May 1, 2025

SocGholish: From loader and C2 activity to RansomHub deployment

In early 2025, Darktrace uncovered SocGholish-to-RansomHub intrusion chains, including loader and C2 activity, alongside credential harvesting via WebDAV and SCF abuse. Learn more about SocGholish and its kill chain here!

Written by

Christina Kreza

Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Christina Kreza

Cyber Analyst

May 2025

Over the past year, a clear pattern has emerged across the threat landscape: ransomware operations are increasingly relying on compartmentalized affiliate models. In these models, initial access brokers (IABs) [6], malware loaders, and post-exploitation operators work together.

Due to those specialization roles, a new generation of loader campaigns has risen. Threat actors increasingly employ loader operators to quietly establish footholds on the target network. These entities then hand off access to ransomware affiliates. One loader that continues to feature prominently in such campaigns is SocGholish.

What is SocGholish?

SocGholish is a loader malware that has been utilized since at least 2017 [7]. It has long been associated with fake browser updates and JavaScript-based delivery methods on infected websites.

Threat actors often target outdated or poorly secured CMS-based websites like WordPress. Through unpatched plugins, or even remote code execution flaws, they inject malicious JavaScript into the site’s HTML, templates or external JS resources [8]. Historically, SocGholish has functioned as a first-stage malware loader, ultimately leading to deployment of Cobalt Strike beacons [9], and further facilitating access persistence to corporate environments. More recently, multiple security vendors have reported that infections involving SocGholish frequently lead to the deployment of RansomHub ransomware [3] [5].

This blog explores multiple instances within Darktrace's customer base where SocGholish deployment led to subsequent network compromises. Investigations revealed indicators of compromise (IoCs) similar to those identified by external security researchers, along with variations in attacker behavior post-deployment. Key innovations in post-compromise activities include credential access tactics targeting authentication mechanisms, particularly through the abuse of legacy protocols like WebDAV and SCF file interactions over SMB.

Initial access and execution

Since January 2025, Darktrace’s Threat Research team observed multiple cases in which threat actors leveraged the SocGholish loader for initial access. Malicious actors commonly deliver SocGholish by compromising legitimate websites by injecting malicious scripts into the HTML of the affected site. When the visitor lands on an infected site, they are typically redirected to a fake browser update page, tricking them into downloading a ZIP file containing a JavaScript-based loader [1] [2]. In one case, a targeted user appears to have visited the compromised website garagebevents[.]com (IP: 35.203.175[.]30), from which around 10 MB of data was downloaded.

Figure 1: Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.

Within milliseconds of the connection establishment, the user’s device initiated several HTTPS sessions over the destination port 443 to the external endpoint 176.53.147[.]97, linked to the following Keitaro TDS domains:

packedbrick[.]com
rednosehorse[.]com
blackshelter[.]org
blacksaltys[.]com

To evade detection, SocGholish uses highly obfuscated code and relies on traffic distribution systems (TDS) [3]. TDS is a tool used in digital and affiliate marketing to manage and distribute incoming web traffic based on predefined rules. More specifically, Keitaro is a premium self-hosted TDS frequently utilized by attackers as a payload repository for malicious scripts following redirects from compromised sites. In the previously noted example, it appears that the device connected to the compromised website, which then retrieved JavaScript code from the aforementioned Keitaro TDS domains. The script served by those instances led to connections to the endpoint virtual.urban-orthodontics[.]com (IP: 185.76.79[.]50), successfully completing SocGholish’s distribution.

Figure 2: Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.

Persistence

During some investigations, Darktrace researchers observed compromised devices initiating HTTPS connections to the endpoint files.pythonhosted[.]org (IP: 151.101.1[.]223), suggesting Python package downloads. External researchers have previously noted how attackers use Python-based backdoors to maintain access on compromised endpoints following initial access via SocGholish [5].

