Blog
/
Network
/
October 26, 2022

Strategies to Prolong Quantum Ransomware Attacks

Learn more about how Darktrace combats Quantum Ransomware changing strategy for cyberattacks. Explore the power of AI-driven network cyber security!
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Nicole Wong
Cyber Security Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
26
Oct 2022

Within science and engineering, the word ‘quantum’ may spark associations with speed and capability, referencing a superior computer that can perform tasks a classical computer cannot. In cyber security, some may recognize ‘quantum’ in relation to cryptography or, more recently, as the name of a new ransomware group, which achieved network-wide encryption a mere four hours after an initial infection.   

Although this group now has a reputation for carrying out fast and efficient attacks, speed is not their only tactic. In August 2022, Darktrace detected a Quantum Ransomware incident where attackers remained in the victim’s network for almost a month after the initial signs of infection, before detonating ransomware. This was a stark difference to previously reported attacks, demonstrating that as motives change, so do threat actors’ strategies. 

The Quantum Group

Quantum was first identified in August 2021 as the latest of several rebrands of MountLocker ransomware [1]. As part of this rebrand, the extension ‘.quantum’ is appended to filenames that are encrypted and the associated ransom notes are named ‘README_TO_DECRYPT.html’ [2].  

From April 2022, media coverage of this group has increased following a DFIR report detailing an attack that progressed from initial access to domain-wide ransomware within four hours [3]. To put this into perspective, the global median dwell time for ransomware in 2020 and 2021 is 5 days [4]. In the case of Quantum, threat actors gained direct keyboard access to devices merely 2 hours after initial infection. The ransomware was staged on the domain controller around an hour and a half later, and executed 12 minutes after that.   

Quantum’s behaviour bears similarities to other groups, possibly due to their history and recruitment. Several members of the disbanded Conti ransomware group are reported to have joined the Quantum and BumbleBee operations. Security researchers have also identified similarities in the payloads and C2 infrastructure used by these groups [5 & 6].  Notably, these are the IcedID initial payload and Cobalt Strike C2 beacon used in this attack. Darktrace has also observed and prevented IcedID and Cobalt Strike activity from BumbleBee across several customer environments.

The Attack

From 11th July 2022, a device suspected to be patient zero made repeated DNS queries for external hosts that appear to be associated with IcedID C2 traffic [7 & 8]. In several reported cases [9 & 10], this banking trojan is delivered through a phishing email containing a malicious attachment that loads an IcedID DLL. As Darktrace was not deployed in the prospect’s email environment, there was no visibility of the initial access vector, however an example of a phishing campaign containing this payload is presented below. It is also possible that the device was already infected prior to joining the network. 

Figure 1- An example phishing email used to distribute IcedID. If configured, Darktrace/Email would be able to detect that the email was sent from an anomalous sender, was part of a fake reply chain, and had a suspicious attachment containing compressed content of unusual mime type [11].    

 

Figure 2- The DNS queries to endpoints associated with IcedID C2 servers, taken from the infected device’s event log.  Additional DNS queries made to other IcedID C2 servers are in the list of IOCs in the appendices.  The repeated DNS queries are indicative of beaconing.


It was not until 22nd July that activity was seen which indicated the attack had progressed to the next stage of the kill chain. This contrasts the previously seen attacks where the progression to Cobalt Strike C2 beaconing and reconnaissance and lateral movement occurred within 2 hours of the initial infection [12 & 13]. In this case, patient zero initiated numerous unusual connections to other internal devices using a compromised account, connections that were indicative of reconnaissance using built-in Windows utilities:

·      DNS queries for hostnames in the network

·      SMB writes to IPC$ shares of those hostnames queried, binding to the srvsvc named pipe to enumerate things such as SMB shares and services on a device, client access permissions on network shares and users logged in to a remote session

·      DCE-RPC connections to the endpoint mapper service, which enables identification of the ports assigned to a particular RPC service

These connections were initiated using an existing credential on the device and just like the dwelling time, differed from previously reported Quantum group attacks where discovery actions were spawned and performed automatically by the IcedID process [14]. Figure 3 depicts how Darktrace detected that this activity deviated from the device’s normal behaviour.  

Figure 3- This figure displays the spike in active internal connections initiated by patient zero. The coloured dots represent the Darktrace models that were breached, detecting this unusual reconnaissance and lateral movement activity.

Four days later, on the 26th of July, patient zero performed SMB writes of DLL and MSI executables to the C$ shares of internal devices including domain controllers, using a privileged credential not previously seen on the patient zero device. The deviation from normal behaviour that this represents is also displayed in Figure 3. Throughout this activity, patient zero made DNS queries for the external Cobalt Strike C2 server shown in Figure 4. Cobalt Strike has often been seen as a secondary payload delivered via IcedID, due to IcedID’s ability to evade detection and deploy large scale campaigns [15]. It is likely that reconnaissance and lateral movement was performed under instructions received by the Cobalt Strike C2 server.   

Figure 4- This figure is taken from Darktrace’s Advanced Search interface, showing a DNS query for a Cobalt Strike C2 server occurring during SMB writes of .dll files and DCE-RPC requests to the epmapper service, demonstrating reconnaissance and lateral movement.


The SMB writes to domain controllers and usage of a new account suggests that by this stage, the attacker had achieved domain dominance. The attacker also appeared to have had hands-on access to the network via a console; the repetition of the paths ‘programdata\v1.dll’ and ‘ProgramData\v1.dll’, in lower and title case respectively, suggests they were entered manually.  

These DLL files likely contained a copy of the malware that injects into legitimate processes such as winlogon, to perform commands that call out to C2 servers [16]. Shortly after the file transfers, the affected domain controllers were also seen beaconing to external endpoints (‘sezijiru[.]com’ and ‘gedabuyisi[.]com’) that OSINT tools have associated with these DLL files [17 & 18]. Moreover, these SSL connections were made using a default client fingerprint for Cobalt Strike [19], which is consistent with the initial delivery method. To illustrate the beaconing nature of these connections, Figure 5 displays the 4.3 million daily SSL connections to one of the C2 servers during the attack. The 100,000 most recent connections were initiated by 11 unique source IP addresses alone.

Figure 5- The Advanced Search interface, querying for external SSL connections from devices in the network to an external host that appears to be a Cobalt Strike C2 server. 4.3 million connections were made over 8 days, even after the ransomware was eventually detonated on 2022-08-03.


Shortly after the writes, the attack progressed to the penultimate stage. The next day, on the 27th of July, the attackers moved to achieve their first objective: data exfiltration. Data exfiltration is not always performed by the Quantum ransomware gang. Researchers have noted discrepancies between claims of data theft made in their ransom notes versus the lack of data seen leaving the network, although this may have been missed due to covert exfiltration via a Cobalt Strike beacon [20]. 

In contrast, this attack displayed several gigabytes of data leaving internal devices including servers that had previously beaconed to Cobalt Strike C2 servers. This data was transferred overtly via FTP, however the attacker still attempted to conceal the activity using ephemeral ports (FTP in EPSV mode). FTP is an effective method for attackers to exfiltrate large files as it is easy to use, organizations often neglect to monitor outbound usage, and it can be shipped through ports that will not be blocked by traditional firewalls [21].   

Figure 6 displays an example of the FTP data transfer to attacker-controlled infrastructure, in which the destination share appears structured to identify the organization that the data was stolen from, suggesting there may be other victim organizations’ data stored. This suggests that data exfiltration was an intended outcome of this attack. 

Figure 6- This figure is from Darktrace’s Advanced Search interface, displaying some of the data transferred from an internal device to the attacker’s FTP server.

 
Data was continuously exfiltrated until a week later when the final stage of the attack was achieved and Quantum ransomware was detonated. Darktrace detected the following unusual SMB activity initiated from the attacker-created account that is a hallmark for ransomware (see Figure 7 for example log):

·      Symmetric SMB Read to Write ratio, indicative of active encryption

·      Sustained MIME type conversion of files, with the extension ‘.quantum’ appended to filenames

·      SMB writes of a ransom note ‘README_TO_DECRYPT.html’ (see Figure 8 for an example note)

Figure 7- The Model Breach Event Log for a device that had files encrypted by Quantum ransomware, showing the reads and writes of files with ‘.quantum’ appended to encrypted files, and an HTML ransom note left where the files were encrypted.

 

Figure 8- An example of the ransom note left by the Quantum gang, this one is taken from open-sources [22].


The example in Figure 8 mentions that the attacker also possessed large volumes of victim data.  It is likely that the gigabytes of data exfiltrated over FTP were leveraged as blackmail to further extort the victim organization for payment.  

Darktrace Coverage

 

Figure 9- Timeline of Quantum ransomware incident


If Darktrace/Email was deployed in the prospect’s environment, the initial payload (if delivered through a phishing email) could have been detected and held from the recipient’s inbox. Although DETECT identified anomalous network behaviour at each stage of the attack, since the incident occurred during a trial phase where Darktrace could only detect but not respond, the attack was able to progress through the kill chain. If RESPOND/Network had been configured in the targeted environment, the unusual connections observed during the initial access, C2, reconnaissance and lateral movement stages of the attack could have been blocked. This would have prevented the attackers from delivering the later stage payloads and eventual ransomware into the target network.

It is often thought that a properly implemented backup strategy is sufficient defense against ransomware [23], however as discussed in a previous Darktrace blog, the increasing frequency of double extortion attacks in a world where ‘data is the new oil’ demonstrates that backups alone are not a mitigation for the risk of a ransomware attack [24]. Equally, the lack of preventive defenses in the target’s environment enabled the attacker’s riskier decision to dwell in the network for longer and allowed them to optimize their potential reward. 

Recent crackdowns from law enforcement on ransomware groups have shifted these groups’ approaches to aim for a balance between low risk and significant financial rewards [25]. However, given the Quantum gang only have a 5% market share in Q2 2022, compared to the 13.2% held by LockBit and 16.9% held by BlackCat [26], a riskier strategy may be favourable, as a longer dwell time and double extortion outcome offers a ‘belt and braces’ approach to maximizing the rewards from carrying out this attack. Alternatively, the gaps in-between the attack stages may imply that more than one player was involved in this attack, although this group has not been reported to operate a franchise model before [27]. Whether assisted by others or driving for a risk approach, it is clear that Quantum (like other actors) are continuing to adapt to ensure their financial success. They will continue to be successful until organizations dedicate themselves to ensuring that the proper data protection and network security measures are in place. 

Conclusion 

Ransomware has evolved over time and groups have merged and rebranded. However, this incident of Quantum ransomware demonstrates that regardless of the capability to execute a full attack within hours, prolonging an attack to optimize potential reward by leveraging double extortion tactics is sometimes still the preferred action. The pattern of network activity mirrors the techniques used in other Quantum attacks, however this incident lacked the continuous progression of the group’s attacks reported recently and may represent a change of motives during the process. Knowing that attacker motives can change reinforces the need for organizations to invest in preventative controls- an organization may already be too far down the line if it is executing its backup contingency plans. Darktrace DETECT/Network had visibility over both the early network-based indicators of compromise and the escalation to the later stages of this attack. Had Darktrace also been allowed to respond, this case of Quantum ransomware would also have had a very short dwell time, but a far better outcome for the victim.

Thanks to Steve Robinson for his contributions to this blog.

Appendices

References

[1] https://community.ibm.com/community/user/security/blogs/tristan-reed/2022/07/13/ibm-security-reaqta-vs-quantum-locker-ransomware

 

[2] https://www.bleepingcomputer.com/news/security/quantum-ransomware-seen-deployed-in-rapid-network-attacks/

 

[3], [12], [14], [16], [20] https://thedfirreport.com/2022/04/25/quantum-ransomware/

 

[4] https://www.mandiant.com/sites/default/files/2022-04/M-Trends%202022%20Executive%20Summary.pdf

 

[5] https://cyware.com/news/over-650-healthcare-organizations-affected-by-the-quantum-ransomware-attack-d0e776bb/

 

[6] https://www.kroll.com/en/insights/publications/cyber/bumblebee-loader-linked-conti-used-in-quantum-locker-attacks

 

[7] https://github.com/pan-unit42/tweets/blob/master/2022-06-28-IOCs-for-TA578-IcedID-Cobalt-Strike-and-DarkVNC.txt 

 

[8] https://github.com/stamparm/maltrail/blob/master/trails/static/malware/icedid.txt

 

[9], [15] https://www.cynet.com/blog/shelob-moonlight-spinning-a-larger-web-from-icedid-to-conti-a-trojan-and-ransomware-collaboration/

 

[10] https://www.microsoft.com/security/blog/2021/04/09/investigating-a-unique-form-of-email-delivery-for-icedid-malware/

 

[11] https://twitter.com/0xToxin/status/1564289244084011014

 

[13], [27] https://cybernews.com/security/quantum-ransomware-gang-fast-and-furious/

 

[17] https://www.virustotal.com/gui/domain/gedabuyisi.com/relations

 

[18] https://www.virustotal.com/gui/domain/sezijiru.com/relations.

 

[19] https://github.com/ByteSecLabs/ja3-ja3s-combo/blob/master/master-list.txt 

 

[21] https://www.darkreading.com/perimeter/ftp-hacking-on-the-rise

 

[22] https://www.pcrisk.com/removal-guides/23352-quantum-ransomware

 

[23] https://www.cohesity.com/resource-assets/tip-sheet/5-ways-ransomware-renders-backup-useless-tip-sheet-en.pdf

 

[24] https://www.forbes.com/sites/nishatalagala/2022/03/02/data-as-the-new-oil-is-not-enough-four-principles-for-avoiding-data-fires/ 

 

[25] https://www.bleepingcomputer.com/news/security/access-to-hacked-corporate-networks-still-strong-but-sales-fall/

 

[26] https://www.bleepingcomputer.com/news/security/ransom-payments-fall-as-fewer-victims-choose-to-pay-hackers/ 

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Nicole Wong
Cyber Security Analyst

More in this series

No items found.

Blog

/

Compliance

/

June 9, 2025

Modernising UK Cyber Regulation: Implications of the Cyber Security and Resilience Bill

Two individuals sitting at a desk working on a documentDefault blog imageDefault blog image

The need for security and continued cyber resilience

The UK government has made national security a key priority, and the new Cyber Security and Resilience Bill (CSRB) is a direct reflection of that focus. In introducing the Bill, Secretary of State for Science, Innovation and Technology, Peter Kyle, recognised that the UK is “desperately exposed” to cyber threats—from criminal groups to hostile nation-states that are increasingly targeting the UK's digital systems and critical infrastructure[1].

Context and timeline for the new legislation

First announced during the King’s Speech of July 2024, and elaborated in a Department for Science, Innovation and Technology (DSIT) policy statement published in April 2025, the CSRB is expected to be introduced in Parliament during the 2025-26 legislative session.

For now, organisations in the UK remain subject to the 2018 Network and Information Systems (NIS) Regulations – an EU-derived law which was drafted before today’s increasing digitisation of critical services, rise in cloud adoption and emergence of AI-powered threats.

Why modernisation is critical

Without modernisation, the Government believes UK’s infrastructure and economy risks falling behind international peers. The EU, which revised its cybersecurity regulation under the NIS2 Directive, already imposes stricter requirements on a broader set of sectors.

The urgency of the Bill is also underscored by recent high-impact incidents, including the Synnovis attack which targeted the National Health Service (NHS) suppliers and disrupted thousands of patient appointments and procedures[2]. The Government has argued that such events highlight a systemic failure to keep pace with a rapidly evolving threat landscape[3].

What the Bill aims to achieve

This Bill represents a decisive shift. According to the Government, it will modernise and future‑proof the UK’s cyber laws, extending oversight to areas where risk has grown but regulation has not kept pace[4]. While the legislation builds on previous consultations and draws lessons from international frameworks like the EU’s NIS2 directive, it also aims to tailor solutions to the UK’s unique threat environment.

Importantly, the Government is framing cybersecurity not as a barrier to growth, but as a foundation for it. The policy statement emphasises that strong digital resilience will create the stability businesses need to thrive, innovate, and invest[5]. Therefore, the goals of the Bill will not only be to enhance security but also act as an enabler to innovation and economic growth.

Recognition that AI changes cyber threats

The CSRB policy statement recognises that AI is fundamentally reshaping the threat landscape, with adversaries now leveraging AI and commercial cyber tools to exploit vulnerabilities in critical infrastructure and supply chains. Indeed, the NCSC has recently assessed that AI will almost certainly lead to “an increase in the frequency and intensity of cyber threats”[6]. Accordingly, the policy statement insists that the UK’s regulatory framework “must keep pace and provide flexibility to respond to future threats as and when they emerge”[7].

To address the threat, the Bill signals new obligations for MSPs and data centres, timely incident reporting and dynamic guidance that can be refreshed without fresh primary legislation, making it essential for firms to follow best practices.

What might change in day-to-day practice?

New organisations in scope of regulation

Under the existing Network and Information Systems (NIS) Regulations[8], the UK already supervises operators in five critical sectors—energy, transport, drinking water, health (Operators of Essential Services, OES) and digital infrastructure (Relevant Digital Service Providers, RDSPs).

The Cyber Security and Resilience Bill retains this foundation and adds Managed Service Providers (MSPs) and data centres to the scope of regulation to “better recognise the increasing reliance on digital services and the vulnerabilities posed by supply chains”[9]. It also grants the Secretary of State for Science, Innovation and Technology the power to add new sectors or sub‑sectors via secondary legislation, following consultation with Parliament and industry.

