Blog
/
Email
/
April 10, 2025

FedRAMP High-compliant email security protects federal agencies from nation-state attacks

Not only has Darktrace Federal achieved its FedRAMP High Authority to Operate, one of the few cybersecurity vendors to do this, but we have also released Darktrace Commercial Government Cloud High/Email, a FedRAMP High-compliant email security solution for customers using Microsoft Government Community Cloud High.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Marcus Fowler
CEO of Darktrace Federal and SVP of Strategic Engagements and Threats
U.S. government building with flag against blue skyDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
10
Apr 2025

What is FedRAMP High Authority to Operate (ATO)?

Federal Risk and Authorization Management Program (FedRAMP®) High is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment for cloud technologies and federal agencies, ensuring the protection of federal information.  

Cybersecurity is paramount in the Defense Industrial Base (DIB), where protecting sensitive information and ensuring operational resilience from the most sophisticated adversaries has national security implications. Organizations within the DIB must comply with strict security standards to work with the U.S. federal government, and FedRAMP High is one of those standards.

Darktrace achieves FedRAMP High ATO across IT, OT, and email

Last week, Darktrace Federal shared that we achieved FedRAMP® High ATO, a significant milestone that recognizes our ability to serve federal customers across IT, OT, and email via secure cloud-native deployments.  

Achieving the FedRAMP High ATO indicates that Darktrace Federal has achieved the highest standard for cloud security controls and can handle the U.S. federal government’s most sensitive, unclassified data in cloud environments.

Azure Government email security with FedRAMP High ATO

Darktrace has now released Darktrace Commercial Government Cloud High/Email (DCGC High/Email). This applies our email coverage to systems hosted in Microsoft's Azure Government, which adheres to NIST SP 800-53 controls and other federal standards. DCGC High/Email both meets and exceeds the compliance requirements of the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC), providing organizations with a much-needed email security solution that delivers unparalleled, AI-driven protection against sophisticated cyber threats.

In these ways, DCGC High/Email enhances compliance, security, and operational resilience for government and federally-affiliated customers. Notably, it is crucial for securing contractors and suppliers within DIB, helping those organizations implement necessary cybersecurity practices to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

Adopting DCGC High/Email ensures organizations within the DIB can work with the government without needing to invest extensive time and money into meeting the strict compliance standards.

Building DCGC High/Email to ease DIB work with the government

DCGC High/Email was built to achieve FedRAMP High standards and meet the most rigorous security standards required of our customers. This level of compliance not only allows more organizations than ever to leverage our AI-driven technology, but also ensures that customer data is protected by the highest security measures available.

The DIB has never been more critical to national security, which means they are under constant threats from nation state and cyber criminals. We built DCGC High/Email to FedRAMP High controls to ensure sensitive company and federal government communications are secured at the highest level possible.” – Marcus Fowler, CEO of Darktrace Federal

Evolving threats now necessitate DCGC High/Email

According to Darktrace’s 2025 State of AI Cybersecurity report, more than half (54%) of global government cybersecurity professionals report seeing a significant impact from AI-powered cyber threats.  

These aren’t the only types of sophisticated threats. Advanced Persistent Threats (APTs) are launched by nation-states or cyber-criminal groups with the resources to coordinate and achieve long-term objectives.  

These attacks are carefully tailored to specific targets, using techniques like social engineering and spear phishing to gain initial access via the inbox. Once inside, attackers move laterally through networks, often remaining undetected for months or even years, silently gathering intelligence or preparing for a decisive strike.  

However, the barrier for entry for these threat actors has been lowered immensely, likely related to the observed impact of AI-powered cyber threats. Securing email environments is more important than ever.  

Darktrace’s 2025 State of AI Cybersecurity report also found that 89% of government cybersecurity professionals believe AI can help significantly improve their defensive capabilities.  

Darktrace's AI-powered defensive tools are uniquely capable of detecting and neutralizing APTs and other sophisticated threats, including ones that enter via the inbox. Our Self-Learning AI continuously adapts to evolving threats, providing real-time protection.

Darktrace builds to secure the DIB to the highest degree

In summary, Darktrace Federal's achievement of FedRAMP High ATO and the introduction of DCGC High/Email mark significant advancements in our ability to protect defense contractors and federal customers against sophisticated threats that other solutions miss.

For a technical review of Darktrace Federal’s Cyber AI Mission Defense™ solution, download an independent evaluation from the Technology Advancement Center here.

[related-resource]

Understand Darktrace's Unique AI Approach

Learn how Darktrace applies different AI techniques by downloading “The AI Arsenal: Understanding the Tools Shaping Cybersecurity”

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Marcus Fowler
CEO of Darktrace Federal and SVP of Strategic Engagements and Threats

More in this series

No items found.

Blog

/

Network

/

October 23, 2025

Darktrace Redefines NDR: Industry-First Autonomous Threat Investigation from Network to Endpoint with Agentic AI

autonomous investigations, endpoint, ndr, network detection and responseDefault blog imageDefault blog image

Darktrace delivers the next evolution of unified and proactive NDR

Darktrace Network Endpoint eXtended Telemetry (NEXT) is revolutionizing NDR with the industry’s first mixed-telemetry agent using Self-Learning AI.  

The combined context of native network and endpoint process data significantly reduces incident triage and investigation times for threats spanning both domains. Our business-centric approach learns what normal looks like for each endpoint, and now uses process context to extend our ability to identify novel threats that existing EDR/XDR tools often  miss.

Summary of what’s new:

  • Native endpoint process telemetry combined with NDR, bridging the EDR gap
  • Self-Learning AI on the endpoint to stop novel threats missed by EDR
  • Sophisticated Agentic AI to automate SecOps investigations across all major IT domains
  • AI-native, real-time threat detection, investigation, and response (TDIR) for cross-domain activity throughout the enterprise

Why is this an important next step in NDR?

Security analysts are buried under a flood of alerts that lack the context needed to separate genuine threats from noise. The root problem is that most security tools only see one slice of the environment. IT and OT networks, endpoints, and cloud systems are monitored in isolation, with little correlation between them.

As a result, investigations are highly manual. Analysts are forced to pivot between siloed point-products, each providing only a fragment of the incident. This slows response, creates blind spots, and limits the team’s ability to understand and contain threats effectively.

In many cases, the high degree of skill it takes to pivot tools and conduct investigations leads even the most experienced analysts closer to burnout, especially when they are already exhausted by the quantity of alerts. Ultimately, the human personnel managing these systems are using their skills to accommodate for the lack of synergy between tools they are using in their security stack, rather than developing the higher-value expertise needed to anticipate, prevent, and respond to emerging threats.

Many organizations have attempted to overcome this challenge by implementing XDR solutions. But, XDR does not cover NDR related use cases. This is especially true in OT/CPS environments where it is not possible to install an agent on devices.

XDR is an Endpoint-focused tool that cannot see the full picture of threats moving laterally across the network, targeting unmanaged devices, or blending into legitimate traffic. While XDR is still a strong tool in the arsenal, attackers are noticing where the gaps are:

  • A CISA Red Team assessment found that one U.S. critical infrastructure organization suffered prolonged compromise because it overly relied on host‑based EDR and lacked sufficient network-layer defenses.  

Bottom line: Without native network detection and response (NDR), critical incidents slip through undetected.

Not all NDR tools are built the same

When it comes to NDR, the details matter. Here are a few reasons why not all NDR solutions are created equal:

  • Most NDR solutions depend on EDR/XDR integrations to ingest endpoint alerts, which are raised based on activity that is already known to be malicious
  • They can’t investigate beyond what the EDR already flags, lacking process-level context in network investigations
  • Almost no NDR solutions have a native endpoint agent to extend NDR visibility to remote worker devices

This reliance on EDR leaves critical gaps in network coverage, since EDRs themselves don’t provide network-level visibility.

The NEXT evolution of NDR

Darktrace Network Endpoint eXtended Telemetry (NEXT) is revolutionizing NDR with the industry’s first mixed-telemetry agent using Self-Learning AI.  

The combined context of native network and endpoint process data significantly reduces incident triage and investigation times for threats spanning both domains, our business-centric approach with new data also extends our ability to identify novel threats that existing EDR/XDR may miss.

Darktrace / ENDPOINT agents are now able to utilize new Network Endpoint eXtended Telemetry (NEXT) capabilities. This combines full network visibility with native endpoint process data, enabling autonomous investigations that trace threats from initial network activity all the way to the root cause at the endpoint, without manual correlation or tool switching. This bridges the gap between NDR and the endpoint, while adding value to existing EDR investments.

Darktrace natively shows the endpoint process context in relation to network events, complete with parent/child process relationships, adding immediate context to network investigations without needing to pivot to your EDR.
Figure 1: Darktrace natively shows the endpoint process context in relation to network events, complete with parent/child process relationships, adding immediate context to network investigations without needing to pivot to your EDR.

Leveraging this data in investigations

This additional context is then leveraged by Cyber AI Analyst, a sophisticated agentic AI system that autonomously performs end-to-end investigations of all relevant alerts and prioritizes incidents. With the new endpoint process visibility, Cyber AI Analyst now incorporates process context into its decision-making, which improves detection accuracy, filters out benign activity, and enhances incident narratives with process-level insights.

This makes Darktrace the first NDR to natively investigate threats across network and endpoint telemetry with an autonomous, agentic AI analyst. And with our Self-Learning AI, Darktrace continuously evolves by understanding what’s normal for each unique environment, now adding process data to extend visibility and range of detections. This enables Darktrace to detect and contain novel threats, including zero-days, insider threats, and emerging attack techniques, up to 8 days before public disclosure.

This is more than a solution to a visibility problem. It’s a fundamental evolution in how threats are detected, investigated, and stopped. By applying agentic AI, Darktrace empowers security teams to move from reactive alert triage to proactive, autonomous defense, surfacing and blocking threats that others simply can’t see.

An excerpt from a Darktrace Cyber AI Analyst incident, showing the inclusion of native endpoint process context alongside other network events.
Figure 2: An excerpt from a Darktrace Cyber AI Analyst incident, showing the inclusion of native endpoint process context alongside other network events.

Continued innovation in detection and response

Darktrace also continues to invest in our core NDR capabilities, delivering enhancements and innovations to solve modern network security challenges. In the latest release, Darktrace / NETWORK has been enhanced to increase detection efficacy and performance. This includes increased protocol detection fidelity and new support for custom port mappings, plus expanded visibility into HTTP traffic to support more targeted threat hunting across a wider range of application layer activity. In addition, vSensor performance has been upgraded for tunnel protocols such as Geneve.

We have also released enhancements to Autonomous Response, which is already trusted by thousands of organizations to contain threats at the earliest stages without causing business disruption. This includes enhanced support for highly complex and segmented networks, plus the ability to extend Autonomous Response actions to more areas with additional firewall integration support. This enables faster and more effective response to network threats, and continues Darktrace’s proven ability to contain zero-day threats up to 8 days before public disclosure.

Providing seamless operations with the new Darktrace ActiveAI Security Portal

As part of Darktrace’s commitment to breaking down silos across the cyber defense lifecycle, this release also introduces major platform enhancements that tackle often-overlooked operational gaps specifically around user access, permissions, and integration workflows. With the launch of the new Darktrace ActiveAI Security Portal, organizations can now manage security at scale across diverse environments, making it ideal for large enterprises, MSSPs, and partners overseeing multiple tenants. These updates ensure that visibility, control, and scalability extend beyond detection and response and into how teams manage and interact with the platform itself.

Committed to innovation

These updates are part of the broader Darktrace release, which also included major innovations in cloud security with the launch of the industry’s first fully automated cloud forensics solution, reinforcing Darktrace’s leadership in AI-native security. As attackers exploit gaps between tools, the Darktrace ActiveAI Security Platform delivers unified detection, automated investigation, and autonomous response across cloud, endpoint, email, network, and OT. With full-stack visibility and AI-native workflows, Darktrace empowers security teams to detect, understand, and stop novel threats before they escalate.

Join our Live Launch Event

When? 

December 9, 2025

What will be covered?

Join our live broadcast to experience how Darktrace is eliminating blind spots for detection and response across your complete enterprise with new innovations in Agentic AI across our ActiveAI Security platform. Industry leaders from IDC will join Darktrace customers to discuss challenges in cross-domain security, with a live walkthrough reshaping the future of Network Detection & Response, Endpoint Detection & Response, Email Security, and SecOps in novel threat detection and autonomous investigations.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response

Blog

/

/

October 20, 2025

Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion

salt typhoonDefault blog imageDefault blog image

What is Salt Typhoon?

Salt Typhoon represents one of the most persistent and sophisticated cyber threats targeting global critical infrastructure today. Believed to be linked to state-sponsored actors from the People’s Republic of China (PRC), this advanced persistent threat (APT) group has executed a series of high-impact campaigns against telecommunications providers, energy networks, and government systems—most notably across the United States.

Active since at least 2019, the group—also tracked as Earth Estries, GhostEmperor, and UNC2286—has demonstrated advanced capabilities in exploiting edge devices, maintaining deep persistence, and exfiltrating sensitive data across more than 80 countries. While much of the public reporting has focused on U.S. targets, Salt Typhoon’s operations have extended into Europe, the Middle East, and Africa (EMEA) where it has targeted telecoms, government entities, and technology firms. Its use of custom malware and exploitation of high-impact vulnerabilities (e.g., Ivanti, Fortinet, Cisco) underscores the strategic nature of its campaigns, which blend intelligence collection with geopolitical influence [1].

Leveraging zero-day exploits, obfuscation techniques, and lateral movement strategies, Salt Typhoon has demonstrated an alarming ability to evade detection and maintain long-term access to sensitive environments. The group’s operations have exposed lawful intercept systems, compromised metadata for millions of users, and disrupted essential services, prompting coordinated responses from intelligence agencies and private-sector partners worldwide. As organizations reassess their threat models, Salt Typhoon serves as a stark reminder of the evolving nature of nation-state cyber operations and the urgent need for proactive defense strategies.

Darktrace’s coverage

In this case, Darktrace observed activity in a European telecommunications organisation consistent with Salt Typhoon’s known tactics, techniques and procedures (TTPs), including dynamic-link library (DLL) sideloading and abuse of legitimate software for stealth and execution.

Initial access

The intrusion likely began with exploitation of a Citrix NetScaler Gateway appliance in the first week of July 2025. From there, the actor pivoted to Citrix Virtual Delivery Agent (VDA) hosts in the client’s Machine Creation Services (MCS) subnet. Initial access activities in the intrusion originated from an endpoint potentially associated with the SoftEther VPN service, suggesting infrastructure obfuscation from the outset.

Tooling

Darktrace subsequently observed the threat actor delivering a backdoor assessed with high confidence to be SNAPPYBEE (also known as Deed RAT) [2][3] to multiple Citrix VDA hosts. The backdoor was delivered to these internal endpoints as a DLL alongside legitimate executable files for antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This pattern of activity indicates that the attacker relied on DLL side-loading via legitimate antivirus software to execute their payloads. Salt Typhoon and similar groups have a history of employing this technique [4][5], enabling them to execute payloads under the guise of trusted software and bypassing traditional security controls.

Command-and-Control (C2)

The backdoor delivered by the threat actor leveraged LightNode VPS endpoints for C2, communicating over both HTTP and an unidentified TCP-based protocol. This dual-channel setup is consistent with Salt Typhoon’s known use of non-standard and layered protocols to evade detection. The HTTP communications displayed by the backdoor included POST requests with an Internet Explorer User-Agent header and Target URI patterns such as “/17ABE7F017ABE7F0”. One of the C2 hosts contacted by compromised endpoints was aar.gandhibludtric[.]com (38.54.63[.]75), a domain recently linked to Salt Typhoon [6].

Detection timeline

Darktrace produced high confidence detections in response to the early stages of the intrusion, with both the initial tooling and C2 activities being strongly covered by both investigations by Darktrace Cyber AI AnalystTM investigations and Darktrace models. Despite the sophistication of the threat actor, the intrusion activity identified and remediated before escalating beyond these early stages of the attack, with Darktrace’s timely high-confidence detections likely playing a key role in neutralizing the threat.

Cyber AI Analyst observations

Darktrace’s Cyber AI Analyst autonomously investigated the model alerts generated by Darktrace during the early stages of the intrusion. Through its investigations, Cyber AI Analyst discovered the initial tooling and C2 events and pieced them together into unified incidents representing the attacker’s progression.

Cyber AI Analyst weaved together separate events from the intrusion into broader incidents summarizing the attacker’s progression.
Figure 1: Cyber AI Analyst weaved together separate events from the intrusion into broader incidents summarizing the attacker’s progression.

Conclusion

Based on overlaps in TTPs, staging patterns, infrastructure, and malware, Darktrace assesses with moderate confidence that the observed activity was consistent with Salt Typhoon/Earth Estries (ALA GhostEmperor/UNC2286). Salt Typhoon continues to challenge defenders with its stealth, persistence, and abuse of legitimate tools. As attackers increasingly blend into normal operations, detecting behavioral anomalies becomes essential for identifying subtle deviations and correlating disparate signals. The evolving nature of Salt Typhoon’s tradecraft, and its ability to repurpose trusted software and infrastructure, ensures it will remain difficult to detect using conventional methods alone. This intrusion highlights the importance of proactive defense, where anomaly-based detections, not just signature matching, play a critical role in surfacing early-stage activity.

Credit to Nathaniel Jones (VP, Security & AI Strategy, FCISO), Sam Lister (Specialist Security Researcher), Emma Foulger (Global Threat Research Operations Lead), Adam Potter (Senior Cyber Analyst)

Edited by Ryan Traill (Analyst Content Lead)

Appendices

Indicators of Compromise (IoCs)

IoC-Type-Description + Confidence

89.31.121[.]101 – IP Address – Possible C2 server

hxxp://89.31.121[.]101:443/WINMM.dll - URI – Likely SNAPPYBEE download

b5367820cd32640a2d5e4c3a3c1ceedbbb715be2 - SHA1 – Likely SNAPPYBEE download

hxxp://89.31.121[.]101:443/NortonLog.txt - URI - Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/123.txt - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/123.tar - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/pdc.exe - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443//Dialog.dat - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/fltLib.dll - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/DisplayDialog.exe - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/DgApi.dll - URI - Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/dbindex.dat - URI - Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/1.txt - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/imfsbDll.dll – Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/imfsbSvc.exe - URI – Likely DLL side-loading activity

aar.gandhibludtric[.]com – Hostname – Likely C2 server

38.54.63[.]75 – IP – Likely C2 server

156.244.28[.]153 – IP – Possible C2 server

hxxp://156.244.28[.]153/17ABE7F017ABE7F0 - URI – Possible C2 activity

MITRE TTPs

Technique | Description

T1190 | Exploit Public-Facing Application - Citrix NetScaler Gateway compromise

T1105 | Ingress Tool Transfer – Delivery of backdoor to internal hosts

T1665 | Hide Infrastructure – Use of SoftEther VPN for C2

T1574.001 | Hijack Execution Flow: DLL – Execution of backdoor through DLL side-loading

T1095 | Non-Application Layer Protocol – Unidentified application-layer protocol for C2 traffic

T1071.001| Web Protocols – HTTP-based C2 traffic

T1571| Non-Standard Port – Port 443 for unencrypted HTTP traffic

Darktrace Model Alerts during intrusion

Anomalous File::Internal::Script from Rare Internal Location

Anomalous File::EXE from Rare External Location

Anomalous File::Multiple EXE from Rare External Locations

Anomalous Connection::Possible Callback URL

Antigena::Network::External Threat::Antigena Suspicious File Block

Antigena::Network::Significant Anomaly::Antigena Significant Server Anomaly Block

Antigena::Network::Significant Anomaly::Antigena Controlled and Model Alert

Antigena::Network::Significant Anomaly::Antigena Alerts Over Time Block

Antigena::Network::External Threat::Antigena File then New Outbound Block  

References

[1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a

[2] https://www.trendmicro.com/en_gb/research/24/k/earth-estries.html

[3] https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/k/earth-estries/IOC_list-EarthEstries.txt

[4] https://www.trendmicro.com/en_gb/research/24/k/breaking-down-earth-estries-persistent-ttps-in-prolonged-cyber-o.html

[5] https://lab52.io/blog/deedrat-backdoor-enhanced-by-chinese-apts-with-advanced-capabilities/

[6] https://www.silentpush.com/blog/salt-typhoon-2025/

The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.

Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.

Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.

The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content.

Continue reading
About the author
Nathaniel Jones
VP, Security & AI Strategy, Field CISO
Your data. Our AI.
Elevate your network security with Darktrace AI