Blog
/
/
April 7, 2020

Four Ways Cyber-Criminals Fly Under the Radar

Learn how cyber criminals evade detection. Darktrace analyses the four ways they operate under the radar. Read here to stay vigilant against cyber attacks.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Oliver Rochford
Technical Director
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
07
Apr 2020

The challenge of reliably attributing cyber-threats has amplified in recent years, as adversaries adopt a collection of techniques to ensure that even if their attacks are caught, they themselves escape detection and avoid punishment.

Detecting a threat is, of course, a very different technical challenge compared to tracing that activity back to a human operator. Nevertheless, at some point after the dust has settled, during the post-hoc incident analysis for example, someone somewhere may need to know who the suspects are. And in spite of all of our other advances, and also some recent successes in attributing offensive and cyber-criminal acts, only three out of every 100,000 cyber-crimes are prosecuted. Put simply, this is still an unsolved set of problems. Many of the successes we do have can be attributed more to operational security fails on the criminals’ end than any other active approaches. In fact, some recent trends have actually made reliable attribution even more challenging.

The four cyber-threat trends that make attribution difficult

There are four related trends in how threat-actors can procure and obtain attack capabilities that have resulted in an increase in complexity when attempting to reliably identify Tools, Techniques, and Procedures (TTPs) and attributing them to distinct threat-actors.

A Cybercrime-as-a-Service economy and supply chain allowing cyber-criminals to mix and match off the shelf offensive cyber capabilities.

Expansion of ‘Living off the Land’ (LoL) tool usage by threat-actors to evade traditional, signature-based security defenses, and to obfuscate their activity.

While Code Reuse has always existed in the hacker community, copying nation-state-grade attack code has recently become possible.

The barrier to entry for criminally motivated operators has been lowered, providing the means for less technical criminals, who are only limited by time and their imagination.

Figure 1: The four cyber-threat trends

Threat-actors can mix and match attack tools, creating attack stacks that can be tailored for a variety of campaigns.

Between a professional marketplace of cyber-crime tools and services, the increasing adoption of ‘Living off the Land’ techniques, and the reusing of code leaked from nation-state intelligence services, threat-actors with even the most limited technical ability can conduct highly sophisticated criminal campaigns. Prospective cyber-criminals now have four primary types of attack tools to choose from – with three of them brand new or greatly enhanced. Even more importantly, these threat-actors can mix and match attack tools, creating tactically flexible attack stacks that can be tailored for a variety of campaigns against a diverse set of victims.

Off the shelf attacks

The burgeoning and increasingly professional Cybercrime-as-a-Service market (estimated at $1.6B) provides a thriving marketplace of microservices, attack code, and attack platforms. Anyone with a motive and enough bitcoin and enthusiasm can become the next ‘cyber Don Corleone’. Many of these services offer dedicated account management and professional support 24 hours a day. The commercialization of the cyber-crime supply chain has raised the barrier to entry for Cybercrime-as-a-Service vendors, while at the same time lowering it for cyber-criminal operators.

Living off the Land

‘Living off the Land’ (LoL) and “malware-less” attacks have been on the rise for some time now. What makes these attack methods so dangerous is that they leverage standard operating system tools to conduct their nefarious business, making signature-based approaches that look for malware heuristics ineffective – including signature-based Intrusion Protection Systems.

These attacks in particular demonstrate the need for an approach to cyber security that goes beyond looking at what malware is being used. Rather than relying on static blacklists, security teams are instead turning to a more sophisticated approach that learns ‘normal’ for every user and device across an entire business. From that evolving baseline, this approach to defense can identify and contain anomalous activity indicative of a cyber-threat – all in real time.

Code reuse and repurpose

What is new, and unprecedented, is that cyber-criminals are gaining access to intelligence and nation-state grade attack code.

Hackers have always begged, borrowed, and stolen code from others, including attack code – just two notable examples include the Zeus trojan and RIG exploit kit code leaks that provided the code base for much of the current generation of threats. What is new and unprecedented is that, whether through malice or incompetence, cyber-criminals are gaining access to intelligence and nation-state grade attack code. The Shadowbroker leaks that resulted in Wannacry is one recent example of this trend, and one we expect to accelerate – especially with intelligence services actively outing each other’s methods.

Custom and bespoke techniques

The practice of hackers creating their own tools and researching their own exploits has a long and hallowed tradition, with headline-grabbing zero-days becoming more and more common. Nation-state actors in particular often make a distinction between attack operators and attack code developers, with the ability to request tailored and bespoke code and tools – not unlike the model that has been replicated in the Cybercrime-as-a-Service market. Even when developing custom tools, threat-actors frequently integrate code and exploits from other parties.

Figure 2: The four main attack tool types

When determining who is actually behind these attacks, though, what is most important is the ability to combine all four types of attack tools – this provides a further layer of obfuscation against methods that rely on pattern matching for detection whilst causing additional confusion for would-be investigators. An attacker can use any combination and variation of these tool types to create a different “Chimera” attack stack – making it that much more difficult to identify who is really the operator. Telling apart the operator from the Cybercrime-as-a-Service vendor, for example, is difficult when most of the TTPs that are evaluated are technical and derive from the tooling.

Figure 3: The TTP and Attribution Confusion Chain

Conclusion

As the challenge of attribution intensifies, our focus must turn to defending against cyber-attacks themselves.

The combination of the four threat trends outlined above has lowered the barrier to entry for criminally motivated operators. Less technical adversaries are now able to launch attacks at a speed and scale previously confined to the most organized and well-financed cyber-criminal rings. This change in circumstances has made attribution of offensive cyber activity drastically more complex, and it may be some time before the prosecution rate for cyber-crime gets good enough that it can act as a greater disincentive.

As the challenge of attribution intensifies, our focus must turn to defending against cyber-attacks themselves. You may not ever know who is attacking you, but if you can successfully thwart the full range of threats, new and old, your organization can continue to operate as normal.

Fortunately, defenders’ abilities to detect and respond to cyber-threats have significantly advanced in recent years, thanks to the latest developments in AI and machine learning. Over 3,500 organizations now rely on Cyber AI to detect and contain cyber-threats – whether attackers use pre-existing OS tools to masquerade their attacks or use bespoke and entirely new techniques to bypass rules and signatures. When a threat is identified, AI can respond autonomously by enforcing a user or device’s ‘pattern of life’, allowing ‘business as usual’ whilst ensuring the organization is protected from harm.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Oliver Rochford
Technical Director

More in this series

No items found.

Blog

/

Cloud

/

June 12, 2025

Breaking Silos: Why Unified Security is Critical in Hybrid World

laptop with statistics on itDefault blog imageDefault blog image

Hybrid environments demand end-to-end visibility to stop modern attacks

Hybrid environments are a dominant trend in enterprise technology, but they continue to present unique issues to the defenders tasked with securing them. By 2026, Gartner predicts that 75% of organizations will adopt hybrid cloud strategies [1]. At the same time, only 23% of organizations report full visibility across cloud environments [2].

That means a strong majority of organizations do not have comprehensive visibility across both their on-premises and cloud networks. As a result, organizations are facing major challenges in achieving visibility and security in hybrid environments. These silos and fragmented security postures become a major problem when considering how attacks can move between different domains, exploiting the gaps.

For example, an attack may start with a phishing email, leading to the compromise of a cloud-based application identity and then moving between the cloud and network to exfiltrate data. Some attack types inherently involve multiple domains, like lateral movement and supply chain attacks, which target both on-premises and cloud networks.

Given this, unified visibility is essential for security teams to reduce blind spots and detect threats across the entire attack surface.

Risks of fragmented visibility

Silos arise due to separate teams and tools managing on-premises and cloud environments. Many teams have a hand in cloud security, with some common ones including security, infrastructure, DevOps, compliance, and end users, and these teams can all use different tools. This fragmentation increases the likelihood of inconsistent policies, duplicate alerts, and missed threats. And that’s just within the cloud, not even considering the additional defenses involved with network security.

Without a unified security strategy, gaps between these infrastructures and the teams which manage them can leave organizations vulnerable to cyber-attacks. The lack of visibility between on-premises and cloud environments contributes to missed threats and delayed incident response. In fact, breaches involving stolen or compromised credentials take an average of 292 to identify and contain [3]. That’s almost ten months.

The risk of fragmented visibility runs especially high as companies undergo cloud migrations. As organizations transition to cloud environments, they still have much of their data in on-premises networks, meaning that maintaining visibility across both on-premises and cloud environments is essential for securing critical assets and ensuring seamless operations.

Unified visibility is the solution

Unified visibility is achieved by having a single-pane-of-glass view to monitor both on-premises and cloud environments. This type of view brings many benefits, including streamlined detection, faster response times, and reduced complexity.

This can only be accomplished through integrations or interactions between the teams and tools involved with both on-premises security and cloud security.

AI-driven platforms, like Darktrace, are especially well equipped to enable the real-time monitoring and insights needed to sustain unified visibility. This is because they can handle the large amounts of data and data types.

Darktrace accomplishes this by plugging into an organization’s infrastructure so the AI can ingest and analyze data and its interactions within the environment to form an understanding of the organization’s normal behavior, right down to the granular details of specific users and devices. The system continually revises its understanding about what is normal based on evolving evidence.

This dynamic understanding of normal means that the AI engine can identify, with a high degree of precision, events or behaviors that are both anomalous and unlikely to be benign. This helps reduce noise while surfacing real threats, across cloud and on-prem environments without manual tuning.

In this way, given its versatile AI-based, platform approach, Darktrace empowers security teams with real-time monitoring and insights across both the network and cloud.

Unified visibility in the modern threat landscape

As part of the Darktrace ActiveAI Security Platform™, Darktrace / CLOUD works continuously across public, private, hybrid, and multi-cloud deployments. With real-time Cloud Asset Enumeration and Dynamic Architecture Modeling, Darktrace / CLOUD generates up-to-date architecture diagrams, giving SecOps and DevOps teams a unified view of cloud infrastructures.

It is always on the lookout for changes, driven by user and service activity. For example, unusual user activity can significantly raise the asset’s score, prompting Darktrace’s AI to update its architectural view and keep a living record of the cloud’s ever-changing landscape, providing near real-time insights into what’s happening.

This continuous architectural awareness ensures that security teams have a real-time understanding of cloud behavior and not just a static snapshot.

Darktrace / CLOUD’s unified view of AWS and Azure cloud posture and compliance over time.
Figure 1. Darktrace / CLOUD’s unified view of AWS and Azure cloud posture and compliance over time.

With this dynamic cloud visibility and monitoring, Darktrace / CLOUD can help unify and secure environments.

Real world example: Remote access supply chain attacks

Sectop Remote Access Trojan (RAT) malware, also known as ‘ArchClient2,’ is a .NET RAT that contains information stealing capabilities and allows threat actors to monitor and control targeted computers. It is commonly distributed through drive-by downloads of illegitimate software via malvertizing.

Darktrace has been able to detect and respond to Sectop RAT attacks using unified visibility and platform-wide coverage. In one such example, Darktrace observed one device making various suspicious connections to unusual endpoints, likely in an attempt to receive C2 information, perform beaconing activity, and exfiltrate data to the cloud.

This type of supply chain attack can jump from the network to the cloud, so a unified view of both environments helps shorten detection and response times, therefore mitigating potential impact. Darktrace’s ability to detect these cross-domain behaviors stems from its AI-driven, platform-native visibility.

Conclusion

Organizations need unified visibility to secure complex, hybrid environments effectively against threats and attacks. To achieve this type of comprehensive visibility, the gaps between legacy security tools across on-premises and cloud networks can be bridged with platform tools that use AI to boost data analysis for highly accurate behavioral prediction and anomaly detection.

Read more about the latest trends in cloud security in the blog “Protecting Your Hybrid Cloud: The Future of Cloud Security in 2025 and Beyond.”

References:

1. Gartner, May 22, 2023, “10 Strategic Data and Analytics Predictions Through 2028

2. Cloud Security Alliance, February 14, 2024, “Cloud Security Alliance Survey Finds 77% of Respondents Feel Unprepared to Deal with Security Threats

3. IBM, “Cost of a Data Breach Report 2024

Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance

Blog

/

OT

/

June 11, 2025

Proactive OT security: Lessons on supply chain risk management from a rogue Raspberry Pi

man working on computerDefault blog imageDefault blog image

Understanding supply chain risk in manufacturing

For industries running Industrial Control Systems (ICS) such as manufacturing and fast-moving consumer goods (FMCG), complex supply chains mean that disruption to one weak node can have serious impacts to the entire ecosystem. However, supply chain risk does not always originate from outside an organization’s ICS network.  

The implicit trust placed on software or shared services for maintenance within an ICS can be considered a type of insider threat [1], where defenders also need to look ‘from within’ to protect against supply chain risk. Attackers have frequently mobilised this form of insider threat:

  • Many ICS and SCADA systems were compromised during the 2014 Havex Watering Hole attack, where via operators’ implicit trust in the trojanized versions of legitimate applications, on legitimate but compromised websites [2].
  • In 2018, the world’s largest manufacturer of semiconductors and processers shut down production for three days after a supplier installed tainted software that spread to over 10,000 machines in the manufacturer’s network [3].
  • During the 2020 SolarWinds supply chain attack, attackers compromised a version of Orion software that was deployed from SolarWinds’ own servers during a software update to thousands of customers, including tech manufacturing companies such as Intel and Nvidia [4].

Traditional approaches to ICS security have focused on defending against everything from outside the castle walls, or outside of the ICS network. As ICS attacks become more sophisticated, defenders must not solely rely on static perimeter defenses and prevention. 

A critical part of active defense is understanding the ICS environment and how it operates, including all possible attack paths to the ICS including network connections, remote access points, the movement of data across zones and conduits and access from mobile devices. For instance, original equipment manufacturers (OEMs) and vendors often install remote access software or third-party equipment in ICS networks to facilitate legitimate maintenance and support activities, which can unintentionally expand the ICS’ attack surface.  

This blog describes an example of the convergence between supply chain risk and insider risk, when a vendor left a Raspberry Pi device in a manufacturing customer’s ICS network without the customer’s knowledge.

Case study: Using unsupervised machine learning to detect pre-existing security issues

Raspberry Pi devices are commonly used in SCADA environments as low-cost, remotely accessible data collectors [5][6][7]. They are often paired with Industrial Internet of Things (IIoT) for monitoring and tracking [8]. However, these devices also represent a security risk because their small physical size and time-consuming nature of physical inspection makes them easy to overlook. This poses a security risk, as these devices have previously been used to carry out USB-based attacks or to emulate Ethernet-over-USB connections to exfiltrate sensitive data [8][9].

In this incident, a Darktrace customer was unaware that their supplier had installed a Raspberry Pi device on their ICS network. Crucially, the installation occurred prior to Darktrace’s deployment on the customer’s network. 

For other anomaly detection tools, this order of events meant that this third-party device would likely have been treated as part of the customer’s existing infrastructure. However, after Darktrace was deployed, it analyzed the metadata from the encrypted HTTPS and DNS connections that the Raspberry Pi made to ‘call home’ to the supplier and determined that these connections were  unusual compared to the rest of the devices in the network, even in the absence of any malicious indicators of compromise (IoCs).  

Darktrace triggered the following alerts for this unusual activity that consequently notified the customer to the pre-existing threat of an unmanaged device already present in their network:

  • Compromise / Sustained SSL or HTTP Increase
  • Compromise / Agent Beacon (Short Period)
  • Compromise / Agent Beacon (Medium Period)
  • Compromise / Agent Beacon (Long Period)
  • Tags / New Raspberry Pi Device
  • Device / DNS Requests to Unusual Server
  • Device / Anomaly Indicators / Spike in Connections to Rare Endpoint Indicator
Darktrace’s External Sites Summary showing the rarity of the external endpoint that the Raspberry Pi device ‘called home’ to and the model alerts triggered.  
Figure 1: Darktrace’s External Sites Summary showing the rarity of the external endpoint that the Raspberry Pi device ‘called home’ to and the model alerts triggered.  

Darktrace’s Cyber AI Analyst launched an autonomous investigation into the activity, correlating related events into a broader incident and generating a report outlining the potential threat along with supporting technical details.

Darktrace’s anomaly-based detection meant that the Raspberry Pi device did not need to be observed performing clearly malicious behavior to alert the customer to the security risk, and neither can defenders afford to wait for such escalation.

Why is this significant?

In 2021 a similar attack took place. Aiming to poison a Florida water treatment facility, attackers leveraged a TeamViewer instance that had been dormant on the system for six months, effectively allowing the attacker to ‘live off the land’ [10].  

The Raspberry Pi device in this incident also remained outside the purview of the customer’s security team at first. It could have been leveraged by a persistent attacker to pivot within the internal network and communicate externally.

A proactive approach to active defense that seeks to minimize and continuously monitor the attack surface and network is crucial.  

The growing interest in manufacturing from attackers and policymakers

Significant motivations for targeting the manufacturing sector and increasing regulatory demands make the convergence of supply chain risk, insider risk, and the prevalence of stealthy living-off-the-land techniques particularly relevant to this sector.

Manufacturing is consistently targeted by cybercriminals [11], and the sector’s ‘just-in-time’ model grants attackers the opportunity for high levels of disruption. Furthermore, under NIS 2, manufacturing and some food and beverage processing entities are now designated as ‘important’ entities. This means stricter incident reporting requirements within 24 hours of detection, and enhanced security requirements such as the implementation of zero trust and network segmentation policies, as well as measures to improve supply chain resilience [12][13][14].

How can Darktrace help?

Ultimately, Darktrace successfully assisted a manufacturing organization in detecting a potentially disruptive 'near-miss' within their OT environment, even in the absence of traditional IoCs.  Through passive asset identification techniques and continuous network monitoring, the customer improved their understanding of their network and supply chain risk.  

While the swift detection of the rogue device allowed the threat to be identified before it could escalate, the customer could have reduced their time to respond by using Darktrace’s built-in response capabilities, had Darktrace’s Autonomous Response capability been enabled.  Darktrace’s Autonomous Response can be configured to target specific connections on a rogue device either automatically upon detection or following manual approval from the security team, to stop it communicating with other devices in the network while allowing other approved devices to continue operating. Furthermore, the exportable report generated by Cyber AI Analyst helps security teams to meet NIS 2’s enhanced reporting requirements.  

Sophisticated ICS attacks often leverage insider access to perform in-depth reconnaissance for the development of tailored malware capabilities.  This case study and high-profile ICS attacks highlight the importance of mitigating supply chain risk in a similar way to insider risk.  As ICS networks adapt to the introduction of IIoT, remote working and the increased convergence between IT and OT, it is important to ensure the approach to secure against these threats is compatible with the dynamic nature of the network.  

Credit to Nicole Wong (Principal Cyber Analyst), Matthew Redrup (Senior Analyst and ANZ Team Lead)

[related-resource]

Appendices

MITRE ATT&CK Mapping

  • Infrastructure / New Raspberry Pi Device - INITIAL ACCESS - T1200 Hardware Additions
  • Device / DNS Requests to Unusual Server - CREDENTIAL ACCESS, COLLECTION - T1557 Man-in-the-Middle
  • Compromise / Agent Beacon - COMMAND AND CONTROL - T1071.001 Web Protocols

References

[1] https://www.cisa.gov/topics/physical-security/insider-threat-mitigation/defining-insider-threats

[2] https://www.trendmicro.com/vinfo/gb/threat-encyclopedia/web-attack/139/havex-targets-industrial-control-systems

[3]https://thehackernews.com/2018/08/tsmc-wannacry-ransomware-attack.html

[4] https://www.theverge.com/2020/12/21/22194183/intel-nvidia-cisco-government-infected-solarwinds-hack

[5] https://www.centreon.com/monitoring-ot-with-raspberry-pi-and-centreon/

[6] https://ieeexplore.ieee.org/document/9107689

[7] https://www.linkedin.com/pulse/webicc-scada-integration-industrial-raspberry-pi-devices-mryff

[8] https://www.rowse.co.uk/blog/post/how-is-the-raspberry-pi-used-in-the-iiot

[9] https://sepiocyber.com/resources/whitepapers/raspberry-pi-a-friend-or-foe/#:~:text=Initially%20designed%20for%20ethical%20purposes,as%20cyberattacks%20and%20unauthorized%20access

[10] https://edition.cnn.com/2021/02/10/us/florida-water-poison-cyber/index.html

[11] https://www.mxdusa.org/2025/02/13/top-cyber-threats-in-manufacturing/

[12] https://www.shoosmiths.com/insights/articles/nis2-what-manufacturers-and-distributors-need-to-know-about-europes-new-cybersecurity-regime

[13] https://www.goodaccess.com/blog/nis2-require-zero-trust-essential-security-measure#zero-trust-nis2-compliance

[14] https://logisticsviewpoints.com/2024/11/06/the-impact-of-nis-2-regulations-on-manufacturing-supply-chains/

Continue reading
About the author
Nicole Wong
Cyber Security Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI