December 20, 2023

Ivanti Sentry Vulnerability | Analysis & Insights

Darktrace observed a critical vulnerability in Ivanti Sentry's cybersecurity. Learn how this almost become a huge threat and how we stopped it in its tracks.

Written by

Sam Lister

Specialist Security Researcher

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Sam Lister

Specialist Security Researcher

Dec 2023

In an increasingly interconnected digital landscape, the prevalence of critical vulnerabilities in internet-facing systems stands as an open invitation to malicious actors. These vulnerabilities serve as a near limitless resource, granting attackers a continually array of entry points into targeted networks.

In the final week of August 2023, Darktrace observed malicious actors validating exploits for one such critical vulnerability, likely the critical RCE vulnerability, CVE-2023-38035, on Ivanti Sentry servers within multiple customer networks. Shortly after these successful tests were carried out, malicious actors were seen delivering crypto-mining and reconnaissance tools onto vulnerable Ivanti Sentry servers.

Fortunately, Darktrace DETECT™ was able to identify this post-exploitation activity on the compromised servers at the earliest possible stage, allowing the customer security teams to take action against affected devices. In environments where Darktrace RESPOND™ was enabled in autonomous response mode, Darktrace was further able inhibit the identified post-exploitation activity and stop malicious actors from progressing towards their end goals.

Exploitation of Vulnerabilities in Ivanti Products

The software provider, Ivanti, offers a variety of widely used endpoint management, service management, and security solutions. In July and August 2023, the Norwegian cybersecurity company, Mnemonic, disclosed three vulnerabilities in Ivanti products [1]/[2]/[3]; two in Ivanti's endpoint management solution, Ivanti Endpoint Manager Mobile (EPMM) (formerly called 'MobileIron Core'), and one in Ivanti’s security gateway solution, Ivanti Sentry (formerly called 'MobileIron Sentry'):

CVE-2023-35078

CVSS Score: 10.0
Affected Product: Ivanti EPMM
Details from Ivanti: [4]/[5]/[6]
Vulnerability type: Authentication bypass

CVE-2023-35081

CVSS Score: 7.2
Affected Product: Ivanti EPMM
Details from Ivanti: [7]/[8]/[9]
Vulnerability type: Directory traversal

CVE-2023-38035

CVSS Score:
Affected Product: Ivanti Sentry
Details from Ivanti: [10]/[11]/[12]
Vulnerability type: Authentication bypass

At the beginning of August 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) provided details of advanced persistent threat (APT) activity targeting EPMM systems within Norwegian private sector and government networks via exploitation of CVE-2023-35078 combined with suspected exploitation of CVE-2023-35081.

In an article published in August 2023 [12], Ivanti disclosed that a very limited number of their customers had been subjected to exploitation of the Ivanti Sentry vulnerability, CVE-2023-38035, and on the August 22, 2023, CISA added the Ivanti Sentry vulnerability, CVE-2023-38035 to its ‘Known Exploited Vulnerabilities Catalogue’. CVE-2023-38035 is a critical authentication bypass vulnerability affecting the System Manager Portal of Ivanti Sentry systems. The System Manager Portal, which is accessible by default on port 8433, is used for administration of the Ivanti Sentry system. Through exploitation of CVE-2023-38035, an unauthenticated actor with access to the System Manager Portal can achieve Remote Code Execution (RCE) on the underlying Ivanti Sentry system.

Observed Exploitation of CVE-2023-38035

On August 24, Darktrace observed Ivanti Sentry servers within several customer networks receiving successful SSL connections over port 8433 from the external endpoint, 34.77.65[.]112. The usage of port 8433 indicates that the System Manager Portal was accessed over the connections. Immediately after receiving these successful connections, Ivanti Sentry servers made GET requests over port 4444 to 34.77.65[.]112. The unusual string ‘Wget/1.14 (linux-gnu)’ appeared in the User-Agent headers of these requests, indicating that the command-line utility, wget, was abused to initiate the requests.

Figure 1: Event Log data for an Ivanti Sentry system showing the device breaching a range of DETECT models after contacting 34.77.65[.]112.The suspicious behavior highlighted by DETECT was subsequently investigated by Darktrace’s Cyber AI Analyst™, which was able to weave together these separate behaviors into single incidents representing the whole attack chain.

‍

Figure 2: AI Analyst Incident representing a chain of suspicious activities from an Ivanti Sentry server.

In cases where Darktrace RESPOND was enabled in autonomous response mode, RESPOND was able to automatically enforce the Ivanti Sentry server’s normal pattern of life, thus blocking further exploit testing.

Figure 3: Event Log for an Ivanti Sentry server showing the device receiving a RESPOND action immediately after trying to 34.77.65[.]112.

The GET requests to 34.77.65[.]112 were responded to with the following HTML document:

Figure 4: Snapshot of the HTML document returned by 34.77.65[.]112.

None of the links within this HTML document were functional. Furthermore, the devices’ downloads of these HTML documents do not appear to have elicited further malicious activities. These facts suggest that the observed 34.77.65[.]112 activities were representative of a malicious actor validating exploits (likely for CVE-2023-38035) on Ivanti Sentry systems.

Over the next 24 hours, these Ivanti Sentry systems received successful SSL connections over port 8433 from a variety of suspicious external endpoints, such as 122.161.66[.]161. These connections resulted in Ivanti Sentry systems making HTTP GET requests to subdomains of ‘oast[.]site’ and ‘oast[.]live’. Strings containing ‘curl’ appeared in the User-Agent headers of these requests, indicating that the command-line utility, cURL, was abused to initiate the requests.

These ‘oast[.]site’ and ‘oast[.]live’ domains are used by the out-of-band application security testing (OAST) service, Interactsh. Malicious actors are known to abuse this service to carry out out-of-band (OOB) exploit testing. It, therefore, seems likely that these activities were also representative of a malicious actor validating exploits for CVE-2023-38035 on Ivanti Sentry systems.

Figure 5: Event Log for Ivanti Sentry system showing the device contacting an 'oast[.]site' endpoint after receiving connections from the suspicious, external endpoint 122.161.66[.]161.

The actors seen validating exploits for CVE-2023-38035 may have been conducting such activities in preparation for their own subsequent malicious activities. However, given the variety of attack chains which ensued from these exploit validation activities, it is also possible that they were carried out by Initial Access Brokers (IABs) The activities which ensued from exploit validation activities identified by Darktrace fell into two categories: internal network reconnaissance and cryptocurrency mining.

Reconnaissance Activities

In one of the reconnaissance cases, immediately after receiving successful SSL connections over port 8443 from the external endpoints 190.2.131[.]204 and 45.159.248[.]179, an Ivanti Sentry system was seen making a long SSL connection over port 443 to 23.92.29[.]148, and making wget GET requests over port 4444 with the Target URIs '/ncat' and ‘/TxPortMap’ to the external endpoints, 45.86.162[.]147 and 195.123.240[.]183.

Figure 6: Event Log data for an Ivanti Sentry system showing the device making connections to the external endpoints, 45.86.162[.]147, 23.92.29[.]148, and 195.123.240[.]183, immediately after receiving connections from rare external endpoints.

The Ivanti Sentry system then went on to scan for open SMB ports on systems within the internal network. This activity likely resulted from an attacker dropping a port scanning utility on the vulnerable Ivanti Sentry system.

Figure 7: Event Log data for an Ivanti Sentry server showing the device breaching several DETECT models after downloading a port scanning tool from 195.123.240[.]183.

In another reconnaissance case, Darktrace observed multiple wget HTTP requests with Target URIs such as ‘/awp.tar.gz’ and ‘/resp.tar.gz’ to a suspicious, external server (78.128.113[.]130). Shortly after making these requests, the Ivanti Sentry system started to scan for open SMB ports and to respond to LLMNR queries from other internal devices. These behaviors indicate that the server may have installed an LLMNR poisoning tool, such as Responder. The Ivanti Sentry server also went on to conduct further information-gathering activities, such as LDAP reconnaissance, HTTP-based vulnerability scanning, HTTP-based password searching, and RDP port scanning.

Figure 8: Event Log data for an Ivanti Sentry system showing the device making connections to 78.128.113[.]130, scanning for an open SMB port on internal endpoints, and responding to LLMNR queries from internal endpoints.

In cases where Darktrace RESPOND was active, reconnaissance activities resulted in RESPOND enforcing the Ivanti Sentry server’s pattern of life.

Figure 9: Event Log data for an Ivanti Sentry system receiving a RESPOND action as a result of its SMB port scanning activity.

Figure 10: Event Log data for an Ivanti Sentry system receiving a RESPOND action as a result of its LDAP reconnaissance activity.

Crypto-Mining Activities

In one of the cryptomining cases, Darktrace detected an Ivanti Sentry server making SSL connections to aelix[.]xyz and mining pool endpoints after receiving successful SSL connections over port 8443 from the external endpoint, 140.228.24[.]160.

Figure 11: Event Log data for an Ivanti Sentry system showing the device contacting aelix[.]xyz and mining pool endpoints immediately after receiving connections from the external endpoint, 140.228.24[.]160.

In a cryptomining case on another customer’s network, an Ivanti Sentry server was seen making GET requests indicative of Kinsing malware infection. These requests included wget GET requests to 185.122.204[.]197 with the Target URIs ‘/unk.sh’ and ‘/se.sh’ and a combination of GET and POST requests to 185.221.154[.]208 with the User-Agent header ‘Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36’ and the Target URIs, ‘/mg’, ‘/ki’, ‘/get’, ‘/h2’, ‘/ms’, and ‘/mu’. These network-based artefacts have been observed in previous Kinsing infections [13].

Figure 12: Event Log data for an Ivanti Sentry system showing the device displaying likely Kinsing C2 activity.

On customer environments where RESPOND was active, Darktrace was able to take swift autonomous action by blocking cryptomining connection attempts to malicious command-and-control (C2) infrastructure, in this case Kinsing servers.

Figure 13: Event Log data for an Ivanti Sentry server showing the device receiving a RESPOND action after attempting to contact Kinsing C2 infrastructure.

Fortunately, due to Darktrace DETECT+RESPOND prompt identification and targeted actions against these emerging threats, coupled with remediating steps taken by affected customers’ security teams, neither the cryptocurrency mining activities nor the network reconnaissance activities led to significant disruption.

Figure 14: Timeline of observed malicious activities.

Conclusion The inevitable presence of critical vulnerabilities in internet-facing systems underscores the perpetual challenge of defending against malicious intrusions. The near inexhaustible supply of entry routes into organizations’ networks available to malicious actors necessitates a more proactive and vigilant approach to network security.

While it is, of course, essential for organizations to secure their digital environments through the regular patching of software and keeping abreast of developing vulnerabilities that could impact their network, it is equally important to have a safeguard in place to mitigate against attackers who do manage to exploit newly discovered vulnerabilities.

In the case of Ivanti Sentry, Darktrace observed malicious actors validating exploits against affected servers on customer networks just a few days after the public disclosure of the critical vulnerability. This activity was followed up by a variety of malicious and disruptive, activities including cryptocurrency mining and internal network reconnaissance.

Darktrace DETECT immediately detected post-exploitation activities on compromised Ivanti Sentry servers, enabling security teams to intervene at the earliest possible stage. Darktrace RESPOND, when active, autonomously inhibited detected post-exploitation activities. These DETECT detections, along with their accompanying RESPOND interventions, prevented malicious actors from being able to progress further towards their likely harmful objectives.

Credit to Sam Lister, Senior Cyber Analyst, and Trent Kessler, SOC Analyst

‍

Appendices

MITRE ATT&CK Mapping

Initial Access techniques:

Exploit Public-Facing Application (T1190)

Credential Access techniques:

Unsecured Credentials: Credentials In Files (T1552.001)
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)

Discovery

Network Service Discovery (T1046)
Remote System Discovery (T1018)
Account Discovery: Domain Account (T1087.002)

Command and Control techniques:

Application Layer Protocol: Web Protocols (T1071.001)
Ingress Tool Transfer (T1105)
Non-Standard Port (T1571)
Encrypted Channel: Asymmetric Cryptography (T1573.002)

Impact techniques

Resource Hijacking (T1496)

List of IoCs

Exploit testing IoCs:

· 34.77.65[.]112

· Wget/1.14 (linux-gnu)

· cjjovo7mhpt7geo8aqlgxp7ypod6dqaiz.oast[.]site • 178.128.16[.]97

· curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2

· cjk45q1chpqflh938kughtrfzgwiofns3.oast[.]site • 178.128.16[.]97

· curl/7.29.0

Kinsing-related IoCs:

· 185.122.204[.]197

· /unk.sh

· /se.sh

· 185.221.154[.]208

· 45.15.158[.]124

· Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

· /mg

· /ki

· /get

· /h2

· /ms

· /mu

· vocaltube[.]ru • 185.154.53[.]140

· 92.255.110[.]4

· 194.87.254[.]160

Responder-related IoCs:

· 78.128.113[.]130

· 78.128.113[.]34

· /awp.tar.gz

· /ivanty

· /resp.tar.gz

Crypto-miner related IoCs:

· 140.228.24[.]160

· aelix[.]xyz • 104.21.60[.]147 / 172.67.197[.]200

· c8446f59cca2149cb5f56ced4b448c8d (JA3 client fingerprint)

· b5eefe582e146aed29a21747a572e11c (JA3 client fingerprint)

· pool.supportxmr[.]com

· xmr.2miners[.]com

· monerooceans[.]stream

· xmr-eu2.nanopool[.]org

Port scanner-related IoCs:

· 122.161.66[.]161

· 192.241.235[.]32

· 45.86.162[.]147

· /ncat

· Wget/1.14 (linux-gnu)

· 45.159.248[.]179

· 142.93.115[.]146

· 23.92.29[.]148

· /TxPortMap

· 195.123.240.183

· 6935a8d379e086ea1aed159b8abcb0bc8acf220bd1cbc0a84fd806f14014bca7 (SHA256 hash of downloaded file)

Darktrace DETECT Model Breaches

· Anomalous Server Activity / New User Agent from Internet Facing System

· Device / New User Agent

· Anomalous Connection / New User Agent to IP Without Hostname

· Device / New User Agent and New IP

· Anomalous Connection / Application Protocol on Uncommon Port

· Anomalous Connection / Callback on Web Facing Device

· Compromise / High Volume of Connections with Beacon Score

· Compromise / Large Number of Suspicious Failed Connections

· Compromise / High Volume of Connections with Beacon Score

· Compromise / Beacon for 4 Days

· Compromise / Agent Beacon (Short Period)

· Device / Large Number of Model Breaches

· Anomalous Server Activity / Rare External from Server

· Compromise / Large Number of Suspicious Successful Connections

· Compromise / Monero Mining

· Compromise / High Priority Crypto Currency Mining

· Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

· Device / Internet Facing Device with High Priority Alert

· Device / Suspicious SMB Scanning Activity

· Device / Internet Facing Device with High Priority Alert

· Device / Network Scan

· Device / Unusual LDAP Bind and Search Activity

· Compliance / Vulnerable Name Resolution

· Device / Anomalous SMB Followed By Multiple Model Breaches

· Device / New User Agent To Internal Server

· Anomalous Connection / Suspicious HTTP Activity

· Anomalous Connection / Unusual Internal Connections

· Anomalous Connection / Suspicious HTTP Activity

· Device / RDP Scan

· Device / Large Number of Model Breaches

· Compromise / Beaconing Activity To External Rare

· Compromise / Beacon to Young Endpoint

· Anomalous Connection / Suspicious HTTP Activity

· Compromise / Suspicious Internal Use Of Web Protocol

· Anomalous File / EXE from Rare External Location

· Anomalous File / Internet Facing System File Download

· Device / Suspicious SMB Scanning Activity

· Device / Internet Facing Device with High Priority Alert

· Device / Network Scan

· Device / Initial Breach Chain Compromise

References

[1] https://www.mnemonic.io/resources/blog/ivanti-endpoint-manager-mobile-epmm-authentication-bypass-vulnerability/
‍[2] https://www.mnemonic.io/resources/blog/threat-advisory-remote-file-write-vulnerability-in-ivanti-epmm/
‍[3] https://www.mnemonic.io/resources/blog/threat-advisory-remote-code-execution-vulnerability-in-ivanti-sentry/
‍[4] https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
‍[5] https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US
‍[6] https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078?language=en_US
‍[7] https://www.ivanti.com/blog/cve-2023-35081-new-ivanti-epmm-vulnerability
‍[8] https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US
‍[9] https://forums.ivanti.com/s/article/KB-Arbitrary-File-Write-CVE-2023-35081?language=en_US
‍[10] https://www.ivanti.com/blog/cve-2023-38035-vulnerability-affecting-ivanti-sentry
‍[11] https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US
‍[12] https://forums.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035?language=en_US
‍[13] https://isc.sans.edu/diary/Your+Business+Data+and+Machine+Learning+at+Risk+Attacks+Against+Apache+NiFi/29900

Written by

Sam Lister

Specialist Security Researcher

Inside the SOC

Written by

Sam Lister

Specialist Security Researcher

Senior Product Marketing Manager, Email

Watch the NIS2 Webinar

Blog

Email

December 18, 2025

Why organizations are moving to label-free, behavioral DLP for outbound email

Why outbound email DLP needs reinventing

In 2025, the global average cost of a data breach fell slightly — but remains substantial at USD 4.44 million (IBM Cost of a Data Breach Report 2025). The headline figure hides a painful reality: many of these breaches stem not from sophisticated hacks, but from simple human error: mis-sent emails, accidental forwarding, or replying with the wrong attachment. Because outbound email is a common channel for sensitive data leaving an organization, the risk posed by everyday mistakes is enormous.

In 2025, 53% of data breaches involved customer PII, making it the most commonly compromised asset (IBM Cost of a Data Breach Report 2025). This makes “protection at the moment of send” essential. A single unintended disclosure can trigger compliance violations, regulatory scrutiny, and erosion of customer trust –consequences that are disproportionate to the marginal human errors that cause them.

Traditional DLP has long attempted to mitigate these impacts, but it relies heavily on perfect labelling and rigid pattern-matching. In reality, data loss rarely presents itself as a neat, well-structured pattern waiting to be caught – it looks like everyday communication, just slightly out of context.

How data loss actually happens

Most data loss comes from frustratingly familiar scenarios. A mistyped name in auto-complete sends sensitive data to the wrong “Alex.” A user forwards a document to a personal Gmail account “just this once.” Someone shares an attachment with a new or unknown correspondent without realizing how sensitive it is.

Traditional, content-centric DLP rarely catches these moments. Labels are missing or wrong. Regexes break the moment the data shifts formats. And static rules can’t interpret the context that actually matters – the sender-recipient relationship, the communication history, or whether this behavior is typical for the user.

It’s the everyday mistakes that hurt the most. The classic example: the Friday 5:58 p.m. mis-send, when auto-complete selects Martin, a former contractor, instead of Marta in Finance.

What traditional DLP approaches offer (and where gaps remain)

Most email DLP today follows two patterns, each useful but incomplete.

Policy- and label-centric DLP works when labels are correct — but content is often unlabeled or mislabeled, and maintaining classification adds friction. Gaps appear exactly where users move fastest
Rule and signature-based approaches catch known patterns but miss nuance: human error, new workflows, and “unknown unknowns” that don’t match a rule

The takeaway: Protection must combine content + behavior + explainability at send time, without depending on perfect labels.

Your technology primer: The three pillars that make outbound DLP effective

1) Label-free (vs. data classification)

Protects all content, not just what’s labeled. Label-free analysis removes classification overhead and closes gaps from missing or incorrect tags. By evaluating content and context at send time, it also catches misdelivery and other payload-free errors.

No labeling burden; no regex/rule maintenance
Works when tags are missing, wrong, or stale
Detects misdirected sends even when labels look right

2) Behavioral (vs. rules, signatures, threat intelligence)

Understands user behavior, not just static patterns. Behavioral analysis learns what’s normal for each person, surfacing human error and subtle exfiltration that rules can’t. It also incorporates account signals and inbound intel, extending across email and Teams.

Flags risk without predefined rules or IOCs
Catches misdelivery, unusual contacts, personal forwards, odd timing/volume
Blends identity and inbound context across channels

3) Proprietary DSLM (vs. generic LLM)

Optimized for precise, fast, explainable on-send decisions. A DSLM understands email/DLP semantics, avoids generative risks, and stays auditable and privacy-controlled, delivering intelligence reliably without slowing mail flow.

Low-latency, on-send enforcement
Non-generative for predictable, explainable outcomes
Governed model with strong privacy and auditability

The Darktrace approach to DLP

Darktrace / EMAIL – DLP stops misdelivery and sensitive data loss at send time using hold/notify/justify/release actions. It blends behavioral insight with content understanding across 35+ PII categories, protecting both labeled and unlabeled data. Every action is paired with clear explainability: AI narratives show exactly why an email was flagged, supporting analysts and helping end-users learn. Deployment aligns cleanly with existing SOC workflows through mail-flow connectors and optional Microsoft Purview label ingestion, without forcing duplicate policy-building.

Deployment is simple: Microsoft 365 routes outbound mail to Darktrace for real-time, inline decisions without regex or rule-heavy setup.

A buyer’s checklist for DLP solutions

When choosing your DLP solution, you want to be sure that it can deliver precise, explainable protection at the moment it matters – on send – without operational drag.

To finish, we’ve compiled a handy list of questions you can ask before choosing an outbound DLP solution:

Can it operate label free when tags are missing or wrong? 
Does it truly learn per user behavior (no shortcuts)? 
Is there a domain specific model behind the content understanding (not a generic LLM)? 
Does it explain decisions to both analysts and end users? 
Will it integrate with your label program and SOC workflows rather than duplicate them?

For a deep dive into Darktrace’s DLP solution, check out the full solution brief.

[related-resource]

About the author

Carlos Gray

Senior Product Marketing Manager, Email

Blog

Email

December 17, 2025

Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

What is an Adversary-in-the-middle (AiTM) attack?

Adversary-in-the-Middle (AiTM) attacks are a sophisticated technique often paired with phishing campaigns to steal user credentials. Unlike traditional phishing, which multi-factor authentication (MFA) increasingly mitigates, AiTM attacks leverage reverse proxy servers to intercept authentication tokens and session cookies. This allows attackers to bypass MFA entirely and hijack active sessions, stealthily maintaining access without repeated logins.

This blog examines a real-world incident detected during a Darktrace customer trial, highlighting how Darktrace / EMAIL^TM and Darktrace / IDENTITY^TM identified the emerging compromise in a customer’s email and software-as-a-service (SaaS) environment, tracked its progression, and could have intervened at critical moments to contain the threat had Darktrace’s Autonomous Response capability been enabled.

What does an AiTM attack look like?

Inbound phishing email

Attacks typically begin with a phishing email, often originating from the compromised account of a known contact like a vendor or business partner. These emails will often contain malicious links or attachments leading to fake login pages designed to spoof legitimate login platforms, like Microsoft 365, designed to harvest user credentials.

Proxy-based credential theft and session hijacking

When a user clicks on a malicious link, they are redirected through an attacker-controlled proxy that impersonates legitimate services. This proxy forwards login requests to Microsoft, making the login page appear legitimate. After the user successfully completes MFA, the attacker captures credentials and session tokens, enabling full account takeover without the need for reauthentication.

Follow-on attacks

Once inside, attackers will typically establish persistence through the creation of email rules or registering OAuth applications. From there, they often act on their objectives, exfiltrating sensitive data and launching additional business email compromise (BEC) campaigns. These campaigns can include fraudulent payment requests to external contacts or internal phishing designed to compromise more accounts and enable lateral movement across the organization.

Darktrace’s detection of an AiTM attack

At the end of September 2025, Darktrace detected one such example of an AiTM attack on the network of a customer trialling Darktrace / EMAIL and Darktrace / IDENTITY.

In this instance, the first indicator of compromise observed by Darktrace was the creation of a malicious email rule on one of the customer’s Office 365 accounts, suggesting the account had likely already been compromised before Darktrace was deployed for the trial.

Darktrace / IDENTITY observed the account creating a new email rule with a randomly generated name, likely to hide its presence from the legitimate account owner. The rule marked all inbound emails as read and deleted them, while ignoring any existing mail rules on the account. This rule was likely intended to conceal any replies to malicious emails the attacker had sent from the legitimate account owner and to facilitate further phishing attempts.

Figure 1: Darktrace’s detection of the anomalous email rule creation.

Internal and external phishing

Following the creation of the email rule, Darktrace / EMAIL observed a surge of suspicious activity on the user’s account. The account sent emails with subject lines referencing payment information to over 9,000 different external recipients within just one hour. Darktrace also identified that these emails contained a link to an unusual Google Drive endpoint, embedded in the text “download order and invoice”.

Figure 2: Darkrace’s detection of an unusual surge in outbound emails containing suspicious content, shortly following the creation of a new email rule.

Figure 3: Darktrace / EMAIL’s detection of the compromised account sending over 9,000 external phishing emails, containing an unusual Google Drive link.

As Darktrace / EMAIL flagged the message with the ‘Compromise Indicators’ tag (Figure 2), it would have been held automatically if the customer had enabled default Data Loss Prevention (DLP) Action Flows in their email environment, preventing any external phishing attempts.

Figure 4: Darktrace / EMAIL’s preview of the email sent by the offending account.

Darktrace analysis revealed that, after clicking the malicious link in the email, recipients would be redirected to a convincing landing page that closely mimicked the customer’s legitimate branding, including authentic imagery and logos, where prompted to download with a PDF named “invoice”.

Figure 5: Download and login prompts presented to recipients after following the malicious email link, shown here in safe view.

After clicking the “Download” button, users would be prompted to enter their company credentials on a page that was likely a credential-harvesting tool, designed to steal corporate login details and enable further compromise of SaaS and email accounts.

Darktrace’s Response

In this case, Darktrace’s Autonomous Response was not fully enabled across the customer’s email or SaaS environments, allowing the compromise to progress, as observed by Darktrace here.

Despite this, Darktrace / EMAIL’s successful detection of the malicious Google Drive link in the internal phishing emails prompted it to suggest ‘Lock Link’, as a recommended action for the customer’s security team to manually apply. This action would have automatically placed the malicious link behind a warning or screening page blocking users from visiting it.

Figure 6: Autonomous Response suggesting locking the malicious Google Drive link sent in internal phishing emails.

Furthermore, if active in the customer’s SaaS environment, Darktrace would likely have been able to mitigate the threat even earlier, at the point of the first unusual activity: the creation of a new email rule. Mitigative actions would have included forcing the user to log out, terminating any active sessions, and disabling the account.

Conclusion

AiTM attacks represent a significant evolution in credential theft techniques, enabling attackers to bypass MFA and hijack active sessions through reverse proxy infrastructure. In the real-world case we explored, Darktrace’s AI-driven detection identified multiple stages of the attack, from anomalous email rule creation to suspicious internal email activity, demonstrating how Autonomous Response could have contained the threat before escalation.

MFA is a critical security measure, but it is no longer a silver bullet. Attackers are increasingly targeting session tokens rather than passwords, exploiting trusted SaaS environments and internal communications to remain undetected. Behavioral AI provides a vital layer of defense by spotting subtle anomalies that traditional tools often miss

Security teams must move beyond static defenses and embrace adaptive, AI-driven solutions that can detect and respond in real time. Regularly review SaaS configurations, enforce conditional access policies, and deploy technologies that understand “normal” behavior to stop attackers before they succeed.

Credit to David Ison (Cyber Analyst), Bertille Pierron (Solutions Engineer), Ryan Traill (Analyst Content Lead)

Appendices

Models

SaaS / Anomalous New Email Rule

Tactic – Technique – Sub-Technique

Phishing - T1566

Adversary-in-the-Middle - T1557

About the author

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Ivanti Sentry Vulnerability | Analysis & Insights

Ivanti Sentry Vulnerability | Analysis & Insights

Exploitation of Vulnerabilities in Ivanti Products

Observed Exploitation of CVE-2023-38035

Reconnaissance Activities

Crypto-Mining Activities

Appendices

MITRE ATT&CK Mapping

List of IoCs

References

Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

Why organizations are moving to label-free, behavioral DLP for outbound email

Enjoying the blog?

More in this series

React2Shell: How Opportunist Attackers Exploited CVE-2025-55182 Within Hours

Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System

Blog

Email

December 18, 2025

Why organizations are moving to label-free, behavioral DLP for outbound email

Why outbound email DLP needs reinventing

How data loss actually happens

What traditional DLP approaches offer (and where gaps remain)

Your technology primer: The three pillars that make outbound DLP effective

1) Label-free (vs. data classification)

2) Behavioral (vs. rules, signatures, threat intelligence)

3) Proprietary DSLM (vs. generic LLM)

The Darktrace approach to DLP

A buyer’s checklist for DLP solutions

Blog

Email

December 17, 2025

Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

What is an Adversary-in-the-middle (AiTM) attack?

What does an AiTM attack look like?

Inbound phishing email

Proxy-based credential theft and session hijacking

Follow-on attacks

Darktrace’s detection of an AiTM attack

Internal and external phishing

Darktrace’s Response

Conclusion

Appendices

Models