Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Narinder Bains
Infrastructure Manager, National Farmers' Union (Guest Contributor)
Share
12
Sep 2022
The National Farmers' Union (NFU) is the largest farmers’ organization in England and Wales, representing more than 46,000 farming businesses and over 80,000 members. We champion farmers across the country and represent them in Europe, negotiating with governments and other organizations from our Brussels office.
Despite the wide scope of our operations, our IT team consists of only 15 individuals. Because of this, we began looking for a security solution which could bolster our small team and its capacity to monitor our organization without complicating our security efforts.
Revealing NFU’s Environment with AI
We were satisfied that our firewalls and other older security tools were doing all that they could to protect our perimeter security. These tools could be working perfectly, but we would still lack the ability to know whether attacks were unfolding under the radar within our network. In other words, we needed visibility when there were already hackers inside.
Even with the best perimeter protection we could buy, this remained a blind spot, and the numerous high-profile stories in the news regarding successful ransomware attacks over last few years left the team increasingly on edge.
We also knew that attackers weren’t just probing in one area – we needed coverage over our entire digital estate, including our endpoint devices and Microsoft 365 activity. These were the areas that were the most difficult to get visibility over, but also the newest parts of our digital estate and the most vulnerable to attacks.
When we were introduced to Darktrace, we quickly saw its potential: the visibility it gave us across our digital estate was unparalleled, and its Autonomous Response technology was something we knew could be a huge benefit for NFU.
Previously, we’d lost hours sifting through data in an attempt to respond to attacks, and that’s only after dealing with numerous emails and false positives from our old security solutions. Once Darktrace was implemented, it covered everything, allowing us to view our entire organization from a single platform, and it dealt with threats 24/7 without requiring any input from us.
Taking action on a pre-infected endpoint
NFU’s adoption of hybrid working brought the importance of endpoint security to the forefront of our team’s minds. The dispersion of company devices across the country made it harder than ever for the team to monitor logs with their existing manpower, and we were constantly worried that an employee at home – whether or not they were connected to the company VPN – might inadvertently open us up to an attack like ransomware.
Because it bases its detection on an understanding of the digital estate’s ‘normal’ behaviors, we hadn’t expected that Darktrace would be able to spot threats in pre-infected environments. As soon as we deployed Darktrace/Endpoint, however, it spotted a user trying to make root level changes to one of our servers from a company laptop without permission, and immediately blocked the activity while allowing the user to continue legitimate business operations. Its ability to differentiate between benign and risky activity was impressive.
A straightforward threat summary delivered to our security team allowed us to understand the situation quickly and easily. Seeing this technology not only spotting dangerous activity, but quickly taking the necessary steps to stop it and strengthen our security posture in its wake, has really given us that extra peace of mind.
Enhancing existing tools with AI
Adding something to your security stack can often mean taking one step forward and two steps back, as the incorporation of a new solution can damage the ability of an old one. For example, creating two VPNs: while it seems like it might provide greater security, the two networks often disrupt one another and only make protection more difficult.
Darktrace, however, augments existing endpoint solutions, utilizing the data they gather in its investigations. By implementing the technology, we weren’t replacing our existing security tools but enhancing them. The way we see it, the greater the depth and breadth of information we feed into Darktrace’s AI, the greater its understanding and the better its decision-making; ultimately, the better it can protect our organization.
In addition to our endpoint devices, Darktrace now works across our Microsoft 365 environments and the network. It uses data from all three areas to draw conclusions about emerging threats and can take action against attacks wherever and whenever they emerge in the digital environment. Knowing this allows us to finally feel confident in our security posture, and to focus our efforts on the rest of our business operations.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Narinder Bains
Infrastructure Manager, National Farmers' Union (Guest Contributor)
ClearFake: From Fake CAPTCHAs to Blockchain-Driven Payload Retrieval
Darktrace detected a potential ClearFake‑related incident involving signs of EtherHiding activity and interactions with blockchain‑based infrastructure. A single device showed repeated suspicious command‑line behavior, primarily involving Microsoft HTML Application Host. The activity occurred over the course of a day and indicated early‑stage attempts to load malicious content associated with the ClearFake campaign.
Darktrace Advances Incident Investigation and AI-Agent Security with OpenAI Daybreak Models
Earlier this year, Darktrace joined OpenAI’s Daybreak Defense Network to explore how their cyber capabilities can be integrated within Darktrace products and services to transform how security teams move from signal to action.
At the heart of this work is Darktrace's behavioral understanding of customer environments and identification of complex security incidents, combined with OpenAI models that can add context to help explain why an incident matters and its potential impact on the business. By bringing these capabilities into defensive workflows security teams already use, the goal is to give defenders not just greater visibility, but the context and guidance they need to act with confidence.
Since joining the program, we've been working with OpenAI to explore how these capabilities can address specific security challenges for defenders.
The problem we're solving
Attackers continue to change how they operate, including by using AI to increase the speed and scale of some techniques. Security teams are already managing a large volume of alerts, and the question isn't just what's happening, but how it could affect the organization. Even when an incident is fully investigated and correlated, technical severity alone doesn't tell a security team how much it actually matters to the business. That same challenge extends to internal AI adoption. As organizations adopt more AI systems and agents, security teams need visibility into their behavior, access and activity, along with the broader business context needed to identify and investigate potential risk.
Darktrace's Adaptive AI™ builds a detailed, organization-specific picture of what's normal for each environment, and uses that picture to investigate threats and identify complex security activity across domains. OpenAI's models can build on Darktrace's correlated, technically prioritized incidents by adding context that can help defenders understand what may be at stake.
What we're building
Our work is focused on two areas: supporting security investigation and response, and helping defenders identify risky behavior across enterprise AI systems and agents.
The first aligns Darktrace's behavioral understanding with OpenAI models to support security investigation and prioritization. Darktrace's Adaptive AI continuously learns the unique patterns of normal behavior within each customer it protects, creating a deep, organization-specific understanding of its digital estate. When unusual activity emerges, OpenAI's models can draw on that context to help analysts investigate the incident, understand its significance and assess potential business consequences — reducing the need to manually assemble context from fragmented signals.
Second, we are exploring how these capabilities can support AI-agent and runtime security through Darktrace / SECURE AI™. OpenAI’s Daybreak models can build on the detections and visibility Darktrace / SECURE AI provides, connecting signals across a customer's environment and help defenders identify potentially risky behavior involving AI systems and agents. Activity that might appear isolated can instead be connected with related signals, helping defenders investigate the broader context and determine appropriate remediation.
Darktrace brings deep cybersecurity expertise, an evolving understanding of each customer's environment, and AI-driven identification of threats across the digital estate. Through the Daybreak Defense Network, Darktrace is exploring how OpenAI models can augment those capabilities in defensive security workflows — supporting incident investigation and response and improving visibility into AI-agent and runtime risk.
These capabilities are still in development, and we're excited to continue building on this work.
To learn more about how Darktrace continues to innovate to meet today's most pressing security challenges, register for our upcoming launch broadcast here.
Botnet Behind the Camera: Mirai Katana Activity on a Video Recording Device
Key takeaways
Darktrace identified a camera device infected with the Mirai/Katana botnet in a sports-sector customer environment, showing how exposed IoT devices can become active participants in wider attack chains.
The compromise involved suspicious Wget behavior, file downloads from rare external IPs, unusual incoming HTTP connections to video recorder management interfaces, and large outbound data transfers to infrastructure associated with botnet activity.
The incident highlights the importance of extending visibility and response beyond traditional endpoints, as unmanaged or overlooked connected devices can be exploited for command-and-control, malware delivery, and data exfiltration.
Mirai and the Katana variant
Mirai is a botnet that first emerged in August 2016 and is well known for launching large-scale distributed-denial-of-service (DDoS) attacks, typically targeting exposed Internet of Things (IoT) devices. It identifies vulnerable IoT devices ,often by abusing default credentials or exposed services, and recruiting them into a remotely controlled botnet that can be used in DDoS campaigns [1].
Katana, one of the many variants that arose after Mirai’s source code was released publicly, was first observed in late 2020 and has been seen using more advanced capabilities, including custom command-and-control (C2), persistence mechanisms, and DDoS functionality [2].
In March 2026, research from the Nokia Deepfield Emergency Response Team (ERT) identified Katana as a Mirai-derived DDoS botnet targeting Android-based TV set-top boxes through exposed Android Debug Bridge (ADB) access. Observed capabilities included custom C2, runtime domain rotation, multiple DDoS methods, and an on-device compiled kernel rootkit used for persistence and stealth [3].
Darktrace’s detection of Mirai Botnet activity on a camera device
In early 2026, Darktrace identified a Network/Digital Video Recorder (NVR/DVR) on the network of a sports-sector customer that had been infected with the Mirai Katana botnet and subsequently used to exfiltrate data from the customer’s environment. Seemingly related follow-up activity was observed on the same device several months later.
In both instances, the Darktrace Security Operations Centre (SOC) alerted the customer as part of the Managed Threat Detection (MTD) service. However, as Darktrace’s Autonomous Response capability was not fully enabled on the affected device, Darktrace was unable to proactively block the suspicious activity or prevent the compromise from continuing and recurring.
The initial compromise appears to have occurred when the affected device was seen using Wget to download Linux-based Executable and Linkable Format (ELF) files from a rare external IP, 195.177.94[.]105, which had not previously been observed in the customer’s network. Further analysis downloaded file hashes identified files related to the Mirai botnet.
Figure 1: Darktrace’s Real-Time AI Analyst investigation into the unusual outbound connection where the ELF files were downloaded.
Within a few hours, Darktrace detected the device uploading close to 3GB of data to another external IP, 50.7.49[.]4:3017 (ASN AS30058 FDCSERVERS), suggesting that the activity was likely routed via a virtual private server (VPS) hosted by FDC Servers [2]. Attackers often abuse VPS infrastructure from legitimate cloud providers to blend in with legitimate traffic and evade IP reputation and geolocation-based detections.
Figure 2: Darktrace’s detection of the unusual data upload activity by the affected camera device.
Darktrace continued to observe similar data transfers to multiple rare endpoints including 171.225.223[.]53, 95.161.128[.]62, 61.7.209[.]88, 95.161.128[.]62, which have been linked to Mirai by open-source intelligence (OSINT).
Figure 3: Darktrace’s detection of spikes in unusual external data transfer activity from the camera device.
Exploitation continued
Several months later, Darktrace identified the same exfiltration pattern on the device again, this time with stronger indications of associations with Mirai Katana botnet infection.
The device received incoming HTTP connections from 129.121.114[.]124, an external IP known to be associated with the Katana botnet IP [3]. The connections targeted the ‘/dvr/cmd’ path using the root username and user agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246.
The ‘/dvr/cmd’ path appears to be associated with the affected device’s web management functionality. This API endpoint has historically been targeted by Mirai and other IoT botnets through the exploitation of critical command injection vulnerabilities and automated botnet exploitation [4].
Figure 4: Darktrace’s detection of HTTP connectivity from the external IP associated with Mirai Katana Botnet.
A few days later, Darktrace observed the Wget utility being used to download ELF files, including “/lil”, from the IP 129.121.114[.]124. OSINT reporting has since associated this IP address with the Mirai Katana botnet. Notably, the IP observed earlier in the year, 195.177.94[.]105, had also hosted a file named “lil”, indicating a link between the observed activity.
Over the following days, the device received a sudden spike in connections from multiple rare external endpoints, suggesting a possible successful brute force attack. Darktrace also observed the device exfiltrating just under 4GB of data to another Mirai-associated IP address, 66.92.198[.]194, over ports 3344, 954922, and 80. Finally, the device was seen uploading data to the Mirai botnet IP 5.175.249[.]53 over port138 and exhibited an increase in UDP connections to 34.18.28[.]10 over port 9068.
Following both file download events, Darktrace identified spikes in external data transfers and connection attempts to rare destinations. While Darktrace’s Threat Research team could not confirm with high confidence that this to activity was directly associated with Mirai, it may indicate that Mirai Katana includes data exfiltration functionality.
Darktrace’s threat researchers also identified an internet-facing NTP server belonging to a separate customer receiving incoming connection attempts from the same initially observed IP, 195.177.94[.]105,over the port 123. This suggests that Mirai Katana may not exclusively target IoT devices.
Conclusion
This case demonstrates how threat actors can exploit overlooked IoT and OT devices to support broader malicious objectives. Here, a camera device infected with a botnet was used to exfiltrate data from the customer's environment, showing how peripheral assets can become active participants in an attack chain.
This case also reinforces a challenge many organizations face today: extending security visibility beyond traditional endpoints and servers. Cameras, sensors, and other connected devices often operate with limited monitoring and may fall outside established security processes, despite maintaining network connectivity and access to potentially sensitive environments. This is particularly relevant in the sports sector, where growing reliance on connected cameras, smart stadium technologies, and other IoT devices continues to expand the attack surface, as highlighted in Darktrace's Sports Sector Threat Report.
As botnets like Kata and Mirai continue to evolve, defenders need visibility across unmanaged IoT and edge devices, as well as security solutions that can recognize subtle deviations in device behavior that may indicate an emerging compromise.
Credit to Parvatha Ananthakannan (Cyber Analyst), Signe Zaharka (Principal Analyst)
Edited by Ryan Traill (Content Manager)
Appendices
Darktrace Model Detections
· Anomalous File / EXE from Rare External Location
· Anomalous File / Multiple EXE from Rare External Locations
· Device / Initial Attack Chain Activity
· Unusual Activity / Unusual External Data to New Endpoint
· Anomalous Connection / Data Sent to Rare Domain
· Unusual Activity / Enhanced Unusual External Data Transfer
· Anomalous Connection / Uncommon 1 GiB Outbound
· Device / Significant UDP Increase
· Anomalous Connection / Low and Slow Exfiltration to IP
· Compromise / Large Number of Suspicious Failed Connections
· Compromise / Large Number of Suspicious Successful Connections
