May 28, 2024

Stemming the Citrix Bleed Vulnerability with Darktrace’s ActiveAI Security Platform

This blog delves into Darktrace’s investigation into the exploitation of the Citrix Bleed vulnerability on the network of a customer in late 2023. Darktrace’s Self-Learning AI ensured the customer was well equipped to track the post-compromise activity and identify affected devices.

Written by

Vivek Rajan

Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Vivek Rajan

Cyber Analyst

May 2024

What is Citrix Bleed?

Since August 2023, cyber threat actors have been actively exploiting one of the most significant critical vulnerabilities disclosed in recent years: Citrix Bleed. Citrix Bleed, also known as CVE-2023-4966, remained undiscovered and even unpatched for several months, resulting in a wide range of security incidents across business and government sectors [1].

How does Citrix Bleed vulnerability work?

The vulnerability, which impacts the Citrix Netscaler Gateway and Netscaler ADC products, allows for outside parties to hijack legitimate user sessions, thereby bypassing password and multifactor authentication (MFA) requirements.

When used as a means of initial network access, the vulnerability has resulted in the exfiltration of sensitive data, as in the case of Xfinity, and even the deployment of ransomware variants including Lockbit [2]. Although Citrix has released a patch to address the vulnerability, slow patching procedures and the widespread use of these products has resulted in the continuing exploitation of Citrix Bleed into 2024 [3].

How Does Darktrace Handle Citrix Bleed?

Darktrace has demonstrated its proficiency in handling the exploitation of Citrix Bleed since it was disclosed back in 2023; its anomaly-based approach allows it to efficiently identify and inhibit post-exploitation activity as soon as it surfaces. Rather than relying upon traditional rules and signatures, Darktrace’s Self-Learning AI enables it to understand the subtle deviations in a device’s behavior that would indicate an emerging compromise, thus allowing it to detect anomalous activity related to the exploitation of Citrix Bleed.

In late 2023, Darktrace identified an instance of Citrix Bleed exploitation on a customer network. As this customer had subscribed to the Proactive Threat Notification (PTN) service, the suspicious network activity surrounding the compromise was escalated to Darktrace’s Security Operation Center (SOC) for triage and investigation by Darktrace Analysts, who then alerted the customer’s security team to the incident.

Darktrace’s Coverage

Initial Access and Beaconing of Citrix Bleed

Darktrace’s initial detection of indicators of compromise (IoCs) associated with the exploitation of Citrix Bleed actually came a few days prior to the SOC alert, with unusual external connectivity observed from a critical server. The suspicious connection in question, a SSH connection to the rare external IP 168.100.9[.]137, lasted several hours and utilized the Windows PuTTY client. Darktrace also identified an additional suspicious IP, namely 45.134.26[.]2, attempting to contact the server. Both rare endpoints had been linked with the exploitation of the Citrix Bleed vulnerability by multiple open-source intelligence (OSINT) vendors [4] [5].

Figure 1: Darktrace model alert highlighting an affected device making an unusual SSH connection to 168.100.9[.]137 via port 22.

As Darktrace is designed to identify network-level anomalies, rather than monitor edge infrastructure, the initial exploitation via the typical HTTP buffer overflow associated with this vulnerability fell outside the scope of Darktrace’s visibility. However, the aforementioned suspicious connectivity likely constituted initial access and beaconing activity following the successful exploitation of Citrix Bleed.

Command and Control (C2) and Payload Download

Around the same time, Darktrace also detected other devices on the customer’s network conducting external connectivity to various endpoints associated with remote management and IT services, including Action1, ScreenConnect and Fixme IT. Additionally, Darktrace observed devices downloading suspicious executable files, including “tniwinagent.exe”, which is associated with the tool Total Network Inventory. While this tool is typically used for auditing and inventory management purposes, it could also be leveraged by attackers for the purpose of lateral movement.

Defense Evasion

In the days surrounding this compromise, Darktrace observed multiple devices engaging in potential defense evasion tactics using the ScreenConnect and Fixme IT services. Although ScreenConnect is a legitimate remote management tool, it has also been used by threat actors to carry out C2 communication [6]. ScreenConnect itself was the subject of a separate critical vulnerability which Darktrace investigated in early 2024. Meanwhile, CISA observed that domains associated with Fixme It (“fixme[.]it”) have been used by threat actors attempting to exploit the Citrix Bleed vulnerability [7].

Reconnaissance and Lateral Movement

A few days after the detection of the initial beaconing communication, Darktrace identified several devices on the customer’s network carrying out reconnaissance and lateral movement activity. This included SMB writes of “PSEXESVC.exe”, network scanning, DCE-RPC binds of numerous internal devices to IPC$ shares and the transfer of compromise-related tools. It was at this point that Darktrace’s Self-Learning AI deemed the activity to be likely indicative of an ongoing compromise and several Enhanced Monitoring models alerted, triggering the aforementioned PTNs and investigation by Darktrace’s SOC.

Darktrace observed a server on the network initiating a wide range of connections to more than 600 internal IPs across several critical ports, suggesting port scanning, as well as conducting unexpected DCE-RPC service control (svcctl) activity on multiple internal devices, amongst them domain controllers. Additionally, several binds to server service (srvsvc) and security account manager (samr) endpoints via IPC$ shares on destination devices were detected, indicating further reconnaissance activity. The querying of these endpoints was also observed through RPC commands to enumerate services running on the device, as well as Security Account Manager (SAM) accounts.

Darktrace also identified devices performing SMB writes of the WinRAR data compression tool, in what likely represented preparation for the compression of data prior to data exfiltration. Further SMB file writes were observed around this time including PSEXESVC.exe, which was ultimately used by attackers to conduct remote code execution, and one device was observed making widespread failed NTLM authentication attempts on the network, indicating NTLM brute-forcing. Darktrace observed several devices using administrative credentials to carry out the above activity.

In addition to the transfer of tools and executables via SMB, Darktrace also identified numerous devices deleting files through SMB around this time. In one example, an MSI file associated with the patch management and remediation service, Action1, was deleted by an attacker. This legitimate security tool, if leveraged by attackers, could be used to uncover additional vulnerabilities on target networks.

A server on the customer’s network was also observed writing the file “m.exe” to multiple internal devices. OSINT investigation into the executable indicated that it could be a malicious tool used to prevent antivirus programs from launching or running on a network [8].

Impact and Data Exfiltration

Following the initial steps of the breach chain, Darktrace observed numerous devices on the customer’s network engaging in data exfiltration and impact events, resulting in additional PTN alerts and a SOC investigation into data egress. Specifically, two servers on the network proceeded to read and download large volumes of data via SMB from multiple internal devices over the course of a few hours. These hosts sent large outbound volumes of data to MEGA file storage sites using TLS/SSL over port 443. Darktrace also identified the use of additional file storage services during this exfiltration event, including 4sync, file[.]io, and easyupload[.]io. In total the threat actor exfiltrated over 8.5 GB of data from the customer’s network.

Figure 2: Darktrace Cyber AI Analyst investigation highlighting the details of a data exfiltration attempt.

Finally, Darktrace detected a user account within the customer’s Software-as-a-Service (SaaS) environment conducting several suspicious Office365 and AzureAD actions from a rare IP for the network, including uncommon file reads, creations and the deletion of a large number of files.

Unfortunately for the customer in this case, Darktrace RESPOND™ was not enabled on the network and the post-exploitation activity was able to progress until the customer was made aware of the attack by Darktrace’s SOC team. Had RESPOND been active and configured in autonomous response mode at the time of the attack, it would have been able to promptly contain the post-exploitation activity by blocking external connections, shutting down any C2 activity and preventing the download of suspicious files, blocking incoming traffic, and enforcing a learned ‘pattern of life’ on offending devices.

Conclusion

Given the widespread use of Netscaler Gateway and Netscaler ADC, Citrix Bleed remains an impactful and potentially disruptive vulnerability that will likely continue to affect organizations who fail to address affected assets. In this instance, Darktrace demonstrated its ability to track and inhibit malicious activity stemming from Citrix Bleed exploitation, enabling the customer to identify affected devices and enact their own remediation.

Darktrace’s anomaly-based approach to threat detection allows it to identify such post-exploitation activity resulting from the exploitation of a vulnerability, regardless of whether it is a known CVE or a zero-day threat. Unlike traditional security tools that rely on existing threat intelligence and rules and signatures, Darktrace’s ability to identify the subtle deviations in a compromised device’s behavior gives it a unique advantage when it comes to identifying emerging threats.

