Blog
/
/
April 22, 2020

AI-Powered Darktrace Email | Defend Against Phishing Attacks

Protect your organization from phishing attacks with Antigena Email. Learn how Bunim Murray Productions secures against targeted spear phishing emails.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Gabe Cortina
CTO, Bunim/Murray Productions
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
22
Apr 2020

The 2014 Sony hack changed everything. Bunim/Murray, like other entertainment companies, woke up to the new threats targeting our sector – jumpstarting our journey to improve security.

Bunim/Murray is the production company behind a whole host of reality television shows and is well-known for several hit series such as The Real World (MTV), Road Rules (MTV), The Simple Life (E!), Family or Fiancé (OWN), and Starting Over (syndicated). Bunim/Murray Productions infuses its finely-tuned sense of dramatic story structure to turn the ordinary tales of real people into extraordinary television programming and filmed entertainment. When landing as the CTO at Bunim/Murray, protecting our business was – and still is – a fundamental part of the job. With strong support from the CEO and CFO, I embarked on the journey to bolster cyber defense for our organization.

Bunim/Murray has some unique challenges in security: we onboard and offboard many employees, especially in production. We have a lot of BYOD (‘Bring Your Own Device’) users. Our IT staff is lean, and we don’t want to spend a lot of time and money on security resources or services. Instead, we want to focus on improving business processes – preparing our organization to launch capabilities to remain competitive in an industry undergoing transformation.

So, in searching for security tools, we were looking for technologies with the following criteria:

  • User-friendly
  • Able to continously identify and respond to the latest threats
  • Efficient with IT resources – low on false positives and alerts
  • Cost effective

After being called by Darktrace, I invited the team over to see if it made sense for them to participate in a bake-off with other tools we were assessing. At our meeting, the team at Darktrace spoke to me about the AI and machine learning capabilities, its roots in MI5 cyber operations, how it would fit into our ecosystem, and the product roadmap. Traditionally, I’m not one to be easily impressed by words – so I asked to try it out within our own organization. Within a week, we had the technology installed and up and running in our data center.

Darktrace’s Enterprise Immune System technology immediately began to baseline the dynamic ‘pattern of life’ for our business. It was the first time we had seen all the devices on our network, and we were able to drill down into all of the activity on our environment. But, even more impressive, Darktrace’s AI instantly got to work in the background, alerting us when we needed to investigate an in-progress security event in real time. Not only were we impressed with the machine learning capabilities, we were impressed with the level of support and security expertise Darktrace provided – and continues to provide our business. I canceled the bake-off and bought the system.

As we moved forward on our journey, our highest vulnerability became phishing. We subscribed to a company to train our workforce and got excellent results. We then turned on Microsoft Advanced ATP to help filter spam and phishing emails. And when I learned that Darktrace was pioneering a new approach to neutralize phishing attacks, I got on board early.

Using AI to tackle phishing head on

We were one of the first adopters of Antigena Email, and the first release surprised us. Within days, Antigena Email cut down phishing emails like no other tool I had ever seen before in my career. Using AI, Antigena Email learns all of our users’ activity patterns – how they interact and communicate both internally and externally. It creates a comprehensive and evolving understanding of what’s ‘normal’ for all of our users, and from there, identifies significant anomalies indicative of a vulnerability or threat. Once the threat is detected, Antigena Email contains the attack before it can cause damage.

Incredibly, once we started using Antigena Email, we no longer needed to spend time and money training our users on phishing awareness because we simply weren’t seeing phishing emails anymore – Antigena Email was blocking them before they ever reached the user.

We turned off our Microsoft ATP and instead used Darktrace’s plug-in to Office 365 and the Dropbox monitoring feature. These features turned out to be essential as we increased our remote workforce due to COVID-19.

Antigena Email in action: Neutralizing COVID-19 phishing campaigns

We have all seen the hundreds of thousands of COVID-19-related domains that have been created by cyber-attackers looking to launch novel phishing campaigns. By exploiting the emotional vulnerability of the situation, these attackers craft messages that are so convincing to users that they click on these malicious links. It is our unfortunate reality that threat-actors use these types of events to prey on the collective attention of the population.

As I’m sure countless other organizations have also experienced, Bunim/Murray has not been immune to these types of attacks. In fact, just last week, Antigena Email caught several phishing emails purporting to deliver corporate COVID-19 updates. These emails bore a spoofed Bunim/Murray domain, with the subject line ‘COVID-19 Update 7.4.2020’. Fortunately, due to Antigena Email’s granular analysis of what’s normal for our corporate email communication, it was able to detect this spoofed domain and block the emails from ever reaching any of the target users.

It’s exactly this type of situation that demonstrates the power of Antigena Email. Had these emails reached the user, we might have been in a situation where one of our well-intentioned employees clicked on the malicious link in an attempt to get accurate, up-to-date information – not recognizing that it would introduce malware into our environment. But with Antigena Email, we don’t have to worry about our end user behavior because the AI neutralizes it before it even gets to that point.

Technology that evolves as we do

What threats will be coming after COVID-19? I am not sure. But, I am confident that Darktrace’s AI will be on it. With its ability to ingest new and evolving information from its customer base, coupled with its top-notch security resources, we know that Darktrace will be able to continue to monitor, alert, and respond to new threats – even if those threats have never been seen before.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Gabe Cortina
CTO, Bunim/Murray Productions

More in this series

No items found.

Blog

/

Network

/

April 21, 2026

How a Compromised eScan Update Enabled Multi‑Stage Malware and Blockchain C2

multi-stage malwareDefault blog imageDefault blog image

The Rise of supply chain attacks

In recent years, the abuse of trusted software has become increasingly common, with supply chain compromises emerging as one of the fastest growing vectors for cyber intrusions. As highlighted in Darktrace’s Annual Threat Report 2026, attackers and state-actors continue to find significant value in gaining access to networks through compromised trusted links, third-party tools, or legitimate software. In January 2026, a supply chain compromise affecting MicroWorld Technologies’ eScan antivirus product was reported, with malicious updates distributed to customers through the legitimate update infrastructure. This, in turn, resulted in a multi‑stage loader malware being deployed on compromised devices [1][2].

An overview of eScan exploitation

According to eScan’s official threat advisory, unauthorized access to a regional update server resulted in an “incorrect file placed in the update distribution path” [3]. Customers associated with the affected update servers who downloaded the update during a two-hour window on January 20 were impacted, with affected Windows devices subsequently have experiencing various errors related to update functions and notifications [3].

While eScan did not specify which regional update servers were affected by the malicious update, all impacted Darktrace customer environments were located in the Europe, Middle East, and Africa (EMEA) region.

External research reported that a malicious 32-bit executable file , “Reload.exe”, was first installed on affected devices, which then dropped the 64-bit downloader, “CONSCTLX.exe”. This downloader establishes persistence by creating scheduled tasks such as “CorelDefrag”, which are responsible for executing PowerShell scripts. Subsequently, it evades detection by tampering with the Windows HOSTS file and eScan registry to prevent future remote updates intended for remediation. Additional payloads are then downloaded from its command-and-control (C2) server [1].

Darktrace’s Coverage of eScan Exploitation

Initial Access and Blockchain as multi-distributed C2 Infrastructure

On January 20, the same day as the aforementioned two‑hour exploit window, Darktrace observed multiple devices across affected networks downloading .dlz package files from eScan update servers, followed by connections to an anomalous endpoint, vhs.delrosal[.]net, which belongs to the attackers’ C2 infrastructure.

The endpoint contained a self‑signed SSL certificate with the string “O=Internet Widgits Pty Ltd, ST=SomeState, C=AU”, a default placeholder commonly used in SSL/TLS certificates for testing and development environments, as well as in malicious C2 infrastructure [4].

Utilizing a multi‑distributed C2 infrastructure, the attackers also leveraged domains linked with the Solana open‑source blockchain for C2 purposes, namely “.sol”. These domains were human‑readable names that act as aliases for cryptocurrency wallet addresses. As browsers do not natively resolve .sol domains, the Solana Naming System (formerly known as Bonfida, an independent contributor within the Solana ecosystem) provides a proxy service, through endpoints such as sol-domain[.]org, to enable browser access.

Darktrace observed devices connecting to blackice.sol-domain[.]org, indicating that attackers were likely using this proxy to reach a .sol domain for C2 activity. Given this behavior, it is likely that the attackers leveraged .sol domains as a dead drop resolver, a C2 technique in which threat actors host information on a public and legitimate service, such as a blockchain. Additional proxy resolver endpoints, such as sns-resolver.bonfida.workers[.]dev, were also observed.

Solana transactions are transparent, allowing all activity to be viewed publicly. When Darktrace analysts examined the transactions associated with blackice[.]sol, they observed that the earliest records dated November 7, 2025, which coincides with the creation date of the known C2 endpoint vhs[.]delrosal[.]net as shown in WHOIS Lookup information [4][5].

WHOIS Look records of the C2 endpoint vhs[.]delrosal[.]net.
Figure 1: WHOIS Look records of the C2 endpoint vhs[.]delrosal[.]net.
 Earliest observed transaction record for blackice[.]sol on public ledgers.
Figure 2: Earliest observed transaction record for blackice[.]sol on public ledgers.

Subsequent instructions found within the transactions contained strings such as “CNAME= vhs[.]delrosal[.]net”, indicating attempts to direct the device toward the malicious endpoint. A more recent transaction recorded on January 28 included strings such as “hxxps://96.9.125[.]243/i;code=302”, suggesting an effort to change C2 endpoints. Darktrace observed multiple alerts triggered for these endpoints across affected devices.

Similar blockchain‑related endpoints, such as “tumama.hns[.]to”, were also observed in C2 activities. The hns[.]to service allows web browsers to access websites registered on Handshake, a decentralized blockchain‑based framework designed to replace centralized authorities and domain registries for top‑level domains. This shift toward decentralized, blockchain‑based infrastructure likely reflects increased efforts by attackers to evade detection.

In outgoing connections to these malicious endpoints across affected networks, Darktrace / NETWORK recognized that the activity was 100% rare and anomalous for both the devices and the wider networks, likely indicative of malicious beaconing, regardless of the underlying trusted infrastructure. In addition to generating multiple model alerts to capture this malicious activity across affected networks, Darktrace’s Cyber AI Analyst was able to compile these separate events into broader incidents that summarized the entire attack chain, allowing customers’ security teams to investigate and remediate more efficiently. Moreover, in customer environments where Darktrace’s Autonomous Response capability was enabled, Darktrace took swift action to contain the attack by blocking beaconing connections to the malicious endpoints, even when those endpoints were associated with seemingly trustworthy services.

Conclusion

Attacks targeting trusted relationships continue to be a popular strategy among threat actors. Activities linked to trusted or widely deployed software are often unintentionally whitelisted by existing security solutions and gateways. Darktrace observed multiple devices becoming impacted within a very short period, likely because tools such as antivirus software are typically mass‑deployed across numerous endpoints. As a result, a single compromised delivery mechanism can greatly expand the attack surface.

Attackers are also becoming increasingly creative in developing resilient C2 infrastructure and exploiting legitimate services to evade detection. Defenders are therefore encouraged to closely monitor anomalous connections and file downloads. Darktrace’s ability to detect unusual activity amidst ever‑changing tactics and indicators of compromise (IoCs) helps organizations maintain a proactive and resilient defense posture against emerging threats.

Credit to Joanna Ng (Associate Principal Cybersecurity Analyst) and Min Kim (Associate Principal Cybersecurity Analyst) and Tara Gould (Malware Researcher Lead)

Edited by Ryan Traill (Content Manager)

Appendices

Darktrace Model Detections

  • Anomalous File::Zip or Gzip from Rare External Location
  • Anomalous Connection / Suspicious Self-Signed SSL
  • Anomalous Connection / Rare External SSL Self-Signed
  • Anomalous Connection / Suspicious Expired SSL
  • Anomalous Server Activity / Anomalous External Activity from Critical Network Device

List of Indicators of Compromise (IoCs)

  • vhs[.]delrosal[.]net – C2 server
  • tumama[.]hns[.]to – C2 server
  • blackice.sol-domain[.]org – C2 server
  • 96.9.125[.]243 – C2 Server

MITRE ATT&CK Mapping

  • T1071.001 - Command and Control: Web Protocols
  • T1588.001 - Resource Development
  • T1102.001 - Web Service: Dead Drop Resolver
  • T1195 – Supple Chain Compromise

References

[1] https://www.morphisec.com/blog/critical-escan-threat-bulletin/

[2] https://www.bleepingcomputer.com/news/security/escan-confirms-update-server-breached-to-push-malicious-update/

[3] hxxps://download1.mwti.net/documents/Advisory/eScan_Security_Advisory_2026[.]pdf

[4] https://www.virustotal.com/gui/domain/delrosal.net

[5] hxxps://explorer.solana[.]com/address/2wFAbYHNw4ewBHBJzmDgDhCXYoFjJnpbdmeWjZvevaVv

Continue reading
About the author
Joanna Ng
Senior Cyber Analyst

Blog

/

AI

/

April 17, 2026

Why Behavioral AI Is the Answer to Mythos

mythos behavioral aiDefault blog imageDefault blog image

How AI is breaking the patch-and-prevent security model

The business world was upended last week by the news that Anthropic has developed a powerful new AI model, Claude Mythos, which poses unprecedented risk because of its ability to expose flaws in IT systems.  

Whether it’s Mythos or OpenAI’s GPT-5.4-Cyber, which was just announced on Tuesday, supercharged AI models in the hands of hackers will allow them to carry out attacks at machine speed, much faster than most businesses can stop them.  

This news underscores a stark reality for all leaders: Patching holes alone is not a sufficient control against modern cyberattacks. You must assume that your software is already vulnerable right now. And while LLMs are very good at spotting vulnerabilities, they’re pretty bad at reliably patching them.

Project Glasswing members say it could take months or years for patches to be applied. While that work is done, enterprises must be protected against Zero-Day attacks, or security holes that are still undiscovered.  

Most cybersecurity strategies today are built like a daily multivitamin: broad, preventative, and designed to keep the system generally healthy over time. Patch regularly. Update software. Reduce known vulnerabilities. It’s necessary, disciplined, and foundational. But it’s also built for a world where the risks are well known and defined, cycles are predictable, and exposure unfolds at a manageable pace.

What happens when that model no longer holds?

The AI cyber advantage: Behavioral AI

The vulnerabilities exposed by AI systems like Mythos aren’t the well-understood risks your “multivitamin” was designed to address. They are transient, fast-emerging entry points that exist just long enough to be exploited.

In that environment, prevention alone isn’t enough. You don’t need more vitamins—you need a painkiller. The future of cybersecurity won’t be defined by how well you maintain baseline health. It will be defined by how quickly you respond when something breaks and every second counts.

That’s why behavioral AI gives businesses a durable cyber advantage. Rather than trying to figure out what the attacker looks like, it learns what “normal” looks like across the digital ecosystem of each individual business.  

That’s exactly how behavioral AI works. It understands the self, or what's normal for the organization, and then it can spot deviations in from normal that are actually early-stage attacks.

The Darktrace approach to cybersecurity

At Darktrace, we’ve been defending our 10,000 customers using behavioral AI cybersecurity developed in our AI Research Centre in Cambridge, U.K.

Darktrace was built on the understanding that attacks do not arrive neatly labeled, and that the most damaging threats often emerge before signatures, indicators, or public disclosures can catch up.  

Our AI algorithms learn in real time from your personalized business data to learn what’s normal for every person and every asset, and the flows of data within your organization. By continuously understanding “normal” across your entire digital ecosystem, Darktrace identifies and contains threats emerging from unknown vulnerabilities and compromised supply chain dependencies, autonomously curtailing attacks at machine speed.  

Security for novel threats

Darktrace is built for a world where AI is not just accelerating attacks, but fundamentally reshaping how they originate. What makes our AI so unique is that it's proven time and again to identify cyber threats before public vulnerability disclosures, such as critical Ivanti vulnerabilities in 2025 and SAP NetWeaver exploitations tied to nation-state threat actors.  

As AI reshapes how vulnerabilities are found and exploited, cybersecurity must be anchored in something more durable than a list of known flaws. It requires a real-time understanding of the business itself: what belongs, what does not, and what must be stopped immediately.

What leaders should do right now

The leadership priority must shift accordingly.

First, stop treating unknown vulnerabilities as an edge case. AI‑driven discovery makes them the norm. Security programs built primarily around known flaws, signatures, and threat intelligence will always lag behind an attacker that is operating in real time.

Second, insist on an understanding of what is actually normal across the business. When threats are novel, labels are useless. The earliest and most reliable signal of danger is abnormal behavior—systems, users, or data flows that suddenly depart from what is expected. If you cannot see that deviation as it happens, you are effectively blind during the most critical window.

Finally, assume that the next serious incident will occur before remediation guidance is available. Ask what happens in those first minutes and hours. The organizations that maintain resilience are not the ones waiting for disclosure cycles to catch up—they are the ones that can autonomously identify and contain emerging threats as they unfold.

This is the reality of cybersecurity in an AI‑shaped world. Patching and prevention remain important foundations, but the advantage now belongs to those who can respond instantly when the unpredictable occurs.

Behavioral AI is security designed not just for known threats, but for the ones that AI will discover next.

[related-resource]

Continue reading
About the author
Ed Jennings
President and CEO
Your data. Our AI.
Elevate your network security with Darktrace AI