Detecting Metamorphic Malware with Darktrace's AI Technology
Detect metamorphic malware with Darktrace's AI. Learn how it uncovers self-modifying cyber-attacks and stops threats that evade traditional security measures.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Justin Fier
SVP, Red Team Operations
Share
30
Jul 2017
Some of the most insidious threats that Darktrace finds use self-modifying technology to hide their presence on the network. These attacks can dynamically change their threat signatures, automatically extract data, and spread without a human controller.
Recently, we discovered anomalous activity on the network of a major US university. After investigation, we found that the anomaly was the ‘Smoke Malware Loader’ which employs numerous techniques to evade internal security. Most notably, the malware generates fake traffic to hide its presence.
Darktrace observed the initial infection when three anomalous executables were transferred over plain text. The malware did not match any known threat signatures, allowing it to bypass the network’s perimeter controls.
C1ulyq1wLrMBs6LG00 on Thu Sep 8, 13:19:01 Co2eAJ2GifEkWut700 on Thu Sep 8, 12:09:52 CdcZeu200UOsuf5u00 on Wed Sep 14, 16:38:44
The connections originated from a suspicious external domain that the company had never communicated with before:
lago666[.]com (91.243.193.149)
Both the anomalous download and the beaconing activity represented major deviations from the unique ‘pattern of life’ learned by the Enterprise Immune System.
Although the payload circumvented the network’s perimeter security, the company also had an alternate security system monitoring network flow. This tool raised an alert when the download occurred, but it was deemed a ‘false positive’ because the malware proceeded to install new, previously unknown versions of the executable to the Windows registry.
After the self-modifying modules were uploaded to the company device, a large number of HTTP POST requests were sent against /smk/log.php to the following domains:
The malware attempted to transfer data to these external destinations, but to hide its tracks, the remote machine replied with a fake 404 error code. These connections were deemed highly anomalous by Darktrace’s AI algorithms.
Since the payload was designed to be compatible with the password grabber module2 – which is often deployed side-by-side with Smoke Malware Loader – the data attempting to leave the network likely contained user credentials and passwords.
In conjunction with the initial transfer, another anomalous file was then delivered to a different device. This activity indicated that the threat actor was likely attempting to move laterally across the network:
hxxp://cdn.che[.]moe/izgmcx.exe (connection UID: CGH6uV3G5tdKSNY800) to 10.1.105.117 on Mon Sep 12 at 08:02:03.
Darktrace detected each anomaly in real time as the situation developed. By using AI algorithms to continuously learn normal behavior, Darktrace was able to monitor the malware’s changing threat signature.
Traditional security tools – no matter how advanced – are incapable of detecting such sophisticated threats. Legacy controls rely on rules and signatures, and these threats are specifically designed to bypass rules and signatures.
Darktrace’s real-time threat detection allowed the university’s security team to quarantine the infected devices before the malware could burrow deeper into the network, and before the attacker could use the passwords to further compromise the network. Darktrace then assisted the security team as they remediated the situation and changed their security protocols and passwords.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
CVE-2026-1731: How Darktrace Sees the BeyondTrust Exploitation Wave Unfolding
Note: Darktrace's Threat Research team is publishing now to help defenders. We will update continue updating this blog as our investigations unfold.
Background
On February 6, 2026, the Identity & Access Management solution BeyondTrust announced patches for a vulnerability, CVE-2026-1731, which enables unauthenticated remote code execution using specially crafted requests. This vulnerability affects BeyondTrust Remote Support (RS) and particular older versions of Privileged Remote Access (PRA) [1].
A Proof of Concept (PoC) exploit for this vulnerability was released publicly on February 10, and open-source intelligence (OSINT) reported exploitation attempts within 24 hours [2].
Previous intrusions against Beyond Trust technology have been cited as being affiliated with nation-state attacks, including a 2024 breach targeting the U.S. Treasury Department. This incident led to subsequent emergency directives from the Cybersecurity and Infrastructure Security Agency (CISA) and later showed attackers had chained previously unknown vulnerabilities to achieve their goals [3].
Additionally, there appears to be infrastructure overlap with React2Shell mass exploitation previously observed by Darktrace, with command-and-control (C2) domain avg.domaininfo[.]top seen in potential post-exploitation activity for BeyondTrust, as well as in a React2Shell exploitation case involving possible EtherRAT deployment.
Darktrace Detections
Darktrace’s Threat Research team has identified highly anomalous activity across several customers that may relate to exploitation of BeyondTrust since February 10, 2026. Observed activities include:
- Outbound connections and DNS requests for endpoints associated with Out-of-Band Application Security Testing; these services are commonly abused by threat actors for exploit validation. Associated Darktrace models include:
o Compromise / Possible Tunnelling to Bin Services
o Compromise / High Priority Crypto Currency Mining
And model alerts for:
o Compromise / Rare Domain Pointing to Internal IP
IT Defenders: As part of best practices, we highly recommend employing an automated containment solution in your environment. For Darktrace customers, please ensure that Autonomous Response is configured correctly. More guidance regarding this activity and suggested actions can be found in the Darktrace Customer Portal.
Appendices
Potential indicators of post-exploitation behavior:
AI/LLM-Generated Malware Used to Exploit React2Shell
Introduction
To observe adversary behavior in real time, Darktrace operates a global honeypot network known as “CloudyPots”, designed to capture malicious activity across a wide range of services, protocols, and cloud platforms. These honeypots provide valuable insights into the techniques, tools, and malware actively targeting internet‑facing infrastructure.
A recently observed intrusion against Darktrace’s Cloudypots environment revealed a fully AI‑generated malware sample exploiting CVE-2025-55182, also known as React2Shell. As AI‑assisted software development (“vibecoding”) becomes more widespread, attackers are increasingly leveraging large language models to rapidly produce functional tooling. This incident illustrates a broader shift: AI is now enabling even low-skill operators to generate effective exploitation frameworks at speed. This blog examines the attack chain, analyzes the AI-generated payload, and outlines what this evolution means for defenders.
Initial access
The intrusion was observed against the Darktrace Docker honeypot, which intentionally exposes the Docker daemon internet-facing with no authentication. This configuration allows any attacker to discover the daemon and create a container via the Docker API.
The attacker was observed spawning a container named “python-metrics-collector”, configured with a start up command that first installed prerequisite tools including curl, wget, and python 3.
Figure 1: Container spawned with the name ‘python-metrics-collector’.
Subsequently, it will download a list of required python packages from
hxxps://pastebin[.]com/raw/Cce6tjHM,
Finally it will download and run a python script from:
hxxps://smplu[.]link/dockerzero.
This link redirects to a GitHub Gist hosted by user “hackedyoulol”, who has since been banned from GitHub at time of writing.
Notably the script did not contain a docker spreader – unusual for Docker-focused malware – indicating that propagation was likely handled separately from a centralized spreader server.
Deployed components and execution chain
The downloaded Python payload was the central execution component for the intrusion. Obfuscation by design within the sample was reinforced between the exploitation script and any spreading mechanism. Understanding that docker malware samples typically include their own spreader logic, the omission suggests that the attacker maintained and executed a dedicated spreading tool remotely.
The script begins with a multi-line comment: """ Network Scanner with Exploitation Framework Educational/Research Purpose Only Docker-compatible: No external dependencies except requests """
This is very telling, as the overwhelming majority of samples analysed do not feature this level of commentary in files, as they are often designed to be intentionally difficult to understand to hinder analysis. Quick scripts written by human operators generally prioritize speed and functionality over clarity. LLMs on the other hand will document all code with comments very thoroughly by design, a pattern we see repeated throughout the sample. Further, AI will refuse to generate malware as part of its safeguards.
The presence of the phrase “Educational/Research Purpose Only” additionally suggests that the attacker likely jailbroke an AI model by framing the malicious request as educational.
When portions of the script were tested in AI‑detection software, the output further indicated that the code was likely generated by a large language model.
Figure 2: GPTZero AI-detection results indicating that the script was likely generated using an AI model.
The script is a well constructed React2Shell exploitation toolkit, which aims to gain remote code execution and deploy a XMRig (Monero) crypto miner. It uses an IP‑generation loop to identify potential targets and executes a crafted exploitation request containing:
A deliberately structured Next.js server component payload
A chunk designed to force an exception and reveal command output
A child process invocation to run arbitrary shell commands
def execute_rce_command(base_url, command, timeout=120): """ ACTUAL EXPLOIT METHOD - Next.js React Server Component RCE DO NOT MODIFY THIS FUNCTION Returns: (success, output) """ try: # Disable SSL warnings urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
res = requests.post(base_url, files=files, headers=headers, timeout=timeout, verify=False)
This function is initially invoked with ‘whoami’ to determine if the host is vulnerable, before using wget to download XMRig from its GitHub repository and invoking it with a configured mining pool and wallet address.
Many attackers do not realise that while Monero uses an opaque blockchain (so transactions cannot be traced and wallet balances cannot be viewed), mining pools such as supportxmr will publish statistics for each wallet address that are publicly available. This makes it trivial to track the success of the campaign and the earnings of the attacker.
Figure 3: The supportxmr mining pool overview for the attackers wallet address
Based on this information we can determine the attacker has made approx 0.015 XMR total since the beginning of this campaign, which as of writing is valued at £5. Per day, the attacker is generating 0.004 XMR, which is £1.33 as of writing. The worker count is 91, meaning that 91 hosts have been infected by this sample.
Conclusion
While the amount of money generated by the attacker in this case is relatively low, and cryptomining is far from a new technique, this campaign is proof that AI based LLMs have made cybercrime more accessible than ever. A single prompting session with a model was sufficient for this attacker to generate a functioning exploit framework and compromise more than ninety hosts, demonstrating that the operational value of AI for adversaries should not be underestimated.
CISOs and SOC leaders should treat this event as a preview of the near future. Threat actors can now generate custom malware on demand, modify exploits instantly, and automate every stage of compromise. Defenders must prioritize rapid patching, continuous attack surface monitoring, and behavioral detection approaches. AI‑generated malware is no longer theoretical — it is operational, scalable, and accessible to anyone.
Analyst commentary
It is worth noting that the downloaded script does not appear to include a Docker spreader, meaning the malware will not replicate to other victims from an infected host. This is uncommon for Docker malware, based on other samples analyzed by Darktrace researchers. This indicates that there is a separate script responsible for spreading, likely deployed by the attacker from a central spreader server. This theory is supported by the fact that the IP that initiated the connection, 49[.]36.33.11, is registered to a residential ISP in India. While it is possible the attacker is using a residential proxy server to cover their tracks, it is also plausible that they are running the spreading script from their home computer. However, this should not be taken as confirmed attribution.
Credit to Nathaniel Bill (Malware Research Engineer), Nathaniel Jones ( VP Threat Research | Field CISO AI Security)
.jpg)
