Blog
/
/
December 7, 2017

Darktrace: Investigating Widespread Trojan Infections

Discover how Darktrace expedites the investigation of widespread Trojan infections, enhancing cybersecurity and response times.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
07
Dec 2017

This blog post outlines how Darktrace helps security operations centre (SOC) teams become more efficient by drastically cutting down the time needed to investigate incidents. This is illustrated by an example encountered in a recent Proof of Value where over 350 client devices had been infected by a stealthy banking trojan.

Identifying and investigating a compromise of this size would usually take a SOC team several hours if not days using disparate traditional security tools. Employing Darktrace, the most important questions were answered within 90 minutes. The main reason for this is that Darktrace provides full visibility and context into network activity for all devices monitored on a single, unified platform.

Alert fatigue & the cyber security skill gap

Getting cyber security right is difficult and time-consuming. Complexity is one of the main challenges the cyber security community is facing. These days, networks are only vaguely defined with digital supply chains, outsourcing, the push into the cloud and the advent of micro-virtualisation like Docker. The amount of data stored, devices connected to internal networks, connections made by devices and the heterogeneity in IT adds to this complexity. Managing it is difficult at best and securing it with traditional tools can be a daunting task.

Our industry is struggling with what has been labelled the ‘cyber security skill gap’. The demand for skilled, experienced security practitioners consistently outstrips supply. SOC teams struggle to find the right people for the job and to keep their analysts motivated in the face of a rapidly evolving threat landscape. Alert fatigue and burnout are common symptoms for SOC analysts working long hours and graveyard shifts.

Investigation methodology

Any incident responder will always begin by asking some high-level questions concerning the incident under investigation – regardless of it being an adware infection, a banking trojan, ransomware, an active intrusion or any other form of cyber security incident.

The most important questions usually are:

  • How did the infection occur? (To prevent the same initial infection vector in the future)
  • What behavior is the infected device exhibiting? (To understand the threat and the risk of the infection)
  • What Indicators of Compromise (IoC) are seen? (To update other security tools and to use for further investigation)
  • Are other devices infected as well? (To assess the extent of the infection)

We did a recent Proof of Value with an IT service provider in EMEA. Darktrace entered an environment which had already succumbed to a widespread compromise – over 350 client devices had been infected with banking trojans. Let’s walk through how we identified, triaged and investigated this infection using Darktrace.

Identifying the incident

Darktrace came into the environment after the initial infection had taken place already. Darktrace instantly identified several devices exhibiting unexpected HTTP beaconing to unusual, rare external IP addresses. The devices made HTTP POST requests without prior GET requests along other suspicious behavior. Darktrace created several high-severity alerts for this, e.g. ‘Compromise / Suspicious HTTP Beacons to Dotted Quad’ and ‘Compromise / Possible Malware HTTP Comms’:

Figure 1: Example Darktrace alert.

Triaging the incident

Darktrace then provides context around this alert - e.g. the external IP the beaconing was made to, the internal device including the associated user, and the suspicious behavior:

Figure 2: Detection context and C2 IP.

A quick investigation of the external IP reveals that it is a recently discovered command and control (C2) IP address for the Dridex banking trojan.

Drilling deeper into this, Darktrace provides PCAPs for every connection seen. A PCAP for the C2 connection above confirms this incident as active, successful, encoded beaconing to a malicious C2 IP:

Figure 3: PCAP and encoded HTTP POSTs.

Investigating the incident

At this stage, we want to further examine the behavior of the infected device around the time of the incident. Darktrace provides full visibility into past activity, including all network connection made by any device - regardless of whether the incident occurred on the device or not.

We attend to all external connections made by the infected device around the time of the incident and immediately identify more suspicious C2 communication:

Figure 4: More device behavior; further C2 IPs.

By now we have identified 6 different C2 IP addresses.

We can use Darktrace’s ‘External Sites Summary’ to view all devices that have connected to a specific IP or domain in the recent past. Doing this for the initial C2 IP yields the following result (excerpt):

Figure 5: External Sites Summary; further infections.

We immediately identify 5 additional devices that made successful connections to the C2 IP address. In fact, the list above is abridged as we actually saw over 350 devices connecting to this and other C2 IP addresses. Notably, all observed devices appear to have a similar naming structure - this will become important in the next part of the analysis.

At this point we have answered all but the first question: ‘How did the infection occur?’

Darktrace started monitoring the network after the initial infection occurred and spread. Further research into the C2 IP addresses shows that they are associated with the Emotet trojan. This sophisticated malware often precedes banking trojan (e.g. Dridex) infections and is spread via phishing. We can thus assume that phishing was a likely initial infection vector.

How then did the infection manage to spread to so many devices?

Surely not all users clicked on suspicious phishing emails? Recent versions of Emotet have limited lateral movement capabilities. They mainly propagate via SMB brute forcing - trying administrative accounts and hard-coded password lists. The naming convention on the infected devices is very similar - this could indicate a similar build-process and setup of the devices. If a vulnerability - such as an administrative account with a weak password - existed on one of the devices, it might be present in all of the devices with a similar build.

Using Darktrace, the security team has now a solid understanding of the nature and size of the infection, the IoCs available to update firewalls and other preventive security controls and outstanding remediation-activities.

What would this investigation look like with traditional tools, not using Darktrace?

Detecting these covert banking trojans in the first place, let alone triaging them fully, can be a difficult challenge in itself. Current banking Trojan strains such as Dridex, Fedeo or Vawtrak keep updating the malware with new C2 addresses to avoid blacklisting. Initial detection could be at any stage of the attack lifecycle – likely it will be in the latter stages though, when considerable damage has already been done.

An analyst will have to log into various security devices to get close to the same level of visibility provided in Darktrace – web proxy logs, anti-virus logs, running PCAPs on infected hosts, SIEM logs. Having to switch between all those disparate security tools is not time-efficient and produces a fragmentary picture of what actually transpired.

Conclusion

A working hypothesis is that a single device was initially infected via phishing, allowing Emotet to spread to over 350 internal devices via SMB brute forcing. It took no longer than 90 minutes to come from an initial detection of the incident to this conclusion, which forms the basis for an actionable report.

The last thing a SOC needs is yet another tool producing a profusion of alerts. Using Darktrace’s machine learning and unrivalled network visibility, you can focus on the small set of relevant alerts and rapidly investigate those incidents according to their severity and priority.

Darktrace can reduce costs even if you bring in a third-party incident response team. You will be able to significantly speed up their ongoing investigation if they have access to Darktrace. Third-party incident response teams are expensive – their daily rates ranging between £2,000 and £3,000 per day. Cutting their work down from days to hours will result in cost and efforts saved.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO

More in this series

No items found.

Blog

/

/

May 1, 2025

Your Vendors, Your Risk: Rethinking Third-Party Security in the Age of Supply Chain Attacks

man on cellphoneDefault blog imageDefault blog image

When most people hear the term supply chain attack, they often imagine a simple scenario: one organization is compromised, and that compromise is used as a springboard to attack another. This kind of lateral movement is common, and often the entry vector is as mundane and as dangerous as email.

Take, for instance, a situation where a trusted third-party vendor is breached. An attacker who gains access to their systems can then send malicious emails to your organization, emails that appear to come from a known and reputable source. Because the relationship is trusted, traditional phishing defenses may not be triggered, and recipients may be more inclined to engage with malicious content. From there, the attacker can establish a foothold, move laterally, escalate privileges, and launch a broader campaign.

This is one dimension of a supply chain cyber-attack, and it’s well understood in many security circles. But the risk doesn’t end there. In fact, it goes deeper, and it often hits the most important asset of all: your customers' data.

The risk beyond the inbox

What happens when customer data is shared with a third party for legitimate processing purposes for example billing, analytics, or customer service and that third party is then compromised?

In that case, your customer data is breached, even if your own systems were never touched. That’s the uncomfortable truth about modern cybersecurity: your risk is no longer confined to your own infrastructure. Every entity you share data with becomes an extension of your attack surface. Thus, we should rethink how we perceive responsibility.

It’s tempting to think that securing our environment is our job, and securing their environment is theirs. But if a breach of their environment results in the exposure of our customers, the accountability and reputational damage fall squarely on our shoulders.

The illusion of boundaries

In an era where digital operations are inherently interconnected, the lines of responsibility can blur quickly. Legally and ethically, organizations are still responsible for the data they collect even if that data is processed, stored, or analyzed by a third party. A customer whose data is leaked because of a vendor breach will almost certainly hold the original brand responsible, not the third-party processor they never heard of.

This is particularly important for industries that rely on extensive outsourcing and platform integrations (SaaS platforms, marketing tools, CRMs, analytics platforms, payment processors). The list of third-party vendors with access to customer data grows year over year. Each integration adds convenience, but also risk.

Encryption isn’t a silver bullet

One of the most common safeguards used in these data flows is encryption. Encrypting customer data in transit is a smart and necessary step, but it’s far from enough. Once data reaches the destination system, it typically needs to be decrypted for use. And the moment it is decrypted, it becomes vulnerable to a variety of attacks like ransomware, data exfiltration, privilege escalation, and more.

In other words, the question isn’t just is the data secure in transit? The more important question is how is it protected once it arrives?

A checklist for organizations evaluating third-parties

Given these risks, what should responsible organizations do when they need to share customer data with third parties?

Start by treating third-party security as an extension of your own security program. Here are some foundational controls that can make a difference:

Due diligence before engagement: Evaluate third-party vendors based on their security posture before signing any contracts. What certifications do they hold? What frameworks do they follow? What is their incident response capability?

Contractual security clauses: Build in specific security requirements into vendor contracts. These can include requirements for encryption standards, access control policies, and data handling protocols.