Managed service providers (MSPs)

MSPs occupy a central position within the UK’s enterprise information‑technology infrastructure. Because they remotely run or monitor clients’ systems, networks and data, they hold privileged, often continuous access to multiple environments. This foothold makes them an attractive target for malicious actors.

The Bill aims to bring MSPs in scope of regulation by making them subject to the same duties as those placed on firms that provide digital services under the 2018 NIS Regulations. By doing so, the Bill seeks to raise baseline security across thousands of customer environments and to provide regulators with better visibility of supply‑chain risk.

The proposed definition for MSPs is a service which:

  1. Is provided to another organisation
  2. Relies on the use of network and information systems to deliver the service
  3. Relates to ongoing management support, active administration and/or monitoring of AI systems, IT infrastructure, applications, and/or IT networks, including for the purpose of activities relating to cyber security.
  4. Involves a network connection and/or access to the customer’s network and information systems.

Data centres

Building on the September 2024 designation of data centres as critical national infrastructure, the CSRB will fold data infrastructure into the NIS-style regime by naming it an “relevant sector" and data centres as “essential service”[10].

About 182 colocation facilities run by 64 operators will therefore come under statutory duties to notify the regulator, maintain proportionate CAF-aligned controls and report significant incidents, regardless of who owns them or what workloads they host.

New requirements for regulated organisations

Incident reporting processes

There could be stricter timelines or broader definitions of what counts as a reportable incident. This might nudge organisations to formalise detection, triage, and escalation procedures.

The Government is proposing to introduce a new two-stage incident reporting process. This would include an initial notification which would be submitted within 24 hours of becoming aware of a significant incident, followed by a full incident report which should be submitted within 72 hours of the same.

Supply chain assurance requirements

Supply chains for the UK's most critical services are becoming increasingly complex and present new and serious vulnerabilities for cyber-attacks. The recent Synnovis ransomware attacks on the NHS[11] exemplify the danger posed by attacks against the supply chains of important services and organisations. This is concerning when reflecting on the latest Cyber Security Breaches survey conducted by DSIT, which highlights that fewer than 25% of large businesses review their supply chain risks[12].

Despite these risks, the UK’s legacy cybersecurity regulatory regime does not explicitly cover supply chain risk management. The UK instead relies on supporting and non-statutory guidance to close this gap, such as the NCSC’s Cyber Assessment Framework (CAF)[13].

The CSRB policy statement acts on this regulatory shortcoming and recognises that “a single supplier’s disruption can have far-reaching impacts on the delivery of essential or digital services”[14].

To address this, the Bill would make in-scope organisations (OES and RDPS) directly accountable for the cybersecurity of their supply chains. Secondary legislation would spell out these duties in detail, ensuring that OES and RDSPs systematically assess and mitigate third-party cyber risks.

Updated and strengthened security requirements

By placing the CAF into a firmer footing and backing it with a statutory Code of Practice, the Government is setting clearer expectations about government expectations on technical standards and methods organisations will need to follow to prove their resilience.

How Darktrace can help support affected organizations

Demonstrate resilience

Darktrace’s Self-Learning AITM continuously monitors your digital estate across cloud, network, OT, email, and endpoint to detect, investigate, and autonomously respond to emerging threats in real time. This persistent visibility and defense posture helps organizations demonstrate cyber resilience to regulators with confidence.

Streamline incident reporting and compliance

Darktrace surfaces clear alerts and automated investigation reports, complete with timeline views and root cause analysis. These insights reduce the time and complexity of regulatory incident reporting and support internal compliance workflows with auditable, AI-generated evidence.

Improve supply chain visibility

With full visibility across connected systems and third-party activity, Darktrace detects early indicators of lateral movement, account compromise, and unusual behavior stemming from vendor or partner access, reducing the risk of supply chain-originated cyber-attacks.

Ensure MSPs can meet new standards

For managed service providers, Darktrace offers native multi-tenant support and autonomous threat response that can be embedded directly into customer environments. This ensures consistent, scalable security standards across clients—helping MSPs address increasing regulatory obligations.

[related-resource]

References

[1] https://www.theguardian.com/uk-news/article/2024/jul/29/uk-desperately-exposed-to-cyber-threats-and-pandemics-says-minister

[2] https://www.england.nhs.uk/2024/06/synnovis-cyber-attack-statement-from-nhs-england/

[3] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

[4] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

[5] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

[6] https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027

[7] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

[8] https://www.gov.uk/government/collections/nis-directive-and-nis-regulations-2018

[9] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

[10] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

[11] https://www.england.nhs.uk/2024/06/synnovis-cyber-attack-statement-from-nhs-england/

[12] https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025

[13] https://www.ncsc.gov.uk/collection/cyber-assessment-framework

[14] https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement

Continue reading
About the author
The Darktrace Community

Blog

/

Network

/

June 5, 2025

Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic

Woman on laptop in office buildingDefault blog imageDefault blog image

What is ClickFix and how does it work?

Amid heightened security awareness, threat actors continue to seek stealthy methods to infiltrate target networks, often finding the human end user to be the most vulnerable and easily exploited entry point.

ClickFix baiting is an exploitation of the end user, making use of social engineering techniques masquerading as error messages or routine verification processes, that can result in malicious code execution.

Since March 2024, the simplicity of this technique has drawn attention from a range of threat actors, from individual cybercriminals to Advanced Persistent Threat (APT) groups such as APT28 and MuddyWater, linked to Russia and Iran respectively, introducing security threats on a broader scale [1]. ClickFix campaigns have been observed affecting organizations in across multiple industries, including healthcare, hospitality, automotive and government [2][3].

Actors carrying out these targeted attacks typically utilize similar techniques, tools and procedures (TTPs) to gain initial access. These include spear phishing attacks, drive-by compromises, or exploiting trust in familiar online platforms, such as GitHub, to deliver malicious payloads [2][3]. Often, a hidden link within an email or malvertisements on compromised legitimate websites redirect the end user to a malicious URL [4]. These take the form of ‘Fix It’ or fake CAPTCHA prompts [4].

From there, users are misled into believing they are completing a human verification step, registering a device, or fixing a non-existent issue such as a webpage display error. As a result, they are guided through a three-step process that ultimately enables the execution of malicious PowerShell commands:

  1. Open a Windows Run dialog box [press Windows Key + R]
  2. Automatically or manually copy and paste a malicious PowerShell command into the terminal [press CTRL+V]
  3. And run the prompt [press ‘Enter’] [2]

Once the malicious PowerShell command is executed, threat actors then establish command and control (C2) communication within the targeted environment before moving laterally through the network with the intent of obtaining and stealing sensitive data [4]. Malicious payloads associated with various malware families, such as XWorm, Lumma, and AsyncRAT, are often deployed [2][3].

Attack timeline of ClickFix cyber attack

Based on investigations conducted by Darktrace’s Threat Research team in early 2025, this blog highlights Darktrace’s capability to detect ClickFix baiting activity following initial access.

Darktrace’s coverage of a ClickFix attack chain

Darktrace identified multiple ClickFix attacks across customer environments in both Europe, the Middle East, and Africa (EMEA) and the United States. The following incident details a specific attack on a customer network that occurred on April 9, 2025.

Although the initial access phase of this specific attack occurred outside Darktrace’s visibility, other affected networks showed compromise beginning with phishing emails or fake CAPTCHA prompts that led users to execute malicious PowerShell commands.

Darktrace’s visibility into the compromise began when the threat actor initiated external communication with their C2 infrastructure, with Darktrace / NETWORK detecting the use of a new PowerShell user agent, indicating an attempt at remote code execution.

Darktrace / NETWORK's detection of a device making an HTTP connection with new PowerShell user agent, indicating PowerShell abuse for C2 communications.
Figure 1: Darktrace / NETWORK's detection of a device making an HTTP connection with new PowerShell user agent, indicating PowerShell abuse for C2 communications.

Download of Malicious Files for Lateral Movement

A few minutes later, the compromised device was observed downloading a numerically named file. Numeric files like this are often intentionally nondescript and associated with malware. In this case, the file name adhered to a specific pattern, matching the regular expression: /174(\d){7}/. Further investigation into the file revealed that it contained additional malicious code designed to further exploit remote services and gather device information.

Darktrace / NETWORK's detection of a numeric file, one minute after the new PowerShell User Agent alert.
Figure 2: Darktrace / NETWORK's detection of a numeric file, one minute after the new PowerShell User Agent alert.

The file contained a script that sent system information to a specified IP address using an HTTP POST request, which also processed the response. This process was verified through packet capture (PCAP) analysis conducted by the Darktrace Threat Research team.

By analyzing the body content of the HTTP GET request, it was observed that the command converts the current time to Unix epoch time format (i.e., 9 April 2025 13:26:40 GMT), resulting in an additional numeric file observed in the URI: /1744205200.

PCAP highlighting the HTTP GET request that sends information to the specific IP, 193.36.38[.]237, which then generates another numeric file titled per the current time.
Figure 3: PCAP highlighting the HTTP GET request that sends information to the specific IP, 193.36.38[.]237, which then generates another numeric file titled per the current time.

Across Darktrace’s investigations into other customers' affected by ClickFix campaigns, both internal information discovery events and further execution of malicious code were observed.

Data Exfiltration

By following the HTTP stream in the same PCAP, the Darktrace Threat Research Team assessed the activity as indicative of data exfiltration involving system and device information to the same command-and-control (C2) endpoint, , 193.36.38[.]237. This endpoint was flagged as malicious by multiple open-source intelligence (OSINT) vendors [5].

PCAP highlighting HTTP POST connection with the numeric file per the URI /1744205200 that indicates data exfiltration to 193.36.38[.]237.
Figure 4: PCAP highlighting HTTP POST connection with the numeric file per the URI /1744205200 that indicates data exfiltration to 193.36.38[.]237.

Further analysis of Darktrace’s Advanced Search logs showed that the attacker’s malicious code scanned for internal system information, which was then sent to a C2 server via an HTTP POST request, indicating data exfiltration

Advanced Search further highlights Darktrace's observation of the HTTP POST request, with the second numeric file representing data exfiltration.
Figure 5: Advanced Search further highlights Darktrace's observation of the HTTP POST request, with the second numeric file representing data exfiltration.

Actions on objectives

Around ten minutes after the initial C2 communications, the compromised device was observed connecting to an additional rare endpoint, 188.34.195[.]44. Further analysis of this endpoint confirmed its association with ClickFix campaigns, with several OSINT vendors linking it to previously reported attacks [6].

In the final HTTP POST request made by the device, Darktrace detected a file at the URI /init1234 in the connection logs to the malicious endpoint 188.34.195[.]44, likely depicting the successful completion of the attack’s objective, automated data egress to a ClickFix C2 server.

Darktrace / NETWORK grouped together the observed indicators of compromise (IoCs) on the compromised device and triggered an Enhanced Monitoring model alert, a high-priority detection model designed to identify activity indicative of the early stages of an attack. These models are monitored and triaged 24/7 by Darktrace’s Security Operations Center (SOC) as part of the Managed Threat Detection service, ensuring customers are promptly notified of malicious activity as soon as it emerges.

Darktrace correlated the separate malicious connections that pertained to a single campaign.
Figure 6: Darktrace correlated the separate malicious connections that pertained to a single campaign.

Darktrace Autonomous Response

In the incident outlined above, Darktrace was not configured in Autonomous Response mode. As a result, while actions to block specific connections were suggested, they had to be manually implemented by the customer’s security team. Due to the speed of the attack, this need for manual intervention allowed the threat to escalate without interruption.

However, in a different example, Autonomous Response was fully enabled, allowing Darktrace to immediately block connections to the malicious endpoint (138.199.156[.]22) just one second after the initial connection in which a numerically named file was downloaded [7].

Darktrace Autonomous Response blocked connections to a suspicious endpoint following the observation of the numeric file download.
Figure 7: Darktrace Autonomous Response blocked connections to a suspicious endpoint following the observation of the numeric file download.

This customer was also subscribed to our Managed Detection and Response service, Darktrace’s SOC extended a ‘Quarantine Device’ action that had already been autonomously applied in order to buy their security team additional time for remediation.

Autonomous Response blocked connections to malicious endpoints, including 138.199.156[.]22, 185.250.151[.]155, and rkuagqnmnypetvf[.]top, and also quarantined the affected device. These actions were later manually reinforced by the Darktrace SOC.
Figure 8: Autonomous Response blocked connections to malicious endpoints, including 138.199.156[.]22, 185.250.151[.]155, and rkuagqnmnypetvf[.]top, and also quarantined the affected device. These actions were later manually reinforced by the Darktrace SOC.

Conclusion

ClickFix baiting is a widely used tactic in which threat actors exploit human error to bypass security defenses. By tricking end point users into performing seemingly harmless, everyday actions, attackers gain initial access to systems where they can access and exfiltrate sensitive data.

Darktrace’s anomaly-based approach to threat detection identifies early indicators of targeted attacks without relying on prior knowledge or IoCs. By continuously learning each device’s unique pattern of life, Darktrace detects subtle deviations that may signal a compromise. In this case, Darktrace's Autonomous Response, when operating in a fully autonomous mode, was able to swiftly contain the threat before it could progress further along the attack lifecycle.

Credit to Keanna Grelicha (Cyber Analyst) and Jennifer Beckett (Cyber Analyst)

Appendices

NETWORK Models

  • Device / New PowerShell User Agent
  • Anomalous Connection / New User Agent to IP Without Hostname
  • Anomalous Connection / Posting HTTP to IP Without Hostname
  • Anomalous Connection / Powershell to Rare External
  • Device / Suspicious Domain
  • Device / New User Agent and New IP
  • Anomalous File / New User Agent Followed By Numeric File Download (Enhanced Monitoring Model)
  • Device / Initial Attack Chain Activity (Enhanced Monitoring Model)

Autonomous Response Models

  • Antigena / Network::Significant Anomaly::Antigena Significant Anomaly from Client Block
  • Antigena / Network::Significant Anomaly::Antigena Enhanced Monitoring from Client Block
  • Antigena / Network::External Threat::Antigena File then New Outbound Block
  • Antigena / Network::External Threat::Antigena Suspicious File Block
  • Antigena / Network::Significant Anomaly::Antigena Alerts Over Time Block
  • Antigena / Network::External Threat::Antigena Suspicious File Block

IoC - Type - Description + Confidence

·       141.193.213[.]11 – IP address – Possible C2 Infrastructure

·       141.193.213[.]10 – IP address – Possible C2 Infrastructure

·       64.94.84[.]217 – IP address – Possible C2 Infrastructure

·       138.199.156[.]22 – IP address – C2 server

·       94.181.229[.]250 – IP address – Possible C2 Infrastructure

·       216.245.184[.]181 – IP address – Possible C2 Infrastructure

·       212.237.217[.]182 – IP address – Possible C2 Infrastructure

·       168.119.96[.]41 – IP address – Possible C2 Infrastructure

·       193.36.38[.]237 – IP address – C2 server

·       188.34.195[.]44 – IP address – C2 server

·       205.196.186[.]70 – IP address – Possible C2 Infrastructure

·       rkuagqnmnypetvf[.]top – Hostname – C2 server

·       shorturl[.]at/UB6E6 – Hostname – Possible C2 Infrastructure

·       tlgrm-redirect[.]icu – Hostname – Possible C2 Infrastructure

·       diagnostics.medgenome[.]com – Hostname – Compromised Website

·       /1741714208 – URI – Possible malicious file

·       /1741718928 – URI – Possible malicious file

·       /1743871488 – URI – Possible malicious file

·       /1741200416 – URI – Possible malicious file

·       /1741356624 – URI – Possible malicious file

·       /ttt – URI – Possible malicious file

·       /1741965536 – URI – Possible malicious file

·       /1.txt – URI – Possible malicious file

·       /1744205184 – URI – Possible malicious file

·       /1744139920 – URI – Possible malicious file

·       /1744134352 – URI – Possible malicious file

·       /1744125600 – URI – Possible malicious file

·       /1[.]php?s=527 – URI – Possible malicious file

·       34ff2f72c191434ce5f20ebc1a7e823794ac69bba9df70721829d66e7196b044 – SHA-256 Hash – Possible malicious file

·       10a5eab3eef36e75bd3139fe3a3c760f54be33e3 – SHA-1 Hash – Possible malicious file

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique  

Spearphishing Link - INITIAL ACCESS - T1566.002 - T1566

Drive-by Compromise - INITIAL ACCESS - T1189

PowerShell - EXECUTION - T1059.001 - T1059

Exploitation of Remote Services - LATERAL MOVEMENT - T1210

Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071

Automated Exfiltration - EXFILTRATION - T1020 - T1020.001

References

[1] https://www.logpoint.com/en/blog/emerging-threats/clickfix-another-deceptive-social-engineering-technique/

[2] https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape

[3] https://cyberresilience.com/threatonomics/understanding-the-clickfix-attack/

[4] https://www.group-ib.com/blog/clickfix-the-social-engineering-technique-hackers-use-to-manipulate-victims/

[5] https://www.virustotal.com/gui/ip-address/193.36.38.237/detection

[6] https://www.virustotal.com/gui/ip-address/188.34.195.44/community

[7] https://www.virustotal.com/gui/ip-address/138.199.156.22/detection

Continue reading
About the author
Keanna Grelicha
Cyber Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI