Blog
/
Email
/
July 21, 2025

Global Telecom Provider: Powering and Protecting the World's Data Giants

A telecom company relies on Darktrace to uncover email threats other tools miss, save the team time on investigations, and enable 24/7 protection.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
The Darktrace Community
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
21
Jul 2025

This global leader plays a critical role in keeping the world connected. The company works with some of the largest and most influential public and private organizations in the world to enable ultra-fast data transmission.

Safeguarding the systems that keep the world connected

Standing at the forefront of global connectivity, this industry leader designs and manages large-scale communications systems that power the world’s most data-intensive enterprises – including social media giants, hyperscale cloud providers, and major data center operators. Given the scale, confidentiality, and sensitivity of the systems and data it helps transport, the company faces complex cybersecurity challenges.

Protecting sensitive customer data

Most of the organization’s projects are custom-designed and highly proprietary, making data privacy and Intellectual Property (IP) protection critical to maintaining trust and confidentiality with customers. In an industry where every competitor knows the landscape intimately, any loss of data could cause significant damage.

International security implications

The company faces a broad range of advanced cyber threats – from corporate espionage and supply chain risks to cyber-physical attacks on critical infrastructure. Its international footprint adds complexity, including cross-border regulatory compliance. A successful attack could disrupt business, compromise IP, or trigger wider consequences like disruptions to international data transfers and other critical services.

The global leader works closely with communities to anticipate threats that could impact the global communications network at large.

In this environment, cybersecurity is a foundation for international trust,” said the organization’s CISO.

Building a resilient cybersecurity strategy from the ground up

The CISO had the rare opportunity to build the IT and cybersecurity infrastructure from scratch. "Initially, we bought what everyone else buys,” referencing the traditional mix of firewalls, routers, and antivirus tools. “But I knew we needed to do more.”

Self-Learning AI – “the missing piece”

With solid perimeter defenses in place, the security team sought deeper protection inside the network. Darktrace’s Self-Learning AI stood out. “Unlike other solutions, Darktrace’s AI looks beyond known threat signatures, learning what’s normal for our environment and flagging what’s not. That was the missing piece – something that could help us even when everything else failed.”

A solution and partnership that delivered

The CISO said he appreciated the ability to observe Darktrace in action before full deployment, noting that the Darktrace team was there every step of the way, providing guidance and expertise to ensure he got the most out of his investment.

Partnership was especially valuable given the company’s explosive 400% growth over the last six years. As resources were stretched and priorities shifted, “Darktrace remained patient and responsive. We’re slow and methodical, but the Darktrace support team was phenomenal, never losing momentum and earning our trust.”

A unified cybersecurity ecosystem

Today, the global leader is using the Darktrace ActiveAI Security Platform™ as a core part of its layered defense strategy, including:

The CISO appreciates how, as a unified cybersecurity platform, Darktrace has an intuitive user interface, which makes it easier for his team to investigate alerts visually, even without deep technical expertise.

Advancing defenses while impacting the bottom line

A 24/7 “safety net”

The fact that this company has never been hacked is the clearest proof it made the right decision with Darktrace, said the CISO. Initially rolled out in Human Confirmation Mode, meaning it would not take autonomous action without explicit approval from the security team, Darktrace immediately uncovered threats and anomalies that other tools had missed.

Darktrace acts as a must-have safety net—ready to step in when other tools fall short,” said the CISO.

From monitoring internal behavior and identifying unusual attack patterns, to autonomously neutralizing threats after hours, the platform provides peace of mind in a high-stakes industry. “Darktrace is my dark horse – the thing I have in my back pocket if everything else fails. It’s here to save the day, save my company, and maybe even save my career.”

Autonomous capabilities free up time for skilled analysts

Darktrace’s AI-powered detection and response capabilities are deeply embedded in the team’s day-to-day operations, autonomously investigating and responding to the majority of potential threats. Cyber AI Analyst conducted a total of 2,776 total investigations within three months, averaging just 12 minutes to autonomously investigate an incident. Of those 2,776 investigations, Darktrace resolved 2,671 (96%) autonomously and escalated only 105 (4%) to analysts. Darktrace has dramatically reduced alert fatigue and freed up analysts to focus on what really matters, saving the security team 486 analyst hours on investigations within a 20-day period.

From noise to actionable insight

Darktrace delivers meaningful data and meaningful alerts. “If Darktrace escalates an incident, we drop everything and work on that. We trust in Darktrace.” When analysts do need to investigate an incident, Darktrace’s forensic logs and guided remediation suggestions have slashed the time analysts spend on investigations by four to five times.

Stronger security. Lower cost.

The CISO says, “Darktrace is a money-saver for our organization, making continued investments an easy sell to the CEO and the board.”  When he found himself down a resource after a member of the security team left the organization, the CISO turned to Darktrace Managed Threat Detection and Response services for 24/7 expert support. “It was a no brainer. We got better coverage, higher skill levels, and around-the-clock support – all for less than what we would pay to employ a single analyst.”

Scaling securely into the future

Securing networks in motion  

The organization is preparing to scale both its operations and security posture across existing distributed, mobile and deployable communications networks that historically have been disconnected. Some of these networks are in constant motion and operating in some of the world’s most volatile regions. “Darktrace will act as an autonomous defender, monitoring for anomalous behavior and intervening, when necessary, especially during those dangerous times when an asset ‘goes dark’ and becomes disconnected from the broader network,” said the CISO.

Applying AI strategically

As the organization continues to evaluate where and how to apply AI, its emphasis will be on technologies that can act independently to contain threats – especially in environments where human response may be delayed. “It’s about using the right kind of AI for the right challenge. That’s why we’re investing in Darktrace, with tools that can adapt and learn even in isolation and provide real-time protection wherever we operate.”

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
The Darktrace Community

More in this series

No items found.

Blog

/

/

February 13, 2026

CVE-2026-1731: How Darktrace Sees the BeyondTrust Exploitation Wave Unfolding

Default blog imageDefault blog image

Note: Darktrace's Threat Research team is publishing now to help defenders. We will update continue updating this blog as our investigations unfold.

Background

On February 6, 2026, the Identity & Access Management solution BeyondTrust announced patches for a vulnerability, CVE-2026-1731, which enables unauthenticated remote code execution using specially crafted requests.  This vulnerability affects BeyondTrust Remote Support (RS) and particular older versions of Privileged Remote Access (PRA) [1].

A Proof of Concept (PoC) exploit for this vulnerability was released publicly on February 10, and open-source intelligence (OSINT) reported exploitation attempts within 24 hours [2].

Previous intrusions against Beyond Trust technology have been cited as being affiliated with nation-state attacks, including a 2024 breach targeting the U.S. Treasury Department. This incident led to subsequent emergency directives from  the Cybersecurity and Infrastructure Security Agency (CISA) and later showed attackers had chained previously unknown vulnerabilities to achieve their goals [3].

Additionally, there appears to be infrastructure overlap with React2Shell mass exploitation previously observed by Darktrace, with command-and-control (C2) domain  avg.domaininfo[.]top seen in potential post-exploitation activity for BeyondTrust, as well as in a React2Shell exploitation case involving possible EtherRAT deployment.

Darktrace Detections

Darktrace’s Threat Research team has identified highly anomalous activity across several customers that may relate to exploitation of BeyondTrust since February 10, 2026. Observed activities include:

-              Outbound connections and DNS requests for endpoints associated with Out-of-Band Application Security Testing; these services are commonly abused by threat actors for exploit validation.  Associated Darktrace models include:

o    Compromise / Possible Tunnelling to Bin Services

-              Suspicious executable file downloads. Associated Darktrace models include:

o    Anomalous File / EXE from Rare External Location

-              Outbound beaconing to rare domains. Associated Darktrace models include:

o   Compromise / Agent Beacon (Medium Period)

o   Compromise / Agent Beacon (Long Period)

o   Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

o   Compromise / Beacon to Young Endpoint

o   Anomalous Server Activity / Rare External from Server

o   Compromise / SSL Beaconing to Rare Destination

-              Unusual cryptocurrency mining activity. Associated Darktrace models include:

o   Compromise / Monero Mining

o   Compromise / High Priority Crypto Currency Mining

And model alerts for:

o    Compromise / Rare Domain Pointing to Internal IP

IT Defenders: As part of best practices, we highly recommend employing an automated containment solution in your environment. For Darktrace customers, please ensure that Autonomous Response is configured correctly. More guidance regarding this activity and suggested actions can be found in the Darktrace Customer Portal.  

Appendices

Potential indicators of post-exploitation behavior:

·      217.76.57[.]78 – IP address - Likely C2 server

·      hXXp://217.76.57[.]78:8009/index.js - URL -  Likely payload

·      b6a15e1f2f3e1f651a5ad4a18ce39d411d385ac7  - SHA1 - Likely payload

·      195.154.119[.]194 – IP address – Likely C2 server

·      hXXp://195.154.119[.]194/index.js - URL – Likely payload

·      avg.domaininfo[.]top – Hostname – Likely C2 server

·      104.234.174[.]5 – IP address - Possible C2 server

·      35da45aeca4701764eb49185b11ef23432f7162a – SHA1 – Possible payload

·      hXXp://134.122.13[.]34:8979/c - URL – Possible payload

·      134.122.13[.]34 – IP address – Possible C2 server

·      28df16894a6732919c650cc5a3de94e434a81d80 - SHA1 - Possible payload

References:

1.        https://nvd.nist.gov/vuln/detail/CVE-2026-1731

2.        https://www.securityweek.com/beyondtrust-vulnerability-targeted-by-hackers-within-24-hours-of-poc-release/

3.        https://www.rapid7.com/blog/post/etr-cve-2026-1731-critical-unauthenticated-remote-code-execution-rce-beyondtrust-remote-support-rs-privileged-remote-access-pra/

Continue reading
About the author
Emma Foulger
Global Threat Research Operations Lead

Blog

/

AI

/

February 13, 2026

How AI is redefining cybersecurity and the role of today’s CIO

Default blog imageDefault blog image

Why AI is essential to modern security

As attackers use automation and AI to outpace traditional tools and people, our approach to cybersecurity must fundamentally change. That’s why one of my first priorities as Withum's CIO was to elevate cybersecurity from a technical function to a business enabler.

What used to be “IT’s problem” is now a boardroom conversation – and for good reason. Protecting our data, our people, and our clients directly impacts revenue, reputation and competitive positioning.  

As CIOs / CISOs, our responsibilities aren’t just keeping systems running, but enabling trust, protecting our organization's reputation, and giving the business confidence to move forward even as the digital world becomes less predictable. To pull that off, we need to know the business inside-out, understand risk, and anticipate what's coming next. That's where AI becomes essential.

Staying ahead when you’re a natural target

With more than 3,100 team members and over 1,000 CPAs (Certified Public Accountant), Withum’s operates in an industry that naturally attracts attention from attackers. Firms like ours handle highly sensitive financial and personal information, which puts us squarely in the crosshairs for sophisticated phishing, ransomware, and cloud-based attacks.

We’ve built our security program around resilience, visibility, and scale. By using Darktrace’s AI-powered platform, we can defend against both known and unknown threats, across email and network, without slowing our teams down.

Our focus is always on what we’re protecting: our clients’ information, our intellectual property, and the reputation of the firm. With Darktrace, we’re not just keeping up with the massive volume of AI-powered attacks coming our way, we’re staying ahead. The platform defends our digital ecosystem around the clock, detecting potential threats across petabytes of data and autonomously investigating and responding to tens of thousands of incidents every year.

Catching what traditional tools miss

Beyond the sheer scale of attacks, Darktrace ActiveAI Security PlatformTM is critical for identifying threats that matter to our business. Today’s attackers don’t use generic techniques. They leverage automation and AI to craft highly targeted attacks – impersonating trusted colleagues, mimicking legitimate websites, and weaving in real-world details that make their messages look completely authentic.

The platform, covering our network, endpoints, inboxes, cloud and more is so effective because it continuously learns what’s normal for our business: how our users typically behave, the business- and industry-specific language we use, how systems communicate, and how cloud resources are accessed. It picks up on minute details that would sail right past traditional tools and even highly trained security professionals.

Freeing up our team to do what matters

On average, Darktrace autonomously investigates 88% of all our security events, using AI to connect the dots across email, network, and cloud activity to figure out what matters. That shift has changed how our team works. Instead of spending hours sorting through alerts, we can focus on proactive efforts that actually strengthen our security posture.

For example, we saved 1,850 hours on investigating security issues over a ten-day period. We’ve reinvested the time saved into strengthening policies, refining controls, and supporting broader business initiatives, rather than spending endless hours manually piecing together alerts.

Real confidence, real results

The impact of our AI-driven approach goes well beyond threat detection. Today, we operate from a position of confidence, knowing that threats are identified early, investigated automatically, and communicated clearly across our organization.

That confidence was tested when we withstood a major ransomware attack by a well-known threat group. Not only were we able to contain the incident, but we were able to trace attacker activity and provided evidence to law enforcement. That was an exhilarating experience! My team did an outstanding job, and moments like that reinforce exactly why we invest in the right technology and the right people.

Internally, this capability has strengthened trust at the executive level. We share security reporting regularly with leadership, translating technical activity into business-relevant insights. That transparency reinforces cybersecurity as a shared responsibility, one that directly supports growth, continuity, and reputation.

Culturally, we’ve embedded security awareness into daily operations through mandatory monthly training, executive communication, and real-world industry examples that keep cybersecurity top of mind for every employee.

The only headlines we want are positive ones: Withum expanding services, Withum growing year over year. Security plays a huge role in making sure that’s the story we get to tell.

What’s next

Looking ahead, we’re expanding our use of Darktrace, including new cloud capabilities that extend AI-driven visibility and investigation into our AWS and Azure environments.

As I continue shaping our security team, I look for people with passion, curiosity, and a genuine drive to solve problems. Those qualities matter just as much as formal credentials in my view. Combined with AI, these attributes help us build a resilient, engaged security function with low turnover and high impact.

For fellow technology leaders, my advice is simple: be forward-thinking and embrace change. We must understand the business, the threat landscape, and how technology enables both. By augmenting human expertise rather than replacing it, AI allows us to move upstream by anticipating risk, advising the business, and fostering stronger collaboration across teams.

Continue reading
About the author
Amel Edmond
Chief Information Officer
Your data. Our AI.
Elevate your network security with Darktrace AI