Blog
/
Network
/
May 1, 2025

SocGholish: From loader and C2 activity to RansomHub deployment

In early 2025, Darktrace uncovered SocGholish-to-RansomHub intrusion chains, including loader and C2 activity, alongside credential harvesting via WebDAV and SCF abuse. Learn more about SocGholish and its kill chain here!
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Christina Kreza
Cyber Analyst
laptop and hand typingDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
01
May 2025

Over the past year, a clear pattern has emerged across the threat landscape: ransomware operations are increasingly relying on compartmentalized affiliate models. In these models, initial access brokers (IABs) [6], malware loaders, and post-exploitation operators work together.

Due to those specialization roles, a new generation of loader campaigns has risen. Threat actors increasingly employ loader operators to quietly establish footholds on the target network. These entities then hand off access to ransomware affiliates. One loader that continues to feature prominently in such campaigns is SocGholish.

What is SocGholish?

SocGholish is a loader malware that has been utilized since at least 2017 [7].  It has long been associated with fake browser updates and JavaScript-based delivery methods on infected websites.

Threat actors often target outdated or poorly secured CMS-based websites like WordPress. Through unpatched plugins, or even remote code execution flaws, they inject malicious JavaScript into the site’s HTML, templates or external JS resources [8].  Historically, SocGholish has functioned as a first-stage malware loader, ultimately leading to deployment of Cobalt Strike beacons [9], and further facilitating access persistence to corporate environments. More recently, multiple security vendors have reported that infections involving SocGholish frequently lead to the deployment of RansomHub ransomware [3] [5].

This blog explores multiple instances within Darktrace's customer base where SocGholish deployment led to subsequent network compromises. Investigations revealed indicators of compromise (IoCs) similar to those identified by external security researchers, along with variations in attacker behavior post-deployment. Key innovations in post-compromise activities include credential access tactics targeting authentication mechanisms, particularly through the abuse of legacy protocols like WebDAV and SCF file interactions over SMB.

Initial access and execution

Since January 2025, Darktrace’s Threat Research team observed multiple cases in which threat actors leveraged the SocGholish loader for initial access. Malicious actors commonly deliver SocGholish by compromising legitimate websites by injecting malicious scripts into the HTML of the affected site. When the visitor lands on an infected site, they are typically redirected to a fake browser update page, tricking them into downloading a ZIP file containing a JavaScript-based loader [1] [2]. In one case, a targeted user appears to have visited the compromised website garagebevents[.]com (IP: 35.203.175[.]30), from which around 10 MB of data was downloaded.

Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.
Figure 1: Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.

Within milliseconds of the connection establishment, the user’s device initiated several HTTPS sessions over the destination port 443 to the external endpoint 176.53.147[.]97, linked to the following Keitaro TDS domains:

  • packedbrick[.]com
  • rednosehorse[.]com
  • blackshelter[.]org
  • blacksaltys[.]com

To evade detection, SocGholish uses highly obfuscated code and relies on traffic distribution systems (TDS) [3].  TDS is a tool used in digital and affiliate marketing to manage and distribute incoming web traffic based on predefined rules. More specifically, Keitaro is a premium self-hosted TDS frequently utilized by attackers as a payload repository for malicious scripts following redirects from compromised sites. In the previously noted example, it appears that the device connected to the compromised website, which then retrieved JavaScript code from the aforementioned Keitaro TDS domains. The script served by those instances led to connections to the endpoint virtual.urban-orthodontics[.]com (IP: 185.76.79[.]50), successfully completing SocGholish’s distribution.

Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.
Figure 2: Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.

Persistence

During some investigations, Darktrace researchers observed compromised devices initiating HTTPS connections to the endpoint files.pythonhosted[.]org (IP: 151.101.1[.]223), suggesting Python package downloads. External researchers have previously noted how attackers use Python-based backdoors to maintain access on compromised endpoints following initial access via SocGholish [5].