Credential access and lateral movement

Credential access – external

Darktrace researchers identified observed some variation in kill chain activities following initial access and foothold establishment. For example, Darktrace detected interesting variations in credential access techniques. In one such case, an affected device attempted to contact the rare external endpoint 161.35.56[.]33 using the Web Distributed Authoring and Versioning (WebDAV) protocol. WebDAV is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. WebDAV enables remote shares to be mounted over HTTP or HTTPS, similar to how SMB operates, but using web-based protocols. Windows supports WebDAV natively, which means a UNC path pointing to an HTTP or HTTPS resource can trigger system-level behavior such as authentication.

In this specific case, the system initiated outbound connections using the ‘Microsoft-WebDAV-MiniRedir/10.0.19045’ user-agent, targeting the URI path of /s on the external endpoint 161.35.56[.]33. During these requests, the host attempted to initiate NTML authentication and even SMB sessions over the web, both of which failed. Despite the session failures, these attempts also indicate a form of forced authentication. Forced authentication exploits a default behavior in Windows where, upon encountering a UNC path, the system will automatically try to authenticate to the resource using NTML – often without any user interaction. Although no files were directly retrieved, the WebDAV server was still likely able to retrieve the user’s NTLM hash during the session establishment requests, which can later be used by the adversary to crack the password offline.

Credential access – internal

In another investigated incident, Darktrace observed a related technique utilized for credential access and lateral movement. This time, the infected host uploaded a file named ‘Thumbs.scf’ to multiple internal SMB network shares. Shell Command File ( SCF) is a legacy Windows file format used primarily for Windows Explorer shortcuts. These files contain instructions for rendering icons or triggering shell commands, and they can be executed implicitly when a user simply opens a folder containing the file – no clicks required.

The ‘Thumbs.scf’ file dropped by the attacker was crafted to exploit this behavior. Its contents included a [Shell] section with the Command=2 directive and an IconFile path pointing to a remote UNC resource on the same external endpoint, 161.35.56[.]33, seen in the previously described case – specifically, ‘\\161.35.56[.]33\share\icon.ico’. When a user on the internal network navigates to the folder containing the SCF file, their system will automatically attempt to load the icon. In doing so, the system issues a request to the specified UNC path, which again prompts Windows to initiate NTML authentication.

This pattern of activity implies that the attacker leveraged passive internal exposure; users who simply browsed a compromised share would unknowingly send their NTML hashes to an external attacker-controlled host. Unlike the WebDAV approach, which required initiating outbound communication from the infected host, this SCF method relies on internal users to interact with poisoned folders.

Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.

Command-and-control

Following initial compromise, affected devices would then attempt outbound connections using the TLS/SSL protocol over port 443 to different sets of command-and-control (C2) infrastructure associated with SocGholish. The malware frequently uses obfuscated JavaScript loaders to initiate its infection chain, and once dropped, the malware communicates back to its infrastructure over standard web protocols, typically using HTTPS over port 443. However, this set of connections would precede a second set of outbound connections, this time to infrastructure linked to RansomHub affiliates, possibly facilitating the deployed Python-based backdoor.

Connectivity to RansomHub infrastructure relied on defense evasion tactics, such as port-hopping. The idea behind port-hopping is to disguise C2 traffic by avoiding consistent patterns that might be caught by firewalls, and intrusion detection systems. By cycling through ephemeral ports, the malware increases its chances of slipping past basic egress filtering or network monitoring rules that only scrutinize common web traffic ports like 443 or 80. Darktrace analysts identified systems connecting to destination ports such as 2308, 2311, 2313 and more – all on the same destination IP address associated with the RansomHub C2 environment.

Figure 4: Advanced Search connection logs showing connections over destination ports that change rapidly.