Third-party security assessments: Require vendors to provide evidence of their security controls. Independent audits, penetration test results, and SOC 2 reports can all provide useful insights.

Ongoing monitoring and attestations: Security isn’t static. Make sure vendors provide regular security attestations and reports. Where possible, schedule periodic reviews or audits, especially for vendors handling sensitive data.

Minimization and segmentation: Don’t send more data than necessary. Data minimization limits the exposure in the event of a breach. Segmentation, both within your environment and within vendor access levels, can further reduce risk.

Incident response planning: Ensure you have a playbook for handling third-party incidents, and that vendors do as well. Coordination in the event of a breach should be clear and rapid.

The human factor: Customers and communication

There’s another angle to supply chain cyber-attacks that’s easy to overlook: the post-breach exploitation of public knowledge. When a breach involving customer data hits the news, it doesn’t take long for cybercriminals to jump on the opportunity.

Attackers can craft phishing emails that appear to be follow-ups from the affected organization: “Click here to reset your password,” “Confirm your details due to the breach,” etc.

A breach doesn’t just put customer data at risk it also opens the door to further fraud, identity theft, and financial loss through social engineering. This is why post-breach communication and phishing mitigation strategies are valuable components of an incident response strategy.

Securing what matters most

Ultimately, protecting against supply chain cyber-attacks isn’t just about safeguarding your own perimeter. It’s about defending the integrity of your customers’ data, wherever it goes. When customer data is entrusted to you, the duty of care doesn’t end at your firewall.

Relying on vendors to “do their part” is not enough. True due diligence means verifying, validating, and continuously monitoring those extended attack surfaces. It means designing controls that assume failure is possible, and planning accordingly.

In today’s threat landscape, cybersecurity is no longer just a technical discipline. It’s a trust-building exercise. Your customers expect you to protect their information, and rightly so. And when a supply chain attack happens, whether the breach originated with you or your partner, the damage lands in the same place: your brand, your customers, your responsibility.

[related-resource]

Continue reading
About the author
Tony Jarvis
VP, Field CISO

Blog

/

/

April 30, 2025

Boosting Security with Azure Virtual Network TAP Traffic Mirroring

Man sitting at computerDefault blog imageDefault blog image

We are thrilled to announce that Darktrace is a launch partner for the Public Preview of Microsoft Azure Virtual Network Terminal Access Point (TAP). As Microsoft's 2024 UK Partner of the Year, we continue to innovate alongside Microsoft to deliver proactive cyber protection tailored to every organization.

Enhanced Defense Across the Modern Network

Modern networks are expanding far beyond on-premises into virtual environments, cloud and hybrid networks. More than 50% of incidents will come from cloud network activity by 2029, meaning defenders need a solution that can level the playing field against complex attacks that traverse multiple areas of a digital estate, including north-south and east-west traffic.

With Azure Virtual Network TAP, Darktrace’s self-learning AI gains seamless access to granular packet data in hybrid environments. This integration helps our Cyber AI platform build a comprehensive understanding of a customers’ Azure network. Microsoft's recent enhancement allows Virtual Network TAP to mirror the full throughput of VMs without impacting VM bandwidth, enabling agentless Cyber AI defense across these instances.

Darktrace's Cyber AI provides real-time visibility and adaptive, autonomous defense for your Microsoft security strategy. Our platform continuously learns the normal behavior of every user, device, and workload in your environment. This deep understanding of usual 'patterns of life' enables Darktrace to detect subtle deviations that indicate threats, from account takeovers to critical misconfigurations.

Our bespoke, real-time knowledge of usual activity allows Darktrace to identify unknown and unpredictable threats that bypass policy-based defenses—without relying on rules, signatures, or prior assumptions. This approach is a powerful compliment to Microsoft’s unprecedented threat intelligence.

Expanding Azure Virtual Network TAP

Azure Virtual Network TAP allows continuous streaming of virtual machine network traffic, which customers can leverage for Darktrace’s AI-driven threat detection and investigation. Darktrace / NETWORK passively ingests traffic from on-premises, virtual, cloud, hybrid environments, and remote devices, analyzing both encrypted and decrypted packets to uncover unusual activity in real-time. Unlike other NDR vendors that process data in the cloud, our industry-leading Self-Learning AI is deployed locally and trained solely on your data, ensuring tailored security outcomes without compromising privacy.

Benefits to Darktrace Customers

Darktrace customers will experience enhanced security through deeper insights into network traffic, enabling more accurate threat detection and response. The ability to mirror full VM throughput without affecting bandwidth ensures optimal performance, while agentless defense reduces barrier to entry and simplifies management. Customers benefit from proactive protection by continuously monitoring and analyzing traffic to identify and mitigate threats before they cause harm. Additionally, seamless integration with existing Azure environments leverages the power of Darktrace’s AI for enhanced security.

[related-resource]

Continue reading
About the author
Adam Stevens
Director of Product, Cloud Security
Your data. Our AI.
Elevate your network security with Darktrace AI