Blog
/
/
October 1, 2017

Feodo Banking Trojan Threatens Government Network

Learn how AI detected new Feodo banking Trojan on a government network and the resurgence of the Feodo banking trojan on a government network.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Andrew Tsonchev
VP, Security & AI Strategy, Field CISO
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
01
Oct 2017

Famous malware like Zeus, Conficker, and CryptoLocker are still some of the most common threats globally. By repurposing and repackaging known threats like these, attackers can create unknown variants that bypass signature-based security tools.

For instance, an older class of banking Trojans – known as Feodo – recently cropped up again on the network of a local US government. However, this particular strain had a key differentiator.

Darktrace detected the malware when it first was downloaded onto the government’s network. After analysis, the malware was found to be consistent with two well-documented Trojans in the Feodo family: Dridex and Emotet.

Traditionally, Trojans in the Feodo family will infect just a single device, but this attack immediately began propagating on the network, spreading to over 200 devices in a matter of hours.

The incident is part of an emerging trend of similar infections, suggesting that the Feodo family of Trojans is undergoing a resurgence, but this time retooled with ability to rapidly spread across the network.

Darktrace first detected the threat when an internal device made a series of anomalous SSL connections to IPs with self-signed certificates. The abnormal connections were a deviation from what Darktrace’s AI algorithms had learned to be normal, triggering Darktrace to raise the first in a series of alerts.

Time: 2017-04-26 11:38:05 [UTC]
Source: 172.16.14.39
Destination: 76.164.161.46
Destination Port: 995
Protocol: SSL
Version: TLSv12 [Considered HIGH security]
Cipher: TLS_RSA_WI TH_AES_256_ GCM_SHA384 [Considered HIGH security]
UID: CbenK822ViUMxJok00

The identical IP certificate subject and issuer:
Subject: CN=euwtrdjuee.biz,OU=Tslspyqh Dfxdekt Brftapckwr,O=Kaqt Aooscr LLC.,street=132 Vfjteuadivm Fklhnxdmza.,L=Elqazgap Nvax,ST=XI,C=PO
Issuer: CN=euwtrdjuee.biz,OU=Tslspyqh Dfxdekt Brftapckwr,O=Kaqt Aooscr LLC.,street=132 Vfjteuadivm Fklhnxdmza.,L=Elqazgap Nvax,ST=XI,C=PO

The device proceeded to download an anomalous ZIP file from an unusual external server. The email purported to be a notification from FedEx, and the file was disguised as an attachment containing tracking numbers. The download was nearly identical to the malicious files usually seen in Dridex and Emotet infections.

Time: 2017-04-28 16:01:03 [UTC]
Source: 172.16.14.39
Destination: 89.38.128.232
Destination Port: 80/tcp
Protocol: HTTP
Path: hxxp://XX[.]ro/UPS__Ship__Notification__Tracking__Number__2SM099383266006810/Y0894C/FEDEX-TRACK/track-tracknumbers-673639733202/
Filename: fedex-track-tracknumbers-133977976498-language-en.zip
Mime Type: application/zip

After downloading the ZIP, the device wrote an executable file to a second device via SMB. This strongly suggested that the infection was spreading, and quickly.

Time: 2017-04-28 16:52:57 [UTC]
Source: 172.16.14.39
Destination: 172.16.10.41
Destination Port: 445/tcp
Protocol: SMB
Action: write
Filename: tptzfqa.exe
Path: \\PU12881\C$
Write Size: 65536
UID: Cxq64s3tCi1vq4Uo00

The graph shows the internal connectivity of the initial device. The spike in activity, which includes numerous alerts due to unusual behavior, occurs immediately following the SMB write made by the original device.

Devices across the network started to mimic this activity by performing the same type of SMB write, each time with the same amount of data – 65536B – and a random string of characters followed by the .exe filetype.

Meanwhile, the initial device was flagged for making a large number of SMB and Kerberos login attempts. At this point, the infection had spread to over 200 devices, which were all attempting to bruteforce passwords using the same credentials as the original device, in addition to standard usernames like ‘Administrator’ and ‘misadmin’.

Bruteforcing over SMB is consistent with lateral movement seen in recent instances of Emotet, in which the Trojan was seen with new, built-in functionality designed for network propagation.

As the malware continued to spread in the government network, devices began making anomalous SSL connections without SNI (Server Name Indication).

This series of anomalies represented a massive deviation from the network’s normal ‘pattern of life’, causing the Enterprise Immune System to raise three high-priority alerts in real time: one alert for the SMB session bruteforce, another for the Kerberos activity, and another for the anomalous SSL connections without SNI.

The final anomaly occurred when devices made a flurry of unusual DNS requests for DGA-generated domains, often involving rare TLDs such as .biz and .info. The DNS requests illustrate a sophisticated method to disguise communications to the attacker’s command and control centers. Darktrace’s AI algorithms deemed this domain fluxing activity to be highly unusual compared to ordinary behavior, thus raising one final alert before the security team was able to intervene.

A sample of the DNS requests:

15:33:00 hd12530.mi.SALTEDHAZE.org made a successful DNS request for rbqfkjjemttqumeobxb.org to dc1-2012.mi.[REDACTED].org
15:33:10 hd12530.mi.SALTEDHAZE.org made a successful DNS request for tmmiqtsdnkjdcqr.biz to dc1-2012.mi.SALTEDHAZE.org
15:33:20 hd12530.mi.SALTEDHAZE.org made a successful DNS request for mehqdlodsgggehchxdwfsmmoq.biz to dc1-2012.mi.SALTEDHAZE.org

Taken on their own, each of these anomalies could be explained as an isolated incident or perhaps a false-positive. But taken together, they form a broader picture of a widespread and aggressive infection, in which an external hacker had taken control of over 200 devices and was using them to attempt to harvest the users’ banking credentials and transfer funds into their own account.

In accordance with the Feodo family of banking Trojans, the malware was likely attempting to steal banking credentials by intercepting web form submissions. Yet, by adding the ability to spread through the network, the attacker was able to create a completely novel attack type that circumvented the perimeter security controls and infected over 200 devices.

As the threat progressed, the Enterprise Immune System raised real-time alerts and revealed in-depth details on the nature of the compromise. Using this information, the government’s security team was able to remediate the situation before any banking credentials could be stolen.

To learn more about the threats Darktrace finds, check out our Threat Use Cases page which discusses a host of other novel infections that were stopped by the Enterprise Immune System.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Andrew Tsonchev
VP, Security & AI Strategy, Field CISO

More in this series

No items found.

Blog

/

/

May 1, 2025

Your Vendors, Your Risk: Rethinking Third-Party Security in the Age of Supply Chain Attacks

man on cellphoneDefault blog imageDefault blog image

When most people hear the term supply chain attack, they often imagine a simple scenario: one organization is compromised, and that compromise is used as a springboard to attack another. This kind of lateral movement is common, and often the entry vector is as mundane and as dangerous as email.

Take, for instance, a situation where a trusted third-party vendor is breached. An attacker who gains access to their systems can then send malicious emails to your organization, emails that appear to come from a known and reputable source. Because the relationship is trusted, traditional phishing defenses may not be triggered, and recipients may be more inclined to engage with malicious content. From there, the attacker can establish a foothold, move laterally, escalate privileges, and launch a broader campaign.

This is one dimension of a supply chain cyber-attack, and it’s well understood in many security circles. But the risk doesn’t end there. In fact, it goes deeper, and it often hits the most important asset of all: your customers' data.

The risk beyond the inbox

What happens when customer data is shared with a third party for legitimate processing purposes for example billing, analytics, or customer service and that third party is then compromised?

In that case, your customer data is breached, even if your own systems were never touched. That’s the uncomfortable truth about modern cybersecurity: your risk is no longer confined to your own infrastructure. Every entity you share data with becomes an extension of your attack surface. Thus, we should rethink how we perceive responsibility.

It’s tempting to think that securing our environment is our job, and securing their environment is theirs. But if a breach of their environment results in the exposure of our customers, the accountability and reputational damage fall squarely on our shoulders.

The illusion of boundaries

In an era where digital operations are inherently interconnected, the lines of responsibility can blur quickly. Legally and ethically, organizations are still responsible for the data they collect even if that data is processed, stored, or analyzed by a third party. A customer whose data is leaked because of a vendor breach will almost certainly hold the original brand responsible, not the third-party processor they never heard of.

This is particularly important for industries that rely on extensive outsourcing and platform integrations (SaaS platforms, marketing tools, CRMs, analytics platforms, payment processors). The list of third-party vendors with access to customer data grows year over year. Each integration adds convenience, but also risk.

Encryption isn’t a silver bullet

One of the most common safeguards used in these data flows is encryption. Encrypting customer data in transit is a smart and necessary step, but it’s far from enough. Once data reaches the destination system, it typically needs to be decrypted for use. And the moment it is decrypted, it becomes vulnerable to a variety of attacks like ransomware, data exfiltration, privilege escalation, and more.

In other words, the question isn’t just is the data secure in transit? The more important question is how is it protected once it arrives?

A checklist for organizations evaluating third-parties

Given these risks, what should responsible organizations do when they need to share customer data with third parties?

Start by treating third-party security as an extension of your own security program. Here are some foundational controls that can make a difference:

Due diligence before engagement: Evaluate third-party vendors based on their security posture before signing any contracts. What certifications do they hold? What frameworks do they follow? What is their incident response capability?

Contractual security clauses: Build in specific security requirements into vendor contracts. These can include requirements for encryption standards, access control policies, and data handling protocols.

Third-party security assessments: Require vendors to provide evidence of their security controls. Independent audits, penetration test results, and SOC 2 reports can all provide useful insights.

Ongoing monitoring and attestations: Security isn’t static. Make sure vendors provide regular security attestations and reports. Where possible, schedule periodic reviews or audits, especially for vendors handling sensitive data.

Minimization and segmentation: Don’t send more data than necessary. Data minimization limits the exposure in the event of a breach. Segmentation, both within your environment and within vendor access levels, can further reduce risk.

Incident response planning: Ensure you have a playbook for handling third-party incidents, and that vendors do as well. Coordination in the event of a breach should be clear and rapid.

The human factor: Customers and communication

There’s another angle to supply chain cyber-attacks that’s easy to overlook: the post-breach exploitation of public knowledge. When a breach involving customer data hits the news, it doesn’t take long for cybercriminals to jump on the opportunity.

Attackers can craft phishing emails that appear to be follow-ups from the affected organization: “Click here to reset your password,” “Confirm your details due to the breach,” etc.

A breach doesn’t just put customer data at risk it also opens the door to further fraud, identity theft, and financial loss through social engineering. This is why post-breach communication and phishing mitigation strategies are valuable components of an incident response strategy.

Securing what matters most

Ultimately, protecting against supply chain cyber-attacks isn’t just about safeguarding your own perimeter. It’s about defending the integrity of your customers’ data, wherever it goes. When customer data is entrusted to you, the duty of care doesn’t end at your firewall.

Relying on vendors to “do their part” is not enough. True due diligence means verifying, validating, and continuously monitoring those extended attack surfaces. It means designing controls that assume failure is possible, and planning accordingly.

In today’s threat landscape, cybersecurity is no longer just a technical discipline. It’s a trust-building exercise. Your customers expect you to protect their information, and rightly so. And when a supply chain attack happens, whether the breach originated with you or your partner, the damage lands in the same place: your brand, your customers, your responsibility.

[related-resource]

Continue reading
About the author
Tony Jarvis
VP, Field CISO

Blog

/

/

April 30, 2025

Boosting Security with Azure Virtual Network TAP Traffic Mirroring

Man sitting at computerDefault blog imageDefault blog image

We are thrilled to announce that Darktrace is a launch partner for the Public Preview of Microsoft Azure Virtual Network Terminal Access Point (TAP). As Microsoft's 2024 UK Partner of the Year, we continue to innovate alongside Microsoft to deliver proactive cyber protection tailored to every organization.

Enhanced Defense Across the Modern Network

Modern networks are expanding far beyond on-premises into virtual environments, cloud and hybrid networks. More than 50% of incidents will come from cloud network activity by 2029, meaning defenders need a solution that can level the playing field against complex attacks that traverse multiple areas of a digital estate, including north-south and east-west traffic.

With Azure Virtual Network TAP, Darktrace’s self-learning AI gains seamless access to granular packet data in hybrid environments. This integration helps our Cyber AI platform build a comprehensive understanding of a customers’ Azure network. Microsoft's recent enhancement allows Virtual Network TAP to mirror the full throughput of VMs without impacting VM bandwidth, enabling agentless Cyber AI defense across these instances.

Darktrace's Cyber AI provides real-time visibility and adaptive, autonomous defense for your Microsoft security strategy. Our platform continuously learns the normal behavior of every user, device, and workload in your environment. This deep understanding of usual 'patterns of life' enables Darktrace to detect subtle deviations that indicate threats, from account takeovers to critical misconfigurations.

Our bespoke, real-time knowledge of usual activity allows Darktrace to identify unknown and unpredictable threats that bypass policy-based defenses—without relying on rules, signatures, or prior assumptions. This approach is a powerful compliment to Microsoft’s unprecedented threat intelligence.

Expanding Azure Virtual Network TAP

Azure Virtual Network TAP allows continuous streaming of virtual machine network traffic, which customers can leverage for Darktrace’s AI-driven threat detection and investigation. Darktrace / NETWORK passively ingests traffic from on-premises, virtual, cloud, hybrid environments, and remote devices, analyzing both encrypted and decrypted packets to uncover unusual activity in real-time. Unlike other NDR vendors that process data in the cloud, our industry-leading Self-Learning AI is deployed locally and trained solely on your data, ensuring tailored security outcomes without compromising privacy.

Benefits to Darktrace Customers

Darktrace customers will experience enhanced security through deeper insights into network traffic, enabling more accurate threat detection and response. The ability to mirror full VM throughput without affecting bandwidth ensures optimal performance, while agentless defense reduces barrier to entry and simplifies management. Customers benefit from proactive protection by continuously monitoring and analyzing traffic to identify and mitigate threats before they cause harm. Additionally, seamless integration with existing Azure environments leverages the power of Darktrace’s AI for enhanced security.

[related-resource]

Continue reading
About the author
Adam Stevens
Director of Product, Cloud Security
Your data. Our AI.
Elevate your network security with Darktrace AI