Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Share
21
Sep 2020
Cyber AI was recently deployed at a government organization in the EMEA region, where it was protecting over 10,000 devices by learning a sense of ‘self’ for each unique device in order to detect anomalous behavior. Just a week into the Darktrace trial, the AI detected a device which had been infected with malware beaconing to C2 endpoints via HTTP and SSL before downloading a suspicious file.
The attackers were using a strain of Glupteba malware in an attempt to steal sensitive information from browsers such as passwords and credit card information, as well as email account credentials. Given that this was a government agency, the consequences had the attackers been able to gain access to an employees’ account credentials could have been severe.
Darktrace’s Autonomous Response technology, Antigena, would have taken action to contain the threatening behavior, enforcing the device’s ‘pattern of life’ for five minutes and escalating its response as the severity of the threat escalated.
The attack occurred over the course of an hour on a Sunday, meaning the security team’s response time was likely slower than it would have been during a weekday.
Figure 1: A timeline of events
Details of the attack
Darktrace detected a device initiating encrypted connections to an external domain never seen before across the organization. The device had likely been infected before Darktrace was deployed, most likely through a malicious email attachment or link.
Newer strains of Glupteba also use malvertising which directs the user to a rare endpoint and forces an anomalous file download.
Darktrace’s AI detected the device downloading an executable file, atx777.exe, which appears to be associated with the stealer Taurus, accredited to the cyber-criminal group ‘Predator the Thief’.
Following this file download, the device initiated further encrypted connections to suspicious endpoints over unusual communication channels. At the same time, the device downloaded another executable file from a domain with an unusual user agent, ‘CertUtil URL Agent’.
A stealthy stealer
Malicious actors are using more sophisticated techniques to avoid traditional security tools. The Glupteba malware framework, which has seen a resurgence over the past few months, utilizes several evasion techniques, including sandbox detection.
Shortly after the payload is dropped, the malware examines the environment where it has been installed and will not execute any further processes if it detects the host machine is a sandbox. The malware is able to further conceal itself by excluding Glupteba files from Windows Defender, altering Firewall rules to allow command and control traffic, and by ‘Living off the Land,’ using tools preinstalled on the device such as CertUtil.
Despite these attempts at evasion, Darktrace’s Cyber AI easily detected the suspicious activity, which fell outside the ‘pattern of life’ for the device and the wider organization. Darktrace identified the activity as suspicious at the first stages of the attack, and the Cyber AI Analyst investigated the incident in full, revealing some crucial metrics, including the endpoints contacted.
Figure 2: AI Analyst’s detection and summary of the command and control traffic
Antigena responds
In this case, the malware had been installed on the device before Darktrace started monitoring the environment, however had Antigena been active it would have taken a precise response at every stage of the attack. At the beginning of the attack, Antigena would have blocked connections to the suspicious domain, zvwxstarserver17km[.]xyz for two hours, preventing any additional malicious downloads.
As the activity escalated, Antigena would have enforced a ‘pattern of life’ on the infected device and stopped any malicious command and control communications by blocking all outgoing traffic for one hour.
Concluding thoughts
As the race between cyber-criminals and security analysts continues, malware authors are employing increasingly sophisticated techniques to avoid detection. Although the Taurus stealer utilizes a number of these evasion techniques, Darktrace’s AI technology was able to not only alert and act on the malicious activity without disrupting business continuity, but did so despite the malware already being present on a device before the customer began leveraging Darktrace for cyber defense.
Had Antigena been deployed in active mode during this incident, it would have stopped the malware in its tracks at the initial stages, preventing any sensitive data from being removed from the government network. Critically, Antigena updated and escalated its actions in light of the evolving activity, and yet was still precise enough to ensure normal business operations were allowed to continue.
Despite Antigena being in passive mode, this case study demonstrates the power of Autonomous Response in intelligently acting to stop cyber-threats when human security resources are limited, or when the team is out of office. As both public and private organizations continue to be targeted with ransomware and other fast and stealthy threats, the need for Autonomous Response is greater than ever.
Thanks to Darktrace analyst Tom Priest for his insights on the above threat find.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Darktrace Named the Only 2025 Gartner® Peer Insights™ Customers’ Choice for Network Detection and Response
Darktrace: The only Customers’ Choice for NDR in 2025
In a year defined by rapid change across the threat landscape, recognition from those who use and rely on security technology every day means the most.
That’s why we’re proud to share that Darktrace has been named the only Customers’ Choice in the 2025 Gartner® Peer Insights™ Voice of the Customer for Network Detection and Response (NDR).
Out of 11 leading NDR vendors evaluated, Darktrace stood alone as the sole Customers’ Choice, a recognition that we feel reflects not just our innovation, but the trust and satisfaction of the customers who secure their networks with Darktrace every day.
What the Gartner® Peer Insights™ Voice of the Customer means
“Voice of the Customer” is a document that synthesizes Gartner Peer Insights reviews into insights for buyers of technology and services. This aggregated peer perspective, along with the individual detailed reviews, is complementary to Gartner expert research and can play a key role in your buying process. Peers are verified reviewers of a technology product or service, who not only rate the offering, but also provide valuable feedback to consider before making a purchase decision. Vendors placed in the upper-right “Customers’ Choice” quadrant of the “Voice of the Customer” have scores that meet or exceed the market average for both axes (User Interest and Adoption, and Overall Experience).It’s not just a rating. We feel it’s a reflection of genuine customer sentiment and success in the field.
In our view, Customers consistently highlight Darktrace’s ability to:
Detect and respond to unknown threats in real time
Deliver unmatched visibility across IT, OT, and cloud environments
Automate investigations and responses through AI-driven insights
We believe this recognition reinforces what our customers already know: that Darktrace helps them see, understand, and stop attacks others miss.
A rare double: recognized by customers and analysts alike
This distinction follows another major recogniton. Darktrace’s placement as a Leader in the Gartner® Magic Quadrant™ for Network Detection and Response earlier this year.
That makes Darktrace the only vendor to achieve both:
A Leader status in the Gartner Magic Quadrant for NDR, and
A Customers’ Choice in Gartner Peer Insights 2025
It’s a rare double that we feel reflects both industry leadership and customer trust, two perspectives that, together, define what great cybersecurity looks like.
A Customers’ Choice across the network and the inbox
To us, this recognition also builds on Darktrace’s momentum across multiple domains. Earlier this year, Darktrace was also named a Customers’ Choice for Email Security Platforms in the Gartner® Peer Insights™ report.
With more than 1,000 verified reviews across Network Detection and Response, Email Security Platforms, and Cyber Physical Systems (CPS), we at Darktrace are proud to be trusted across the full attack surface, from the inbox to the industrial network.
Thank you to our customers
We’re deeply grateful to every customer who shared their experience with Darktrace on Gartner Peer Insights. Your insights drive our innovation and continue to shape how we protect complex, dynamic environments across the world.
Gartner® Peer Insights™ content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
Magic Quadrant and Peer Insights are registered trademarks of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.
Gartner, Voice of the Customer for Network Detection and Response, By Peer Community Contributor, 30 October 2025
Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace
What is DragonForce?
DragonForce is a Ransomware-as-a-Service (RaaS) platform that emerged in late 2023, offering broad-scale capabilities and infrastructure to threat actors. Recently, DragonForce has been linked to attacks targeting the UK retail sector, resulting in several high-profile cases [1][2]. Moreover, the group launched an affiliate program offering a revenue share of roughly 20%, significantly lower than commissions reported across other RaaS platforms [3].
This Darktrace case study examines a DragonForce-linked RaaS infection within the manufacturing industry. The earliest signs of compromise were observed during working hours in August 2025, where an infected device started performing network scans and attempted to brute-force administrative credentials. After eight days of inactivity, threat actors returned and multiple devices began encrypting files via the SMB protocol using a DragonForce-associated file extension. Ransom notes referencing the group were also dropped, suggesting the threat actor is claiming affiliation with DragonForce, though this has not been confirmed.
Despite Darktrace’s detection of the attack in its early stages, the customer’s deployment did not have Darktrace’s Autonomous Response capability configured, allowing the threat to progress to data exfiltration and file encryption.
Darktrace's Observations
While the initial access vector was not clearly defined in this case study, it was likely achieved through common methods previously employed out by DragonForce affiliates. These include phishing emails leveraging social engineering tactics, exploitation of public-facing applications with known vulnerabilities, web shells, and/or the abuse of remote management tools.
Darktrace’s analysis identified internal devices performing internal network scanning, brute-forcing credentials, and executing unusual Windows Registry operations. Notably, Windows Registry events involving "Schedule\Taskcache\Tasks" contain subkeys for individual tasks, storing GUIDs that can be used to locate and analyze scheduled tasks. Additionally, Control\WMI\Security holds security descriptors for WMI providers and Event Tracing loggers that use non-default security settings respectively.
Furthermore, Darktrace identified data exfiltration activity over SSH, including connections to an ASN associated with a malicious hosting service geolocated in Russia.
1. Network Scan & Brute Force
Darktrace identified anomalous behavior in late August to early September 2025, originating from a source device engaging in internal network scanning followed by brute-force attempts targeting administrator credential, including “administrator”, “Admin”, “rdpadmin”, “ftpadmin”.
Upon further analysis, one of the HTTP connections seen in this activity revealed the use of the user agent string “OpenVAS-VT”, suggesting that the device was using the OpenVAS vulnerability scanner. Subsequently, additional devices began exhibiting network scanning behavior. During this phase, a file named “delete.me” was deleted by multiple devices using SMB protocol. This file is commonly associated with network scanning and penetration testing tool NetScan.
2. Windows Registry Key Update
Following the scanning phase, Darktrace observed the initial device then performing suspicious Winreg operations. This included the use of the ”BaseRegOpenKey” function across multiple registry paths.
Additional operations such as “BaseRegOpenKey” and “BaseRegQueryValue” were also seen around this time. These operations are typically used to retrieve specific registry key values and allow write operations to registry keys.
The registry keys observed included “SYSTEM\CurrentControlSet\Control\WMI\Security” and “Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks”. These keys can be leveraged by malicious actors to update WMI access controls and schedule malicious tasks, respectively, both of which are common techniques for establishing persistence within a compromised system.
3. New Administrator Credential Usage
Darktrace subsequently detected the device using a highly privileged credential, “administrator”, via a successful Kerberos login for the first time. Shortly after, the same credential was used again for a successful SMB session.
These marked the first instances of authentication using the “administrator” credential across the customer’s environment, suggesting potential malicious use of the credential following the earlier brute-force activity.
Figure 1: Darktrace’s detection of administrator credentials being used in Kerberos login events by an infected device.
Figure 2: Darktrace’s detection of administrator credentials being used in SMB sessions by an infected device.
4. Data Exfiltration
Prior to ransomware deployment, several infected devices were observed exfiltrating data to the malicious IP 45.135.232[.]229 via SSH connections [7][8]. This was followed by the device downloading data from other internal devices and transferring an unusually large volume of data to the same external endpoint.
The IP address was first seen on the network on September 2, 2025 - the same date as the observed data exfiltration activity preceding ransomware deployment and encryption.
Further analysis revealed that the endpoint was geolocated in Russia and registered to the malicious hosting provider Proton66. Multiple external researchers have reported malicious activity involving the same Proton66 ASN (AS198953 Proton66 OOO) as far back as April 2025. These activities notably included vulnerability scanning, exploitation attempts, and phishing campaigns, which ultimately led to malware [4][5][6].
Data Exfiltration Endpoint details.
Endpoint: 45.135.232[.]229
ASN: AS198953 Proton66 OOO
Transport protocol: TCP
Application protocol: SSH
Destination port: 22
Figure 3: Darktrace’s summary of the external IP 45.135.232[.]229, first detected on September 2, 2025. The right-hand side showcases model alerts triggered related to this endpoint including multiple data exfiltration related model alerts.
Further investigation into the endpoint using open-source intelligence (OSINT) revealed that it led to a Microsoft Internet Information Services (IIS) Manager console webpage. This interface is typically used to configure and manage web servers. However, threat actors have been known to exploit similar setups, using fake certificate warnings to trick users into downloading malware, or deploying malicious IIS modules to steal credentials.
Figure 4: Live screenshot of the destination (45.135.232[.]229), captured via OSINT sources, displaying a Microsoft IIS Manager console webpage.
5. Ransomware Encryption & Ransom Note
Multiple devices were later observed connecting to internal devices via SMB and performing a range of actions indicative of file encryption. This suspicious activity prompted Darktrace’s Cyber AI Analyst to launch an autonomous investigation, during which it pieced together associated activity and provided concrete timestamps of events for the customer’s visibility.
During this activity, several devices were seen writing a file named “readme.txt” to multiple locations, including network-accessible webroot paths such as inetpub\ and wwwroot\. This “readme.txt” file, later confirmed to be the ransom note, claimed the threat actors were affiliated with DragonForce.
At the same time, devices were seen performing SMB Move, Write and ReadWrite actions involving files with the “.df_win” extension across other internal devices, suggesting that file encryption was actively occurring.
Figure 5: Darktrace’s detection of SMB events (excluding Read events) where the device was seen moving or writing files with the “.df_win” extension.
Figure 6: Darktrace’s detection of a spike in SMB Write events with the filename “readme.txt” on September 9, indicating the start of file encryption.
Conclusion
The rise of Ransomware-as-a-Service (RaaS) and increased attacker customization is fragmenting tactics, techniques, and procedures (TTPs), making it increasingly difficult for security teams to prepare for and defend against each unique intrusion. RaaS providers like DragonForce further complicate this challenge by enabling a wide range of affiliates, each with varying levels of sophistication [9].
In this instance, Darktrace was able to identify several stages of the attack kill chain, including network scanning, the first-time use of privileged credentials, data exfiltration, and ultimately ransomware encryption. Had the customer enabled Darktrace’s Autonomous Response capability, it would have taken timely action to interrupt the attack in its early stages, preventing the eventual data exfiltration and ransomware detonation.
Credit to Justin Torres, Senior Cyber Analyst, Nathaniel Jones, VP, Security & AI Strategy, FCISO, & Emma Foulger, Global Threat Research Operations Lead.
Darktrace Cyber AI Analyst Coverage/Investigation Events:
· Web Application Vulnerability Scanning of Multiple Devices
· Port Scanning
· Large Volume of SMB Login Failures
· Unusual RDP Connections
· Widespread Web Application Vulnerability Scanning
· Unusual SSH Connections
· Unusual Repeated Connections
· Possible Application Layer Reconnaissance Activity
· Unusual Administrative Connections
· Suspicious Remote WMI Activity
· Extensive Unusual Administrative Connections
· Suspicious Directory Replication Service Activity
· Scanning of Multiple Devices
· Unusual External Data Transfer
· SMB Write of Suspicious File
· Suspicious Remote Service Control Activity
· Access of Probable Unencrypted Password Files
· Internal Download and External Upload
· Possible Encryption of Files over SMB
· SMB Writes of Suspicious Files to Multiple Devices
The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.
Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.
Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.
The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content.
![Darktrace’s summary of the external IP 45.135.232[.]229, first detected on September 2, 2025. The right-hand side showcases model alerts triggered related to this endpoint including multiple data exfiltration related model alerts.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/690baa3e2f4def9f29b1ecae_Screenshot%202025-11-05%20at%2011.48.57%E2%80%AFAM.png)
![Live screenshot of the destination (45.135.232[.]229), captured via OSINT sources, displaying a Microsoft IIS Manager console webpage.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/690baa68a5b7b13fba715069_Screenshot%202025-11-05%20at%2011.49.52%E2%80%AFAM.png)
