October 9, 2025

Inside Akira’s SonicWall Campaign: Darktrace’s Detection and Response

Starting in July 2025, Akira ransomware attacks surged globally, targeting SonicWall SSL VPN devices. In August, Darktrace detected suspicious activity in a US network, including scanning, lateral movement, and data exfiltration. A compromised SonicWall VPN server linked the incident to the broader Akira campaign exploiting known vulnerabilities.

Written by

Emily Megan Lim

Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Emily Megan Lim

Cyber Analyst

Oct 2025

Introduction: Background on Akira SonicWall campaign

Between July and August 2025, security teams worldwide observed a surge in Akira ransomware incidents involving SonicWall SSL VPN devices [1]. Initially believed to be the result of an unknown zero-day vulnerability, SonicWall later released an advisory announcing that the activity was strongly linked to a previously disclosed vulnerability, CVE-2024-40766, first identified over a year earlier [2].

On August 20, 2025, Darktrace observed unusual activity on the network of a customer in the US. Darktrace detected a range of suspicious activity, including network scanning and reconnaissance, lateral movement, privilege escalation, and data exfiltration. One of the compromised devices was later identified as a SonicWall virtual private network (VPN) server, suggesting that the incident was part of the broader Akira ransomware campaign targeting SonicWall technology.

As the customer was subscribed to the Managed Detection and Response (MDR) service, Darktrace’s Security Operations Centre (SOC) team was able to rapidly triage critical alerts, restrict the activity of affected devices, and notify the customer of the threat. As a result, the impact of the attack was limited - approximately 2 GiB of data had been observed leaving the network, but any further escalation of malicious activity was stopped.

Threat Overview

CVE-2024-40766 and other misconfigurations

CVE-2024-40766 is an improper access control vulnerability in SonicWall’s SonicOS, affecting Gen 5, Gen 6, and Gen 7 devices running SonicOS version 7.0.1 5035 and earlier [3]. The vulnerability was disclosed on August 23, 2024, with a patch released the same day. Shortly after, it was reported to be exploited in the wild by Akira ransomware affiliates and others [4].

Almost a year later, the same vulnerability is being actively targeted again by the Akira ransomware group. In addition to exploiting unpatched devices affected by CVE-2024-40766, security researchers have identified three other risks potentially being leveraged by the group [5]:

*The Virtual Office Portal can be used to initially set up MFA/TOTP configurations for SSLVPN users.

Thus, even if SonicWall devices were patched, threat actors could still target them for initial access by reusing previously stolen credentials and exploiting other misconfigurations.

Akira Ransomware

Akira ransomware was first observed in the wild in March 2023 and has since become one of the most prolific ransomware strains across the threat landscape [6]. The group operates under a Ransomware-as-a-Service (RaaS) model and frequently uses double extortion tactics, pressuring victims to pay not only to decrypt files but also to prevent the public release of sensitive exfiltrated data.

The ransomware initially targeted Windows systems, but a Linux variant was later observed targeting VMware ESXi virtual machines [7]. In 2024, it was assessed that Akira would continue to target ESXi hypervisors, making attacks highly disruptive due to the central role of virtualisation in large-scale cloud deployments. Encrypting the ESXi file system enables rapid and widespread encryption with minimal lateral movement or credential theft. The lack of comprehensive security protections on many ESXi hypervisors also makes them an attractive target for ransomware operators [8].

Victimology

Akira is known to target organizations across multiple sectors, most notably those in manufacturing, education, and healthcare. These targets span multiple geographic regions, including North America, Latin America, Europe and Asia-Pacific [9].

Figure 1: Geographical distribution of organization’s affected by Akira ransomware in 2025 [9].

Common Tactics, Techniques and Procedures (TTPs) [7][10]

Initial Access
Targets remote access services such as RDP and VPN through vulnerability exploitation or stolen credentials.

Reconnaissance
Uses network scanning tools like SoftPerfect and Advanced IP Scanner to map the environment and identify targets.

Lateral Movement
Moves laterally using legitimate administrative tools, typically via RDP.

Persistence
Employs techniques such as Kerberoasting and pass-the-hash, and tools like Mimikatz to extract credentials. Known to create new domain accounts to maintain access.

Command and Control
Utilizes remote access tools including AnyDesk, RustDesk, Ngrok, and Cloudflare Tunnel.

Exfiltration
Uses tools such as FileZilla, WinRAR, WinSCP, and Rclone. Data is exfiltrated via protocols like FTP and SFTP, or through cloud storage services such as Mega.

Darktrace’s Coverage of Akira ransomware

Reconnaissance

Darktrace first detected of unusual network activity around 05:10 UTC, when a desktop device was observed performing a network scan and making an unusual number of DCE-RPC requests to the endpoint mapper (epmapper) service. Network scans are typically used to identify open ports, while querying the epmapper service can reveal exposed RPC services on the network.

Multiple other devices were also later seen with similar reconnaissance activity, and use of the Advanced IP Scanner tool, indicated by connections to the domain advanced-ip-scanner[.]com.

Lateral movement

Shortly after the initial reconnaissance, the same desktop device exhibited unusual use of administrative tools. Darktrace observed the user agent “Ruby WinRM Client” and the URI “/wsman” as the device initiated a rare outbound Windows Remote Management (WinRM) connection to two domain controllers (REDACTED-dc1 and REDACTED-dc2). WinRM is a Microsoft service that uses the WS-Management (WSMan) protocol to enable remote management and control of network devices.

Darktrace also observed the desktop device connecting to an ESXi device (REDACTED-esxi1) via RDP using an LDAP service credential, likely with administrative privileges.

Credential access

At around 06:26 UTC, the desktop device was seen fetching an Active Directory certificate from the domain controller (REDACTED-dc1) by making a DCE-RPC request to the ICertPassage service. Shortly after, the device made a Kerberos login using the administrative credential.

Figure 3: Darktrace’s detection of the of anomalous certificate download and subsequent Kerberos login.

Further investigation into the device’s event logs revealed a chain of connections that Darktrace’s researchers believe demonstrates a credential access technique known as “UnPAC the hash.”

This method begins with pre-authentication using Kerberos’ Public Key Cryptography for Initial Authentication (PKINIT), allowing the client to use an X.509 certificate to obtain a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) instead of a password.

The next stage involves User-to-User (U2U) authentication when requesting a Service Ticket (ST) from the KDC. Within Darktrace's visibility of this traffic, U2U was indicated by the client and service principal names within the ST request being identical. Because PKINIT was used earlier, the returned ST contains the NTLM hash of the credential, which can then be extracted and abused for lateral movement or privilege escalation [11].

Flowchart of Kerberos PKINIT pre-authentication and U2U authentication [12]. — Figure 4: Flowchart of Kerberos PKINIT pre-authentication and U2U authentication [12]

Figure 5: Device event log showing the Kerberos Login and Kerberos Ticket events

Analysis of the desktop device’s event logs revealed a repeated sequence of suspicious activity across multiple credentials. Each sequence included a DCE-RPC ICertPassage request to download a certificate, followed by a Kerberos login event indicating PKINIT pre-authentication, and then a Kerberos ticket event consistent with User-to-User (U2U) authentication.

Darktrace identified this pattern as highly unusual. Cyber AI Analyst determined that the device used at least 15 different credentials for Kerberos logins over the course of the attack.

By compromising multiple credentials, the threat actor likely aimed to escalate privileges and facilitate further malicious activity, including lateral movement. One of the credentials obtained via the “UnPAC the hash” technique was later observed being used in an RDP session to the domain controller (REDACTED-dc2).

C2 / Additional tooling

At 06:44 UTC, the domain controller (REDACTED-dc2) was observed initiating a connection to temp[.]sh, a temporary cloud hosting service. Open-source intelligence (OSINT) reporting indicates that this service is commonly used by threat actors to host and distribute malicious payloads, including ransomware [13].

Shortly afterward, the ESXi device was observed downloading an executable named “vmwaretools” from the rare external endpoint 137.184.243[.]69, using the user agent “Wget.” The repeated outbound connections to this IP suggest potential command-and-control (C2) activity.

Figure 6: Cyber AI Analyst investigation into the suspicious file download and suspected C2 activity between the ESXI device and the external endpoint 137.184.243[.]69.

Figure 7: Packet capture (PCAP) of connections between the ESXi device and 137.184.243[.]69.

Data exfiltration

The first signs of data exfiltration were observed at around 7:00 UTC. Both the domain controller (REDACTED-dc2) and a likely SonicWall VPN device were seen uploading approximately 2 GB of data via SSH to the rare external endpoint 66.165.243[.]39 (AS29802 HVC-AS). OSINT sources have since identified this IP as an indicator of compromise (IoC) associated with the Akira ransomware group, known to use it for data exfiltration [14].

Cyber AI Analyst

Throughout the course of the attack, Darktrace’s Cyber AI Analyst autonomously investigated the anomalous activity as it unfolded and correlated related events into a single, cohesive incident. Rather than treating each alert as isolated, Cyber AI Analyst linked them together to reveal the broader narrative of compromise. This holistic view enabled the customer to understand the full scope of the attack, including all associated activities and affected assets that might otherwise have been dismissed as unrelated.

Containing the attack

In response to the multiple anomalous activities observed across the network, Darktrace's Autonomous Response initiated targeted mitigation actions to contain the attack. These included:

Blocking connections to known malicious or rare external endpoints, such as 137.184.243[.]69, 66.165.243[.]39, and advanced-ip-scanner[.]com.
Blocking internal traffic to sensitive ports, including 88 (Kerberos), 3389 (RDP), and 49339 (DCE-RPC), to disrupt lateral movement and credential abuse.
Enforcing a block on all outgoing connections from affected devices to contain potential data exfiltration and C2 activity.

Figure 10: Autonomous Response actions taken by Darktrace on an affected device, including the blocking of malicious external endpoints and internal service ports.

Managed Detection and Response

As this customer was an MDR subscriber, multiple Enhanced Monitoring alerts—high-fidelity models designed to detect activity indicative of compromise—were triggered across the network. These alerts prompted immediate investigation by Darktrace’s SOC team.

Upon determining that the activity was likely linked to an Akira ransomware attack, Darktrace analysts swiftly acted to contain the threat. At around 08:05 UTC, devices suspected of being compromised were quarantined, and the customer was promptly notified, enabling them to begin their own remediation procedures without delay.

A wider campaign?

Darktrace’s SOC and Threat Research teams identified at least three additional incidents likely linked to the same campaign. All targeted organizations were based in the US, spanning various industries, and each have indications of using SonicWall VPN, indicating it had likely been targeted for initial access.

Across these incidents, similar patterns emerged. In each case, a suspicious executable named “vmwaretools” was downloaded from the endpoint 85.239.52[.]96 using the user agent “Wget”, bearing some resemblance to the file downloads seen in the incident described here. Data exfiltration was also observed via SSH to the endpoints 107.155.69[.]42 and 107.155.93[.]154, both of which belong to the same ASN also seen in the incident described in this blog: S29802 HVC-AS. Notably, 107.155.93[.]154 has been reported in OSINT as an indicator associated with Akira ransomware activity [15]. Further recent Akira ransomware cases have been observed involving SonicWall VPN, where no similar executable file downloads were observed, but SSH exfiltration to the same ASN was. These overlapping and non-overlapping TTPs may reflect the blurring lines between different affiliates operating under the same RaaS.

Lessons from the campaign

This campaign by Akira ransomware actors underscores the critical importance of maintaining up-to-date patching practices. Threat actors continue to exploit previously disclosed vulnerabilities, not just zero-days, highlighting the need for ongoing vigilance even after patches are released. It also demonstrates how misconfigurations and overlooked weaknesses can be leveraged for initial access or privilege escalation, even in otherwise well-maintained environments.

Darktrace’s observations further reveal that ransomware actors are increasingly relying on legitimate administrative tools, such as WinRM, to blend in with normal network activity and evade detection. In addition to previously documented Kerberos-based credential access techniques like Kerberoasting and pass-the-hash, this campaign featured the use of UnPAC the hash to extract NTLM hashes via PKINIT and U2U authentication for lateral movement or privilege escalation.

Credit to Emily Megan Lim (Senior Cyber Analyst), Vivek Rajan (Senior Cyber Analyst), Ryan Traill (Analyst Content Lead), and Sam Lister (Specialist Security Researcher)

Appendices

Darktrace Model Detections

Anomalous Connection / Active Remote Desktop Tunnel

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / New User Agent to IP Without Hostname

Anomalous Connection / Possible Data Staging and External Upload

Anomalous Connection / Rare WinRM Incoming

Anomalous Connection / Rare WinRM Outgoing

Anomalous Connection / Uncommon 1 GiB Outbound

Anomalous Connection / Unusual Admin RDP Session

Anomalous Connection / Unusual Incoming Long Remote Desktop Session

Anomalous Connection / Unusual Incoming Long SSH Session

Anomalous Connection / Unusual Long SSH Session

Anomalous File / EXE from Rare External Location

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous Server Activity / Outgoing from Server

Anomalous Server Activity / Rare External from Server

Compliance / Default Credential Usage

Compliance / High Priority Compliance Model Alert

Compliance / Outgoing NTLM Request from DC

Compliance / SSH to Rare External Destination

Compromise / Large Number of Suspicious Successful Connections

Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

Device / Anomalous Certificate Download Activity

Device / Anomalous SSH Followed By Multiple Model Alerts

Device / Anonymous NTLM Logins

Device / Attack and Recon Tools

Device / ICMP Address Scan

Device / Large Number of Model Alerts

Device / Network Range Scan

Device / Network Scan

Device / New User Agent To Internal Server

Device / Possible SMB/NTLM Brute Force

Device / Possible SMB/NTLM Reconnaissance

Device / RDP Scan

Device / Reverse DNS Sweep

Device / Suspicious SMB Scanning Activity

Device / UDP Enumeration

Unusual Activity / Unusual External Data to New Endpoint

Unusual Activity / Unusual External Data Transfer

User / Multiple Uncommon New Credentials on Device

User / New Admin Credentials on Client

User / New Admin Credentials on Server

Enhanced Monitoring Models

Compromise / Anomalous Certificate Download and Kerberos Login

Device / Initial Attack Chain Activity

Device / Large Number of Model Alerts from Critical Network Device

Device / Multiple Lateral Movement Model Alerts

Device / Suspicious Network Scan Activity

Unusual Activity / Enhanced Unusual External Data Transfer

Antigena/Autonomous Response Models

Antigena / Network / External Threat / Antigena File then New Outbound Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

Antigena / Network / External Threat / Antigena Suspicious File Block

Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block

Antigena / Network / Insider Threat / Antigena Network Scan Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Block

Antigena / Network / Manual / Quarantine Device

Antigena / Network / Significant Anomaly / Antigena Alerts Over Time Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Alert

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block

Antigena / Network / Significant Anomaly / Repeated Antigena Alerts

List of Indicators of Compromise (IoCs)

· 66.165.243[.]39 – IP Address – Data exfiltration endpoint

· 107.155.69[.]42 – IP Address – Probable data exfiltration endpoint

· 107.155.93[.]154 – IP Address – Likely Data exfiltration endpoint

· 137.184.126[.]86 – IP Address – Possible C2 endpoint

· 85.239.52[.]96 – IP Address – Likely C2 endpoint

· hxxp://85.239.52[.]96:8000/vmwarecli – URL – File download

· hxxp://137.184.126[.]86:8080/vmwaretools – URL – File download

MITRE ATT&CK Mapping

Initial Access – T1190 – Exploit Public-Facing Application

Reconnaissance – T1590.002 – Gather Victim Network Information: DNS

Reconnaissance – T1590.005 – Gather Victim Network Information: IP Addresses

Reconnaissance – T1592.004 – Gather Victim Host Information: Client Configurations

Reconnaissance – T1595 – Active Scanning

Discovery – T1018 – Remote System Discovery

Discovery – T1046 – Network Service Discovery

Discovery – T1083 – File and Directory Discovery

Discovery – T1135 – Network Share Discovery

Lateral Movement – T1021.001 – Remote Services: Remote Desktop Protocol

Lateral Movement – T1021.004 – Remote Services: SSH

Lateral Movement – T1021.006 – Remote Services: Windows Remote Management

Lateral Movement – T1550.002 – Use Alternate Authentication Material: Pass the Hash

Lateral Movement – T1550.003 – Use Alternate Authentication Material: Pass the Ticket

Credential Access – T1110.001 – Brute Force: Password Guessing

Credential Access – T1649 – Steal or Forge Authentication Certificates

Persistence, Privilege Escalation – T1078 – Valid Accounts

Resource Development – T1588.001 – Obtain Capabilities: Malware

Command and Control – T1071.001 – Application Layer Protocol: Web Protocols

Command and Control – T1105 – Ingress Tool Transfer

Command and Control – T1573 – Encrypted Channel

Collection – T1074 – Data Staged

Exfiltration – T1041 – Exfiltration Over C2 Channel

Exfiltration – T1048 – Exfiltration Over Alternative Protocol

References

[1] https://thehackernews.com/2025/08/sonicwall-investigating-potential-ssl.html

[2] https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/250804095336430

[3] https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015

[4] https://arcticwolf.com/resources/blog/arctic-wolf-observes-akira-ransomware-campaign-targeting-sonicwall-sslvpn-accounts/

[5] https://www.rapid7.com/blog/post/dr-akira-ransomware-group-utilizing-sonicwall-devices-for-initial-access/

[6] https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf

[7] https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a

[8] https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/

[9] https://www.ransomware.live/map?year=2025&q=akira

[10] https://attack.mitre.org/groups/G1024/
[11] https://labs.lares.com/fear-kerberos-pt2/#UNPAC

[12] https://www.thehacker.recipes/ad/movement/kerberos/unpac-the-hash

[13] https://www.s-rminform.com/latest-thinking/derailing-akira-cyber-threat-intelligence)

[14] https://fieldeffect.com/blog/update-akira-ransomware-group-targets-sonicwall-vpn-appliances

[15] https://arcticwolf.com/resources/blog/arctic-wolf-observes-july-2025-uptick-in-akira-ransomware-activity-targeting-sonicwall-ssl-vpn/

Get the latest insights on emerging cyber threats

This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2026.

Inside the SOC

Written by

Emily Megan Lim

Cyber Analyst

•

April 7, 2026

Nathaniel Bill

Malware Research Engineer

Director of Product Management | Darktrace

Watch the NIS2 Webinar

Blog

Cloud

April 9, 2026

Bringing Together SOC and IR teams with Automated Threat Investigations for the Hybrid World

The investigation gap: Why incident response is slow, fragmented and reactive

Modern investigations often fall apart the moment analysts move beyond an initial alert. Whether detections originate in cloud or on-prem environments, SOC and Incident Response (IR) teams are frequently hindered by fragmented tools and data sources, closed ecosystems, and slow, manual evidence collection just to access the forensic context they need. SOC analysts receive alerts without the depth required to confidently confirm or dismiss a threat, while IR teams struggle with inconsistent visibility across cloud, on‑premises, and contained endpoints, creating delays, blind spots, and incomplete attack timelines.

This gap between SOC and Digital Forensics and Incident Response (DFIR) slows response and forces teams into reactive and inefficient investigation patterns. Security teams struggle to collect high‑fidelity forensic data during active incidents, particularly from cloud workloads, on‑prem systems, and XDR‑contained endpoints where traditional tools cannot operate without deploying new agents or disrupting containment. The result is a fragmented response process where investigations slow down, context gets lost, and critical attacker activity can slip through the cracks.

What’s new at Darktrace

‍

Helping teams move from detection to root cause faster, more efficiently, and with greater confidence

The latest update to Darktrace / Forensic Acquisition & Investigation eliminates the traditional handoff between the SOC and IR teams, enabling analysts to seamlessly pivot from alert into forensic investigation. It also brings on-demand and automated data capture through Darktrace / ENDPOINT as well as third-party detection platforms, where investigators can safely collect critical forensic data from network contained endpoints, preserving containment while accelerating investigation and response.

Together, this solidifies / Forensic Acquisition & Investigation as an investigation-first platform beyond the cloud, fit for any organization that has adopted a multi-technology infrastructure. In practice, when these various detection sources and host‑level forensics are combined, investigations move from limited insight to complete understanding quickly, giving security teams the clarity and deep context required to drive confident remediation and response based on the exact tactics, techniques and procedures employed.

‍

Integrated forensic context inside every incident workflow

SOC analysts now have seamless access to forensic evidence at the exact moment they need it. There is a new dedicated Forensics tab inside Cyber AI Analyst™ incidents, allowing users to move instantly from detection to rich forensic context in a single click, without the need to export data or get other teams involved.

For investigations that previously required multiple tools, credentials, or intervention by a dedicated team, this change represents a shift toward truly embedded incident‑driven forensics – accelerating both decision‑making and response quality at the point of detection.

Figure 1: The forensic investigation associated with the Cyber AI Analyst™ incident appears in a dedicated ‘Forensics’ tab, with the ability to pivot into the / Forensic Acquisition & Investigation UI for full context and deep analysis workflows.

‍

Reliable automated and manual hybrid evidence capture across any environment

Across cloud, on‑premises, and hybrid environments, analysts can now automate or request on‑demand forensic evidence collection the moment a threat is detected via Darktrace / ENDPOINT. This allows investigators to quickly capture high-fidelity forensic data from endpoints already under protection, accelerating investigations without additional tooling or disrupting systems. Especially in larger environments where the ability to scale is critical, automated data capture across hybrid environments significantly reduces response time and enables consistent, repeatable investigations.

Unlike EDR‑only solutions, which capture only a narrow slice of activity, these workflows provide high‑quality, cross‑environment forensic depth, even on third‑party XDR‑contained devices that many vendor ecosystems cannot reach.

The result is a single, unified process for capturing the forensic context analysts need no matter where the threat originates, even in third-party vendor protected areas.

Figure 2: The ability to acquire, process, and investigate devices with the Darktrace / ENDPOINT agent installed using the ‘Darktrace Endpoint’ import provider

Figure 3: A Linux device that has the Darktrace / ENDPOINT agent installed has been acquired and processed by / Forensic Acquisition & Investigation

‍

Investigation‑first design flexible for hybrid organizations

Luckily, taking advantage of automated forensic data capture of non-cloud assets won’t be subject to those who purely use Darktrace / ENDPOINT. This functionality is also available where CrowdStrike, Microsoft Defender for Endpoint, or SentinelOne agents are deployed. In the case of CrowdStrike, Darktrace / Forensic Acquisition & Investigation can also perform a triage capture of a device that has been contained using CrowdStrike’s network containment capability. What’s critical here is the fact that investigators can safely acquire additional forensic evidence without breaking or altering containment. That massively improves investigation and response time without adding more risk factors.

Figure 4: ‘cado.xdr.test2’ has been contained using CrowdStrike’s network containment capability

Figure 5: Successful triage capture of contained endpoint ‘cado.xdr.test2’ using / Forensic Acquisition & Investigation

The benefits of extending forensics to on‑premises and endpoint environments

Despite Darktrace / Forensic Acquisition & Investigation originating as a cloud‑first solution, the challenges of incident response are not limited to the cloud. Many investigations span on‑premises servers, unmanaged endpoints, legacy systems, or devices locked inside third‑party ecosystems.

By extending automated investigation capabilities into on‑premises environments and endpoints, Darktrace delivers several critical benefits:

Unified investigations across hybrid infrastructure and a heterogeneous security stack
Consistent forensic depth regardless of asset type
Faster and more accurate root-cause analysis
Stronger incident response readiness

‍

Figure 6: Unified alerts from cloud and on-prem environments, grouped into incident-centric investigations with forensic depth

Simplifying deep investigations across hybrid environments

These enhancements move Darktrace / Forensic Acquisition & Investigation closer to a vision out of reach for most security teams: seamless, integrated, high‑fidelity forensics across cloud, on‑prem, and endpoint environments where other solutions usually stop at detection. Automated forensics as a whole is fueling faster outcomes with complete clarity throughout the end-to-end investigation process, which now takes teams from alert to understanding in minutes compared to days or even weeks. All without added agents, disruptions, or specialized teams. The result is an incident response lifecycle that finally matches the reality of modern infrastructure.

‍

Ready to see Darktrace / Forensic Acquisition & Investigation in your environment? Request a demo.

Hear from industry-leading experts on the latest developments in AI cybersecurity at Darktrace LIVE. Coming to a city near you.

[related-resource]

About the author

Paul Bottomley

Director of Product Management | Darktrace

Blog

AI

April 10, 2026

How to Secure AI and Find the Gaps in Your Security Operations

secuing AI testing gaps security operations

What “securing AI” actually means (and doesn’t)

Security teams are under growing pressure to “secure AI” at the same pace which businesses are adopting it. But in many organizations, adoption is outpacing the ability to govern, monitor, and control it. When that gap widens, decision-making shifts from deliberate design to immediate coverage. The priority becomes getting something in place, whether that’s a point solution, a governance layer, or an extension of an existing platform, rather than ensuring those choices work together.

At the same time, AI governance is lagging adoption. 37% of organizations still lack AI adoption policies, shadow AI usage across SaaS has surged, and there are notable spikes in anomalous data uploads to generative AI services.

First and foremost, it’s important to recognize the dual nature of AI risk. Much of the industry has focused on how attackers will use AI to move faster, scale campaigns, and evade detection. But what’s becoming just as significant is the risk introduced by AI inside the organization itself. Enterprises are rapidly embedding AI into workflows, SaaS platforms, and decision-making processes, creating new pathways for data exposure, privilege misuse, and unintended access across an already interconnected environment.

Because the introduction of complex AI systems into modern, hybrid environments is reshaping attacker behavior and exposing gaps between security functions, the challenge is no longer just having the right capabilities in place but effectively coordinating prevention, detection, investigation, response, and remediation together. As threats accelerate and systems become more interconnected, security depends on coordinated execution, not isolated tools, which is why lifecycle-based approaches to governance, visibility, behavioral oversight, and real-time control are gaining traction.

From cloud consolidation to AI systems what we can learn

We have seen a version of AI adoption before in cloud security. In the early days, tooling fragmented into posture, workload/runtime, identity, data, and more. Gradually, cloud security collapsed into broader cloud platforms. The lesson was clear: posture without runtime misses active threats; runtime without posture ignores root causes. Strong programs ran both in parallel and stitched the findings together in operations.

Today’s AI wave stretches that lesson across every domain. Adversaries are compressing “time‑to‑tooling” using LLM‑assisted development (“vibecoding”) and recycling public PoCs at unprecedented speed. That makes it difficult to secure through siloed controls, because the risk is not confined to one layer. It emerges through interactions across layers.

Keep in mind, most modern attacks don’t succeed by defeating a single control. They succeed by moving through the gaps between systems faster than teams can connect what they are seeing. Recent exploitation waves like React2Shell show how quickly opportunistic actors operationalize fresh disclosures and chain misconfigurations to monetize at scale.

In the React2Shell window, defenders observed rapid, opportunistic exploitation and iterative payload diversity across a broad infrastructure footprint, strains that outpace signature‑first thinking.

You can stay up to date on attacker behavior by signing up for our newsletter where Darktrace’s threat research team and analyst community regularly dive deep into threat finds.

Ultimately, speed met scale in the cloud era; AI adds interconnectedness and orchestration. Simple questions — What happened? Who did it? Why? How? Where else? — now cut across identities, SaaS agents, model/service endpoints, data egress, and automated actions. The longer it takes to answer, the worse the blast radius becomes.
‍

The case for a platform approach in the age of AI

Think of security fusion as the connective tissue that lets you prevent, detect, investigate, and remediate in parallel, not in sequence. In practice, that looks like:

Unified telemetry with behavioral context across identities, SaaS, cloud, network, endpoints, and email—so an anomalous action in one plane automatically informs expectations in others. (Inside‑the‑SOC investigations show this pays off when attacks hop fast between domains.)

Pre‑CVE and “in‑the‑wild” awareness feeding controls before signatures—reducing dwell time in fast exploitation windows.

Automated, bounded response that can contain likely‑malicious actions at machine speed without breaking workflows—buying analysts time to investigate with full context. (Rapid CVE coverage and exploit‑wave posts illustrate how critical those first minutes are.)

Investigation workflows that assume AI is in the loop—for both defenders and attackers. As adversaries adopt “agentic” patterns, investigations need graph‑aware, sequence‑aware reasoning to prioritize what matters early.

This isn’t theoretical. It’s reflected in the Darktrace posts that consistently draw readership: timely threat intel with proprietary visibility and executive frameworks that transform field findings into operating guidance.

The five questions that matter (and the one that matters more)

When alerted to malicious or risky AI use, you’ll ask:

What happened?

Who did it?

Why did they do it?

How did they do it?

Where else can this happen?

The sixth, more important question is: How much worse does it get while you answer the first five? The answer depends on whether your controls operate in sequence (slow) or in fused parallel (fast).

What to watch next: How the AI security market will likely evolve

Security markets tend to follow a familiar pattern. New technologies drive an initial wave of specialized tools (posture, governance, observability) each focused on a specific part of the problem. Over time, those capabilities consolidate as organizations realize the new challenge is coordination.

AI is accelerating the shift of focus to coordination because AI-powered attackers can move faster and operate across more systems at once. Recent exploitation waves show exactly this. Adversaries can operationalize new techniques and move across domains, turning small gaps into full attack paths.

Anticipate a continued move toward more integrated security models because fragmented approaches can’t keep up with the speed and interconnected nature of modern attacks.

Building the Groundwork for Secure AI: How to Test Your Stack’s True Maturity

AI doesn’t create new surfaces as much as it exposes the fragility of the seams that already exist.

Darktrace’s own public investigations consistently show that modern attacks, from LinkedIn‑originated phishing that pivots into corporate SaaS to multi‑stage exploitation waves like BeyondTrust CVE‑2026‑1731 and React2Shell, succeed not because a single control failed, but because no control saw the whole sequence, or no system was able to respond at the speed of escalation.

Before thinking about “AI security,” customers should ensure they’ve built a security foundation where visibility, signals, and responses can pass cleanly between domains. That requires pressure‑testing the seams.

Below are the key integration questions and stack‑maturity tests every organization should run.
‍

1. Do your controls see the same event the same way?

Integration questions

When an identity behaves strangely (impossible travel, atypical OAuth grants), does that signal automatically inform your email, SaaS, cloud, and endpoint tools?
Do your tools normalize events in a way that lets you correlate identity → app → data → network without human stitching?

Why it matters

Darktrace’s public SOC investigations repeatedly show attackers starting in an unmonitored domain, then pivoting into monitored ones, such as phishing on LinkedIn that bypassed email controls but later appeared as anomalous SaaS behavior.

If tools can’t share or interpret each other's context, AI‑era attacks will outrun every control.

Tests you can run

Shadow Identity Test

Create a temporary identity with no history.
Perform a small but unusual action: unusual browser, untrusted IP, odd OAuth request.
Expected maturity signal: other tools (email/SaaS/network) should immediately score the identity as high‑risk.

Context Propagation Test

Trigger an alert in one system (e.g., endpoint anomaly) and check if other systems automatically adjust thresholds or sensitivity.
Low maturity signal: nothing changes unless an analyst manually intervenes.

‍

2. Does detection trigger coordinated action, or does everything act alone?

Integration questions

When one system blocks or contains something, do other systems automatically tighten, isolate, or rate‑limit?
Does your stack support bounded autonomy — automated micro‑containment without broad business disruption?

Why it matters

In public cases like BeyondTrust CVE‑2026‑1731 exploitation, Darktrace observed rapid C2 beaconing, unusual downloads, and tunneling attempts across multiple systems. Containment windows were measured in minutes, not hours.

Tests you can run

Chain Reaction Test

Simulate a primitive threat (e.g., access from TOR exit node).
Your identity provider should challenge → email should tighten → SaaS tokens should re‑authenticate.
Weak seam indicator: only one tool reacts.

Autonomous Boundary Test

Induce a low‑grade anomaly (credential spray simulation).
Evaluate whether automated containment rules activate without breaking legitimate workflows.

‍

3. Can your team investigate a cross‑domain incident without swivel‑chairing?

Integration questions

Can analysts pivot from identity → SaaS → cloud → endpoint in one narrative, not five consoles?
Does your investigation tooling use graphs or sequence-based reasoning, or is it list‑based?

Why it matters

Darktrace’s Cyber AI Analyst and DIGEST research highlights why investigations must interpret structure and progression, not just standalone alerts. Attackers now move between systems faster than human triage cycles.

Tests you can run

One‑Hour Timeline Build Test

Pick any detection.
Give an analyst one hour to produce a full sequence: entry → privilege → movement → egress.
Weak seam indicator: they spend >50% of the hour stitching exports.

Multi‑Hop Replay Test

Simulate an incident that crosses domains (phish → SaaS token → data access).
Evaluate whether the investigative platform auto‑reconstructs the chain.

‍

4. Do you detect intent or only outcomes?

Integration questions

Can your stack detect the setup behaviors before an attack becomes irreversible?
Are you catching pre‑CVE anomalies or post‑compromise symptoms?

Why it matters

Darktrace publicly documents multiple examples of pre‑CVE detection, where anomalous behavior was flagged days before vulnerability disclosure. AI‑assisted attackers will hide behind benign‑looking flows until the very last moment.

Tests you can run

Intent‑Before‑Impact Test

Simulate reconnaissance-like behavior (DNS anomalies, odd browsing to unknown SaaS, atypical file listing).
Mature systems will flag intent even without an exploit.

CVE‑Window Test

During a real CVE patch cycle, measure detection lag vs. public PoC release.
Weak seam indicator: your detection rises only after mass exploitation begins.

‍

5. Are response and remediation two separate universes?

Integration questions

When you contain something, does that trigger root-cause remediation workflows in identity, cloud config, or SaaS posture?
Does fixing a misconfiguration automatically update correlated controls?

Why it matters

Darktrace’s cloud investigations (e.g., cloud compromise analysis) emphasize that remediation must close both runtime and posture gaps in parallel.

Tests you can run

Closed‑Loop Remediation Test

Introduce a small misconfiguration (over‑permissioned identity).
Trigger an anomaly.
Mature stacks will: detect → contain → recommend or automate posture repair.

Drift‑Regression Test

After remediation, intentionally re‑introduce drift.
The system should immediately recognize deviation from known‑good baseline.

‍

6. Do SaaS, cloud, email, and identity all agree on “normal”?

Integration questions

Is “normal behavior” defined in one place or many?
Do baselines update globally or per-tool?

Why it matters

Attackers (including AI‑assisted ones) increasingly exploit misaligned baselines, behaving “normal” to one system and anomalous to another.

Tests you can run

Baseline Drift Test

Change the behavior of a service account for 24 hours.
Mature platforms will flag the deviation early and propagate updated expectations.

Cross‑Domain Baseline Consistency Test

Compare identity’s risk score vs. cloud vs. SaaS.
Weak seam indicator: risk scores don’t align.

‍

Final takeaway

Security teams should ask be focused on how their stack operates as one system before AI amplifies pressure on every seam.

Only once an organization can reliably detect, correlate, and respond across domains can it safely begin to secure AI models, agents, and workflows.

About the author

Nabil Zoldjalali

VP, Field CISO

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Inside Akira’s SonicWall Campaign: Darktrace’s Detection and Response

Introduction: Background on Akira SonicWall campaign

Threat Overview

CVE-2024-40766 and other misconfigurations

Akira Ransomware

Victimology

Common Tactics, Techniques and Procedures (TTPs) [7][10]

Darktrace’s Coverage of Akira ransomware

Reconnaissance

Lateral movement

Credential access

C2 / Additional tooling

Data exfiltration

Cyber AI Analyst

Containing the attack

Managed Detection and Response

A wider campaign?

Lessons from the campaign

Appendices

Enhanced Monitoring Models

Antigena/Autonomous Response Models

List of Indicators of Compromise (IoCs)

MITRE ATT&CK Mapping

References

Get the latest insights on emerging cyber threats

Darktrace Identifies New Chaos Malware Variant Exploiting Misconfigurations in the Cloud

Bringing Together SOC and IR teams with Automated Threat Investigations for the Hybrid World

Enjoying the blog?

More in this series

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

Phantom Footprints: Tracking GhostSocks Malware

When Reality Diverges from the Playbook: Darktrace Identifies Encryption in a World Leaks Ransomware Attack

Blog

Cloud

April 9, 2026

Bringing Together SOC and IR teams with Automated Threat Investigations for the Hybrid World

The investigation gap: Why incident response is slow, fragmented and reactive

What’s new at Darktrace

Helping teams move from detection to root cause faster, more efficiently, and with greater confidence

Integrated forensic context inside every incident workflow

Reliable automated and manual hybrid evidence capture across any environment

Investigation‑first design flexible for hybrid organizations

The benefits of extending forensics to on‑premises and endpoint environments

Simplifying deep investigations across hybrid environments

Blog

AI

April 10, 2026

How to Secure AI and Find the Gaps in Your Security Operations

What “securing AI” actually means (and doesn’t)

From cloud consolidation to AI systems what we can learn

The case for a platform approach in the age of AI

What to watch next: How the AI security market will likely evolve

Building the Groundwork for Secure AI: How to Test Your Stack’s True Maturity

1. Do your controls see the same event the same way?

2. Does detection trigger coordinated action, or does everything act alone?

3. Can your team investigate a cross‑domain incident without swivel‑chairing?

4. Do you detect intent or only outcomes?

5. Are response and remediation two separate universes?

6. Do SaaS, cloud, email, and identity all agree on “normal”?

Final takeaway