Securing our team’s inboxes has long been a challenge at McLaren Racing. Even before COVID-19 hit, our workforce was incredibly dynamic; we’d been used to effectively setting up a remote office at tracks around the world every other weekend for the last 30 years. We were therefore used to people emailing at an extremely high rate while not always being centralised in a single location.
Collaboration is key for this team, with both our partners and key suppliers. Sharing data happens every day and a variety of methods are used – ranging from sensitive car designs to confidential track-side data.
The email attacks targeting our users have advanced considerably in the last year or two, with attackers seeking to solicit fraudulent payments, or trying to access our own intellectual property. Increasingly sophisticated social engineering attempts meant that our users continued to engage with these phishing and spoofing emails, despite having an array of tools and procedures in place to avoid such an eventuality.
Last year we extended Darktrace’s coverage to our inbox, and now have an intelligent AI security solution understanding ‘patterns of life’ for every Microsoft 365 user in order to spot attacks. Darktrace has allowed the security team here to stay ahead of the most advanced email threats, rather than respond retrospectively to attacks that manage to slip through traditional defences.
Training our workforce to spot attacks
Previously we relied on threat intelligence feeds and retrospective security tools that blocked malicious addresses, domains and URLs, but regardless, a small volume of phishing emails would still reach user mailboxes. Typically, these emails would be well-researched and highly contextualised, targeted to the recipient and sometimes indistinguishable from genuine communications. Despite running employee awareness programs, a proportion of these malicious emails would be acted on by users, leading to account compromises and fraud attempts. Our security resources were then consumed with reacting to these incidents rather than proactively improving security at McLaren Racing.
We run cyber awareness weeks, in collaboration with many of our partners, simulating our own phishing campaigns to teach our workforce how to spot attacks. But these education programs have become harder to communicate with the increase of remote working. Employee engagement was always key and that meant a larger resource strain on our security team, who would typically spend a lot of time with our senior stakeholders, helping them identify spoof emails and working with them on putting business processes in place.
This was a long and arduous process, and it’s difficult to expect our employees to spot the increasingly subtle signs of an email attack. With the sophistication of modern email attacks, the research that goes into them, and the level of social engineering in play, phishing attacks do inevitably still get through both humans and rudimentary defences.
Turning to cyber AI
Working with our partner Darktrace, we deployed their email security technology, Darktrace/Email, and worked on the configuration and installation together. We were able to see results in days. The volume of phishing emails reported by users fell substantially, and over time with Autonomous Response, the regular reviews of Darktrace/Email’s actions has led us to discover many phishing campaigns that we were previously unaware of.
Darktrace’s actions are taken in the context of the business, holding back emails only as a last resort (less than 1% in our environment), and catching only the genuinely malicious emails rather than producing a load of false positives. The actions are also targeted and proportionate, varying from moving emails to junk to converting attachments and locking links, giving us the flexibility we need.
With Darktrace/Email constantly learning and stopping advanced email attacks, the pressure has been taken off the rest of the team, who can now spend their time working with the business supporting new initiatives and collaborating on new areas of innovation.
Stopping a targeted credential-grabbing attack targeting the C-suite
As with many organisations, it’s often our C-suite that gets targeted by the most malicious mails, and Darktrace/Email recently detected an email sent to one of our executives, prompting them to sign a financial document. The email appeared to come from DocuSign, and contained a malicious link hidden behind the text ‘Review Document’.
If the link is clicked on, two types of scenarios usually follow from these kind of email attacks. Either the user is led to a fake (and often very convincing) login page which captures credentials, or the document itself contains a legitimate-looking invoice, but with one crucial element changed – the bank details. Accounts teams and CFOs are targeted with this kind of attack on a regular basis, but in this case, the attackers were after the executive’s credentials.
Had the executive clicked through and attempted to log in, they would unknowingly have been sending their credentials to the attacker, who then could have used this information to gather sensitive data from their inbox or other SaaS accounts, or send additional malicious emails from the account to make further inroads into our organisation.
The email was sent over the Imola GP race weekend, which was a high-pressured 48 hours for the whole team, as we ran in a new format without Friday practice, bringing a new intensity to the race weekend. However, Darktrace/Email was on guard, recognising the sender as a new contact and deeming the link to be suspicious. With suitable concerns over the email, Darktrace’s AI double locked the link and automatically moved the email to the executive’s Junk folder. All without having to alert the on-call cyber security team over the weekend.
With attacks like this coming in every day, relying on McLaren’s workforce to distinguish real from fake will never realistically protect us from every single threat. With credential harvesting and account takeover on the rise, it really felt like a matter of time before just one phishing email was successful and the floodgates were opened. But with Darktrace/Email, we can rest assured that we have a powerful AI solution keeping us safe, on and off the track.
![Model alert in Darktrace / NETWORK showing the repeated SSL connections to a rare external Self-Signed endpoint, 185.49.126[.]50.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823ad5f8454ff831da3182a_Screenshot%202025-05-13%20at%201.35.56%E2%80%AFPM.avif)
![Darktrace’s detection of repeated connections to the suspicious IP address 185.49.126[.]50 over port 6606, indicative of beaconing behavior.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823adc5ac5c997938babf30_Screenshot%202025-05-13%20at%201.38.15%E2%80%AFPM.avif)
![Darktrace's Autonomous Response actions blocking the suspicious IP address,185.49.126[.]50.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6825268603a7a2b1459c9fea_Figure%204.avif)
![Darktrace’s detection of connections to the suspicious endpoint 195.26.255[.]81, where the default ports (6606, 7707, and 8808) for AsyncRAT were observed.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823ae6e325a742b23ef6e6d_Screenshot%202025-05-13%20at%201.41.09%E2%80%AFPM.avif)
![Darktrace's detection of a connection to the suspicious IP address 195.26.255[.]81 and the domain name identified under the common name (CN) of a certificate as AsyncRAT Server](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823aea233fc6374c1432604_Screenshot%202025-05-13%20at%201.42.00%E2%80%AFPM.avif)
![Darktrace’s Autonomous Response applied a total of nine actions against the IP address 191.96.207[.]246 and the domain 'kashuub[.]com', successfully blocking the connections.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823af1b3cbc7734f47fc15b_Screenshot%202025-05-13%20at%201.43.56%E2%80%AFPM.avif)
