July 27, 2023

Revealing Outlaw's Returning Features & New Tactics

Darktrace's investigation of the latest Outlaw crypto-mining operation, covering the resurgence of old tactics along with the emergence of new ones.

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Adam Potter

Senior Cyber Analyst

Jul 2023

What is Outlaw Cryptocurrency Mining Operation?

The cybersecurity community has been aware of the threat of Outlaw cryptocurrency mining operation, and its affiliated activities since as early as 2018. Despite its prominence, Outlaw remains largely elusive to researchers and analysts due to its ability to adapt its tactics, procedures, and payloads.

Outlaw gained notoriety in 2018 as security researchers began observing the creation of affiliated botnets.^[1][2] Researchers gave Outlaw its name based on the English translation of the “Haiduc” tool observed during their initial activity on compromised devices.^[3],[4] By 2019, much of the initial Outlaw activity focused on the targeting of Internet of Things (IoT) devices and other internet facing servers, reportedly focusing operations in China and on Chinese devices.^[5],[6] From the outset, mining operations featured as a core element of botnets created by the group.^[7] This initial focus may have been a sign of caution by threat actors or a preliminary means of testing procedures and operation efficacy. Regardless, Outlaw actors inevitably expanded scope, targeting larger organizations and a wider range of internet facing devices across geographic scope.

Following a short period of inactivity, security researchers began to observe new Outlaw activity, showcasing additional capabilities such as the ability to kill existing crypto-mining processes on devices, thereby reclaiming devices already compromised by crypto-jacking.^[8],[9]

Latest News on Outlaw

Although the more recently observed incidents of Outlaw did demonstrate some new tactics, many of its procedures remained the same, including its unique bundling of payloads that combine crypto-mining and botnet capabilities.^[10] In conjunction, the continued use of mining-specific payloads and growth of affiliated botnets has bolstered the belief that Outlaw actors historically prioritizes financial gain, in lieu of overt political objectives.

Given the tendency for malicious actors to share tools and capabilities, true attribution of threat or threat group is extremely difficult in the wild. As such, a genuine survey of activity from the group across a customer base has not always been possible. Therefore, we will present an updated look into more recent activity associated with Outlaw detected across the Darktrace customer base.

Darktrace vs Outlaw

Since late 2022, Darktrace has observed a rise in probable cyber incidents involving indicators of compromise (IoCs) associated with Outlaw. Given its continued prevalence and relative dearth of information, it is essential to take a renewed look at the latest campaign activity associated with threats like Outlaw to avoid making erroneous assumptions and to ensure the threat posed is correctly characterized.

While being aware of previous IoCs and tactics known to be employed in previous campaigns will go some way to protecting against future Outlaw attacks, it is paramount for organizations to arm themselves with an autonomous intelligent decision maker that can identify malicious activity, based on recognizing deviations from expected patterns of behavior, and take preventative action to effectively defend against such a versatile threat.

Darktrace’s anomaly-based approach to threat detection means it is uniquely positioned to detect novel campaign activity by recognizing subtle deviations in affected devices’ behavior that would have gone unnoticed by traditional security tools relying on rules, signatures and known IoCs.

Outlaw Attack Overview & Darktrace Coverage

From late 2022 through early 2023, Darktrace identified multiple cyber events involving IP addresses, domains, and payloads associated with Outlaw on customer networks. In this recent re-emergence of campaign activity, Darktrace identified numerous attack vectors and IoCs that had previously been associated with Outlaw, however it also observed significant deviations from previous campaigns.

Returning Features

As outlined in a previous blog, past iterations of Outlaw compromises include four identified, distinct phases:

1. Targeting of internet facing devices via SSH brute-forcing

2. Initiation of crypto-mining operations

3. Download of shell script and/or botnet malware payloads

4. Outgoing external SSH scanning to propagate the botnet

Nearly all affected devices analyzed by Darktrace were tagged as internet facing, as identified in previous campaigns, supporting the notion that Outlaw continues to focus on easily exposed devices. In addition to this, Darktrace observed three other core returning features from previous Outlaw campaigns in affected devices between late 2022 and early 2023:

1. Gzip and/or Script Download

2. Beaconing Activity (Command and Control)

3. Crypto-mining

Gzip and/or Script Download

Darktrace observed numerous devices downloading the Dota malware, a strain that is previously known to have been associated with the Outlaw botnet, as either a gzip file or a shell script from rare external hosts.

In some examples, IP addresses that provided the payload were flagged by open-source intelligence (OSINT) sources as having engaged in widespread SSH brute-forcing activities. While the timing of the payload transfer to the device was not consistent, download of gzip files featured prominently during directly observed or potentially affiliated activity. Moreover, Darktrace detected multiple devices performing HTTP requests for shell scripts (.sh) according to detected connection URIs. Darktrace DETECT was able to identify these anomalous connections due to the rarity of the endpoint, payloads, and connectivity for the devices.

Figure 1: Darktrace Cyber AI Analyst technical details summary from an incident during the analysis timeframe that highlights a breach device retrieving the anomalous shell scripts using wget.

Beaconing Activity – Command and Control (C2) Endpoint

Across all Outlaw activity identified by Darktrace, devices engaged in some form of beaconing behavior, rather than one-off connections to IPs associated with Outlaw. While the use of application protocol was not uniform, repeated connectivity to rare external IP addresses related to Outlaw occurred across many analyzed incidents. Darktrace’s Self-Learning AI understood that this beaconing activity represented devices deviating from their expected patterns of life and was able to bring it to the immediate attention of customer security teams.

Figure 2: Model breach log details showing sustained, repeated connectivity to Outlaw affiliated endpoint over port 443, indicating potential C2 activity.

Crypto-mining

In almost every incident of Outlaw identified across the fleet, Darktrace detected some form of cryptocurrency mining activity. Devices affected by Outlaw were consistently observed making anomalous connections to external endpoints associated with crypto-mining operations. Furthermore, the Minergate protocol appeared consistently across hosts; even when devices did not make direct crypto-mining commands, such hosts attempted connections to external entities that were known to support crypto-mining operations.

Figure 3: Advanced Search results showing a sudden spike in mining activity from a device observed connecting to Outlaw-affiliated IP addresses. Such crypto-mining activity was observed consistently across analyzed incidents.

Is Outlaw Using New Tactics?

While in the past, Outlaw activity was identified through a systematic kill chain, recent investigations conducted by Darktrace show significant deviations from this.

For instance, affected devices do not necessarily follow the previously outlined kill chain directly as they did previously. Instead, Darktrace observed affected devices exhibiting these phases in differing orders, repeating steps, or missing out attack phases entirely.

It is essential to study such variation in the kill chain to learn more about the threat of Outlaw and how threat actors are continuing to use it is varying ways. These discrepancies in kill chain elements are likely impacted by visibility into the networks and devices of Darktrace customers, with some relevant activity falling outside of Darktrace’s purview. This is particularly true for internet-exposed devices and hosts that repeatedly performed the same anomalous activity (such as making Minergate requests). Moreover, some devices involved in Outlaw activity may have already been compromised prior to Darktrace’s visibility into the network. As such, these conclusions must be evaluated with a degree of uncertainty.

SSH Activity

Although external SSH connectivity was apparent in some of the incidents detected by Darktrace, it was not directly related to brute-forcing activity. Affected devices did receive anomalous incoming SSH connections, however, wide ranging SSH failed connectivity following the initiation of mining operations by compromised devices was not readily apparent across analyzed compromises. Connections over port 22 were more frequently associated with beaconing and/or C2 activity to endpoints associated with Outlaw, than with potential brute-forcing. As such, Darktrace could not, with high confidence correlate such SSH activity to brute-forcing. This could suggest that threat actors are now portioning or rotation of botnet devices for different operations, for example dividing between botnet expansion and mining operations.

Command line tools

In cases of Outlaw investigated by Darktrace, there was also a degree of variability involving the tools used to retrieve payloads. On the networks of customers affected by Outlaw, Darktrace DETECT identified the use of user agents and command line tools that it considered to be out of character for the network and its devices.

When retrieving the Dota malware payload or shell script data, compromised devices frequently relied on numerous versions of wget and curl user agents. Although the use of such tools as a tactic cannot be definitively linked to the crypto-mining campaign, the employment of varying and/or outdated native command line tools attests to the procedural flexibility of Outlaw campaigns, and its potential for continued evolution.

Figure 4: Breach log data showing use of curl and wget tools to connect to IP addresses associated with Outlaw.

Outlaw in 2023

Given Outlaw’s widespread notoriety and its continued activities, it is likely to remain a prominent threat to organizations and security teams across the threat landscape in 2023 and beyond.

As Darktrace has observed within its customer base from late 2022 through early 2023, activity linked with the Outlaw cryptocurrency mining campaign continues to transpire, offering security teams and research a renewed look at how it has evolved and adapted over the years. While many of its features and tactics appear to have remained consistent, Darktrace has identified numerous signs of Outlaw deviating from its previously known activities.

While relying on previously established IoCs and known tactics from previous campaigns will go some way to protecting an organization’s network from Outlaw compromises, there is a greater need than ever to go further than this. Rather than depending on a list of known-bads or traditional signatures and rules, Darktrace’s anomaly-based approach to threat detection and unparallel autonomous response capabilities mean it is uniquely positioned to DETECT and RESPOND to Outlaw activity, regardless of how it evolves in the future.

Credit to: Adam Potter, Cyber Analyst, Nahisha Nobregas, SOC Analyst, and Ryan Traill, Threat Content Lead

Relevant DETECT Model Breaches:

Compliance / Incoming SSH

Device / New User Agent and New IP

Device / New User Agent

Anomalous Connection / New User Agent to IP Without Hostname

Compromise / Crypto Currency Mining Activity

Anomalous File / Internet Facing System File Download

Anomalous Server Activity / New User Agent from Internet Facing System

Anomalous File / Zip or Gzip from Rare External Location

Anomalous File / Script from Rare External Location

Anomalous Connection / Multiple Failed Connections to Rare Endpoint

Compromise / Large Number of Suspicious Failed Connections

Anomalous Server Activity / Outgoing from Server

Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

Indicators of Compromise

Indicator - Type - Description

/dota3.tar.gz

File URI

Outlaw payload

‍

/tddwrt7s.sh

File URI

Outlaw payload

‍

73e5dbafa25946ed636e68d1733281e63332441d

SHA1 Hash

Outlaw payload

‍

debian-package[.]center

Hostname

Outlaw C2 endpoint

‍

161.35.236[.]24

IP address

Outlaw C2 endpoint

‍

138.68.115[.]96

IP address

Outlaw C2 endpoint

‍

67.205.134[.]224

IP address

Outlaw C2 endpoint

‍

138.197.212[.]204

IP address

Outlaw C2 endpoint

‍

45.9.148[.]59

IP address

Possible Outlaw C2 endpoint

‍

45.9.148[.]117

IP address

Outlaw C2 endpoint

‍

45.9.148[.]125

IP address

Outlaw C2 endpoint

‍

45.9.148[.]129

IP address

Outlaw C2 endpoint

‍

45.9.148[.]99

IP address

Outlaw C2 endpoint

‍

45.9.148[.]234

IP address

Possible Outlaw C2 endpoint

‍

45.9.148[.]236

IP address

Possible Outlaw C2 endpoint

‍

159.203.102[.]122

IP address

Outlaw C2 endpoint

‍

159.203.85[.]196

IP address

Outlaw C2 endpoint

‍

159.223.235[.]198

IP address

Outlaw C2 endpoint

MITRE ATT&CK Mapping

Tactic -Technique

Initial Access -T1190 Exploit - Public Facing Application

Command and Control - T1071 - Application - Layer Protocol

T1071.001 - Application Layer Protocol: Web Protocols

Impact - T1496 Resource Hijacking

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Written by

Adam Potter

Senior Cyber Analyst

The Darktrace Community

Watch the NIS2 Webinar

Blog

Network

March 31, 2026

Phantom Footprints: Tracking GhostSocks Malware

Why are attackers using residential proxies?

In today's threat landscape, blending in to normal activity is the key to success for attackers and the growing reliance on residential proxies shows a significant shift in how threat actors are attempting to bypass IP detection tools.

The increasing dependency on residential proxies has exposed how prevalent proxy services are and how reliant a diverse range of threat actors are on them. From cybercriminal groups to state‑sponsored actors, the need to bypass IP detection tools is fundamental to the success of these groups. One malware that has quietly become notorious for its ability to avoid anomaly detection is GhostSocks, a malware that turns compromised devices into residential proxies.

What is GhostSocks?

Originally marketed on the Russian underground forum xss[.]is as a Malware‑as‑a‑Service (MaaS), GhostSocks enables threat actors to turn compromised devices into residential proxies, leveraging the victim's internet bandwidth to route malicious traffic through it.

How does Ghostsocks malware work?

The malware offers the threat actor a “clean” IP address, making it look like it is coming from a household user. This enables the bypassing of geographic restrictions and IP detection tools, a perfect tool for avoiding anomaly detection. It wasn’t until 2024, when a partnership was announced with the infamous information stealer Lumma Stealer, that GhostSocks surged into widespread adoption and alluded to who may be the author of the proxy malware.

Written in GoLang, GhostSocks utilizes the SOCKS5 proxy protocol, creating a SOCKS5 connection on infected devices. It uses a relay‑based C2 implementation, where an intermediary server sits in between the real command-and-control (C2) server and the infected device.

How does Ghostsocks malware evade detection?

To further increase evasion, the Ghostsocks malware wraps its SOCKS5 tunnels in TLS encryption, allowing its malicious traffic to blend into normal network traffic.

Early variants of GhostSocks do not implement a persistence mechanism; however, later versions achieve persistence via registry run keys, ensuring sustained proxy operational time [1].

While proxying is its primary purpose, GhostSocks also incorporates backdoor functionality, enabling malicious actors to run arbitrary commands and download and deploy additional malicious payloads. This was evident with the well‑known ransomware group Black Basta, which reportedly used GhostSocks as a way of maintaining long‑term access to victims’ networks [1].

Darktrace’s detection of GhostSocks Malware

Darktrace observed a steady increase in GhostSocks activity across its customer base from late 2025, with its Threat Research team identifying multiple incidents involving the malware. In one notable case from December 2025, Darktrace detected GhostSocks operating alongside Lumma Stealer, reinforcing that the partnership between Lumma and GhostSocks remains active despite recent attempts to disrupt Lumma’s infrastructure.

Darktrace’s first detection of GhostSocks‑related activity came when a device on the network of a customer in the education sector began making connections to an endpoint with a suspicious self‑signed certificate that had never been seen on the network before.

The endpoint in question, 159.89.46[.]92 with the hostname retreaw[.]click, has been flagged by multiple open‑source intelligence (OSINT) sources as being associated with Lumma Stealer’s C2 infrastructure [2], indicating its likely role in the delivery of malicious payloads.

Figure 1: Darktrace’s detection of suspicious SSL connections to retreaw[.]click, indicating an attempted link to Lumma C2 infrastructure.

Less than two minutes later, Darktrace observed the same device downloading the executable (.exe) file “Renewable.exe” from the IP 86.54.24[.]29, which Darktrace recognized as 100% rare for this network.

Figure 2: Darktrace’s detection of a device downloading the unusual executable file “Renewable.exe”.

Both the file MD5 hash and the executable itself have been identified by multiple OSINT vendors as being associated with the GhostSocks malware [3], with the executable likely the backdoor component of the GhostSocks malware, facilitating the distribution of additional malicious payloads [4].

Following this detection, Darktrace’s Autonomous Response capability recommended a blocking action for the device in an early attempt to stop the malicious file download. In this instance, Darktrace was configured in Human Confirmation Mode, meaning the customer’s security team was required to manually apply any mitigative response actions. Had Autonomous Response been fully enabled at the time of the attack, the connections to 86.54.24[.]29 would have been blocked, rendering the malware ineffective at reaching its C2 infrastructure and halting any further malicious communication.

Figure 3: Darktrace’s Autonomous Response capability suggesting blocking the suspicious connections to the unusual endpoint from which the malicious executable was downloaded.

As the attack was able to progress, two days later the device was detected downloading additional payloads from the endpoint www.lbfs[.]site (23.106.58[.]48), including “Setup.exe”, “,.exe”, and “/vp6c63yoz.exe”.

Figure 4: Darktrace’s detection of a malicious payload being downloaded from the endpoint www.lbfs[.]site.

Once again, Darktrace recognized the anomalous nature of these downloads and suggested that a “group pattern of life” be enforced on the offending device in an attempt to contain the activity. By enforcing a pattern of life on a device, Darktrace restricts its activity to connections and behaviors similar to those performed by peer devices within the same group, while still allowing it to carry out its expected activity, effectively preventing deviations indicative of compromise while minimizing disruption. As mentioned earlier, these mitigative actions required manual implementation, so the activity was able to continue. Darktrace proceeded to suggest further actions to contain subsequent malicious downloads, including an attempt to block all outbound traffic to stop the attack from progressing.

Figure 5: An overview of download activity and the Autonomous Response actions recommended by Darktrace to block the downloads.

Around the same time, a third executable download was detected, this time from the hostname hxxp[://]d2ihv8ymzp14lr.cloudfront.net/2021-08-19/udppump[.]exe, along with the file “udppump.exe”.While GhostSocks may have been present only to facilitate the delivery of additional payloads, there is no indication that these CloudFront endpoints or files are functionally linked to GhostSocks. Rather, the evidence points to broader malicious file‑download activity.

Shortly after the multiple executable files had been downloaded, Darktrace observed the device initiating a series of repeated successful connections to several rare external endpoints, behavior consistent with early-stage C2 beaconing activity.

Cyber AI Analyst’s investigation

Figure 7: Darktrace’s detection of additional malicious file downloads from malicious CloudFront endpoints.

Throughout the course of this attack, Darktrace’s Cyber AI Analyst carried out its own autonomous investigation, piecing together seemingly separate events into one wider incident encompassing the first suspicious downloads beginning on December 4, the unusual connectivity to many suspicious IPs that followed, and the successful beaconing activity observed two days later. By analyzing these events in real-time and viewing them as part of the bigger picture, Cyber AI Analyst was able to construct an in‑depth breakdown of the attack to aid the customer’s investigation and remediation efforts.

Figure 8: Cyber AI Analyst investigation detailing the sequence of events on the compromised device, highlighting its extensive connectivity to rare endpoints, the related malicious file‑download activity, and finally the emergence of C2 beaconing behavior.

Conclusion

The versatility offered by GhostSocks is far from new, but its ability to convert compromised devices into residential proxy nodes, while enabling long‑term, covert network access—illustrates how threat actors continue to maximise the value of their victims’ infrastructure. Its growing popularity, coupled with its ongoing partnership with Lumma, demonstrates that infrastructure takedowns alone are insufficient; as long as threat actors remain committed to maintaining anonymity and can rapidly rebuild their ecosystems, related malware activity is likely to persist in some form.

Credit to Isabel Evans (Cyber Analyst), Gernice Lee (Associate Principal Analyst & Regional Consultancy Lead – APJ)
Edited by Ryan Traill (Content Manager)

Appendices

References

1. https://bloo.io/research/malware/ghostsocks

2. https://www.virustotal.com/gui/domain/retreaw.click/community

3. https://synthient.com/blog/ghostsocks-from-initial-access-to-residential-proxy

4. https://www.joesandbox.com/analysis/1810568/0/html

5. https://www.virustotal.com/gui/url/fab6525bf6e77249b74736cb74501a9491109dc7950688b3ae898354eb920413

Darktrace Model Detections

Real-time Detection Models

Anomalous Connection / Suspicious Self-Signed SSL

Anomalous Connection / Rare External SSL Self-Signed

Anomalous File / EXE from Rare External Location

Anomalous File / Multiple EXE from Rare External Locations

Compromise / Possible Fast Flux C2 Activity

Compromise / Large Number of Suspicious Successful Connections

Compromise / Large Number of Suspicious Failed Connections

Compromise / Sustained SSL or HTTP Increase

Autonomous Response Models

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network / External Threat / Antigena Suspicious File Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Alert

Antigena / Network / External Threat / Antigena File then New Outbound Block

Antigena / Network / Significant Anomaly / Antigena Alerts Over Time Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique

Resource Development – T1588 - Malware

Initial Access - T1189 - Drive-by Compromise

Persistence – T1112 – Modify Registry

Command and Control – T1071 – Application Layer Protocol

Command and Control – T1095 – Non-application Layer Protocol

Command and Control – T1071 – Web Protocols

Command and Control – T1571 – Non-Standard Port

Command and Control – T1102 – One-Way Communication

List of Indicators of Compromise (IoCs)

86.54.24[.]29 - IP - Likely GhostSocks C2

http[://]86.54.24[.]29/Renewable[.]exe - Hostname - GhostSocks Distribution Endpoint

http[://]d2ihv8ymzp14lr.cloudfront[.]net/2021-08-19/udppump[.]exe - CDN - Payload Distribution Endpoint

www.lbfs[.]site - Hostname - Likely C2 Endpoint

retreaw[.]click - Hostname - Lumma C2 Endpoint

alltipi[.]com - Hostname - Possible C2 Endpoint

w2.bruggebogeyed[.]site - Hostname - Possible C2 Endpoint

9b90c62299d4bed2e0752e2e1fc777ac50308534 - SHA1 file hash – Likely GhostSocks payload

3d9d7a7905e46a3e39a45405cb010c1baa735f9e - SHA1 file hash - Likely follow-up payload

10f928e00a1ed0181992a1e4771673566a02f4e3 - SHA1 file hash - Likely follow-up payload

About the author

Isabel Evans

Cyber Analyst

Blog

AI

March 31, 2026

State of AI Cybersecurity 2026: 92% of security professionals concerned about the impact of AI agents

The findings in this blog are taken from Darktrace's annual State of AI Cybersecurity Report 2026.

AI is already embedded in day-to-day enterprise activity, with 78% of participants in one recent survey reporting that their organizations are using generative AI in at least one business function. Generative AI now acts as an always-on assistant, researcher, creator, and coach across an expanding array of departments and functions. Autonomous agents are performing multi-step operational workflows from end to end. AI features have been layered on top of every SaaS application. And vibe coding is making it possible for employees without deep technical expertise to build their own AI-powered automations.

According to Gartner, more than 80% of enterprises will have deployed GenAI models, applications, or APIs in production environments by the end of this year, up from less than 5% in 2023. Companies report a 130% increase in spending on AI over the same period, with 72% of business leaders using AI tools at least weekly. The outsized efficiency and productivity gains that were once a future vision are quickly becoming everyday reality.

AI is currently driving business growth and innovation, and organizations risk falling behind peers if they don’t keep up with the pace of adoption, but it is also quietly expanding the enterprise attack surface. The modern CISO is challenged to both enable innovation and protect the business from these emerging threats.

AI agents introduce new risks and vulnerabilities

AI agents are playing growing roles in enterprise production environments. In many cases, these agents act with broad permissions across multiple software systems and platforms. This means they’re granted far-reaching access – to sensitive data, business-critical applications, tokens and APIs, and IT and security tools. With this access comes risk for security leaders – 92% are concerned about the use of AI agents across the workforce and their impact on security.

These agents must be governed as identities, with least-privilege access and ongoing monitoring. They can’t be thought of as invisible aspects of the application estate. Understanding how AI agents behave, and how to manage their permissions, control their behavior, and limit their data access will be a top security priority throughout 2026.

Generative AI prompts: The next frontier

Prompts are how users – both human and agentic – interact with AI systems, and they’re where natural language gets translated into model behavior. Natural language is infinite in its potential combinations and permutations, making this aspect of the attack surface open-ended and far more complex than traditional CVEs. With carefully crafted prompts, bad actors may be able to coax models into disclosing sensitive data, bypassing guardrails, or initiating undesirable actions.

Among security leaders, the biggest worries about AI usage in their environments all involve ways that systems might be manipulated to bypass traditional controls.

61% are most concerned about the exposure of sensitive data
56% are most concerned about potential data security and policy violations
51% are most concerned about the misuse or abuse of AI tools

The more employees rely on AI in their day-to-day workflows, the more critical it becomes for security teams to understand how prompt behavior determines model behavior – and where that behavior could go wrong.

What does “securing AI” mean in practice?

AI adoption opens new security risks that blur the boundaries between traditional security disciplines. A single malicious interaction with an AI model could involve identity misuse, sensitive data exposure, application logic abuse, and supply chain risk – all within a single workflow. Protecting this dynamic and rapidly evolving attack surface requires an approach that spans identity security, cloud security, application security, data security, software development security, and more.

The task for security leaders is to implement the tools, policies, and frameworks to mitigate these novel, expansive, and cross-disciplinary risks.

However, within most enterprises, AI policy creation remains in its infancy. Just 37% of security leaders report that their organization has a formal AI policy, representing a small but worrisome decrease from last year. Conversations about AI abound: in 52% of organizations, there’s discussion about an AI policy. Still, talk is cheap, and leaders will need to take action if they’re to successfully enable secure AI innovation.

To govern and protect their AI systems, organizations must take a multi-pronged approach. This requires building out policies, but it also demands that they are able to:

Monitor the prompts driving GenAI assistants and agents in real time. Organizations must be able to inspect prompts, sessions, and responses across enterprise GenAI tools, low- and high-code environments, and SaaS and SASE so that they can detect clever conversational prompt attacks and malicious chaining.
Secure all business AI agent identities. Security teams need to identify all the agents acting within their environment and supply chain, map their connections and interactions via MCP and services like Amazon S3, and audit their behavior across the cloud, SaaS environments, and on the network and endpoint devices.
Maintain centralized, comprehensive visibility. Understanding intent, assessing risks, and enforcing policies all require that security teams have a single view that spans AI interactions across the entire business.
Discover and control shadow AI. Teams need to be able to identify unsanctioned AI activities, distinguish the misuse of legitimate tools from their appropriate use, and apply policies to protect data, while guiding users towards approved solutions.

Scaling AI safely and responsibly

The approach that most cybersecurity vendors have taken – using historical patterns to predict future threats – doesn’t work well for AI systems. Because AI changes its behavior in response to the information it encounters while taking action, previous patterns don’t indicate what it will do next. Looking at past attacks can’t tell you how complex models will behave in your individual business.

Securing AI requires interpreting ambiguous interactions, uncovering subtleties that reveal intent within extended conversations, understanding how access accumulates over time, and recognizing when behavior – both human and machine – begins to drift towards areas of risk. To do this, you need to understand what “normal” looks like in each unique organization: how users, systems, applications, and AI agents behave, how they communicate, and how data flows between them.

Darktrace has spent more than a decade designing AI-powered solutions that can understand and adapt to evolving behavior in complex environments. This technology learns directly from the environment it protects, identifying malicious actions that deviate from normal operations, so that it can stop AI-related threats on the very first encounter.

As AI adoption reshapes enterprise operations, humans and machines will collaborate more and more often. This collaboration might dramatically expand the attack surface, but it also has the potential to be a force multiplier for defenders.

‍

Explore the full State of AI Cybersecurity 2026 report for deeper insights into how security leaders are responding to AI-driven risks.

Learn more about securing AI in your enterprise.

‍

[related-resource]

About the author

The Darktrace Community

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Revealing Outlaw's Returning Features & New Tactics

Revealing Outlaw's Returning Features & New Tactics

What is Outlaw Cryptocurrency Mining Operation?

Latest News on Outlaw

Darktrace vs Outlaw

Outlaw Attack Overview & Darktrace Coverage

Returning Features

Gzip and/or Script Download

Beaconing Activity – Command and Control (C2) Endpoint

Crypto-mining

Is Outlaw Using New Tactics?

SSH Activity

Command line tools

Outlaw in 2023

Relevant DETECT Model Breaches:

Indicators of Compromise

MITRE ATT&CK Mapping

Phantom Footprints: Tracking GhostSocks Malware

State of AI Cybersecurity 2026: 92% of security professionals concerned about the impact of AI agents

Enjoying the blog?

More in this series

Phantom Footprints: Tracking GhostSocks Malware

When Reality Diverges from the Playbook: Darktrace Identifies Encryption in a World Leaks Ransomware Attack

NetSupport RAT: How Legitimate Tools Can Be as Damaging as Malware

Blog

Network

March 31, 2026

Phantom Footprints: Tracking GhostSocks Malware

Why are attackers using residential proxies?

What is GhostSocks?

How does Ghostsocks malware work?

How does Ghostsocks malware evade detection?

Darktrace’s detection of GhostSocks Malware

Cyber AI Analyst’s investigation

Conclusion

Appendices

References

Darktrace Model Detections

MITRE ATT&CK Mapping

List of Indicators of Compromise (IoCs)

Blog

AI

March 31, 2026

State of AI Cybersecurity 2026: 92% of security professionals concerned about the impact of AI agents

AI agents introduce new risks and vulnerabilities

Generative AI prompts: The next frontier

What does “securing AI” mean in practice?

Scaling AI safely and responsibly