September 21, 2023

How Darktrace Detected Black Basta Ransomware

Discover how Darktrace uncovered Black Basta ransomware. Learn about its tactics, techniques, and how to protect your network from this threat.

Written by

Matthew John

Director of Operations, SOC

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Matthew John

Director of Operations, SOC

Sep 2023

What is Black Basta?

Over the past year, security researchers have been tracking a new ransomware group, known as Black Basta, that has been observed targeted organizations worldwide to deploy double extortion ransomware attacks since early 2022. While the strain and group are purportedly new, evidence seen suggests they are an offshoot of the Conti ransomware group [1].

The group behind Black Basta run a Ransomware as a Service (RaaS) model. They work with initial access brokers who will typically already have a foothold in company infrastructure to begin their attacks. Once inside a network, they then pivot internally using numerous tools to further their attack.

Black Basta Ransomware

Like many other ransomware actors, Black Basta uses double extortion as part of its modus operandi, exfiltrating sensitive company data and using the publication of this as a second threat to affected companies. This is also advertised on a dark web site, setup by the group to apply further pressure for affected companies to make ransom payments and avoid reputational damage.

The group also seems to regularly take advantage of existing tools to undertake the earlier stages of their attacks. Notably, the Qakbot banking trojan, seems to be the malware often used to gain an initial foothold within compromised environments.

Analysis of the tools, procedures and infrastructure used by Black Basta belies a maturity to the actors behind the ransomware. Their models and practices suggest those involved are experienced individuals, and security researchers have drawn possible links to the Conti ransomware group.

As such, Black Basta is a particular concern for security teams as attacks will likely be more sophisticated, with attackers more patient and able to lie low on digital estates for longer, waiting for the opportune moment to strike.

Cyber security is an infinite game where defender and attacker are stuck as cat and mouse; as new attacks evolve, security vendors and teams respond to the new indicators of compromise (IoCs), and update their existing rulesets and lists. As a result, attackers are forced to change their stripes to evade detection or sometimes even readjust their targets and end goals.

Anomaly Based Detection

By using the power of Darktrace’s Self-Learning AI, security teams are able to detect deviations in behavior. Threat actors need to move through the kill chain to achieve their aims, and in doing so will cause affected devices within networks to deviate from their expected pattern of life. Darktrace’s anomaly-based approach to threat detection allows it recognize these subtle deviations that indicate the presence of an attacker, and stop them in their tracks.

Additionally, the ecosystem of cyber criminals has matured in the last few decades. It is well documented how many groups now operate akin to legitimate companies, with structure, departments and governance. As such, while new attack methods and tactics do appear in the wild, the maturity in their business models belie the experience of those behind the attack.

As attackers grow their business models and develop their arsenal of attack vectors, it becomes even more critical for security teams to remain vigilant to anomalies within networks, and remain agnostic to underlying IoCs and instead adopt anomaly detection tools able to identify tactics, techniques, and procedures (TTPs) that indicate attackers may be moving through a network, ahead of deployment of ransomware and data encryption.

Darktrace’s Coverage of Black Basta

In April 2023, the Darktrace Security Operations Center (SOC) assisted a customer in triaging and responding to an ongoing ransomware infection on their network. On a Saturday, the customer reached out directly to the Darktrace analyst team via the Ask the Expert service for support after they observed encrypted files and locked administrative accounts on their network. The analyst team were able to investigate and clarify the attack path, identifying affected devices and assisting the customer with their remediation. Darktrace DETECT™ observed varying IoCs and TTPs throughout the course of this attack’s kill chain; subsequent analysis into these indicators revealed this had likely been a case of Black Basta seen in the wild.

Initial Intrusion

The methods used by the group to gain an initial foothold in environments varies – sometimes using phishing, sometimes gaining access through a common vulnerability exposed to the internet. Black Basta actors appear to target specific organizations, as opposed to some groups who aim to hit multiple at once in a more opportunistic fashion.

In the case of the Darktrace customer likely affected by Black Basta, it is probable that the initial intrusion was out of scope. It may be that the path was via a phishing email containing an Microsoft Excel spreadsheet that launches malicious powershell commands; a noted technique for Black Basta. [3][4] Alternatively, the group may have worked with access brokers who already had a foothold within the customer’s network.

One particular device on the network was observed acting anomalously and was possibly the first to be infected. The device attempted to connect to multiple internal devices over SMB, and connected to a server that was later found to be compromised and is described throughout the course of this blog. During this connection, it wrote a file over SMB, “syncro.exe”, which is possibly a legitimate Remote Management software but could in theory be used to spread an infection laterally. Use of this tool otherwise appears sporadic for the network, and was notably unusual for the environment.

Given these timings, it is possible this activity is related to the likely Black Basta compromise. However, there is some evidence online that use of Syncro has been seen installed as part of the execution of loaders such as Batloader, potentially indicating a separate or concurrent attack [5].

Internal Reconnaissance + Lateral Movement

However the attackers gained access in this instance, the first suspicious activity observed by Darktrace originated from an infected server. The attacker used their foothold in the device to perform internal reconnaissance, enumerating large portions of the network. Darktrace DETECT’s anomaly detection noted a distinct rise in connections to a large number of subnets, particularly to closed ports associated with native Windows services, including:

135 (RPC)
139 (NetBIOS)
445 (SMB)
3389 (RDP)

During the enumeration, SMB connections were observed during which suspiciously named executable files were written:

delete.me
covet.me

Data Staging and Exfiltration

Around 4 hours after the scanning activity, the attackers used their knowledge gained during enumeration about the environment to begin gathering and staging data for their double extortion attempts. Darktrace observed the same infected server connecting to a file storage server, and downloading over 300 GiB of data. Darktrace DETECT identified that the connections had been made via SMB and was able to present a list of filenames to the customer, allowing their security team to determine the data that had likely been exposed to the attackers.

The SMB paths detected by Darktrace showed a range of departments’ file areas being accessed by threat actors. This suggests they were interested in getting as much varied data as possible, presumably in an attempt to ensure a large amount of valuable information was at their disposal to make any threats of releasing them more credible, and more damaging to the company.

Shortly after the download, the device made an external connection over SSH to a rare domain, dataspt[.]com, hosted in the United States. The connection itself was made over an unusual port, 2022, and Darktrace recognized that the domain was new for the network.

During this upload, the threat actors uploaded a similar volume of data to the 300GiB that had been downloaded internally earlier. Darktrace flagged the usual elements of this external upload, making the identification and triage of this exfiltration attempt easier for the customer.

On top of this, Darktrace’s autonomous investigation tool Cyber AI Analyst™ launched an investigation into this on-going activity and was able to link the external upload events to the internal download, identifying them as one exfiltration incident rather than two isolated events. AI Analyst then provided a detailed summary of the activity detected, further speeding up the identification of affected files.

Preparing for Exploitation

All the activity documented so far had occurred on a Wednesday evening. It was at this point that the burst of activity calmed, and the ransomware lay in wait within the environment. Other devices around the network, particularly those connected to by the original infected server and a domain controller, were observed performing some elements of anomalous activity, but the attack seemed to largely take a pause.

However, on the Saturday morning, 3 days later, the compromised server began to change the way it communicated with attackers by reaching out to a new command and control (C2) endpoint. It seemed that attackers were gearing up for their attack, taking advantage of the weekend to strike while security teams often run with a reduced staffing.

Darktrace identified connections to a new endpoint within 4 minutes of it first being seen on the customer’s environment. The server had begun making repeated SSL connections to the new external endpoint, faceappinc[.]com, which has been flagged as malicious by various open-source intelligence (OSINT) sources.

The observed JA3 hash (d0ec4b50a944b182fc10ff51f883ccf7) suggests that the command-line tool BITS Admin was being used to launch these connections, another suggestion of the use of mature tooling.

In addition to this, Darktrace also detected the server using an administrative credential it had never previously been associated with. Darktrace recognized that the use of this credential represented a deviation from the device’s usual activity and thus could be indicative of compromise.

The server then proceeded to use the new credential to authenticate over Keberos before writing a malicious file (“management.exe”) to the Temp directory on a number of internal devices.

Encryption

At this point, the number of anomalous activities detected from the server increased massively as the attacker seems to connect networkwide in an attempt to cause as quick and destructive an encryption effort as possible. Darktrace observed numerous files that had been encrypted by a local process. The compromised server began to write ransom notes, named “instructions_read_me.txt” to other file servers, which presumably also had successfully deployed payloads. While Black Basta actors had initially been observed dropping ransom notes named “readme.txt”, security researchers have since observed and reported an updated variant of the ransomware that drops “instructions_read_me_.txt”, the name of the file detected by Darktrace, instead [6].

Another server was also observed making repeated SSL connections to the same rare external endpoint, faceappinc[.]com. Shortly after beginning these connections, the device made an HTTP connection to a rare IP address with no hostname, 212.118.55[.]211. During this connection, the device also downloaded a suspicious executable file, cal[.]linux. OSINT research linked the hash of this file to a Black Basta Executable and Linkable File (ELF) variant, indicating that the group was highly likely behind this ransomware attack.

Of particular interest again, is how the attacker lives off the land, utilizing pre-installed Windows services. Darktrace flagged that the server was observed using PsExec, a remote management executable, on multiple devices.

Darktrace Assistance

Darktrace DETECT was able to clearly detect and provide visibility over all stages of the ransomware attack, alerting the customer with multiple model breaches and AI Analyst investigation(s) and highlighting suspicious activity throughout the course of the attack.

For example, the exfiltration of sensitive data was flagged for a number of anomalous features of the meta-data: volume; rarity of the endpoint; port and protocol used.

In total, the portion of the attack observed by Darktrace lasted about 4 days from the first model breach until the ransomware was deployed. In particular, the encryption itself was initiated on a Saturday.

The encryption event itself was initiated on a Saturday, which is not uncommon as threat actors tend to launch their destructive attacks when they expect security teams will be at their lowest capacity. The Darktrace SOC team regularly observes and assists in customer’s in the face of ransomware actors who patiently lie in wait. Attackers often choose to strike as security teams run on reduced hours of manpower, sometimes even choosing to deploy ahead of longer breaks for national or public holidays, for example.

In this case, the customer contacted Darktrace directly through the Ask the Expert (ATE) service. ATE offers customers around the clock access to Darktrace’s team of expert analysts. Customers who subscribe to ATE are able to send queries directly to the analyst team if they are in need of assistance in the face of suspicious network activity or emerging attacks.

In this example, Darktrace’s team of expert analysts worked in tandem with Cyber AI Analyst to investigate the ongoing compromise, ensuring that the investigation and response process were completed as quickly and efficiently as possible.

Thanks to Darktrace’s Self-Learning AI, the analyst team were able to quickly produce a detailed report enumerating the timeline of events. By combining the human expertise of the analyst team and the machine learning capabilities of AI Analyst, Darktrace was able to quickly identify anomalous activity being performed and the affected devices. AI Analyst was then able to collate and present this information into a comprehensive and digestible report for the customer to consult.

Conclusion

It is likely that this ransomware attack was undertaken by the Black Basta group, or at least using tools related to their method. Although Black Basta itself is a relatively novel ransomware strain, there is a maturity and sophistication to its tactics. This indicates that this new group are actually experienced threat actors, with evidence pointing towards it being an offshoot of Conti.

The Pyramid of Pain is a well trodden model in cyber security, but it can help us understand the various features of an attack. Indicators like static C2 destinations or file hashes can easily be changed, but it’s the underlying TTPs that remain the same between attacks.

In this case, the attackers used living off the land techniques, making use of tools such as BITSAdmin, as well as using tried and tested malware such as Qakbot. While the domains and IPs involved will change, the way these malware interact and move about systems remains the same. Their fingerprint therefore causes very similar anomalies in network traffic, and this is where the strength of Darktrace lies.

Darktrace’s anomaly-based approach to threat detection means that these new attack types are quickly drawn out of the noise of everyday traffic within an environment. Once attackers have gained a foothold in a network, they will have to cause deviation from the usual pattern of a life on a network to proceed; Darktrace is uniquely placed to detect even the most subtle changes in a device’s behavior that could be indicative of an emerging threat.

Machine learning can act as a force multiplier for security teams. Working hand in hand with the Darktrace SOC, the customer was able to generate cohesive and comprehensive reporting on the attack path within days. This would be a feat for humans alone, requiring significant resources and time, but with the power of Darktrace’s Self-Learning AI, these deep and complex analyses become as easy as the click of a button.

Credit to: Matthew John, Director of Operations, SOC, Paul Jennings, Principal Analyst Consultant

Get the latest insights on emerging cyber threats

Attackers are adapting, are you ready? This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.

Identity-based attacks: How attackers are bypassing traditional defenses
Zero-day exploitation: The rise of previously unknown vulnerabilities
AI-driven threats: How adversaries are leveraging AI to outmaneuver security controls

Stay ahead of evolving threats with expert analysis from Darktrace. Download the report here.

‍

Appendices

Darktrace DETECT Model Breaches

Internal Reconnaissance

Device / Multiple Lateral Movement Model Breaches

Device / Large Number of Model Breaches

Device / Network Scan

Device / Anomalous RDP Followed by Multiple Model Breaches

Device / Possible SMB/NTLM Reconnaissance

Device / SMB Lateral Movement

Anomalous Connection / SMB Enumeration

Anomalous Connection / Possible Share Enumeration Activity

Device / Suspicious SMB Scanning Activity

Device / RDP Scan

Anomalous Connection / Active Remote Desktop Tunnel

Device / Increase in New RPC Services

Device / ICMP Address Scan

Download and Upload

Unusual Activity / Enhanced Unusual External Data Transfer

Unusual Activity / Unusual External Data Transfer

Anomalous Connection / Uncommon 1 GiB Outbound

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / Download and Upload

Compliance / SSH to Rare External Destination

Anomalous Server Activity / Rare External from Server

Anomalous Server Activity / Outgoing from Server

Anomalous Connection / Application Protocol on Uncommon Port

Anomalous Connection / Multiple Connections to New External TCP Port

Device / Anomalous SMB Followed By Multiple Model Breaches

Unusual Activity / SMB Access Failures

Lateral Movement and Encryption

User / New Admin Credentials on Server

Compliance / SMB Drive Write

Device / Anomalous RDP Followed By Multiple Model Breaches

Anomalous Connection / High Volume of New or Uncommon Service Control

Anomalous Connection / New or Uncommon Service Control

Device / New or Unusual Remote Command Execution

Anomalous Connection / SMB Enumeration

Additional Beaconing and Tooling

Device / Initial Breach Chain Compromise

Device / Multiple C2 Model Breaches

Compromise / Large Number of Suspicious Failed Connections

Compromise / Sustained SSL or HTTP Increase

Compromise / SSL or HTTP Beacon

Compromise / Suspicious Beaconing Behavior

Compromise / Large Number of Suspicious Successful Connections

Compromise / High Volume of Connections with Beacon Score

Compromise / Slow Beaconing Activity To External Rare

Compromise / SSL Beaconing to Rare Destination

Compromise / Beaconing Activity To External Rare

Compromise / Beacon to Young Endpoint

Compromise / Agent Beacon to New Endpoint

Anomalous Server Activity / Rare External from Server

Anomalous Connection / Multiple Failed Connections to Rare Endpoint

Anomalous File / EXE from Rare External Location

IoC - Type - Description + Confidence

dataspt[.]com - Hostname - Highly Likely Exfiltration Server

46.22.211[.]151:2022 - IP Address and Unusual Port - Highly Likely Exfiltration Server

faceappinc[.]com - Hostname - Likely C2 Infrastructure

Instructions_read_me.txt - Filename - Almost Certain Ransom Note

212.118.55[.]211 - IP Address - Likely C2 Infrastructure

delete[.]me - Filename - Potential lateral movement script

covet[.]me - Filename - Potential lateral movement script

d0ec4b50a944b182fc10ff51f883ccf7 - JA3 Client Fingerprint - Potential Windows BITS C2 Process

/download/cal.linux - URI - Likely BlackBasta executable file

1f4dcfa562f218fcd793c1c384c3006e460213a8 - Sha1 File Hash - Likely BlackBasta executable file

References

[1] https://blogs.blackberry.com/en/2022/05/black-basta-rebrand-of-conti-or-something-new

[2] https://www.cybereason.com/blog/threat-alert-aggressive-qakbot-campaign-and-the-black-basta-ransomware-group-targeting-u.s.-companies

[3] https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html

[4] https://unit42.paloaltonetworks.com/atoms/blackbasta-ransomware/

[5] https://www.trendmicro.com/en_gb/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html

[6] https://www.pcrisk.com/removal-guides/23666-black-basta-ransomware

Written by

Matthew John

Director of Operations, SOC

Inside the SOC

Written by

Matthew John

Director of Operations, SOC

•

August 3, 2026

Nathaniel Jones

SVP, Global Threat Intelligence

•

August 4, 2026

The Darktrace Community

Watch the NIS2 Webinar

Blog

AI

August 4, 2026

Extending AI Security Visibility with Darktrace and Microsoft Agent 365

AI agents are rapidly becoming embedded in everyday business operations, helping employees automate workflows, access information, and accelerate decision-making. As organizations embrace agentic AI, security teams face a growing challenge: understanding how AI is being used, what agents can access, and where risk may emerge.

As agents take on more business-critical work, security teams often need to move across multiple portals to understand risks spanning identity, data, and threat activity. This fragmented view can make it difficult to assess an agent's overall risk posture and determine where attention is needed. Organizations need a way to bring these signals together without disrupting existing security investments or workflows.

Today, Darktrace is announcing an integration between Darktrace / SECURE AI and Microsoft Agent 365 that brings Darktrace's Adaptive AI-driven risk signals directly into the Microsoft 365 Admin Center. By extending the visibility and risk understanding provided by Darktrace / SECURE AI into the Microsoft ecosystem, organizations can gain a more unified understanding of AI agent risk across their environments.

As one of the first security companies to partner with Microsoft to contribute third-party risk signals to the Agent Registry, Darktrace is helping shape how organizations understand and manage AI agent risk.

Extending visibility into the Microsoft Agent 365 experience

Microsoft Agent 365 provides administrators with a centralized registry of AI agents operating within their environment. As organizations expand their use of AI agents, this centralized visibility becomes increasingly important for governance and oversight.

This new integration extends that visibility by allowing Darktrace-generated risk signals to be surfaced directly within the Microsoft Agent 365 experience. By combining Microsoft's agent management and security capabilities with Darktrace's AI-powered risk analysis, organizations gain greater awareness of potential security concerns associated with AI agents operating across their environments.

By integrating Darktrace telemetry into Agent 365, customers can:

Surface Darktrace-detected risks and signals alongside Microsoft-native signals in a single interface

Identify potentially compromised or anomalous AI agents more quickly

Gain unified understanding of context and agent behavior

This approach reinforces a single control plane for AI security while allowing organizations to continue leveraging existing investments across both platforms.

Why unified visibility of AI agent risk signals matters

As AI adoption accelerates across Microsoft environments, organizations must manage new forms of behavior, access patterns, and risk. Security teams need more than inventories and permissions. They need visibility into how AI systems operate and how risk evolves over time.

This integration addresses a critical gap: how to bring behavioral AI security insights into the same control plane as identity, access, and agent management.

With Darktrace and Microsoft Agent 365 together, organizations benefit from:

Unified visibility: A single pane of glass for understanding AI agent risk signals across Microsoft and Darktrace signals

Faster detection of abnormal agent behavior: Darktrace's Adaptive AI highlights deviations that may not be captured by static controls

Operational efficiency: Security teams can triage and prioritize risk signals without switching between systems

Stronger trust in AI deployments: Clear attribution, context, and investigation pathways improve confidence in AI agent usage

Extending Microsoft's AI security model, not replacing it

Securing AI requires a layered approach that combines governance, visibility, threat detection, and risk management. This integration is designed to complement Microsoft's security capabilities, not duplicate them.

Through Darktrace / SECURE AI, Darktrace contributes:

Identification of risk via advanced prompt analysis

Behavioral anomaly detection across AI agents

Cross-environment threat correlation

Autonomous insight into emerging or unknown risks

Microsoft provides:

Centralized agent management

Identity and access governance

Native detection of risk signals and enforcement capabilities

Together, these capabilities create a more complete, layered approach to securing AI-driven enterprises. Organizations gain the governance and policy controls needed to manage AI adoption while benefiting from continuous visibility into how AI is used across the business.

Building the future of secure AI

As AI agents become more deeply embedded in business processes, organizations need more than inventories and static controls. They need to understand how AI is being used, how agents behave, and where risk is emerging across the enterprise.

Darktrace / SECURE AI delivers that understanding through continuous visibility into AI activity, helping security teams assess intent, identify behavioral drift, and uncover emerging risk across both human and agent-driven workflows. Powered by Adaptive AI, it provides the context needed to secure AI as it evolves.

The integration with Microsoft Agent 365 extends those insights into the workflows organizations already use. Agent 365 provides a unified control plane for governing and securing AI agents, while Darktrace contributes complementary behavioral risk signals that can be surfaced within the Agent 365 experience. Together, they give customers broader context on agent activity and risk while preserving the value of their existing Microsoft and Darktrace investments.

As enterprises move from AI experimentation to AI-powered execution, Microsoft and Darktrace help bring together governance, compliance, behavioral understanding, and oversight in a unified approach to AI security. For organizations adopting Microsoft 365 E7, Darktrace / SECURE AI further strengthens that foundation by providing continuous visibility into AI activity, agent behavior, and emerging risk as AI adoption scales.

About the author

The Darktrace Community

Blog

AI

August 3, 2026

Why Trust is the New Attack Surface: Darktrace’s Mid-Year Threat Update 2026

In early 2026, a React2Shell honeypot purpose-built by Darktrace analysts was compromised in less than two hours after deployment. That single data point captures the pace of the threat landscape in the first half of 2026, but speed tells only part of the story.

The shift over the past six months has moved away from traditional malware and vulnerability-centric attacks and toward the abuse of trusted identities, platforms, and infrastructure. Identities, Software-as-a-Service (SaaS) platforms, cloud entitlements, automation frameworks, and non-human identities have become the preferred attack paths as organizations adopt AI at scale.

Attackers are increasingly operating inside the relationships, services, and authenticated channels that defenders and users are conditioned to rely on, rather than breaking in from the outside.

What has changed since 2025?

In 2025, identity became the new perimeter as attackers increasingly bypassed traditional exploitation in favor of trusted accounts, SaaS platforms, and emerging AI-enabled tradecraft. The first half of 2026 marks the next stage of that evolution. Identity remains central, but the trust challenge now extends far beyond accounts to email authentication, cloud entitlements, software supply chains, AI gateways, remote administration tooling, and non-human identities.

Theme	2025 (Mid-Year / Annual)	H1 2026
Identity	Credentials remained the weak link; identity emerged as the new perimeter.	Identity remains the entry point, but trust has become the new attack surface.
Cloud & SaaS	SaaS-targeted ransomware continued to rise.	Cloud and SaaS became the attacker's preferred operating environment.
AI	Large Language Models (LLMs) were suspected of influencing phishing shifts.	LLM-generated malware, compromised AI proxies, and the abuse of AI identities emerged.
Attack Surface Scale & Speed	Exponential growth of Common Vulnerabilities and Exposures (CVEs), with public proof-of-concepts appearing faster.	Cloud and AI adoption expanded the attack surface, while AI accelerated exploitation. One honeypot was compromised in under two hours.
Supply Chain	Legitimate services were increasingly abused.	Trusted maintainers and CI/CD workflows were weaponized.

Identity and email: trust signals under pressure

Email remains the most reliable route to a trusted identity, and the data shows attackers investing in quality over noise. In the first half of 2026, 67% of phishing emails passed DMARC. Authentication alone is no longer sufficient to stop most phishing attempts. VIP users were targeted in 25.8% of phishing, consistent with 2025's “over 25%” figure, but drifting upward throughout the period. Crucially, phishing sophistication continued to increase: 37% of phishing contained a high volume of text, up from 32% in the first half of 2025, while 39% featured novel social engineering techniques, suggesting attackers are further customizing to specific targets.

The most prevalent threats affecting Darktrace customers were also among the most identity-centric: information stealers, with dedicated StealC and AMOS campaigns running through the half-year. Their prevalence is, fundamentally, an identity story. Credentials harvested by infostealers often become the initial access vector for far higher-impact intrusions later in the attack chain. Crucially, the delivery method rarely requires exploitation of a technical weakness. ClickFix social engineering, which tricks users into running malicious code themselves, remained a common distribution route. One recent campaign impacted Darktrace customers across 17 countries, with the United States the most affected. The compromise did not begin with a software flaw, but with a trusted user taking a trusted action.

Supply chain: Trust weaponized at scale

March and April reinforced the same lesson: trust has become a supply-chain vulnerability. The Axios compromise abused trust in a widely used maintainer, while the Trivy campaign leveraged trusted CI/CD infrastructure, release artifacts, and container images to push malicious code through legitimate development workflows.

The clearest example was a February–March campaign in which devices downloaded malicious payloads while using Hola VPN, later linked to an issue within Hola's own delivery pipeline. Darktrace's Threat Research team identified associated activity through recurring anomalous behavior across multiple customers before a public advisory was released.

More recently, attackers abused legitimate blockchain infrastructure to distribute infostealers, including AMOS and Phexia. Popular tools like VPNs, often used by users with limited security resources, combined with legitimate command-and-control (C2) infrastructure enables attackers to reach a far wider victim base while frustrating defenders who cannot simply block the associated endpoints.

For defenders, the challenge is no longer identifying malicious infrastructure, but recognizing when trusted infrastructure begins behaving maliciously.

Cloud and SaaS: from target to terrain

Through May and June, activity involving device registration, cloud data theft, SaaS abuse, RDP expansion, and remote management tooling suggested that attackers increasingly view cloud and SaaS not simply as targets, but as their preferred operating environment.

In one Darktrace case a single compromised SaaS account triggered activity across email, SaaS, and network layers, including inbox rule changes, phishing propagation, and connections to suspicious infrastructure. None of these indicators were decisive in isolation, but together they revealed a clear intrusion. Increasingly, attackers do not need to bypass trust controls in these environments; they inherit them through compromised identities, delegated access, and legitimate administration tools. This is the natural progression of 2025's SaaS-targeted ransomware trend: the platforms on which businesses operate are increasingly the same platforms on which adversaries operate.

AI: accelerant, attack surface, and trusted but risky actor

If trust is the attack surface, AI is where that surface is expanding fastest. Across the Darktrace customer base, AI service connections per deployment rose 13% in the first half of 2026, surpassing 16 million connections, while the typical organization now interacts with seven different AI providers. AI is no longer at the edge of the enterprise; it is embedded in day-to-day business operations. That shift creates three distinct problems, all of which were observed by Darktrace in the first half of 2026.

1. AI as an attack multiplier

Darktrace identified AI-generated malware exploiting React2Shell, in which an attacker used an LLM to produce working exploit code and deploy it at scale. Similar activity is increasingly appearing across the wider threat landscape, suggesting that the barrier to effective offensive operations is collapsing. As demonstrated by the recent JadePuffer case, in which an agentic threat actor exploited a vulnerability in an internet-facing server before launching a fully automated ransomware attack, AI is accelerating the path from vulnerability disclosure to operational exploitation [1].

2. AI as an attack surface

The AI layer itself is now worth probing. At an automation technology manufacturer, a compromised LLM proxy was used as a steppingstone toward additional AI services; when that failed, the attacker pivoted to cryptomining. Darktrace’s Cyber AI Analyst pieced the intrusion together and Darktrace’s Managed Threat Detection service alerted the customer, containing it before it could progress further. The practitioner lesson is clear: treat AI gateways, proxies, and model endpoints as production cloud workloads because attackers already do.

3. AI as a trusted but potentially risky actor

Darktrace / SECURE AI observations suggest the most common real-world risk is quieter still: employees entering personal identifiable information (PII), tax records, identity documents, company financial data, HR records, and personal medical data into LLM prompts, alongside widespread shadow AI use and increased AI usage from mobile devices. Across nearly 280,000 prompts submitted by almost 28,000 users over 28 days, Darktrace identified that approximately 1% of these prompts (or 2,945 instances) contained sensitive data*.

_{*Prompt data was analyzed in aggregate and anonymized form to protect user privacy.}

‍

For defenders, the challenge is context: knowing when legitimate business use crosses into material risk without breaking privacy or user trust. As organizations increasingly trust AI systems to access, process, and share sensitive information at machine speed, AI must be secured and monitored alongside identities, applications, and cloud infrastructure.

Speed and geopolitics: faster operations, longer-term objectives

Several investigations in the first half of the year showed how quickly attackers operationalize newly disclosed vulnerabilities, validating exploitation through Out-of-Band Application Security Testing (OAST) infrastructure and trusted cloud services before patching cycles can be completed. React2Shell was compromised in two hours, while BeyondTrust exploitation followed in less than a day. Against this backdrop, state-aligned actors continue to prioritize long-term access, intelligence collection, and pre-positioning through legitimate services, cloud infrastructure, and trusted relationships. Operations linked to China, Russia, Iran, and the Democratic People’s Republic of Korea (DPRK) shared a common characteristic: a focus on persistence and strategic positioning rather than immediate disruption.

China: Darktrace observed Chinese-nexus actors prioritizing long-term access through trusted services, dynamic-link library (DLL) sideloading, and modular intrusion chains consistent with activity documented in Crimson Echo reporting and associated with Twill Typhoon tradecraft.

Iran: Darktrace's ZionSiphon investigation highlighted Iranian-linked interest in operational technology (OT) environments, blending espionage objectives with infrastructure disruption capabilities.

Russia: Darktrace investigations, alongside wider industry reporting, highlighted Russian reliance on trusted relationships and supply-chain targeting for long-term intelligence on Ukraine related support [2].

DPRK: Darktrace observed DPRK-linked activity combining rapid vulnerability weaponization with persistent access techniques, including Axios supply-chain compromise, React2Shell exploitation and stealthy macOS intrusions

While objectives differed across actors, the tradecraft was remarkably consistent: trusted services, legitimate infrastructure, and persistent access remained more valuable than immediate disruption.

The defender shift

Across identity compromise, supply-chain attacks, SaaS abuse, AI infrastructure targeting, and state-aligned operations, attackers increasingly succeed by operating through trusted systems rather than breaking through defensive controls. Trusted users, trusted software, trusted infrastructure, and increasingly trusted AI systems all became viable attack paths.

For defenders, the challenge is no longer simply determining whether an action is allowed; it is determining whether that action makes sense in its wider context. Authentication, reputation, and provenance remain important, but they are no longer sufficient on their own. As attackers increasingly operate within trusted systems, the strongest signal is often a behavioral deviation: identifying when trusted activity no longer aligns with expected behavior.

‍

Credit to Nathaniel Jones (SVP, Global Threat Intelligence), Emma Foulger (Global Threat Research Operations Lead), Justin Torres (Senior Cyber Analyst), Daniel Levy (Threat Hunting Data Scientist)

‍
Edited by Ryan Traill (Content Manager)

‍

Appendix 1: Threat Research Methodology

Darktrace’s Threat Research team conducts extensive research across customer deployments to identify active threats, pinpoint key Indicators of Compromise (IoCs), and provide relevant threat intelligence. This research leverages Darktrace’s anomaly-based detection and involves thorough analysis and contextualization by the Threat Research team. Detected threats are promptly reported to the relevant customer security teams. When a customer has Darktrace’s Autonomous Response technology enabled, these threats are swiftly mitigated to prevent escalation.

Between January 1 and June 30, 2026, Darktrace investigated a wide range of cyber threats across its customer base. Many were identified as campaign-like activities targeting multiple customers, where clusters of similar tactics, techniques, and procedures (TTPs) and IoCs were seen affecting a significant number of customers within a short timeframe.

Statistics related to email are derived from aggregated Darktrace / EMAIL data across all cloud-hosted customer deployments between January 1 and June 30, 2026. Standard data-quality filtering was applied to exclude anomalous observations prior to aggregation. Regional statistics are based on relevant subsets of this dataset.

‍

Appendix 2: Campaigns - Regional and Sector Trends

While the above broad themes defined the threat landscape over the last six months, campaign clustering across the Darktrace customer base revealed how they manifested differently across sectors, regions, and industries.

Darktrace’s Threat Research team investigates a range of threats affecting its customer base. Through this research, campaign-like clusters of activity have been identified, in which common tactics, techniques, and procedures (TTPs), as well as infrastructure, are observed impacting a significant number of customers within a short timeframe.

Sectors and industries are classified using the Standard Industrial Classification (SIC) system to ensure consistent categorization. While the sector and regional insights in this report reflect broader global trends, they are also influenced by the distribution of Darktrace's customer base. For example, Finance, Manufacturing, and Education are strongly represented among Darktrace customers, which may result in a higher number of observed cases in these sectors. This reflects customer distribution rather than necessarily indicating elevated sector-specific risk. Similarly, regional trends may be influenced by the geographic distribution of Darktrace customers.

‍

Analysis of campaign clusters identified by the Darktrace Threat Research team during the first half of 2026 revealed distinct regional trends.

Europe, Middle East & Africa (EMEA) dominated with 60% of all campaign cluster cases targeting this region.
The Americas (AMS) was the next most affected region, with 30% of campaign cluster cases.
The Asia-Pacific and Japan (APJ) region was less affected by campaign clusters, potentially indicating that threat actors placed a lower priority on the region and instead focused their efforts elsewhere.

Sector targeting also varied considerably by region:

In EMEA, the Information and Communication was the most affected by a significant margin, representing 25% of all cases.
In contrast, AMS targeting was more evenly distributed, with the Education, Public administration and defence, and Financial Insurance activities sectors all forming over 20% of AMS regional cases.
Across APJ, campaign activity was spread more equally, with no single sector emerging as a dominant target.

‍

Several countries also stood out within their respective regions:

The United States accounted for 60% of all campaign clusters within AMS.
Japan represented 40% of campaign customer cases across APJ.
In EMEA, the United Kingdom and Zimbabwe each accounted for 23% of identified cases, both being involved in a variety of campaign types.

‍

Inside the SOC & Threat Research 2026 Monthly Progression: From Access to Impact

Month	Dominant Themes
January	Voice phishing, VPS infrastructure, WebSocket C2, RMM abuse, ransomware, infostealers (StealC), and trojanized installers (7-Zip).
February	Voice phishing, VPN intrusion, edge infrastructure compromise (BeyondTrust), and RMM abuse.
March	Sustained supply chain compromise (Hola VPN, Axios, Trivy), malicious browser extensions, phishing, and discovery tools.
April	Account creation abuse, payload delivery, VPN credential abuse, Fortinet exploitation, and botnet activity.
May	PowerShell, EtherHiding, data exfiltration, VPN access, business email compromise (BEC), ClickFix, and infostealers (AMOS).
June	RDP abuse, device registration, RMM usage, voice phishing, cloud data theft, botnet activity, blockchain abuse, ClickFix, and infostealers (AMOS).