Credit to Vivek Rajan, Cyber Analyst, Adam Potter, Cyber Analyst

Appendices

Darktrace Model Coverage

Device / Suspicious SMB Scanning Activity

Device / ICMP Address Scan

Device / Possible SMB/NTLM Reconnaissance

Device / Network Scan

Device / SMB Lateral Movement

Device / Possible SMB/NTLM Brute Force

Device / Suspicious Network Scan Activity

User / New Admin Credentials on Server

Anomalous File / Internal::Unusual Internal EXE File Transfer

Compliance / SMB Drive Write

Device / New or Unusual Remote Command Execution

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / Rare WinRM Incoming

Anomalous Connection / Unusual Admin SMB Session

Device / Unauthorised Device

User / New Admin Credentials on Server

Anomalous Server Activity / Outgoing from Server

Device / Long Agent Connection to New Endpoint

Anomalous Connection / Multiple Connections to New External TCP Port

Device / New or Uncommon SMB Named Pipe

Device / Multiple Lateral Movement Model Breaches

Device / Large Number of Model Breaches

Compliance / Remote Management Tool On Server

Device / Anomalous RDP Followed By Multiple Model Breaches

Device / SMB Session Brute Force (Admin)

Device / New User Agent

Compromise / Large Number of Suspicious Failed Connections

Unusual Activity / Unusual External Data Transfer

Unusual Activity / Enhanced Unusual External Data Transfer

Device / Increased External Connectivity

Unusual Activity / Unusual External Data to New Endpoints

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / Uncommon 1 GiB Outbound

Anomalous Connection / Active Remote Desktop Tunnel

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Compliance / Possible Unencrypted Password File On Server

Anomalous Connection / Suspicious Read Write Ratio and Rare External

Device / Reverse DNS Sweep]

Unusual Activity / Possible RPC Recon Activity

Anomalous File / Internal::Executable Uploaded to DC

Compliance / SMB Version 1 Usage

Darktrace AI Analyst Incidents

Scanning of Multiple Devices

Suspicious Remote Service Control Activity

SMB Writes of Suspicious Files to Multiple Devices

Possible SSL Command and Control to Multiple Devices

Extensive Suspicious DCE-RPC Activity

Suspicious DCE-RPC Activity

Internal Downloads and External Uploads

Unusual External Data Transfer

Unusual External Data Transfer to Multiple Related Endpoints

MITRE ATT&CK Mapping

Technique – Tactic – ID – Sub technique of

Network Scanning – Reconnaissance - T1595 - T1595.002

Valid Accounts – Defense Evasion, Persistence, Privilege Escalation, Initial Access – T1078 – N/A

Remote Access Software – Command and Control – T1219 – N/A

Lateral Tool Transfer – Lateral Movement – T1570 – N/A

Data Transfers – Exfiltration – T1567 – T1567.002

Compressed Data – Exfiltration – T1030 – N/A

NTLM Brute Force – Brute Force – T1110 - T1110.001

AntiVirus Deflection – T1553 - NA

Ingress Tool Transfer - COMMAND AND CONTROL - T1105 - NA

Indicators of Compromise (IoCs)

204.155.149[.]37 – IP – Possible Malicious Endpoint

199.80.53[.]177 – IP – Possible Malicious Endpoint

168.100.9[.]137 – IP – Malicious Endpoint

45.134.26[.]2 – IP – Malicious Endpoint

13.35.147[.]18 – IP – Likely Malicious Endpoint

13.248.193[.]251 – IP – Possible Malicious Endpoint

76.223.1[.]166 – IP – Possible Malicious Endpoint

179.60.147[.]10 – IP – Likely Malicious Endpoint

185.220.101[.]25 – IP – Likely Malicious Endpoint

141.255.167[.]250 – IP – Malicious Endpoint

106.71.177[.]68 – IP – Possible Malicious Endpoint

cat2.hbwrapper[.]com – Hostname – Likely Malicious Endpoint

aj1090[.]online – Hostname – Likely Malicious Endpoint

dc535[.]4sync[.]com – Hostname – Likely Malicious Endpoint

204.155.149[.]140 – IP - Likely Malicious Endpoint

204.155.149[.]132 – IP - Likely Malicious Endpoint

204.155.145[.]52 – IP - Likely Malicious Endpoint

204.155.145[.]49 – IP - Likely Malicious Endpoint

References

Written by

Vivek Rajan

Cyber Analyst

Inside the SOC

Written by

Vivek Rajan

Cyber Analyst

The Darktrace Community

Watch the NIS2 Webinar

Blog

Compliance

June 9, 2025

Modernising UK Cyber Regulation: Implications of the Cyber Security and Resilience Bill

Two individuals sitting at a desk working on a document

The need for security and continued cyber resilience

The UK government has made national security a key priority, and the new Cyber Security and Resilience Bill (CSRB) is a direct reflection of that focus. In introducing the Bill, Secretary of State for Science, Innovation and Technology, Peter Kyle, recognised that the UK is “desperately exposed” to cyber threats—from criminal groups to hostile nation-states that are increasingly targeting the UK's digital systems and critical infrastructure^[1].

Context and timeline for the new legislation

First announced during the King’s Speech of July 2024, and elaborated in a Department for Science, Innovation and Technology (DSIT) policy statement published in April 2025, the CSRB is expected to be introduced in Parliament during the 2025-26 legislative session.

For now, organisations in the UK remain subject to the 2018 Network and Information Systems (NIS) Regulations – an EU-derived law which was drafted before today’s increasing digitisation of critical services, rise in cloud adoption and emergence of AI-powered threats.

Why modernisation is critical

Without modernisation, the Government believes UK’s infrastructure and economy risks falling behind international peers. The EU, which revised its cybersecurity regulation under the NIS2 Directive, already imposes stricter requirements on a broader set of sectors.

The urgency of the Bill is also underscored by recent high-impact incidents, including the Synnovis attack which targeted the National Health Service (NHS) suppliers and disrupted thousands of patient appointments and procedures^[2]. The Government has argued that such events highlight a systemic failure to keep pace with a rapidly evolving threat landscape^[3].

What the Bill aims to achieve

This Bill represents a decisive shift. According to the Government, it will modernise and future‑proof the UK’s cyber laws, extending oversight to areas where risk has grown but regulation has not kept pace^[4]. While the legislation builds on previous consultations and draws lessons from international frameworks like the EU’s NIS2 directive, it also aims to tailor solutions to the UK’s unique threat environment.

Importantly, the Government is framing cybersecurity not as a barrier to growth, but as a foundation for it. The policy statement emphasises that strong digital resilience will create the stability businesses need to thrive, innovate, and invest^[5]. Therefore, the goals of the Bill will not only be to enhance security but also act as an enabler to innovation and economic growth.

Recognition that AI changes cyber threats

The CSRB policy statement recognises that AI is fundamentally reshaping the threat landscape, with adversaries now leveraging AI and commercial cyber tools to exploit vulnerabilities in critical infrastructure and supply chains. Indeed, the NCSC has recently assessed that AI will almost certainly lead to “an increase in the frequency and intensity of cyber threats”^[6]. Accordingly, the policy statement insists that the UK’s regulatory framework “must keep pace and provide flexibility to respond to future threats as and when they emerge”^[7].

To address the threat, the Bill signals new obligations for MSPs and data centres, timely incident reporting and dynamic guidance that can be refreshed without fresh primary legislation, making it essential for firms to follow best practices.

What might change in day-to-day practice?

New organisations in scope of regulation

Under the existing Network and Information Systems (NIS) Regulations^[8], the UK already supervises operators in five critical sectors—energy, transport, drinking water, health (Operators of Essential Services, OES) and digital infrastructure (Relevant Digital Service Providers, RDSPs).

The Cyber Security and Resilience Bill retains this foundation and adds Managed Service Providers (MSPs) and data centres to the scope of regulation to “better recognise the increasing reliance on digital services and the vulnerabilities posed by supply chains”^[9]. It also grants the Secretary of State for Science, Innovation and Technology the power to add new sectors or sub‑sectors via secondary legislation, following consultation with Parliament and industry.

Managed service providers (MSPs)

MSPs occupy a central position within the UK’s enterprise information‑technology infrastructure. Because they remotely run or monitor clients’ systems, networks and data, they hold privileged, often continuous access to multiple environments. This foothold makes them an attractive target for malicious actors.

The Bill aims to bring MSPs in scope of regulation by making them subject to the same duties as those placed on firms that provide digital services under the 2018 NIS Regulations. By doing so, the Bill seeks to raise baseline security across thousands of customer environments and to provide regulators with better visibility of supply‑chain risk.

The proposed definition for MSPs is a service which:

Is provided to another organisation
Relies on the use of network and information systems to deliver the service
Relates to ongoing management support, active administration and/or monitoring of AI systems, IT infrastructure, applications, and/or IT networks, including for the purpose of activities relating to cyber security.
Involves a network connection and/or access to the customer’s network and information systems.

Data centres

Building on the September 2024 designation of data centres as critical national infrastructure, the CSRB will fold data infrastructure into the NIS-style regime by naming it an “relevant sector" and data centres as “essential service”^[10].

About 182 colocation facilities run by 64 operators will therefore come under statutory duties to notify the regulator, maintain proportionate CAF-aligned controls and report significant incidents, regardless of who owns them or what workloads they host.

New requirements for regulated organisations

Incident reporting processes

There could be stricter timelines or broader definitions of what counts as a reportable incident. This might nudge organisations to formalise detection, triage, and escalation procedures.

The Government is proposing to introduce a new two-stage incident reporting process. This would include an initial notification which would be submitted within 24 hours of becoming aware of a significant incident, followed by a full incident report which should be submitted within 72 hours of the same.

Supply chain assurance requirements

Supply chains for the UK's most critical services are becoming increasingly complex and present new and serious vulnerabilities for cyber-attacks. The recent Synnovis ransomware attacks on the NHS^[11] exemplify the danger posed by attacks against the supply chains of important services and organisations. This is concerning when reflecting on the latest Cyber Security Breaches survey conducted by DSIT, which highlights that fewer than 25% of large businesses review their supply chain risks^[12].

Despite these risks, the UK’s legacy cybersecurity regulatory regime does not explicitly cover supply chain risk management. The UK instead relies on supporting and non-statutory guidance to close this gap, such as the NCSC’s Cyber Assessment Framework (CAF)^[13].

The CSRB policy statement acts on this regulatory shortcoming and recognises that “a single supplier’s disruption can have far-reaching impacts on the delivery of essential or digital services”^[14].

To address this, the Bill would make in-scope organisations (OES and RDPS) directly accountable for the cybersecurity of their supply chains. Secondary legislation would spell out these duties in detail, ensuring that OES and RDSPs systematically assess and mitigate third-party cyber risks.

Updated and strengthened security requirements

By placing the CAF into a firmer footing and backing it with a statutory Code of Practice, the Government is setting clearer expectations about government expectations on technical standards and methods organisations will need to follow to prove their resilience.

How Darktrace can help support affected organizations

Demonstrate resilience

Darktrace’s Self-Learning AI^TM continuously monitors your digital estate across cloud, network, OT, email, and endpoint to detect, investigate, and autonomously respond to emerging threats in real time. This persistent visibility and defense posture helps organizations demonstrate cyber resilience to regulators with confidence.

Streamline incident reporting and compliance

Darktrace surfaces clear alerts and automated investigation reports, complete with timeline views and root cause analysis. These insights reduce the time and complexity of regulatory incident reporting and support internal compliance workflows with auditable, AI-generated evidence.

Improve supply chain visibility

With full visibility across connected systems and third-party activity, Darktrace detects early indicators of lateral movement, account compromise, and unusual behavior stemming from vendor or partner access, reducing the risk of supply chain-originated cyber-attacks.

Ensure MSPs can meet new standards

For managed service providers, Darktrace offers native multi-tenant support and autonomous threat response that can be embedded directly into customer environments. This ensures consistent, scalable security standards across clients—helping MSPs address increasing regulatory obligations.

[related-resource]

References

^[1] https://www.theguardian.com/uk-news/article/2024/jul/29/uk-desperately-exposed-to-cyber-threats-and-pandemics-says-minister

^[2] https://www.england.nhs.uk/2024/06/synnovis-cyber-attack-statement-from-nhs-england/

^[3] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

^[4] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

^[5] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

^[6] https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027

^[7] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

^[8] https://www.gov.uk/government/collections/nis-directive-and-nis-regulations-2018

^[9] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

^[10] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

^[11] https://www.england.nhs.uk/2024/06/synnovis-cyber-attack-statement-from-nhs-england/

^[12] https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025

^[13] https://www.ncsc.gov.uk/collection/cyber-assessment-framework

^[14] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

About the author

The Darktrace Community

Blog

Network

June 5, 2025

Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic

What is ClickFix and how does it work?

Amid heightened security awareness, threat actors continue to seek stealthy methods to infiltrate target networks, often finding the human end user to be the most vulnerable and easily exploited entry point.

ClickFix baiting is an exploitation of the end user, making use of social engineering techniques masquerading as error messages or routine verification processes, that can result in malicious code execution.

Since March 2024, the simplicity of this technique has drawn attention from a range of threat actors, from individual cybercriminals to Advanced Persistent Threat (APT) groups such as APT28 and MuddyWater, linked to Russia and Iran respectively, introducing security threats on a broader scale [1]. ClickFix campaigns have been observed affecting organizations in across multiple industries, including healthcare, hospitality, automotive and government [2][3].

Actors carrying out these targeted attacks typically utilize similar techniques, tools and procedures (TTPs) to gain initial access. These include spear phishing attacks, drive-by compromises, or exploiting trust in familiar online platforms, such as GitHub, to deliver malicious payloads [2][3]. Often, a hidden link within an email or malvertisements on compromised legitimate websites redirect the end user to a malicious URL [4]. These take the form of ‘Fix It’ or fake CAPTCHA prompts [4].

From there, users are misled into believing they are completing a human verification step, registering a device, or fixing a non-existent issue such as a webpage display error. As a result, they are guided through a three-step process that ultimately enables the execution of malicious PowerShell commands:

Open a Windows Run dialog box [press Windows Key + R]
Automatically or manually copy and paste a malicious PowerShell command into the terminal [press CTRL+V]
And run the prompt [press ‘Enter’] [2]

Once the malicious PowerShell command is executed, threat actors then establish command and control (C2) communication within the targeted environment before moving laterally through the network with the intent of obtaining and stealing sensitive data [4]. Malicious payloads associated with various malware families, such as XWorm, Lumma, and AsyncRAT, are often deployed [2][3].

Attack timeline of ClickFix cyber attack

Based on investigations conducted by Darktrace’s Threat Research team in early 2025, this blog highlights Darktrace’s capability to detect ClickFix baiting activity following initial access.

Darktrace’s coverage of a ClickFix attack chain

Darktrace identified multiple ClickFix attacks across customer environments in both Europe, the Middle East, and Africa (EMEA) and the United States. The following incident details a specific attack on a customer network that occurred on April 9, 2025.

Although the initial access phase of this specific attack occurred outside Darktrace’s visibility, other affected networks showed compromise beginning with phishing emails or fake CAPTCHA prompts that led users to execute malicious PowerShell commands.

Darktrace’s visibility into the compromise began when the threat actor initiated external communication with their C2 infrastructure, with Darktrace / NETWORK detecting the use of a new PowerShell user agent, indicating an attempt at remote code execution.

Figure 1: Darktrace / NETWORK's detection of a device making an HTTP connection with new PowerShell user agent, indicating PowerShell abuse for C2 communications.

Download of Malicious Files for Lateral Movement

A few minutes later, the compromised device was observed downloading a numerically named file. Numeric files like this are often intentionally nondescript and associated with malware. In this case, the file name adhered to a specific pattern, matching the regular expression: /174(\d){7}/. Further investigation into the file revealed that it contained additional malicious code designed to further exploit remote services and gather device information.

Figure 2: Darktrace / NETWORK's detection of a numeric file, one minute after the new PowerShell User Agent alert.

The file contained a script that sent system information to a specified IP address using an HTTP POST request, which also processed the response. This process was verified through packet capture (PCAP) analysis conducted by the Darktrace Threat Research team.

By analyzing the body content of the HTTP GET request, it was observed that the command converts the current time to Unix epoch time format (i.e., 9 April 2025 13:26:40 GMT), resulting in an additional numeric file observed in the URI: /1744205200.

Figure 3: PCAP highlighting the HTTP GET request that sends information to the specific IP, 193.36.38[.]237, which then generates another numeric file titled per the current time.

Across Darktrace’s investigations into other customers' affected by ClickFix campaigns, both internal information discovery events and further execution of malicious code were observed.

Data Exfiltration

By following the HTTP stream in the same PCAP, the Darktrace Threat Research Team assessed the activity as indicative of data exfiltration involving system and device information to the same command-and-control (C2) endpoint, , 193.36.38[.]237. This endpoint was flagged as malicious by multiple open-source intelligence (OSINT) vendors [5].

Further analysis of Darktrace’s Advanced Search logs showed that the attacker’s malicious code scanned for internal system information, which was then sent to a C2 server via an HTTP POST request, indicating data exfiltration

Figure 5: Advanced Search further highlights Darktrace's observation of the HTTP POST request, with the second numeric file representing data exfiltration.

Actions on objectives

Around ten minutes after the initial C2 communications, the compromised device was observed connecting to an additional rare endpoint, 188.34.195[.]44. Further analysis of this endpoint confirmed its association with ClickFix campaigns, with several OSINT vendors linking it to previously reported attacks [6].

In the final HTTP POST request made by the device, Darktrace detected a file at the URI /init1234 in the connection logs to the malicious endpoint 188.34.195[.]44, likely depicting the successful completion of the attack’s objective, automated data egress to a ClickFix C2 server.

Darktrace / NETWORK grouped together the observed indicators of compromise (IoCs) on the compromised device and triggered an Enhanced Monitoring model alert, a high-priority detection model designed to identify activity indicative of the early stages of an attack. These models are monitored and triaged 24/7 by Darktrace’s Security Operations Center (SOC) as part of the Managed Threat Detection service, ensuring customers are promptly notified of malicious activity as soon as it emerges.

Figure 6: Darktrace correlated the separate malicious connections that pertained to a single campaign.

Darktrace Autonomous Response

In the incident outlined above, Darktrace was not configured in Autonomous Response mode. As a result, while actions to block specific connections were suggested, they had to be manually implemented by the customer’s security team. Due to the speed of the attack, this need for manual intervention allowed the threat to escalate without interruption.

However, in a different example, Autonomous Response was fully enabled, allowing Darktrace to immediately block connections to the malicious endpoint (138.199.156[.]22) just one second after the initial connection in which a numerically named file was downloaded [7].

Figure 7: Darktrace Autonomous Response blocked connections to a suspicious endpoint following the observation of the numeric file download.

This customer was also subscribed to our Managed Detection and Response service, Darktrace’s SOC extended a ‘Quarantine Device’ action that had already been autonomously applied in order to buy their security team additional time for remediation.

Figure 8: Autonomous Response blocked connections to malicious endpoints, including 138.199.156[.]22, 185.250.151[.]155, and rkuagqnmnypetvf[.]top, and also quarantined the affected device. These actions were later manually reinforced by the Darktrace SOC.

Conclusion

ClickFix baiting is a widely used tactic in which threat actors exploit human error to bypass security defenses. By tricking end point users into performing seemingly harmless, everyday actions, attackers gain initial access to systems where they can access and exfiltrate sensitive data.

Darktrace’s anomaly-based approach to threat detection identifies early indicators of targeted attacks without relying on prior knowledge or IoCs. By continuously learning each device’s unique pattern of life, Darktrace detects subtle deviations that may signal a compromise. In this case, Darktrace's Autonomous Response, when operating in a fully autonomous mode, was able to swiftly contain the threat before it could progress further along the attack lifecycle.

Credit to Keanna Grelicha (Cyber Analyst) and Jennifer Beckett (Cyber Analyst)

Appendices

NETWORK Models

Device / New PowerShell User Agent
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous Connection / Posting HTTP to IP Without Hostname
Anomalous Connection / Powershell to Rare External
Device / Suspicious Domain
Device / New User Agent and New IP
Anomalous File / New User Agent Followed By Numeric File Download (Enhanced Monitoring Model)
Device / Initial Attack Chain Activity (Enhanced Monitoring Model)

Autonomous Response Models

Antigena / Network::Significant Anomaly::Antigena Significant Anomaly from Client Block
Antigena / Network::Significant Anomaly::Antigena Enhanced Monitoring from Client Block
Antigena / Network::External Threat::Antigena File then New Outbound Block
Antigena / Network::External Threat::Antigena Suspicious File Block
Antigena / Network::Significant Anomaly::Antigena Alerts Over Time Block
Antigena / Network::External Threat::Antigena Suspicious File Block

IoC - Type - Description + Confidence

· 141.193.213[.]11 – IP address – Possible C2 Infrastructure

· 141.193.213[.]10 – IP address – Possible C2 Infrastructure

· 64.94.84[.]217 – IP address – Possible C2 Infrastructure

· 138.199.156[.]22 – IP address – C2 server

· 94.181.229[.]250 – IP address – Possible C2 Infrastructure

· 216.245.184[.]181 – IP address – Possible C2 Infrastructure

· 212.237.217[.]182 – IP address – Possible C2 Infrastructure

· 168.119.96[.]41 – IP address – Possible C2 Infrastructure

· 193.36.38[.]237 – IP address – C2 server

· 188.34.195[.]44 – IP address – C2 server

· 205.196.186[.]70 – IP address – Possible C2 Infrastructure

· rkuagqnmnypetvf[.]top – Hostname – C2 server

· shorturl[.]at/UB6E6 – Hostname – Possible C2 Infrastructure

· tlgrm-redirect[.]icu – Hostname – Possible C2 Infrastructure

· diagnostics.medgenome[.]com – Hostname – Compromised Website

· /1741714208 – URI – Possible malicious file

· /1741718928 – URI – Possible malicious file

· /1743871488 – URI – Possible malicious file

· /1741200416 – URI – Possible malicious file

· /1741356624 – URI – Possible malicious file

· /ttt – URI – Possible malicious file

· /1741965536 – URI – Possible malicious file

· /1.txt – URI – Possible malicious file

· /1744205184 – URI – Possible malicious file

· /1744139920 – URI – Possible malicious file

· /1744134352 – URI – Possible malicious file

· /1744125600 – URI – Possible malicious file

· /1[.]php?s=527 – URI – Possible malicious file

· 34ff2f72c191434ce5f20ebc1a7e823794ac69bba9df70721829d66e7196b044 – SHA-256 Hash – Possible malicious file

· 10a5eab3eef36e75bd3139fe3a3c760f54be33e3 – SHA-1 Hash – Possible malicious file

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique

Spearphishing Link - INITIAL ACCESS - T1566.002 - T1566

Drive-by Compromise - INITIAL ACCESS - T1189

PowerShell - EXECUTION - T1059.001 - T1059

Exploitation of Remote Services - LATERAL MOVEMENT - T1210

Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071

Automated Exfiltration - EXFILTRATION - T1020 - T1020.001

References

[1] https://www.logpoint.com/en/blog/emerging-threats/clickfix-another-deceptive-social-engineering-technique/

[2] https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape

[3] https://cyberresilience.com/threatonomics/understanding-the-clickfix-attack/

[4] https://www.group-ib.com/blog/clickfix-the-social-engineering-technique-hackers-use-to-manipulate-victims/

[5] https://www.virustotal.com/gui/ip-address/193.36.38.237/detection

[6] https://www.virustotal.com/gui/ip-address/188.34.195.44/community

[7] https://www.virustotal.com/gui/ip-address/138.199.156.22/detection

About the author

Keanna Grelicha

Cyber Analyst

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Stemming the Citrix Bleed Vulnerability with Darktrace’s ActiveAI Security Platform

Stemming the Citrix Bleed Vulnerability with Darktrace’s ActiveAI Security Platform

What is Citrix Bleed?

How does Citrix Bleed vulnerability work?

How Does Darktrace Handle Citrix Bleed?

Darktrace’s Coverage

Initial Access and Beaconing of Citrix Bleed

Command and Control (C2) and Payload Download

Defense Evasion

Reconnaissance and Lateral Movement

Impact and Data Exfiltration

Conclusion

Appendices

Darktrace Model Coverage

Darktrace AI Analyst Incidents

MITRE ATT&CK Mapping

Indicators of Compromise (IoCs)

References

Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic

Modernising UK Cyber Regulation: Implications of the Cyber Security and Resilience Bill

Enjoying the blog?

More in this series

Introducing Version 2 of Darktrace’s Embedding Model for Investigation of Security Threats (DEMIST-2)

AI Uncovered: Introducing Darktrace Incident Graph Evaluation for Security Threats (DIGEST)

Force Multiply Your Security Team with Agentic AI: How the Industry’s Only True Cyber AI Analyst™ Saves Time and Stop Threats

Blog

Compliance

June 9, 2025

Modernising UK Cyber Regulation: Implications of the Cyber Security and Resilience Bill

The need for security and continued cyber resilience

Context and timeline for the new legislation

Why modernisation is critical

What the Bill aims to achieve

Recognition that AI changes cyber threats

What might change in day-to-day practice?

New organisations in scope of regulation

Managed service providers (MSPs)

Data centres

New requirements for regulated organisations

Incident reporting processes

Supply chain assurance requirements

Updated and strengthened security requirements

How Darktrace can help support affected organizations

Demonstrate resilience

Streamline incident reporting and compliance

Improve supply chain visibility

Ensure MSPs can meet new standards

References

Blog

Network

June 5, 2025

Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic

What is ClickFix and how does it work?

Darktrace’s coverage of a ClickFix attack chain

Download of Malicious Files for Lateral Movement

Data Exfiltration

Actions on objectives

Darktrace Autonomous Response

Conclusion

Appendices

NETWORK Models

Autonomous Response Models

IoC - Type - Description + Confidence

MITRE ATT&CK Mapping

References