Blog
/
/
April 14, 2020

How Changing Online Habits Have Created New Email Attacks

New email behaviors such as increased subscriptions and remote presentation tools have given rise to a new wave of email cyber-attacks. Learn more here.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Mariana Pereira
VP, Field CISO
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
14
Apr 2020

For several weeks now, we’ve seen how cyber-criminals have used the ongoing global health crisis as a ‘fearware’ topic to mount and spread their attacks. But as more and more of the world’s population works from home, and as consumption of digital content subsequently increases, hackers are finding novel ways to exploit the full range of human emotions through sophisticated email attacks.

From attackers creating ‘digital fake’ campaigns that offer ‘advice’ for those self-isolating, to threat-actors masquerading behind trusted websites to launch malware, the last few weeks have demonstrated how quickly cyber-criminals can adapt their techniques in the email realm. This blog presents four ways hackers are changing their tactics in light of current trends and changing behaviors, and how security teams can react to defend against these developments.

Increased subscription

With a marked increase in digital subscription to entertainment sites and news sources, it should come as no surprise that spammers and hackers have doubled down on using fake newsletter subscriptions in their email attacks.

For security tools such as gateways and inboxes that look at the historic mail-flow, a new email subscription to a newsletter can look very much like any other – especially when the email passes all existing security tests and verifications. A brand new campaign or domain may not have been identified as malicious yet, and thus is allowed into the recipient’s inbox.

Analyzing emails within the broader business context gives a full understanding of the circumstances in which it was received. This requires looking beyond the inbox and considering the user’s ‘pattern of life’ across all touchpoints across the digital ecosystem. In the case of benign subscription emails, a user will have recently visited the domain of the sender and requested the email newsletter. There is an action ahead of receiving the email – requesting it.

Drawing insights from both email traffic and the user’s wider ‘pattern of life’ across the digital business, AI can tell the difference between an email newsletter that has and has not been requested. This simple act alone can help security teams understand when a user has voluntarily signed up for a newsletter versus when they have been targeted by a malicious attack, enabling them to respond appropriately.

Rapid adoption of remote presentation sites

As remote working sees a rapid rise, there has been a sharp increase in the number of people using presentation creation sites. Darktrace has recently picked up on a large number of attacks in which these trusted sites have been exploited to openly host malicious links. Malicious payloads are embedded within presentations, which are then shared in emails that go undetected by gateway tools.

Figure 1: Canva and Infogram, two presentation sites leveraged in this latest string of attacks

Several indicators suggest that this activity originates from a single, well-organized threat-actor or group, including the rotational targeting of presentation sites (Canva, Infogram, Axel, Piktochart, and Sway), the highly-focused nature of the attack type (taking place within the space of two weeks), and the consistent nature of these emails. These emails were seen across a large number of deployments, which appeared to utilize a strikingly similar fake eFax notification format.

Worryingly, the emails appear to display none of the typical ‘trademark’ identifiers often seen for phishing emails, such as spoofed or impersonated email addresses or suspicious link strings. For this reason, they go undetected by products such as Microsoft’s spam and phishing tools. As such, they are currently being delivered to recipients’ inboxes without any alteration or addition of safety features.

This activity appears to represent a significant and currently unrecognized external threat. Whilst the novel nature of the activity allowed it to easily bypass legacy tools, a more nuanced understanding of the human behind the email address allowed Darktrace’s AI to uniquely identify this series of emails as highly threatening. The technology recognized that the links and domains were highly unusual, not only in the context of the recipients’ normal behavior, but the ‘pattern of life’ of their peer group and the organization at large.

An unprecedented convergence of personal and professional

While IT and compliance teams are having to find ways to keep digital environments secure in remote working conditions, users are also changing their own behavior – not only in terms of devices and tools accessed, but also in what content and files are consumed and interacted with. This convergence of the personal and the professional, and the resulting expansion in the attack surface, presents a new set of challenges to security teams. Compromised email credentials and hijacked accounts become even harder to spot.

Securing these environments requires technology that can adapt to the new way of working, without having to explicitly reconfigure or re-write the rules. Digital activity has changed overnight, and will only continue to change – security tools that cannot adapt and grow with that change will fast become redundant. By continuously learning and evolving its understanding of every user and device, AI is being relied upon to protect workers, especially as we now shift our behavior to use more cloud-based communication and collaboration tools.

Adaptive AI-powered attacks

A recent Forrester report found that over half of security professionals expect AI-augmented cyber-attacks to be made evident to the public within the next twelve months. One way this is likely to manifest itself is with the automation of well-crafted spear phishing campaigns.

As attackers use AI to better understand the type of content that each user interacts with, along with the prevalent emotions that drive each individual user, malware or malicious links can be masked in content that is highly targeted to specific users. Individuals who are actively seeking information on particular topics, or are more likely to share and forward light-hearted, humorous content may be targeted more frequently or aggressively.

Using AI to study the target, hackers can leverage insights at a speed and scale never seen before. With sophisticated domain spoofing, indiscriminate writing styles, and carefully hidden malicious links, human analysts and traditional security tools alike will stand little chance.

To prepare for this next wave of attacks, security teams themselves are relying on AI that analyzes emails in light of behaviors across email platforms and the organization at large. Rather than analyzing emails in isolation and at a single point in time, Cyber AI correlates insights over time, and continuously revisits emails many thousands of times as new evidence emerges.

While traditional defenses ask whether elements of an email have been observed in historical attacks, Antigena Email is the only solution that can reliably ask whether it would be unusual for a recipient to interact with a given email in the context of their normal ‘pattern of life’, as well as that of their peers and the wider organization. This contextual knowledge allows the AI to make highly accurate decisions and neutralize the full range of email attacks – from ‘clean’ spoofing emails that seek to wire a fraudulent payment to sophisticated spear phishing attempts.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Mariana Pereira
VP, Field CISO

More in this series

No items found.

Blog

/

Cloud

/

June 12, 2025

Breaking Silos: Why Unified Security is Critical in Hybrid World

laptop with statistics on itDefault blog imageDefault blog image

Hybrid environments demand end-to-end visibility to stop modern attacks

Hybrid environments are a dominant trend in enterprise technology, but they continue to present unique issues to the defenders tasked with securing them. By 2026, Gartner predicts that 75% of organizations will adopt hybrid cloud strategies [1]. At the same time, only 23% of organizations report full visibility across cloud environments [2].

That means a strong majority of organizations do not have comprehensive visibility across both their on-premises and cloud networks. As a result, organizations are facing major challenges in achieving visibility and security in hybrid environments. These silos and fragmented security postures become a major problem when considering how attacks can move between different domains, exploiting the gaps.

For example, an attack may start with a phishing email, leading to the compromise of a cloud-based application identity and then moving between the cloud and network to exfiltrate data. Some attack types inherently involve multiple domains, like lateral movement and supply chain attacks, which target both on-premises and cloud networks.

Given this, unified visibility is essential for security teams to reduce blind spots and detect threats across the entire attack surface.

Risks of fragmented visibility

Silos arise due to separate teams and tools managing on-premises and cloud environments. Many teams have a hand in cloud security, with some common ones including security, infrastructure, DevOps, compliance, and end users, and these teams can all use different tools. This fragmentation increases the likelihood of inconsistent policies, duplicate alerts, and missed threats. And that’s just within the cloud, not even considering the additional defenses involved with network security.

Without a unified security strategy, gaps between these infrastructures and the teams which manage them can leave organizations vulnerable to cyber-attacks. The lack of visibility between on-premises and cloud environments contributes to missed threats and delayed incident response. In fact, breaches involving stolen or compromised credentials take an average of 292 to identify and contain [3]. That’s almost ten months.

The risk of fragmented visibility runs especially high as companies undergo cloud migrations. As organizations transition to cloud environments, they still have much of their data in on-premises networks, meaning that maintaining visibility across both on-premises and cloud environments is essential for securing critical assets and ensuring seamless operations.

Unified visibility is the solution

Unified visibility is achieved by having a single-pane-of-glass view to monitor both on-premises and cloud environments. This type of view brings many benefits, including streamlined detection, faster response times, and reduced complexity.

This can only be accomplished through integrations or interactions between the teams and tools involved with both on-premises security and cloud security.

AI-driven platforms, like Darktrace, are especially well equipped to enable the real-time monitoring and insights needed to sustain unified visibility. This is because they can handle the large amounts of data and data types.

Darktrace accomplishes this by plugging into an organization’s infrastructure so the AI can ingest and analyze data and its interactions within the environment to form an understanding of the organization’s normal behavior, right down to the granular details of specific users and devices. The system continually revises its understanding about what is normal based on evolving evidence.

This dynamic understanding of normal means that the AI engine can identify, with a high degree of precision, events or behaviors that are both anomalous and unlikely to be benign. This helps reduce noise while surfacing real threats, across cloud and on-prem environments without manual tuning.

In this way, given its versatile AI-based, platform approach, Darktrace empowers security teams with real-time monitoring and insights across both the network and cloud.

Unified visibility in the modern threat landscape

As part of the Darktrace ActiveAI Security Platform™, Darktrace / CLOUD works continuously across public, private, hybrid, and multi-cloud deployments. With real-time Cloud Asset Enumeration and Dynamic Architecture Modeling, Darktrace / CLOUD generates up-to-date architecture diagrams, giving SecOps and DevOps teams a unified view of cloud infrastructures.

It is always on the lookout for changes, driven by user and service activity. For example, unusual user activity can significantly raise the asset’s score, prompting Darktrace’s AI to update its architectural view and keep a living record of the cloud’s ever-changing landscape, providing near real-time insights into what’s happening.

This continuous architectural awareness ensures that security teams have a real-time understanding of cloud behavior and not just a static snapshot.

Darktrace / CLOUD’s unified view of AWS and Azure cloud posture and compliance over time.
Figure 1. Darktrace / CLOUD’s unified view of AWS and Azure cloud posture and compliance over time.

With this dynamic cloud visibility and monitoring, Darktrace / CLOUD can help unify and secure environments.

Real world example: Remote access supply chain attacks

Sectop Remote Access Trojan (RAT) malware, also known as ‘ArchClient2,’ is a .NET RAT that contains information stealing capabilities and allows threat actors to monitor and control targeted computers. It is commonly distributed through drive-by downloads of illegitimate software via malvertizing.

Darktrace has been able to detect and respond to Sectop RAT attacks using unified visibility and platform-wide coverage. In one such example, Darktrace observed one device making various suspicious connections to unusual endpoints, likely in an attempt to receive C2 information, perform beaconing activity, and exfiltrate data to the cloud.

This type of supply chain attack can jump from the network to the cloud, so a unified view of both environments helps shorten detection and response times, therefore mitigating potential impact. Darktrace’s ability to detect these cross-domain behaviors stems from its AI-driven, platform-native visibility.

Conclusion

Organizations need unified visibility to secure complex, hybrid environments effectively against threats and attacks. To achieve this type of comprehensive visibility, the gaps between legacy security tools across on-premises and cloud networks can be bridged with platform tools that use AI to boost data analysis for highly accurate behavioral prediction and anomaly detection.

Read more about the latest trends in cloud security in the blog “Protecting Your Hybrid Cloud: The Future of Cloud Security in 2025 and Beyond.”

References:

1. Gartner, May 22, 2023, “10 Strategic Data and Analytics Predictions Through 2028

2. Cloud Security Alliance, February 14, 2024, “Cloud Security Alliance Survey Finds 77% of Respondents Feel Unprepared to Deal with Security Threats

3. IBM, “Cost of a Data Breach Report 2024

Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance

Blog

/

OT

/

June 11, 2025

Proactive OT security: Lessons on supply chain risk management from a rogue Raspberry Pi

man working on computerDefault blog imageDefault blog image

Understanding supply chain risk in manufacturing

For industries running Industrial Control Systems (ICS) such as manufacturing and fast-moving consumer goods (FMCG), complex supply chains mean that disruption to one weak node can have serious impacts to the entire ecosystem. However, supply chain risk does not always originate from outside an organization’s ICS network.  

The implicit trust placed on software or shared services for maintenance within an ICS can be considered a type of insider threat [1], where defenders also need to look ‘from within’ to protect against supply chain risk. Attackers have frequently mobilised this form of insider threat:

  • Many ICS and SCADA systems were compromised during the 2014 Havex Watering Hole attack, where via operators’ implicit trust in the trojanized versions of legitimate applications, on legitimate but compromised websites [2].
  • In 2018, the world’s largest manufacturer of semiconductors and processers shut down production for three days after a supplier installed tainted software that spread to over 10,000 machines in the manufacturer’s network [3].
  • During the 2020 SolarWinds supply chain attack, attackers compromised a version of Orion software that was deployed from SolarWinds’ own servers during a software update to thousands of customers, including tech manufacturing companies such as Intel and Nvidia [4].

Traditional approaches to ICS security have focused on defending against everything from outside the castle walls, or outside of the ICS network. As ICS attacks become more sophisticated, defenders must not solely rely on static perimeter defenses and prevention. 

A critical part of active defense is understanding the ICS environment and how it operates, including all possible attack paths to the ICS including network connections, remote access points, the movement of data across zones and conduits and access from mobile devices. For instance, original equipment manufacturers (OEMs) and vendors often install remote access software or third-party equipment in ICS networks to facilitate legitimate maintenance and support activities, which can unintentionally expand the ICS’ attack surface.  

This blog describes an example of the convergence between supply chain risk and insider risk, when a vendor left a Raspberry Pi device in a manufacturing customer’s ICS network without the customer’s knowledge.

Case study: Using unsupervised machine learning to detect pre-existing security issues

Raspberry Pi devices are commonly used in SCADA environments as low-cost, remotely accessible data collectors [5][6][7]. They are often paired with Industrial Internet of Things (IIoT) for monitoring and tracking [8]. However, these devices also represent a security risk because their small physical size and time-consuming nature of physical inspection makes them easy to overlook. This poses a security risk, as these devices have previously been used to carry out USB-based attacks or to emulate Ethernet-over-USB connections to exfiltrate sensitive data [8][9].

In this incident, a Darktrace customer was unaware that their supplier had installed a Raspberry Pi device on their ICS network. Crucially, the installation occurred prior to Darktrace’s deployment on the customer’s network. 

For other anomaly detection tools, this order of events meant that this third-party device would likely have been treated as part of the customer’s existing infrastructure. However, after Darktrace was deployed, it analyzed the metadata from the encrypted HTTPS and DNS connections that the Raspberry Pi made to ‘call home’ to the supplier and determined that these connections were  unusual compared to the rest of the devices in the network, even in the absence of any malicious indicators of compromise (IoCs).  

Darktrace triggered the following alerts for this unusual activity that consequently notified the customer to the pre-existing threat of an unmanaged device already present in their network:

  • Compromise / Sustained SSL or HTTP Increase
  • Compromise / Agent Beacon (Short Period)
  • Compromise / Agent Beacon (Medium Period)
  • Compromise / Agent Beacon (Long Period)
  • Tags / New Raspberry Pi Device
  • Device / DNS Requests to Unusual Server
  • Device / Anomaly Indicators / Spike in Connections to Rare Endpoint Indicator
Darktrace’s External Sites Summary showing the rarity of the external endpoint that the Raspberry Pi device ‘called home’ to and the model alerts triggered.  
Figure 1: Darktrace’s External Sites Summary showing the rarity of the external endpoint that the Raspberry Pi device ‘called home’ to and the model alerts triggered.  

Darktrace’s Cyber AI Analyst launched an autonomous investigation into the activity, correlating related events into a broader incident and generating a report outlining the potential threat along with supporting technical details.

Darktrace’s anomaly-based detection meant that the Raspberry Pi device did not need to be observed performing clearly malicious behavior to alert the customer to the security risk, and neither can defenders afford to wait for such escalation.

Why is this significant?

In 2021 a similar attack took place. Aiming to poison a Florida water treatment facility, attackers leveraged a TeamViewer instance that had been dormant on the system for six months, effectively allowing the attacker to ‘live off the land’ [10].  

The Raspberry Pi device in this incident also remained outside the purview of the customer’s security team at first. It could have been leveraged by a persistent attacker to pivot within the internal network and communicate externally.

A proactive approach to active defense that seeks to minimize and continuously monitor the attack surface and network is crucial.  

The growing interest in manufacturing from attackers and policymakers

Significant motivations for targeting the manufacturing sector and increasing regulatory demands make the convergence of supply chain risk, insider risk, and the prevalence of stealthy living-off-the-land techniques particularly relevant to this sector.

Manufacturing is consistently targeted by cybercriminals [11], and the sector’s ‘just-in-time’ model grants attackers the opportunity for high levels of disruption. Furthermore, under NIS 2, manufacturing and some food and beverage processing entities are now designated as ‘important’ entities. This means stricter incident reporting requirements within 24 hours of detection, and enhanced security requirements such as the implementation of zero trust and network segmentation policies, as well as measures to improve supply chain resilience [12][13][14].

How can Darktrace help?

Ultimately, Darktrace successfully assisted a manufacturing organization in detecting a potentially disruptive 'near-miss' within their OT environment, even in the absence of traditional IoCs.  Through passive asset identification techniques and continuous network monitoring, the customer improved their understanding of their network and supply chain risk.  

While the swift detection of the rogue device allowed the threat to be identified before it could escalate, the customer could have reduced their time to respond by using Darktrace’s built-in response capabilities, had Darktrace’s Autonomous Response capability been enabled.  Darktrace’s Autonomous Response can be configured to target specific connections on a rogue device either automatically upon detection or following manual approval from the security team, to stop it communicating with other devices in the network while allowing other approved devices to continue operating. Furthermore, the exportable report generated by Cyber AI Analyst helps security teams to meet NIS 2’s enhanced reporting requirements.  

Sophisticated ICS attacks often leverage insider access to perform in-depth reconnaissance for the development of tailored malware capabilities.  This case study and high-profile ICS attacks highlight the importance of mitigating supply chain risk in a similar way to insider risk.  As ICS networks adapt to the introduction of IIoT, remote working and the increased convergence between IT and OT, it is important to ensure the approach to secure against these threats is compatible with the dynamic nature of the network.  

Credit to Nicole Wong (Principal Cyber Analyst), Matthew Redrup (Senior Analyst and ANZ Team Lead)

[related-resource]

Appendices

MITRE ATT&CK Mapping

  • Infrastructure / New Raspberry Pi Device - INITIAL ACCESS - T1200 Hardware Additions
  • Device / DNS Requests to Unusual Server - CREDENTIAL ACCESS, COLLECTION - T1557 Man-in-the-Middle
  • Compromise / Agent Beacon - COMMAND AND CONTROL - T1071.001 Web Protocols

References

[1] https://www.cisa.gov/topics/physical-security/insider-threat-mitigation/defining-insider-threats

[2] https://www.trendmicro.com/vinfo/gb/threat-encyclopedia/web-attack/139/havex-targets-industrial-control-systems

[3]https://thehackernews.com/2018/08/tsmc-wannacry-ransomware-attack.html

[4] https://www.theverge.com/2020/12/21/22194183/intel-nvidia-cisco-government-infected-solarwinds-hack

[5] https://www.centreon.com/monitoring-ot-with-raspberry-pi-and-centreon/

[6] https://ieeexplore.ieee.org/document/9107689

[7] https://www.linkedin.com/pulse/webicc-scada-integration-industrial-raspberry-pi-devices-mryff

[8] https://www.rowse.co.uk/blog/post/how-is-the-raspberry-pi-used-in-the-iiot

[9] https://sepiocyber.com/resources/whitepapers/raspberry-pi-a-friend-or-foe/#:~:text=Initially%20designed%20for%20ethical%20purposes,as%20cyberattacks%20and%20unauthorized%20access

[10] https://edition.cnn.com/2021/02/10/us/florida-water-poison-cyber/index.html

[11] https://www.mxdusa.org/2025/02/13/top-cyber-threats-in-manufacturing/

[12] https://www.shoosmiths.com/insights/articles/nis2-what-manufacturers-and-distributors-need-to-know-about-europes-new-cybersecurity-regime

[13] https://www.goodaccess.com/blog/nis2-require-zero-trust-essential-security-measure#zero-trust-nis2-compliance

[14] https://logisticsviewpoints.com/2024/11/06/the-impact-of-nis-2-regulations-on-manufacturing-supply-chains/

Continue reading
About the author
Nicole Wong
Cyber Security Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI