed multiple customers affected by the malicious 7‑Zip installer between January 12 and January 22, impacting organizations across the Americas (AMS), Asia‑Pacific & Japan (APJ), and Europe, the Middle East, and Africa (EMEA) regions. The activity targeted customers across various sectors, including Human health and social work activities, Manufacturing, Education, and Information and communication.
The following use case highlights a device on one customer network making external connections associated with malicious 7-Zip update activity observed between January 7 and January 18, 2026. This behavior included connectivity to the malicious domain 7zip[.]com, followed by command-and control (C2) activity involving "smshero"-themed domains, as well as outbound proxy connections over ports 1000 and 1002.
Initial Connectivity to 'update[.]7zip[.]com':
Figure 1: Initial Beaconing to Young Endpoint alert behavior, involving the known tunnel/proxy endpoint ‘79.127.221[.]47’.
Starting on January 7, Darktrace / NETWORK detected the device making repeated beaconing connections to the endpoint 79.127.221[.]47 over the destination port 1000. The use of this port aligns with open-source intelligence (OSINT) reporting that hero[.]exe establishes outbound proxy connections via non-standard ports such as 1000 and 1002 [1].
Figure 2: Darktrace observed TLS beaconing alerts to the known trojanized installer, update[.]7zip[.]com · 98.96.229[.]19, over port 443 on January 7th.
Later the same day, the device initiated TLS beaconing to the endpoint update.7zip[.]com. This is more than likely a common source of compromise, where victims unknowingly installed a modified build of the tool alongside additional malicious components. The campaign then progressed into the next attack phase, marked by established connectivity to various C2 domains.
Beaconing Activity to "smshero"-themed domains
Darktrace subsequently observed the same infected device connecting to various C2 domains used to retrieve configuration data. As such, these external hostnames were themed around the string “smshero”, for example ‘smshero[.]co’.
Figure 3: On January 8th, Darktrace observed SSL beaconing to a rare destination which was attributed to a known ‘config/control domain’, nova[.]smshero[.]ai.
The following day, on January 8, the device exhibited its first connectivity to a "smshero"-themed endpoint, which has since been identified as being associated with rotating C2 servers [1] [3]. Similar beaconing activity continued over the following days, with Darktrace identifying C2 connectivity to update[.]7zip[.]com over port 443, alongside additional connections to “smshero”‑themed endpoints such as zest.hero-sms[.]ai, flux.smshero[.]cc, and glide.smshero[.]cc between January 9 and January 15.
Figure 4: Darktrace later observed continued beaconing alerts over a 4-day interval to additional rare destinations attributed to a known ‘config/control domain’, zest[.]hero-sms[.]ai & glide[.]smshero[.]cc.
Proxied connectivity over destination ports
The primary objective of this campaign is believed to be proxyware, whereby third-party traffic is routed through victim devices to potentially obfuscate malicious activity. Devices were also observed communicating with rare external IPs hosted on Cloudflare and DataCamp Limited ASNs, establishing outbound proxy connections over the non-standard ports 1000 and 1002 [1].
OSINT sources also indicate that connections over these ports leveraged an XOR-encoded protocol (key 0x70) designed to obscure control messages. While the end goal of the campaign remains unclear, residential proxy networks can be abused to evade security rules and facilitate further unauthorized activities, including phishing and malware distribution [1][3].
Specifically, on January 8, Darktrace observed the device engaging in low-and-slow data exfiltration to the IP 79.127.221[.]47, which had first been observed the previous day, over port 1000. Proxyware typically installs an agent that routes third‑party traffic through an end-user’s device, effectively turning it into a residential proxy exit node. This activity likely represents the system actively communicating outbound data to an entity that controls its behavior.
Figure 5: Darktrace later observed a ‘Low and Slow Exfiltration to IP’ alert, involving the known tunnel/proxy endpoint ‘79.127.221[.]47’.
Similar activity continued between January 10 and January 18, with Darktrace detecting threat actors attempting to exfiltrate significant volumes of data to 79.127.221[.]47 over destination port 1000.
Throughout the course of this incident, Darktrace’s Cyber AI Analyst launched several autonomous investigations, analyzing each anomalous event and ultimately painting a detailed picture of the attack timeline. These investigations correlated multiple incidents based on Darktrace detections observed between January 7 and January 19. Cyber AI Analyst identified anomalous variables such as repeated connections to unusual endpoints involving data uploads and downloads, with particular emphasis on HTTP and SSL connectivity.
Figure 6: Darktrace AI Analyst Coverage, showcasing multiple incident events that occurred on January 7th & 8th, highlighting associated malicious 7-zip behaviors.
Figure 7: Darktrace AI Analyst Endpoint Details from the given ‘Unusual Repeated Connections’ Incident Event, including the known tunnel/proxy endpoint.
Figure 8: Darktrace AI Analyst Coverage, showcasing additional incident events that occurred on January 12th through 18th, highlighting malicious 7-zip behaviors and SSL connectivity.
Darktrace’s Autonomous Response
At several stages throughout the attack, Darktrace implemented Autonomous Response actions to help contain the suspicious activity as soon as it was identified, providing the customer’s security team with additional time to investigate and remediate. Between January 7 and January 18, Darktrace blocked a wide range of malicious activity, including beaconing connections to unusual endpoints, small data exfiltration attempts, and larger egress efforts, ultimately preventing the attacker from progressing through multiple stages of the attack or achieving their objectives.
Figure 9: Darktrace Autonomous Response Action Coverage showcasing connection block connection events including various endpoints that occurred on January 7th.
Figure 10: Darktrace Antigena (Autonomous Response) Model Alert Coverage, showcasing a Antigena Suspicious Activity Block alert occurred on January 10th as a result of the Low and Slow Exfiltration to IP model alert.
Figure 11: Additional Darktrace Antigena (Autonomous Response) Model Alert Coverage, showcasing a Antigena Large Data Volume Outbound Block alert occurred on January 18th as a result of the Uncommon 1 GiB Outbound model alert.
Conclusion
The malicious 7‑Zip installer underscores how attackers continue to weaponize trust in widely used, legitimate software to gain initial access while evading user suspicion. By exploiting familiar and commonly installed services, this type of attack demonstrates that even routine actions, such as installing compression software, can become high‑risk events when defenses or user awareness are insufficient.
This campaign further emphasizes the urgent need for strict software validation and continuous network monitoring. Modern threats no longer rely solely on obscure tools or overtly malicious behavior. Instead, they increasingly blend seamlessly into everyday operations, making detection more challenging.
In this case, Darktrace / NETWORK was able to identify the anomalous activity and Autonomous Response actions in a timely manner, enabling the customer to be quickly notified and providing crucial additional time to investigate further.
In summary, the abuse of a trojanized 7‑Zip installer highlights a concerning shift in modern threat tactics, where trusted and widely deployed tools can serve as primary delivery mechanisms for system compromise. This reality reinforces that proactive detection, continuous monitoring, and strong security awareness are not optional but essential.
Credit to Justin Torres, Senior Cyber Analyst, David Moreira da Silva, Cyber Analyst, Emma Foulger, Global Threat Research Operations Lead.
![Initial Beaconing to Young Endpoint alert behavior, involving the known tunnel/proxy endpoint ‘79.127.221[.]47’.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a0b527a7ecc78423d4fdbc6_Screenshot%202026-05-18%20at%2010.55.03%E2%80%AFAM.png)
![Darktrace observed TLS beaconing alerts to the known trojanized installer, update[.]7zip[.]com · 98.96.229[.]19, over port 443 on January 7th.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a0b529557224d073e49becd_Screenshot%202026-05-18%20at%2010.55.29%E2%80%AFAM.png)
![On January 8th, Darktrace observed SSL beaconing to a rare destination which was attributed to a known ‘config/control domain’, nova[.]smshero[.]ai.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a0b52ca6bdc2e2e6451446a_Screenshot%202026-05-18%20at%2010.56.22%E2%80%AFAM.png)
![Darktrace later observed continued beaconing alerts over a 4-day interval to additional rare destinations attributed to a known ‘config/control domain’, zest[.]hero-sms[.]ai & glide[.]smshero[.]cc.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a0b52eed2e7185a03c382e7_Screenshot%202026-05-18%20at%2010.56.59%E2%80%AFAM.png)