Credential access and lateral movement

Credential access – external

Darktrace researchers identified observed some variation in kill chain activities following initial access and foothold establishment. For example, Darktrace detected interesting variations in credential access techniques. In one such case, an affected device attempted to contact the rare external endpoint 161.35.56[.]33 using the Web Distributed Authoring and Versioning (WebDAV) protocol. WebDAV is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. WebDAV enables remote shares to be mounted over HTTP or HTTPS, similar to how SMB operates, but using web-based protocols. Windows supports WebDAV natively, which means a UNC path pointing to an HTTP or HTTPS resource can trigger system-level behavior such as authentication.

In this specific case, the system initiated outbound connections using the ‘Microsoft-WebDAV-MiniRedir/10.0.19045’ user-agent, targeting the URI path of /s on the external endpoint 161.35.56[.]33. During these requests, the host attempted to initiate NTML authentication and even SMB sessions over the web, both of which failed. Despite the session failures, these attempts also indicate a form of forced authentication. Forced authentication exploits a default behavior in Windows where, upon encountering a UNC path, the system will automatically try to authenticate to the resource using NTML – often without any user interaction. Although no files were directly retrieved, the WebDAV server was still likely able to retrieve the user’s NTLM hash during the session establishment requests, which can later be used by the adversary to crack the password offline.

Credential access – internal

In another investigated incident, Darktrace observed a related technique utilized for credential access and lateral movement. This time, the infected host uploaded a file named ‘Thumbs.scf’ to multiple internal SMB network shares. Shell Command File ( SCF) is a legacy Windows file format used primarily for Windows Explorer shortcuts. These files contain instructions for rendering icons or triggering shell commands, and they can be executed implicitly when a user simply opens a folder containing the file – no clicks required.

The ‘Thumbs.scf’ file dropped by the attacker was crafted to exploit this behavior. Its contents included a [Shell] section with the Command=2 directive and an IconFile path pointing to a remote UNC resource on the same external endpoint, 161.35.56[.]33, seen in the previously described case – specifically, ‘\\161.35.56[.]33\share\icon.ico’. When a user on the internal network navigates to the folder containing the SCF file, their system will automatically attempt to load the icon. In doing so, the system issues a request to the specified UNC path, which again prompts Windows to initiate NTML authentication.

This pattern of activity implies that the attacker leveraged passive internal exposure; users who simply browsed a compromised share would unknowingly send their NTML hashes to an external attacker-controlled host. Unlike the WebDAV approach, which required initiating outbound communication from the infected host, this SCF method relies on internal users to interact with poisoned folders.

Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.
Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.

Command-and-control

Following initial compromise, affected devices would then attempt outbound connections using the TLS/SSL protocol over port 443 to different sets of command-and-control (C2) infrastructure associated with SocGholish. The malware frequently uses obfuscated JavaScript loaders to initiate its infection chain, and once dropped, the malware communicates back to its infrastructure over standard web protocols, typically using HTTPS over port 443. However, this set of connections would precede a second set of outbound connections, this time to infrastructure linked to RansomHub affiliates, possibly facilitating the deployed Python-based backdoor.

Connectivity to RansomHub infrastructure relied on defense evasion tactics, such as port-hopping. The idea behind port-hopping is to disguise C2 traffic by avoiding consistent patterns that might be caught by firewalls, and intrusion detection systems. By cycling through ephemeral ports, the malware increases its chances of slipping past basic egress filtering or network monitoring rules that only scrutinize common web traffic ports like 443 or 80. Darktrace analysts identified systems connecting to destination ports such as 2308, 2311, 2313 and more – all on the same destination IP address associated with the RansomHub C2 environment.

Figure 4: Advanced Search connection logs showing connections over destination ports that change rapidly.

Conclusion

Since the beginning of 2025, Darktrace analysts identified a campaign whereby ransomware affiliates leveraged SocGholish to establish network access in victim environments. This activity enabled multiple sets of different post exploitation activity. Credential access played a key role, with affiliates abusing WebDAV and NTML over SMB to trigger authentication attempts. The attackers were also able to plant SCF files internally to expose NTML hashes from users browsing shared folders. These techniques evidently point to deliberate efforts at early lateral movement and foothold expansion before deploying ransomware. As ransomware groups continue to refine their playbooks and work more closely with sophisticated loaders, it becomes critical to track not just who is involved, but how access is being established, expanded, and weaponized.

Credit to Chrisina Kreza (Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

[related-resource]

Appendices

Darktrace / NETWORK model alerts

·       Anomalous Connection / SMB Enumeration

·       Anomalous Connection / Multiple Connections to New External TCP Port

·       Anomalous Connection / Multiple Failed Connections to Rare Endpoint

·       Anomalous Connection / New User Agent to IP Without Hostname

·       Compliance / External Windows Communication

·       Compliance / SMB Drive Write

·       Compromise / Large DNS Volume for Suspicious Domain

·       Compromise / Large Number of Suspicious Failed Connections

·       Device / Anonymous NTML Logins

·       Device / External Network Scan

·       Device / New or Uncommon SMB Named Pipe

·       Device / SMB Lateral Movement

·       Device / Suspicious SMB Activity

·       Unusual Activity / Unusual External Activity

·       User / Kerberos Username Brute Force

MITRE ATT&CK mapping

·       Credential Access – T1187 Forced Authentication

·       Credential Access – T1110 Brute Force

·       Command and Control – T1071.001 Web Protocols

·       Command and Control – T1571 Non-Standard Port

·       Discovery – T1083 File and Directory Discovery

·       Discovery – T1018 Remote System Discovery

·       Discovery – T1046 Network Service Discovery

·       Discovery – T1135 Network Share Discovery

·       Execution – T1059.007 JavaScript

·       Lateral Movement – T1021.002 SMB/Windows Admin Shares

·       Resource Deployment – T1608.004 Drive-By Target

List of indicators of compromise (IoCs)

·       garagebevents[.]com – 35.203.175[.]30 – Possibly compromised website

·       packedbrick[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       rednosehorse[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       blackshelter[.]org – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       blacksaltys[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       virtual.urban-orthodontics[.]com – 185.76.79[.]50

·       msbdz.crm.bestintownpro[.]com – 166.88.182[.]126 – SocGholish C2

·       185.174.101[.]240 – RansomHub Python C2

·       185.174.101[.]69 – RansomHub Python C2

·       108.181.182[.]143 – RansomHub Python C2

References

[1] https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/socgholish-malware/

[2] https://intel471.com/blog/threat-hunting-case-study-socgholish

[3] https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html

[4] https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware

[5] https://www.guidepointsecurity.com/blog/ransomhub-affiliate-leverage-python-based-backdoor/

[6] https://www.cybereason.com/blog/how-do-initial-access-brokers-enable-ransomware-attacks

[7] https://attack.mitre.org/software/S1124/

[8] https://expel.com/blog/incident-report-spotting-socgholish-wordpress-injection/

[9] https://www.esentire.com/blog/socgholish-to-cobalt-strike-in-10-minutes

Get the latest insights on emerging cyber threats

This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Christina Kreza
Cyber Analyst

More in this series

No items found.

Blog

/

Network

/

September 15, 2025

SEO Poisoning and Fake PuTTY sites: Darktrace’s Investigation into the Oyster backdoor

Default blog imageDefault blog image

What is SEO poisoning?

Search Engine Optimization (SEO) is the legitimate marketing technique of improving the visibility of websites in organic search engine results. Businesses, publishers, and organizations use SEO to ensure their content is easily discoverable by users. Techniques may include optimizing keywords, creating backlinks, or even ensuring mobile compatibility.

SEO poisoning occurs when attackers use these same techniques for malicious purposes. Instead of improving the visibility of legitimate content, threat actors use SEO to push harmful or deceptive websites to the top of search results. This method exploits the common assumption that top-ranking results are trustworthy, leading users to click on URLs without carefully inspecting them.

As part of SEO poisoning, the attacker will first register a typo-squatted domain, slightly misspelled or otherwise deceptive versions of real software sites, such as putty[.]run or puttyy[.]org. These sites are optimized for SEO and often even backed by malicious Google ads, increasing the visibility when users search for download links. To achieve that, threat actors may embed pages with strategically chosen, high-value keywords or replicate content from reputable sources to elevate the domain’s perceived authority in search engine algorithms [4]. In more advanced operations, these tactics are reinforced with paid promotion, such as Google ads, enabling malicious domains to appear above organic search results as sponsored links. This placement not only accelerates visibility but also impacts an unwarranted sense of legitimacy to unsuspected users.

Once a user lands on one of these fake pages, they are presented with what looks like a legitimate software download option. Upon clicking the download indicator, the user will be redirected to another separate domain that actually hosts the payload. This hosting domain is usually unrelated to the nominally referenced software. These third-party sites can involve recently registered domains but may also include legitimate websites that have been recently compromised. By hosting malware on a variety of infrastructure, attackers can prolong the availability of distribution methods for these malicious files before they are taken down.

What is the Oyster backdoor?

Oyster, also known as Broomstick or CleanUpLoader, is a C++ based backdoor malware first identified in July 2023. It enables remote access to infected systems, offering features such as command-line interaction and file transfers.

Oyster has been widely adopted by various threat actors, often as an entry point for ransomware attacks. Notable examples include Vanilla Tempest and Rhysida ransomware groups, both of which have been observed leveraging the Oyster backdoor to enhance their attack capabilities. Vanilla Tempest is known for using Oyster’s stealth persistence to maintain long-term access within targeted networks, often aligning their operations with ransomware deployment [5]. Rhysida has taken this further by deploying Oyster as an initial access tool in ransomware campaigns, using it to conduct reconnaissance and move laterally before executing encryption activities [6].

Once installed, the backdoor gathers basic system information before communicating with a command-and-control (C2) server. The malware largely relies on a ‘cmd.exe’ instance to execute commands and launch other files [1].

In previous SEO poisoning cases, the file downloaded from the fake pages is not just PuTTY, but a trojanized version that includes the stealthy Oyster backdoor. PuTTY is a free and open-source terminal emulator for Windows that allows users to connect to remote servers and devices using protocols like SSH and Telnet. In the recent campaign, once a user visits the fake software download site, ranked highly through SEO poisoning, the malicious payload is downloaded through direct user interaction and subsequently installed on the local device, initiating the compromise. The malware then performs two actions simultaneously: it installs a fully functional version of PuTTY to avoid user suspicion, while silently deploying the Oyster backdoor. Given PuTTY’s nature, it is prominently used by IT administrators with highly privileged account as opposed to standard users in a business, possibly narrowing the scope of the targets.

Oyster’s persistence mechanism involves creating a Windows Scheduled Task that runs every few minutes. Notably, the infection uses Dynamic Link Library (DLL) side loading, where a malicious DLL, often named ‘twain_96.dll’, is executed via the legitimate Windows utility ‘rundll32.exe’, which is commonly used to run DLLs [2]. This technique is frequently used by malicious actors to blend their activity with normal system operations.

Darktrace’s Coverage of the Oyster Backdoor

In June 2025, security analysts at Darktrace identified a campaign leveraging search engine manipulation to deliver malware masquerading as the popular SSH client, PuTTY. Darktrace / NETWORK’s anomaly-based detection identified signs of malicious activity, and when properly configured, its Autonomous Response capability swiftly shut down the threar before it could escalate into a more disruptive attack. Subsequent analysis by Darktrace’s Threat Research team revealed that the payload was a variant of the Oyster backdoor.

The first indicators of an emerging Oyster SEO campaign typically appeared when user devices navigated to a typosquatted domain, such as putty[.]run or putty app[.]naymin[.]com, via a TLS/SSL connection.

Figure 1: Darktrace’s detection of a device connecting to the typosquatted domain putty[.]run.

The device would then initiate a connection to a secondary domain that hosts the malicious installer, likely triggered by user interaction with redirect elements on the landing page. This secondary site may not have any immediate connection to PuTTY itself but is instead a hijacked blog, a file-sharing service, or a legitimate-looking content delivery subdomain.

Figure 2: Darktrace’s detection of the device making subsequent connections to the payload domain.

Following installation, multiple affected devices were observed attempting outbound connectivity to rare external IP addresses, specifically requesting the ‘/secure’ endpoint as noted within the declared URIs. After the initial callback, the malware continued communicating with additional infrastructure, maintaining its foothold and likely waiting for tasking instructions. Communication patterns included:

·       Endpoints with URIs /api/kcehc and /api/jgfnsfnuefcnegfnehjbfncejfh

·       Endpoints with URI /reg and user agent “WordPressAgent”, “FingerPrint” or “FingerPrintpersistent”

This tactic has been consistently linked to the Oyster backdoor, which has shown similar URI patterns across multiple campaigns [3].

Darktrace analysts also noted the sophisticated use of spoofed user agent strings across multiple investigated customer networks. These headers, which are typically used to identify the application making an HTTP request, are carefully crafted to appear benign or mimic legitimate software. One common example seen in the campaign is the user agent string “WordPressAgent”. While this string references a legitimate web application or plugin, it does not appear to correspond to any known WordPress services or APIs. Its inclusion is most likely designed to mimic background web traffic commonly associated with WordPress-based content management systems.

Figure 3: Cyber AI Analyst investigation linking the HTTP C2 activity.

Case-Specific Observations

While the previous section focused on tactics and techniques common across observed Oyster infections, a closer examination reveals notable variations and unique elements in specific cases. These distinct features offer valuable insights into the diverse operational approaches employed by threat actors. These distinct features, from unusual user agent strings to atypical network behavior, offer valuable insights into the diverse operational approaches employed by the threat actors. Crucially, the divergence in post-exploitation activity reflects a broader trend in the use of widely available malware families like Oyster as flexible entry points, rather than fixed tools with a single purpose. This modular use of the backdoor reflects the growing Malware-as-a-Service (MaaS) ecosystem, where a single initial infection can be repurposed depending on the operator’s goals.

From Infection to Data Egress

In one observed incident, Darktrace observed an infected device downloading a ZIP file named ‘host[.]zip’ via curl from the URI path /333/host[.]zip, following the standard payload delivery chain. This file likely contained additional tools or payloads intended to expand the attacker’s capabilities within the compromised environment. Shortly afterwards, the device exhibited indicators of probable data exfiltration, with outbound HTTP POST requests featuring the URI pattern: /upload?dir=NAME_FOLDER/KEY_KEY_KEY/redacted/c/users/public.

This format suggests the malware was actively engaged in local host data staging and attempting to transmit files from the target machine. The affected device, identified as a laptop, aligns with the expected target profile in SEO poisoning scenarios, where unsuspecting end users download and execute trojanized software.

Irregular RDP Activity and Scanning Behavior

Several instances within the campaign revealed anomalous or unexpected Remote Desktop Protocol (RDP) sessions occurring shortly after DNS requests to fake PuTTY domains. Unusual RDP connections frequently followed communication with Oyster backdoor C2 servers. Additionally, Darktrace detected patterns of RDP scanning, suggesting the attackers were actively probing for accessible systems within the network. This behavior indicates a move beyond initial compromise toward lateral movement and privilege escalation, common objectives once persistence is established.

The presence of unauthorized and administrative RDP sessions following Oyster infections aligns with the malware’s historical role as a gateway for broader impact. In previous campaigns, Oyster has often been leveraged to enable credential theft, lateral movement, and ultimately ransomware deployment. The observed RDP activity in this case suggests a similar progression, where the backdoor is not the final objective but rather a means to expand access and establish control over the target environment.

Cryptic User Agent Strings?

In multiple investigated cases, the user agent string identified in these connections featured formatting that appeared nonsensical or cryptic. One such string containing seemingly random Chinese-language characters translated into an unusual phrase: “Weihe river is where the water and river flow.” Legitimate software would not typically use such wording, suggesting that the string was intended as a symbolic marker rather than a technical necessity. Whether meant as a calling card or deliberately crafted to frame attribution, its presence highlights how subtle linguistic cues can complicate analysis.

Figure 4: Darktrace’s detection of malicious connections using a user agent with randomized Chinese-language formatting.

Strategic Implications

What makes this campaign particularly noteworthy is not simply the use of Oyster, but its delivery mechanism. SEO poisoning has traditionally been associated with cybercriminal operations focused on opportunistic gains, such as credential theft and fraud. Its strength lies in casting a wide net, luring unsuspecting users searching for popular software and tricking them into downloading malicious binaries. Unlike other campaigns, SEO poisoning is inherently indiscriminate, given that the attacker cannot control exactly who lands on their poisoned search results. However, in this case, the use of PuTTY as the luring mechanism possibly indicates a narrowed scope - targeting IT administrators and accounts with high privileges due to the nature of PuTTY’s functionalities.

This raises important implications when considered alongside Oyster. As a backdoor often linked to ransomware operations and persistent access frameworks, Oyster is far more valuable as an entry point into corporate or government networks than small-scale cybercrime. The presence of this malware in an SEO-driven delivery chain suggests a potential convergence between traditional cybercriminal delivery tactics and objectives often associated with more sophisticated attackers. If actors with state-sponsored or strategic objectives are indeed experimenting with SEO poisoning, it could signal a broadening of their targeting approaches. This trend aligns with the growing prominence of MaaS and the role of initial access brokers in today’s cybercrime ecosystem.

Whether the operators seek financial extortion through ransomware or longer-term espionage campaigns, the use of such techniques blurs the traditional distinctions. What looks like a mass-market infection vector might, in practice, be seeding footholds for high-value strategic intrusions.

Credit to Christina Kreza (Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

Appendices

MITRE ATT&CK Mapping

·       T1071.001 – Command and Control – Web Protocols

·       T1008 – Command and Control – Fallback Channels

·       T0885 – Command and Control – Commonly Used Port

·       T1571 – Command and Control – Non-Standard Port

·       T1176 – Persistence – Browser Extensions

·       T1189 – Initial Access – Drive-by Compromise

·       T1566.002 – Initial Access – Spearphishing Link

·       T1574.001 – Persistence – DLL

Indicators of Compromise (IoCs)

·       85.239.52[.]99 – IP address

·       194.213.18[.]89/reg – IP address / URI

·       185.28.119[.]113/secure – IP address / URI

·       185.196.8[.]217 – IP address

·       185.208.158[.]119 – IP address

·       putty[.]run – Endpoint

·       putty-app[.]naymin[.]com – Endpoint

·       /api/jgfnsfnuefcnegfnehjbfncejfh

·       /api/kcehc

Darktrace Model Detections

·       Anomalous Connection / New User Agent to IP Without Hostname

·       Anomalous Connection / Posting HTTP to IP Without Hostname

·       Compromise / HTTP Beaconing to Rare Destination

·       Compromise / Large Number of Suspicious Failed Connections

·       Compromise / Beaconing Activity to External Rare

·       Compromise / Quick and Regular Windows HTTP Beaconing

·       Device / Large Number of Model Alerts

·       Device / Initial Attack Chain Activity

·       Device / Suspicious Domain

·       Device / New User Agent

·       Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

·       Antigena / Network / External Threat / Antigena Suspicious Activity Block

·       Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

References

[1] https://malpedia.caad.fkie.fraunhofer.de/details/win.broomstick

[2] https://arcticwolf.com/resources/blog/malvertising-campaign-delivers-oyster-broomstick-backdoor-via-seo-poisoning-trojanized-tools/

[3] https://hunt.io/blog/oysters-trail-resurgence-infrastructure-ransomware-cybercrime

[4] https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/seo-poisoning/

[5] https://blackpointcyber.com/blog/vanilla-tempest-oyster-backdoor-netsupport-unknown-infostealers-soc-incidents-blackpoint-apg/

[6] https://areteir.com/article/rhysida-using-oyster-backdoor-in-attacks/

The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.

Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.

Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.

The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content without notice.

Continue reading
About the author
Christina Kreza
Cyber Analyst

Blog

/

Network

/

September 9, 2025

The benefits of bringing together network and email security

Default blog imageDefault blog image

In many organizations, network and email security operate in isolation. Each solution is tasked with defending its respective environment, even though both are facing the same advanced, multi-domain threats.  

This siloed approach overlooks a critical reality: email remains the most common vector for initiating cyber-attacks, while the network is the primary stage on which those attacks progress. Without direct integration between these two domains, organizations risk leaving blind spots that adversaries can exploit.  

A modern security strategy needs to unify email and network defenses, not just in name, but in how they share intelligence, conduct investigations, and coordinate response actions. Let’s take a look at how this joined-up approach delivers measurable technical, operational, and commercial benefits.

Technical advantages

Pre-alert intelligence: Gathering data before the threat strikes

Most security tools start working when something goes wrong – an unusual login, a flagged attachment, a confirmed compromise. But by then, attackers may already be a step ahead.

By unifying network and email security under a single AI platform (like the Darktrace Active AI Security Platform), you can analyze patterns across both environments in real time, even when there are no alerts. This ongoing monitoring builds a behavioral understanding of every user, device, and domain in your ecosystem.

That means when an email arrives from a suspicious domain, the system already knows whether that domain has appeared on your network before – and whether its behavior has been unusual. Likewise, when new network activity involves a domain first spotted in an email, it’s instantly placed in the right context.

This intelligence isn’t built on signatures or after-the-fact compromise indicators – it’s built on live behavioral baselines, giving your defenses the ability to flag threats before damage is done.

Alert-related intelligence: Connecting the dots in real time

Once an alert does fire, speed and context matter. The Darktrace Cyber AI Analyst can automatically investigate across both environments, piecing together network and email evidence into a single, cohesive incident.

Instead of leaving analysts to sift through fragmented logs, the AI links events like a phishing email to suspicious lateral movement on the recipient’s device, keeping the full attack chain intact. Investigations that might take hours – or even days – can be completed in minutes, with far fewer false positives to wade through.

This is more than a time-saver. It ensures defenders maintain visibility after the first sign of compromise, following the attacker as they pivot into network infrastructure, cloud services, or other targets. That cross-environment continuity is impossible to achieve with disconnected point solutions or siloed workflows.

Operational advantages

Streamlining SecOps across teams

In many organizations, email security is managed by IT, while network defense belongs to the SOC. The result? Critical information is scattered between tools and teams, creating blind spots just when you need clarity.

When email and network data flow into a single platform, everyone is working from the same source of truth. SOC analysts gain immediate visibility into email threats without opening another console or sending a request to another department. The IT team benefits from the SOC’s deeper investigative context.

The outcome is more than convenience: it’s faster, more informed decision-making across the board.

Reducing time-to-meaning and enabling faster response

A unified platform removes the need to manually correlate alerts between tools, reducing time-to-meaning for every incident. Built-in AI correlation instantly ties together related events, guiding analysts toward coordinated responses with higher confidence.

Instead of relying on manual SIEM rules or pre-built SOAR playbooks, the platform connects the dots in real time, and can even trigger autonomous response actions across both environments simultaneously. This ensures attacks are stopped before they can escalate, regardless of where they begin.

Commercial advantages

While purchasing “best-of-breed" for all your different tools might sound appealing, it often leads to a patchwork of solutions with overlapping costs and gaps in coverage. However good a “best-in-breed" email security solution might be in the email realm, it won't be truly effective without visibility across domains and an AI analyst piecing intelligence together. That’s why we think “best-in-suite" is the only “best-in-breed" approach that works – choosing a high-quality platform ensures that every new capability strengthens the whole system.  

On top of that, security budgets are under constant pressure. Managing separate vendors for email and network defense means juggling multiple contracts, negotiating different SLAs, and stitching together different support models.

With a single provider for both, procurement and vendor management become far simpler. You deal with one account team, one support channel, and one unified strategy for both environments. If you choose to layer on managed services, you get consistent expertise across your whole security footprint.

Even more importantly, an integrated AI platform sets the stage for growth. Once email and network are under the same roof, adding coverage for other attack surfaces – like cloud or identity – is straightforward. You’re building on the same architecture, not bolting on new point solutions that create more complexity.

Check out the white paper, The Modern Security Stack: Why Your NDR and Email Security Solutions Need to Work Together, to explore these benefits in more depth, with real-world examples and practical steps for unifying your defenses.

[related-resource]

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI