Blog
/
Email
/
February 24, 2025

Detecting and Containing Account Takeover with Darktrace

Account takeovers are rising with SaaS adoption. Learn how Darktrace detects deviations in user behavior and autonomously stops threats before they escalate.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Min Kim
Cyber Security Analyst
women on laptop in officeDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
24
Feb 2025

Thanks to its accessibility from anywhere with an internet connection and a web browser, Software-as-a-Service (SaaS) platforms have become nearly universal across organizations worldwide. However, with this growing popularity comes greater responsibility. Increased attention attracts a larger audience, including those who may seek to exploit these widely used services. One crucial factor to be vigilant about in the SaaS landscape is safeguarding internal credentials. Minimal protection on accounts can lead to SaaS hijacking, which could allow further escalations within the network.

How does SaaS account takeover work?

SaaS hijacking occurs when a malicious actor takes control of a user’s active session with a SaaS application. Attackers can achieve this through various methods, including employees using company credentials on compromised or spoofed external websites, brute-force attacks, social engineering, and exploiting outdated software or applications.

After the hijack, attackers may escalate their actions by changing email rules and using internal addresses for additional social engineering attacks. The larger goal of these actions is often to steal internal data, damage reputations, and disrupt operations.

Account takeover protection

It has become essential to have security tools capable of outsmarting potential malicious actors. Traditional tools that rely on rules and signatures may not be able to identify new events, such as logins or activities from a rare endpoint, unless they come from a known malicious source.

Darktrace relies on analysis of user and network behavior, tailored to each customer, allowing it to identify anomalous events that the user typically does not engage in. In this way, unusual SaaS activities can be detected, and unwanted actions can be halted to allow time for remediation before further escalations.

The following cases, drawn from the global customer base, illustrate how Darktrace detects potential SaaS hijack attempts and further escalations, and applies appropriate actions when necessary.

Case 1: Unusual login after a phishing email

A customer in the US received a suspicious email that seemed to be from the legitimate file storage service, Dropbox. However, Darktrace identified that the reply-to email address, hremployeepyaroll@mail[.]com, was masquerading as one associated with the customer’s Human Resources (HR) department.

Further inspection of this sender address revealed that the attacker had intentionally misspelled ‘payroll’ to trick recipients into believing it was legitimate

Furthermore, the subject of the email indicated that the attackers were attempting a social engineering attack by sharing a file related to pay raises and benefits to capture the recipients' attention and increase the likelihood of their targets engaging with the email and its attachment.

Figure 1: Subject of the phishing email.
Figure 1: Subject of the phishing email.

Unknowingly, the recipient, who believed the email to be a legitimate HR communication, acted on it, allowing malicious attackers to gain access to the account. Following this, the recipient’s account was observed logging in from a rare location using multi-factor authentication (MFA) while also being active from another more commonly observed location, indicating that the SaaS account had been compromised.

Darktrace’s Autonomous Response action triggered by an anomalous email received by an internal user, followed by a failed login attempt from a rare external source.
Figure 2: Darktrace’s Autonomous Response action triggered by an anomalous email received by an internal user, followed by a failed login attempt from a rare external source.

Darktrace subsequently observed the SaaS actor creating new inbox rules on the account. These rules were intended to mark as read and move any emails mentioning the file storage company, whether in the subject or body, to the ‘Conversation History’ folder. This was likely an attempt by the threat actor to hide any outgoing phishing emails or related correspondence from the legitimate account user, as the ‘Conversation History’ folder typically goes unread by most users.

Typically, Darktrace / EMAIL would have instantly placed the phishing email in the junk folder before they reached user’s inbox, while also locking the links identified in the suspicious email, preventing them from being accessed. Due to specific configurations within the customer’s deployment, this did not happen, and the email remained accessible to the user.

Case 2: Login using unusual credentials followed by password change

In the latter half of 2024, Darktrace detected an unusual use of credentials when a SaaS actor attempted to sign into a customer’s Microsoft 365 application from an unfamiliar IP address in the US. Darktrace recognized that since the customer was located within the Europe, Middle East, and Africa (EMEA) region, a login from the US was unexpected and suspicious. Around the same time, the legitimate account owner logged into the customer’s SaaS environment from another location – this time from a South African IP, which was commonly seen within the environment and used by other internal SaaS accounts.

Darktrace understood that this activity was highly suspicious and unlikely to be legitimate, given one of the IPs was known and expected, while the other had never been seen before in the environment, and the simultaneous logins from two distant locations were geographically impossible.

Model alert in Darktrace / IDENTITY: Detecting a login from a different source while the user is already active from another source.
Figure 3: Model alert in Darktrace / IDENTITY: Detecting a login from a different source while the user is already active from another source.

Darktrace detected several unusual login attempts, including a successful login from an uncommon US source. Subsequently, Darktrace / NETWORK identified the device associated with this user making external connections to rare endpoints, some of which were only two weeks old. As this customer had integrated Darktrace with Microsoft Defender, the Darktrace detection was enriched by Defender, adding the additional context that the user had likely been compromised in an Adversary-in-the-Middle (AiTM) phishing attack. AiTM phishing attacks occur when a malicious attacker intercepts communications between a user and a legitimate authentication service, potentially leading to account hijacking. These attacks are harder to identify as they can bypass security measures like MFA.

Following this, Darktrace observed the attacker using the now compromised credentials to access password management and change the account's password. Such behavior is common in account takeover incidents, as attackers seek to maintain persistence within the SaaS environment.

While Darktrace’s Autonomous Response was not fully configured on the customer’s SaaS environment, they were subscribed to the Managed Threat Detection service offered by Darktrace’s Security Operations Center (SOC). This 24/7 service ensures that Darktrace’s analysts monitor and investigate emerging suspicious activity, informing customers in real-time. As such, the customer received notification of the compromise and were able to quickly take action to prevent further escalation.

Case 3: Unusual logins, new email rules and outbound spam

Recently, Darktrace has observed a trend in SaaS compromises involving unusual logins, followed by the creation of new email rules, and then outbound spam or phishing campaigns being launched from these accounts.

In October, Darktrace identified a SaaS user receiving an email with the subject line "Re: COMPANY NAME Request for Documents" from an unknown sender using a freemail  account. As freemail addresses require very little personal information to create, threat actors can easily create multiple accounts for malicious purposes while retaining their anonymity.

Within the identified email, Darktrace found file storage links that were likely intended to divert recipients to fraudulent or malicious websites upon interaction. A few minutes after the email was received, the recipient was seen logging in from three different sources located in the US, UK, and the Philippines, all around a similar time. As the customer was based in the Philippines, a login from there was expected and not unusual. However, Darktrace understood that the logins from the UK and US were highly unusual, and no other SaaS accounts had connected from these locations within the same week.

After successfully logging in from the UK, the actor was observed updating a mailbox rule, renaming it to ‘.’ and changing its parameters to move any inbound emails to the deleted items folder and mark them as read.

Figure 4: The updated email rule intended to move any inbound emails to the deleted items folder.

Malicious actors often use ambiguous names like punctuation marks, repetitive letters, and unreadable words to name resources, disguising their rules to avoid detection by legitimate users or administrators. Similarly, attackers have been known to adjust existing rule parameters rather than creating new rules to keep their footprints untracked. In this case, the rule was updated to override an existing email rule and delete all incoming emails. This ensured that any inbound emails, including responses to potential phishing emails sent by the account, would be deleted, allowing the attacker to remain undetected.

Over the next two days, additional login attempts, both successful and failed, were observed from locations in the UK and the Philippines. Darktrace noted multiple logins from the Philippines where the legitimate user was attempting to access their account using a password that had recently expired or been changed, indicating that the attacker had altered the user’s original password as well.

Following this chain of events, over 500 emails titled “Reminder For Document Signed Agreement.10/28/2024” were sent from the SaaS actor’s account to external recipients, all belonging to a different organization within the Philippines.

These emails contained rare attachments with a ‘.htm’ extension, which included programming language that could initiate harmful processes on devices. While inherently not malicious, if used inappropriately, these files could perform unwanted actions such as code execution, malware downloads, redirects to malicious webpages, or phishing upon opening.

Outbound spam seen from the hijacked SaaS account containing a ‘.htm’ attachment.
Figure 5: Outbound spam seen from the hijacked SaaS account containing a ‘.htm’ attachment.

As this customer did not have Autonomous Response enabled for Darktrace / IDENTITY, the unusual activity went unattended, and the compromise was able to escalate to the point of a spam email campaign being launched from the account.

In a similar example on a customer network in EMEA, Darktrace detected unusual logins and the creation of new email rules from a foreign location through a SaaS account. However, in this instance, Autonomous Response was enabled and automatically disabled the compromised account, preventing further malicious activity and giving the customer valuable time to implement their own remediation measures.

Conclusion

Whether it is an unexpected login or an unusual sequence of events – such as a login followed by a phishing email being sent – unauthorized or unexpected activities can pose a significant risk to an organization’s SaaS environment. The threat becomes even greater when these activities escalate to account hijacking, with the compromised account potentially providing attackers access to sensitive corporate data. Organizations, therefore, must have robust SaaS security measures in place to prevent data theft, ensure compliance and maintain continuity and trust.

The Darktrace suite of products is well placed to detect and contain SaaS hijack attempts at multiple stages of an attack. Darktrace / EMAIL identifies initial phishing emails that attackers use to gain access to customer SaaS environments, while Darktrace / IDENTITY detects anomalous SaaS behavior on user accounts which could indicate they have been taken over by a malicious actor.

By identifying these threats in a timely manner and taking proactive mitigative measures, such as logging or disabling compromised accounts, Darktrace prevents escalation and ensures customers have sufficient time to response effectively.

Credit to Min Kim (Cyber Analyst) and Ryan Traill (Analyst Content Lead)

[related-resource]

Appendices

Darktrace Model Detections Case 1

SaaS / Compromise / SaaS Anomaly Following Anomalous Login

SaaS / Compromise / Unusual Login and New Email Rule

SaaS / Compliance / Anomalous New Email Rule

SaaS / Unusual Activity / Multiple Unusual SaaS Activities

SaaS / Access / Unusual External Source for SaaS Credential Us

SaaS / Compromise / Login From Rare Endpoint While User is Active

SaaS / Email Nexus / Unusual Login Location Following Link to File Storage

Antigena / SaaS / Antigena Email Rule Block (Autonomous Response)

Antigena / SaaS / Antigena Suspicious SaaS Activity Block (Autonomous Response)

Antigena / SaaS / Antigena Enhanced Monitoring from SaaS User Block (Autonomous Response)

List of Indicators of Compromise (IoCs)

176.105.224[.]132 – IP address – Unusual SaaS Activity Source

hremployeepyaroll@mail[.]com – Email address – Reply-to email address

MITRE ATT&CK Mapping

Cloud Accounts – DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS – T1078

Outlook Rules – PERSISTENCE – T1137

Cloud Service Dashboard – DISCOVERY – T1538

Compromise Accounts – RESOURCE DEVELOPMENT – T1586

Steal Web Session Cookie – CREDENTIAL ACCESS – T1539

Darktrace Model Detections Case 2

SaaS / Compromise / SaaS Anomaly Following Anomalous Login

SaaS / Compromise / Unusual Login and Account Update

Security Integration / High Severity Integration Detection

SaaS / Access / Unusual External Source for SaaS Credential Use

SaaS / Compromise / Login From Rare Endpoint While User Is Active

SaaS / Compromise / Login from Rare High Risk Endpoint

SaaS / Access / M365 High Risk Level Login

Antigena / SaaS / Antigena Suspicious SaaS Activity Block (Autonomous Response)

Antigena / SaaS / Antigena Enhanced Monitoring from SaaS user Block (Autonomous Response)

List of IoCs

74.207.252[.]129 – IP Address – Suspicious SaaS Activity Source

MITRE ATT&CK Mapping

Cloud Accounts – DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS – T1078

Cloud Service Dashboard – DISCOVERY – T1538

Compromise Accounts – RESOURCE DEVELOPMENT – T1586

Steal Web Session Cookie – CREDENTIAL ACCESS – T1539

Darktrace Model Detections Case 3

SaaS / Compromise / Unusual Login and Outbound Email Spam

SaaS / Compromise / New Email Rule and Unusual Email Activity

SaaS / Compromise / Unusual Login and New Email Rule

SaaS / Email Nexus / Unusual Login Location Following Sender Spoof

SaaS / Email Nexus / Unusual Login Location Following Link to File Storage

SaaS / Email Nexus / Possible Outbound Email Spam

SaaS / Unusual Activity / Multiple Unusual SaaS Activities

SaaS / Email Nexus / Suspicious Internal Exchange Activity

SaaS / Compliance / Anomalous New Email Rule

List of IoCs

95.142.116[.]1 – IP Address – Suspicious SaaS Activity Source

154.12.242[.]58 – IP Address – Unusual Source

MITRE ATT&CK Mapping

Cloud Accounts – DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS – T1078

Compromise Accounts – RESOURCE DEVELOPMENT – T1586

Email Accounts – RESOURCE DEVELOPMENT – T1585

Phishing – INITIAL ACCESS – T1566

Outlook Rules – PERSISTENCE – T1137

Internal Spear phishing – LATERAL MOVEMENT - T1534

Get the latest insights on emerging cyber threats

This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Min Kim
Cyber Security Analyst

More in this series

No items found.

Blog

/

Network

/

August 8, 2025

Ivanti Under Siege: Investigating the Ivanti Endpoint Manager Mobile Vulnerabilities (CVE-2025-4427 & CVE-2025-4428)

ivanti cve exploitation edge infrastructure Default blog imageDefault blog image

Ivanti & Edge infrastructure exploitation

Edge infrastructure exploitations continue to prevail in today’s cyber threat landscape; therefore, it was no surprise that recent Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities CVE-2025-4427 and CVE-2025-4428 were exploited targeting organizations in critical sectors such as healthcare, telecommunications, and finance across the globe, including across the Darktrace customer base in May 2025.

Exploiting these types of vulnerabilities remains a popular choice for threat actors seeking to enter an organization’s network to perform malicious activity such as cyber espionage, data exfiltration and ransomware detonation.

Vulnerabilities in Ivanti EPMM

Ivanti EPMM allows organizations to manage and configure enterprise mobile devices. On May 13, 2025, Ivanti published a security advisory [1] for their Ivanti Endpoint Manager Mobile (EPMM) devices addressing a medium and high severity vulnerability:

  • CVE-2025-4427, CVSS: 5.6: An authentication bypass vulnerability
  • CVE-2025-4428, CVSS: 7.2: Remote code execution vulnerability

Successfully exploiting both vulnerabilities at the same time could lead to unauthenticated remote code execution from an unauthenticated threat actor, which could allow them to control, manipulate, and compromise managed devices on a network [2].

Shortly after the disclosure of these vulnerabilities, external researchers uncovered evidence that they were being actively exploited in the wild and identified multiple indicators of compromise (IoCs) related to post-exploitation activities for these vulnerabilities [2] [3]. Research drew particular attention to the infrastructure utilized in ongoing exploitation activity, such as leveraging the two vulnerabilities to eventually deliver malware contained within ELF files from Amazon Web Services (AWS) S3 bucket endpoints and to deliver KrustyLoader malware for persistence. KrustyLoader is a Rust based malware that was discovered being downloaded in compromised Ivanti Connect Secure systems back in January 2024 when the zero-day critical vulnerabilities; CVE-2024-21887 and CVE-2023-46805 [10].

This suggests the involvement of the threat actor UNC5221, a suspected China-nexus espionage actor [3].

In addition to exploring the post-exploit tactics, techniques, and procedures (TTPs) observed for these vulnerabilities across Darktrace’s customer base, this blog will also examine the subtle changes and similarities in the exploitation of earlier Ivanti vulnerabilities—specifically Ivanti Connect Secure (CS) and Policy Secure (PS) vulnerabilities CVE-2023-46805 and CVE-2024-21887 in early 2024, as well as CVE-2025-0282 and CVE-2025-0283, which affected CS, PS, and Zero Trust Access (ZTA) in January 2025.

Darktrace Coverage

In May 2025, shortly after Ivanti disclosed vulnerabilities in their EPMM product, Darktrace’s Threat Research team identified attack patterns potentially linked to the exploitation of these vulnerabilities across multiple customer environments. The most noteworthy attack chain activity observed included exploit validation, payload delivery via AWS S3 bucket endpoints, subsequent delivery of script-based payloads, and connections to dpaste[.]com, possibly for dynamic payload retrieval. In a limited number of cases, connections were also made to an IP address associated with infrastructure linked to SAP NetWeaver vulnerability CVE-2025-31324, which has been investigated by Darktrace in an earlier case.

Exploit Validation

Darktrace observed devices within multiple customer environments making connections related to Out-of-Band Application Security Testing (OAST). These included a range of DNS requests and connections, most of which featured a user agent associated with the command-line tool cURL, directed toward associated endpoints. The hostnames of these endpoints consisted of a string of randomly generated characters followed by an OAST domain, such as 'oast[.]live', 'oast[.]pro', 'oast[.]fun', 'oast[.]site', 'oast[.]online', or 'oast[.]me'. OAST endpoints can be leveraged by malicious actors to trigger callbacks from targeted systems, such as for exploit validation. This activity, likely representing the initial phase of the attack chain observed across multiple environments, was also seen in the early stages of previous investigations into the exploitation of Ivanti vulnerabilities [4]. Darktrace also observed similar exploit validation activity during investigations conducted in January 2024 into the Ivanti CS vulnerabilities CVE-2023-46805 and CVE-2024-21887.

Payload Delivery via AWS

Devices across multiple customer environments were subsequently observed downloading malicious ELF files—often with randomly generated filenames such as 'NVGAoZDmEe'—from AWS S3 bucket endpoints like 's3[.]amazonaws[.]com'. These downloads occurred over HTTP connections, typically using wget or cURL user agents. Some of the ELF files were later identified to be KrustyLoader payloads using open-source intelligence (OSINT). External researchers have reported that the KrustyLoader malware is executed in cases of Ivanti EPMM exploitation to gain and maintain a foothold in target networks [2].

In one customer environment, after connections were made to the endpoint fconnect[.]s3[.]amazonaws[.]com, Darktrace observed the target system downloading the ELF file mnQDqysNrlg via the user agent Wget/1.14 (linux-gnu). Further investigation of the file’s SHA1 hash (1dec9191606f8fc86e4ae4fdf07f09822f8a94f2) linked it to the KrustyLoader malware [5]. In another customer environment, connections were instead made to tnegadge[.]s3[.]amazonaws[.]com using the same user agent, from which the ELF file “/dfuJ8t1uhG” was downloaded. This file was also linked to KrustyLoader through its SHA1 hash (c47abdb1651f9f6d96d34313872e68fb132f39f5) [6].

The pattern of activity observed so far closely mirrors previous exploits associated with the Ivanti vulnerabilities CVE-2023-46805 and CVE-2024-21887 [4]. As in those cases, Darktrace observed exploit validation using OAST domains and services, along with the use of AWS endpoints to deliver ELF file payloads. However, in this instance, the delivered payload was identified as KrustyLoader malware.

Later-stage script file payload delivery

In addition to the ELF file downloads, Darktrace also detected other file downloads across several customer environments, potentially representing the delivery of later-stage payloads.

The downloaded files included script files with the .sh extension, featuring randomly generated alphanumeric filenames. One such example is “4l4md4r.sh”, which was retrieved during a connection to the IP address 15.188.246[.]198 using a cURL-associated user agent. This IP address was also linked to infrastructure associated with the SAP NetWeaver remote code execution vulnerability CVE-2025-31324, which enables remote code execution on NetWeaver Visual Composer. External reporting has attributed this infrastructure to a China-nexus state actor [7][8][9].

In addition to the script file downloads, devices on some customer networks were also observed making connections to pastebin[.]com and dpaste[.]com, two sites commonly used to host or share malicious payloads or exploitation instructions [2]. Exploits, including those targeting Ivanti EPMM vulnerabilities, can dynamically fetch malicious commands from sites like dpaste[.]com, enabling threat actors to update payloads. Unlike the previously detailed activity, this behavior was not identified in any prior Darktrace investigations into Ivanti-related vulnerabilities, suggesting a potential shift in the tactics used in post-exploitation stages of Ivanti attacks.

Conclusion

Edge infrastructure vulnerabilities, such as those found in Ivanti EPMM and investigated across customer environments with Darktrace / NETWORK, have become a key tool in the arsenal of attackers in today’s threat landscape. As highlighted in this investigation, while many of the tactics employed by threat actors following successful exploitation of vulnerabilities remain the same, subtle shifts in their methods can also be seen.

These subtle and often overlooked changes enable threat actors to remain undetected within networks, highlighting the critical need for organizations to maintain continuous extended visibility, leverage anomaly based behavioral analysis, and deploy machine speed intervention across their environments.

Credit to Nahisha Nobregas (Senior Cyber Analyst) and Anna Gilbertson (Senior Cyber Analyst)

Appendices

Mid-High Confidence IoCs

(IoC – Type - Description)

-       trkbucket.s3.amazonaws[.]com – Hostname – C2 endpoint

-       trkbucket.s3.amazonaws[.]com/NVGAoZDmEe – URL – Payload

-       tnegadge.s3.amazonaws[.]com – Hostname – C2 endpoint

-       tnegadge.s3.amazonaws[.]com/dfuJ8t1uhG – URL – Payload

-       c47abdb1651f9f6d96d34313872e68fb132f39f5 - SHA1 File Hash – Payload

-       4abfaeadcd5ab5f2c3acfac6454d1176 - MD5 File Hash - Payload

-       fconnect.s3.amazonaws[.]com – Hostname – C2 endpoint

-       fconnect.s3.amazonaws[.]com/mnQDqysNrlg – URL - Payload

-       15.188.246[.]198 – IP address – C2 endpoint

-       15.188.246[.]198/4l4md4r.sh?grep – URL – Payload

-       185.193.125[.]65 – IP address – C2 endpoint

-       185.193.125[.]65/c4qDsztEW6/TIGHT_UNIVERSITY – URL – C2 endpoint

-       d8d6fe1a268374088fb6a5dc7e5cbb54 – MD5 File Hash – Payload

-       64.52.80[.]21 – IP address – C2 endpoint

-       0d8da2d1.digimg[.]store – Hostname – C2 endpoint

-       134.209.107[.]209 – IP address – C2 endpoint

Darktrace Model Detections

-       Compromise / High Priority Tunnelling to Bin Services (Enhanced Monitoring Model)

-       Compromise / Possible Tunnelling to Bin Services

-       Anomalous Server Activity / New User Agent from Internet Facing System

-       Compliance / Pastebin

-       Device / Internet Facing Device with High Priority Alert

-       Anomalous Connection / Callback on Web Facing Device

-       Anomalous File / Script from Rare External Location

-       Anomalous File / Incoming ELF File

-       Device / Suspicious Domain

-       Device / New User Agent

-       Anomalous Connection / Multiple Connections to New External TCP Port

-       Anomalous Connection / New User Agent to IP Without Hostname

-       Anomalous File / EXE from Rare External Location

-       Anomalous File / Internet Facing System File Download

-       Anomalous File / Multiple EXE from Rare External Locations

-       Compromise / Suspicious HTTP and Anomalous Activity

-       Device / Attack and Recon Tools

-       Device / Initial Attack Chain Activity

-       Device / Large Number of Model Alerts

-       Device / Large Number of Model Alerts from Critical Network Device

References

1.     https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US

2.     https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability

3.     https://www.wiz.io/blog/ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428

4.     https://www.darktrace.com/blog/the-unknown-unknowns-post-exploitation-activities-of-ivanti-cs-ps-appliances

5.     https://www.virustotal.com/gui/file/ac91c2c777c9e8638ec1628a199e396907fbb7dcf9c430ca712ec64a6f1fcbc9/community

6.     https://www.virustotal.com/gui/file/f3e0147d359f217e2aa0a3060d166f12e68314da84a4ecb5cb205bd711c71998/community

7.     https://www.virustotal.com/gui/ip-address/15.188.246.198

8.     https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures

9.     https://www.darktrace.com/blog/tracking-cve-2025-31324-darktraces-detection-of-sap-netweaver-exploitation-before-and-after-disclosure

10.  https://www.synacktiv.com/en/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises

The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.

Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein.

Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.

Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.

The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content without notice.

Continue reading
About the author
Nahisha Nobregas
SOC Analyst

Blog

/

/

August 7, 2025

How CDR & Automated Forensics Transform Cloud Incident Response

cloud security investigation guy on computer doing workDefault blog imageDefault blog image

Introduction: Cloud investigations

In cloud security, speed, automation and clarity are everything. However, for many SOC teams, responding to incidents in the cloud is often very difficult especially when attackers move fast, infrastructure is ephemeral, and forensic skills are scarce.

In this blog we will walk through an example that shows exactly how Darktrace Cloud Detection and Response (CDR) and automated cloud forensics together, solve these challenges, automating cloud detection, and deep forensic investigation in a way that’s fast, scalable, and deeply insightful.

The Problem: Cloud incidents are hard to investigate

Security teams often face three major hurdles when investigating cloud detections:

Lack of forensic expertise: Most SOCs and security teams aren’t natively staffed with forensics specialists.

Ephemeral infrastructure: Cloud assets spin up and down quickly, leaving little time to capture evidence.

Lack of existing automation: Gathering forensic-level data often requires manual effort and leaves teams scrambling around during incidents — accessing logs, snapshots, and system states before they disappear. This process is slow and often blocked by permissions, tooling gaps, or lack of visibility.

How Darktrace augments cloud investigations

1. Darktrace’s CDR finds anomalous activity in the cloud

An alert is generated for a large outbound data transfer from an externally facing EC2 instance to a rare external endpoint. It’s anomalous, unexpected, and potentially serious.

2. AI-led investigation stitches together the incident for a SOC analyst to look into

When a security incident unfolds, Darktrace’s Cyber AI Analyst TM is the first to surface it, automatically correlating behaviors, surfacing anomalies, and presenting a cohesive incident summary. It’s fast, detailed, and invaluable.

Once the incident is created, more questions are raised.

  • How were the impacted resources compromised?
  • How did the attack unfold over time – what tools and malware were used?
  • What data was accessed and exfiltrated?

What you’ll see as a SOC analyst: The incident begins in Darktrace’s Threat Visualizer, where a Cyber AI Analyst incident has been generated automatically highlighting large anomalous data transfer to a suspicious external IP. This isn’t just another alert, it’s a high-fidelity signal backed by Darktrace’s Self-Learning AI.

Cyber AI Analyst incident created for anomalous outbound data transfer
Figure 1: Cyber AI Analyst incident created for anomalous outbound data transfer

The analyst can then immediately pivot to Darktrace / CLOUD’s architecture view (see below), gaining context on the asset’s environment, ingress/egress points, connected systems, potential attack paths and whether there are any current misconfigurations detected on the asset.

Darktrace / CLOUD architecture view providing critical cloud context
Figure 2: Darktrace / CLOUD architecture view providing critical cloud context

3. Automated forensic capture — No expertise required

Then comes the game-changer, Darktrace’s recent acquisition of Cado enhances its cloud forensics capabilities. From the first alert triggered, Darktrace has already kicked in and automatically processed and analyzed a full volume capture of the EC2. Everything, past and present, is preserved. No need for manual snapshots, CLI commands, or specialist intervention.

Darktrace then provides a clear timeline highlighting the evidence and preserving it. In our example we identify:

  • A brute-force attempt on a file management app, followed by a successful login
  • A reverse shell used to gain unauthorized remote access to the EC2
  • A reverse TCP connection to the same suspicious IP flagged by Darktrace
  • Attacker commands showing how the data was split and prepared for exfiltration
  • A file (a.tar) created from two sensitive archives: product_plans.zip and research_data.zip

All of this is surfaced through the timeline view, ranked by significance using machine learning. The analyst can pivot through time, correlate events, and build a complete picture of the attack — without needing cloud forensics expertise.

Darktrace even gives the ability to:

  • Download and inspect gathered files in full detail, enabling teams to verify exactly what data was accessed or exfiltrated.
  • Interact with the file system as if it were live, allowing investigators to explore directories, uncover hidden artifacts, and understand attacker movement with precision.
Figure 3 Cado critical forensic investigation automated insights
Figure 3: Cado critical forensic investigation automated insights
Figure 4: Cado forensic file analysis of reverse shell and download option
Figure 5: a.tar created from two sensitive archives: product_plans.zip and research_data.zip
Figure 6: Traverse the full file system of the asset

Why this matters?

This workflow solves the hardest parts of cloud investigation:

  1. Capturing evidence before it disappears
  2. Understanding attacker behavior in detail - automatically
  3. Linking detections to impact with full incident visibility

This kind of insight is invaluable for organizations especially regulated industries, where knowing exactly what data was affected is critical for compliance and reporting. It’s also a powerful tool for detecting insider threats, not just external attackers.

Darktrace / CLOUD and Cado together acts as a force multiplier helping with:

  • Reducing investigation time from hours to minutes
  • Preserving ephemeral evidence automatically
  • Empowering analysts with forensic-level visibility

Cloud threats aren’t slowing down. Your response shouldn’t either. Darktrace / CLOUD + Cado gives your SOC the tools to detect, contain, and investigate cloud incidents — automatically, accurately, and at scale.

[related-resource]

Continue reading
About the author
Adam Stevens
Director of Product, Cloud Security
Your data. Our AI.
Elevate your network security with Darktrace AI