Conclusion

Since the beginning of 2025, Darktrace analysts identified a campaign whereby ransomware affiliates leveraged SocGholish to establish network access in victim environments. This activity enabled multiple sets of different post exploitation activity. Credential access played a key role, with affiliates abusing WebDAV and NTML over SMB to trigger authentication attempts. The attackers were also able to plant SCF files internally to expose NTML hashes from users browsing shared folders. These techniques evidently point to deliberate efforts at early lateral movement and foothold expansion before deploying ransomware. As ransomware groups continue to refine their playbooks and work more closely with sophisticated loaders, it becomes critical to track not just who is involved, but how access is being established, expanded, and weaponized.

Credit to Chrisina Kreza (Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

[related-resource]

Appendices

Darktrace / NETWORK model alerts

· Anomalous Connection / SMB Enumeration

· Anomalous Connection / Multiple Connections to New External TCP Port

· Anomalous Connection / Multiple Failed Connections to Rare Endpoint

· Anomalous Connection / New User Agent to IP Without Hostname

· Compliance / External Windows Communication

· Compliance / SMB Drive Write

· Compromise / Large DNS Volume for Suspicious Domain

· Compromise / Large Number of Suspicious Failed Connections

· Device / Anonymous NTML Logins

· Device / External Network Scan

· Device / New or Uncommon SMB Named Pipe

· Device / SMB Lateral Movement

· Device / Suspicious SMB Activity

· Unusual Activity / Unusual External Activity

· User / Kerberos Username Brute Force

MITRE ATT&CK mapping

· Credential Access – T1187 Forced Authentication

· Credential Access – T1110 Brute Force

· Command and Control – T1071.001 Web Protocols

· Command and Control – T1571 Non-Standard Port

· Discovery – T1083 File and Directory Discovery

· Discovery – T1018 Remote System Discovery

· Discovery – T1046 Network Service Discovery

· Discovery – T1135 Network Share Discovery

· Execution – T1059.007 JavaScript

· Lateral Movement – T1021.002 SMB/Windows Admin Shares

· Resource Deployment – T1608.004 Drive-By Target

List of indicators of compromise (IoCs)

· garagebevents[.]com – 35.203.175[.]30 – Possibly compromised website

· packedbrick[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

· rednosehorse[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

· blackshelter[.]org – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

· blacksaltys[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

· virtual.urban-orthodontics[.]com – 185.76.79[.]50

· msbdz.crm.bestintownpro[.]com – 166.88.182[.]126 – SocGholish C2

· 185.174.101[.]240 – RansomHub Python C2

· 185.174.101[.]69 – RansomHub Python C2

· 108.181.182[.]143 – RansomHub Python C2

References

[1] https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/socgholish-malware/

[2] https://intel471.com/blog/threat-hunting-case-study-socgholish

[3] https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html

[4] https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware

[5] https://www.guidepointsecurity.com/blog/ransomhub-affiliate-leverage-python-based-backdoor/

[6] https://www.cybereason.com/blog/how-do-initial-access-brokers-enable-ransomware-attacks

[7] https://attack.mitre.org/software/S1124/

[8] https://expel.com/blog/incident-report-spotting-socgholish-wordpress-injection/

[9] https://www.esentire.com/blog/socgholish-to-cobalt-strike-in-10-minutes

Get the latest insights on emerging cyber threats

This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025

Inside the SOC

Written by

Christina Kreza

Cyber Analyst

Senior Product Marketing Manager, Email

Watch the NIS2 Webinar

Blog

Network

December 4, 2025

Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

The Rise of Infostealers Targeting Apple Users

In a threat landscape historically dominated by Windows-based threats, the growing prevalence of macOS information stealers targeting Apple users is becoming an increasing concern for organizations. Infostealers are a type of malware designed to steal sensitive data from target devices, often enabling attackers to extract credentials and financial data for resale or further exploitation. Recent research identified infostealers as the largest category of new macOS malware, with an alarming 101% increase in the last two quarters of 2024 [1].

What is Atomic Stealer?

Among the most notorious is Atomic macOS Stealer (or AMOS), first observed in 2023. Known for its sophisticated build, Atomic Stealer can exfiltrate a wide range of sensitive information including keychain passwords, cookies, browser data and cryptocurrency wallets.

Originally marketed on Telegram as a Malware-as-a-Service (MaaS), Atomic Stealer has become a popular malware due to its ability to target macOS. Like other MaaS offerings, it includes services like a web panel for managing victims, with reports indicating a monthly subscription cost between $1,000 and $3,000 [2]. Although Atomic Stealer’s original intent was as a standalone MaaS product, its unique capability to target macOS has led to new variants emerging at an unprecedented rate

Even more concerning, the most recent variant has now added a backdoor for persistent access [3]. This backdoor presents a significant threat, as Atomic Stealer campaigns are believed to have reached an around 120 countries. The addition of a backdoor elevates Atomic Stealer to the rare category of backdoor deployments potentially at a global scale, something only previously attributed to nation-state threat actors [4].

This level of sophistication is also evident in the wide range of distribution methods observed since its first appearance; including fake application installers, malvertising and terminal command execution via the ClickFix technique. The ClickFix technique is particularly noteworthy: once the malware is downloaded onto the device, users are presented with what appears to be a legitimate macOS installation prompt. In reality, however, the user unknowingly initiates the execution of the Atomic Stealer malware.

This blog will focus on activity observed across multiple Darktrace customer environments where Atomic Stealer was detected, along with several indicators of compromise (IoCs). These included devices that successfully connected to endpoints associated with Atomic Stealer, those that attempted but failed to establish connections, and instances suggesting potential data exfiltration activity.

Darktrace’s Coverage of Atomic Stealer

As this evolving threat began to spread across the internet in June 2025, Darktrace observed a surge in Atomic Stealer activity, impacting numerous customers in 24 different countries worldwide. Initially, most of the cases detected in 2025 affected Darktrace customers within the Europe, Middle East, and Africa (EMEA) region. However, later in the year, Darktrace began to observe a more even distribution of cases across EMEA, the Americas (AMS), and Asia Pacific (APAC). While multiple sectors were impacted by Atomic Stealer, Darktrace customers in the education sector were the most affected, particularly during September and October, coinciding with the return to school and universities after summer closures. This spike likely reflects increased device usage as students returned and reconnected potentially compromised devices to school and campus environments.

Starting from June, Darktrace detected multiple events of suspicious HTTP activity to external connections to IPs in the range 45.94.47.0/24. Investigation by Darktrace’s Threat Research team revealed several distinct patterns ; HTTP POST requests to the URI “/contact”, identical cURL User Agents and HTTP requests to “/api/tasks/[base64 string]” URIs.

Within one observed customer’s environment in July, Darktrace detected two devices making repeated initiated HTTP connections over port 80 to IPs within the same range. The first, Device A, was observed making GET requests to the IP 45.94.47[.]158 (AS60781 LeaseWeb Netherlands B.V.), targeting the URI “/api/tasks/[base64string]” using the “curl/8.7.2” user agent. This pattern suggested beaconing activity and triggered the ‘Beaconing Activity to External Rare' model alert in Darktrace / NETWORK, with Device A’s Model Event Log showing repeated connections. The IP associated with this endpoint has since been flagged by multiple open-source intelligence (OSINT) vendors as being associated with Atomic Stealer [5].

Figure 1: Darktrace’s detection of Device A showing repeated connections to the suspicious IP address over port 80, indicative of beaconing behavior.

Darktrace’s Cyber AI Analyst subsequently launched an investigation into the activity, uncovering that the GET requests resulted in a ‘503 Service Unavailable’ response, likely indicating that the server was temporarily unable to process the requests.

Figure 2: Cyber AI Analyst Incident showing the 503 Status Code, indicating that the server was temporarily unavailable.

This unusual activity prompted Darktrace’s Autonomous Response capability to recommend several blocking actions for the device in an attempt to stop the malicious activity. However, as the customer’s Autonomous Response configuration was set to Human Confirmation Mode, Darktrace was unable to automatically apply these actions. Had Autonomous Response been fully enabled, these connections would have been blocked, likely rendering the malware ineffective at reaching its malicious command-and-control (C2) infrastructure.

Figure 3: Autonomous Response’s suggested actions to block suspicious connectivity on Device A in the first customer environment.

In another customer environment in August, Darktrace detected similar IoCs, noting a device establishing a connection to the external endpoint 45.94.47[.]149 (ASN: AS57043 Hostkey B.V.). Shortly after the initial connections, the device was observed making repeated requests to the same destination IP, targeting the URI /api/tasks/[base64string] with the user agent curl/8.7.1, again suggesting beaconing activity. Further analysis of this endpoint after the fact revealed links to Atomic Stealer in OSINT reporting [6].

Figure 4: Cyber AI Analyst investigation finding a suspicious URI and user agent for the offending device within the second customer environment.

As with the customer in the first case, had Darktrace’s Autonomous Response been properly configured on the customer’s network, it would have been able to block connectivity with 45.94.47[.]149. Instead, Darktrace suggested recommended actions that the customer’s security team could manually apply to help contain the attack.

Figure 5: Autonomous Response’s suggested actions to block suspicious connectivity to IP 45.94.47[.]149 for the device within the second customer environment.

In the most recent case observed by Darktrace in October, multiple instances of Atomic Stealer activity were seen across one customer’s environment, with two devices communicating with Atomic Stealer C2 infrastructure. During this incident, one device was observed making an HTTP GET request to the IP 45.94.47[.]149 (ASN: AS60781 LeaseWeb Netherlands B.V.). These connections targeted the URI /api/tasks/[base64string, using the user agent curl/8.7.1.

Shortly afterward, the device began making repeated connections over port 80 to the same external IP, 45.94.47[.]149. This activity continued for several days until Darktrace detected the device making an HTTP POST request to a new IP, 45.94.47[.]211 (ASN: AS57043 Hostkey B.V.), this time targeting the URI /contact, again using the curl/8.7.1 user agent. Similar to the other IPs observed in beaconing activity, OSINT reporting later linked this one to information stealer C2 infrastructure [7].

Figure 6: Darktrace’s detection of suspicious beaconing connectivity with the suspicious IP 45.94.47.211.

Further investigation into this customer’s network revealed that similar activity had been occurring as far back as August, when Darktrace detected data exfiltration on a second device. Cyber AI Analyst identified this device making a single HTTP POST connection to the external IP 45.94.47[.]144, another IP with malicious links [8], using the user agent curl/8.7.1 and targeting the URI /contact.

Figure 7: Cyber AI Analyst investigation finding a successful POST request to 45.94.47[.]144 for the device within the third customer environment.

A deeper investigation into the technical details within the POST request revealed the presence of a file named “out.zip”, suggesting potential data exfiltration.

Figure 8: Advanced Search log in Darktrace / NETWORK showing “out.zip”, indicating potential data exfiltration for a device within the third customer environment.

Similarly, in another environment, Darktrace was able to collect a packet capture (PCAP) of suspected Atomic Stealer activity, which revealed potential indicators of data exfiltration. This included the presence of the “out.zip” file being exfiltrated via an HTTP POST request, along with data that appeared to contain details of an Electrum cryptocurrency wallet and possible passwords.

Read more about Darktrace’s full deep dive into a similar case where this tactic was leveraged by malware as part of an elaborate cryptocurrency scam.

Figure 9: PCAP of an HTTP POST request showing the file “out.zip” and details of Electrum Cryptocurrency wallet.

Although recent research attributes the “out.zip” file to a new variant named SHAMOS [9], it has also been linked more broadly to Atomic Stealer [10]. Indeed, this is not the first instance where Darktrace has seen the “out.zip” file in cases involving Atomic Stealer either. In a previous blog detailing a social engineering campaign that targeted cryptocurrency users with the Realst Stealer, the macOS version of Realst contained a binary that was found to be Atomic Stealer, and similar IoCs were identified, including artifacts of data exfiltration such as the “out.zip” file.

Conclusion‍

The rapid rise of Atomic Stealer and its ability to target macOS marks a significant shift in the threat landscape and should serve as a clear warning to Apple users who were traditionally perceived as more secure in a malware ecosystem historically dominated by Windows-based threats.

Atomic Stealer’s growing popularity is now challenging that perception, expanding its reach and accessibility to a broader range of victims. Even more concerning is the emergence of a variant embedded with a backdoor, which is likely to increase its appeal among a diverse range of threat actors. Darktrace’s ability to adapt and detect new tactics and IoCs in real time delivers the proactive defense organizations need to protect themselves against emerging threats before they can gain momentum.

Credit to Isabel Evans (Cyber Analyst), Dylan Hinz (Associate Principal Cyber Analyst)
Edited by Ryan Traill (Analyst Content Lead)

Appendices

References

1. https://www.scworld.com/news/infostealers-targeting-macos-jumped-by-101-in-second-half-of-2024

2. https://www.kandji.io/blog/amos-macos-stealer-analysis

3. https://www.broadcom.com/support/security-center/protection-bulletin/amos-stealer-adds-backdoor

4. https://moonlock.com/amos-backdoor-persistent-access

5. https://www.virustotal.com/gui/ip-address/45.94.47.158/detection

6. https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html

7. https://www.virustotal.com/gui/ip-address/45.94.47.211/detection

8. https://www.virustotal.com/gui/ip-address/45.94.47.144/detection

9. https://securityaffairs.com/181441/malware/over-300-entities-hit-by-a-variant-of-atomic-macos-stealer-in-recent-campaign.html

10. https://binhex.ninja/malware-analysis-blogs/amos-stealer-atomic-stealer-malware.html

Darktrace Model Detections

Darktrace / NETWORK

Compromise / Beaconing Activity To External Rare
Compromise / HTTP Beaconing to New IP
Compromise / HTTP Beaconing to Rare Destination
Anomalous Connection / New User Agent to IP Without Hostname
Device / New User Agent
Compromise / Sustained TCP Beaconing Activity To Rare Endpoint
Compromise / Slow Beaconing Activity To External Rare
Anomalous Connection / Posting HTTP to IP Without Hostname
Compromise / Quick and Regular Windows HTTP Beaconing

Autonomous Response

Antigena / Network / Significant Anomaly::Antigena Alerts Over Time Block
Antigena / Network / Significant Anomaly::Antigena Significant Anomaly from Client Block
Antigena / Network / External Threat::Antigena Suspicious Activity Block

List of IoCs

45.94.47[.]149 – IP – Atomic C2 Endpoint
45.94.47[.]144 – IP – Atomic C2 Endpoint
45.94.47[.]158 – IP – Atomic C2 Endpoint
45.94.47[.]211 – IP – Atomic C2 Endpoint
out.zip - File Output – Possible ZIP file for Data Exfiltration

MITRE ATT&CK Mapping:

Tactic –Technique – Sub-Technique

Execution - T1204.002 - User Execution: Malicious File

Credential Access - T1555.001 - Credentials from Password Stores: Keychain

Credential Access - T1555.003 - Credentials from Web Browsers

Command & Control - T1071 - Application Layer Protocol

Exfiltration - T1041 - Exfiltration Over C2 Channel

About the author

Dylan Hinz

Cyber Analyst

Blog

Email

December 4, 2025

How Darktrace is ending email security silos with new capabilities in cross-domain detection, DLP, and native Microsoft integrations

A new era of reputation-aware, unified email security

Darktrace / EMAIL is redefining email defense with new innovations that close email security silos and empower SOC teams to stop multi-stage attacks – without disrupting business operations.

By extending visibility across interconnected domains, Darktrace catches the 17% of threats that leading SEGs miss, including multi-stage attacks like email bombing and cloud platform abuse. Its label-free behavioral DLP protects sensitive data without reliance on manual rules or classification, while DMARC strengthens brand trust and authenticity. With native integrations for Microsoft Defender and Security Copilot, SOC teams can now investigate and respond faster, reducing risk and maintaining operational continuity across the enterprise.

Summary of what’s new:

Cross-domain AI-native detection unifying email, identity, and SaaS
Label-free behavioral DLP for effortless data protection
Microsoft Defender and Security Copilot integrations for streamlined investigation and response

Why email security must evolve

Today’s attacks don’t stop at the inbox. They move across domains – email to identity, SaaS, and network – exploiting the blind spots between disconnected tools. Yet most email security solutions still operate in isolation, unable to see or respond beyond the message itself.

In 2024, Darktrace detected over 30 million phishing attempts: 38% targeting high-value individuals and almost a third using novel social engineering, including AI-generated text. Generative AI is amplifying the realism and scale of social engineering, while customers face a wave of new techniques like email bombing, where attackers flood inboxes to distract or manipulate users, and polymorphic malware, which continuously evolves to evade static defenses.

Meanwhile, defenders are exposed to traditional DLP tools that create operational drag with high false positives and rigid policies. Accidental insider breachers remain a major risk to organizations: 6% of all data breaches are caused by misdelivery, and 95% of those incidents involve personal data.

Tool sprawl compounds the issue. The average enterprise manages around 75 security products, and 69% report operational strain as a result. This complexity is counterproductive – and with legacy SEGs failing to adapt to detect threats that exploit human behavior, analysts are left juggling an unwieldy patchwork of fragmented defenses.

The bottom line? Siloed email defenses can’t keep pace with today’s AI-driven, cross domain attacks.

Beyond detection: AI built for modern threats

Darktrace / EMAIL is uniquely designed to catch the threats SEGs miss, powered by Self-Learning AI. It learns the communication patterns of every user – correlating behavioral signals from email, identity, and SaaS – to identify the subtle, context-driven deviations that define advanced social engineering and supply chain attacks.

Unlike tools that rely on static rules or historical attack data, Darktrace’s AI assumes a zero trust posture, treating every interaction as a potential risk. It detects novel threats in real time, including those that exploit trusted relationships or mimic legitimate business processes. And because Darktrace’s technology is natively unified, it delivers precise, coordinated responses that neutralize threats in real time.

Powerful innovations to Darktrace / EMAIL

Improved, multi-domain threat detection and response

With this update, Darktrace reveals multi-domain detection linking behavioral signals across email, identity, and SaaS to uncover advanced attacks. Darktrace leverages its existing agentic platform to understand behavioral deviations in any communication channel and take precise actions regardless of the domain.  

This innovation enables customers to:

Correlate behavioral signals across domains to expose cross-channel threats and enable coordinated response
Link email and identity intelligence to neutralize multi-stage attacks, including advanced email bombing campaigns

Detection accuracy is further strengthened through layering with traditional threat intelligence:

Integrated antivirus verdicts improve detection efficacy by adding traditional file scanning
Structured threat intelligence (STIX/TAXII) enriches alerts with global context for faster triage and prioritization

Expanded ecosystem visibility also includes:

Salesforce integration, enabling automatic action on potentially malicious tickets auto-created from emails – accelerating threat response and reducing manual burden

Advancements in label-free DLP

Darktrace is delivering the industry’s first label-free data loss prevention (DLP) solution powered by a proprietary domain specific language model (DSLM).

This update expands DLP to protect against both secrets and personally identifiable information (PII), safeguarding sensitive data without relying on status rules or manual classification. The DSLM is tuned for email/DLP semantics so it understands entities, PII patterns, and message context quickly enough to enforce at send time.

Key enhancements include:

Behaviorally enhanced PII detection that automatically defines over 35+ new categories, including personal, financial, and health data
Added detail to DLP alerts in the UI, showing exactly how and when DLP policies were applied
Enhanced Cyber AI Analyst narratives to explain detection logic, making it easier to investigate and escalate incidents

And for further confidence in outbound mail, discover new updates to DMARC, with support for BIMI logo verification, automatic detection of both MTA-STS and TLS records, and data exports for deeper analysis and reporting. Accessible for all organizations, available now on the Azure marketplace.

Streamlined SOC workflows, with Microsoft-native integrations

This update introduces new integrations that simplify SOC operations, unify visibility, and accelerate response. By embedding directly into the Microsoft ecosystem – with Defender and Security Copilot – analysts gain instant access to correlated insights without switching consoles.

New innovations include:

Unified quarantine management with Microsoft Defender, centralizing containment within the native Microsoft interface and eliminating console hopping
Ability to surface threat insights directly in Copilot via the Darktrace Email Analysis Agent, eliminating data hunting and simplifying investigations
Automatic ticket creation in JIRA when users report suspicious messages
Sandbox analysis integration, enabling payload inspection in isolated environments directly from the Darktrace UI

Committed to innovation

These updates are part of the broader Darktrace release, which also included:

Major innovations in cloud security with the launch of the industry’s first fully automated cloud forensics solution, reinforcing Darktrace’s leadership in AI-native security.
Redefining NDR with industry-first autonomous threat investigation from network to endpoint
Innovations to our suite of Exposure Management & Attack Surface Management tools

As attackers exploit gaps between tools, the Darktrace ActiveAI Security Platform delivers unified detection, automated investigation, and autonomous response across cloud, endpoint, email, network, and OT. With full-stack visibility and AI-native workflows, Darktrace empowers security teams to detect, understand, and stop novel threats before they escalate.

Join our Live Launch Event

When? December 9, 2025

What will be covered? Join our live broadcast to experience how Darktrace is eliminating blind spots for detection and response across your complete enterprise with new innovations in Agentic AI across our ActiveAI Security platform. Industry leaders from IDC will join Darktrace customers to discuss challenges in cross-domain security, with a live walkthrough reshaping the future of Network Detection & Response, Endpoint Detection & Response, Email Security, and SecOps in novel threat detection and autonomous investigations.

About the author

Carlos Gray

Senior Product Marketing Manager, Email

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

SocGholish: From loader and C2 activity to RansomHub deployment

What is SocGholish?

Initial access and execution

Persistence

Credential access and lateral movement

Credential access – external

Credential access – internal

Command-and-control

Conclusion

Appendices

MITRE ATT&CK mapping

List of indicators of compromise (IoCs)

References

Get the latest insights on emerging cyber threats

Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

How Darktrace is ending email security silos with new capabilities in cross-domain detection, DLP, and native Microsoft integrations

Enjoying the blog?

More in this series

Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System

Xillen Stealer Updates to Version 5 to Evade AI Detection

Blog

Network

December 4, 2025

Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

The Rise of Infostealers Targeting Apple Users

What is Atomic Stealer?

Darktrace’s Coverage of Atomic Stealer

Appendices

References

Darktrace Model Detections

List of IoCs

Blog

Email

December 4, 2025

How Darktrace is ending email security silos with new capabilities in cross-domain detection, DLP, and native Microsoft integrations

A new era of reputation-aware, unified email security

Why email security must evolve

Beyond detection: AI built for modern threats

Powerful innovations to Darktrace / EMAIL

Improved, multi-domain threat detection and response

Advancements in label-free DLP

Streamlined SOC workflows, with Microsoft-native integrations

Committed to innovation

Join our Live Launch Event