Blog
/
Network
/
November 13, 2024

Tactics Behind the Royal and Blacksuit Ransomware

Delve into the complexities of the Royal and Blacksuit ransomware strains and their implications for cybersecurity in today’s digital landscape.
Written by
Signe Zaharka
Principal Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Signe Zaharka
Principal Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
13
Nov 2024

What is BlackSuit Ransomware?

Since late 2023, Darktrace has detected BlackSuit ransomware infiltrating multiple customer networks in the US. This ransomware has targeted a wide range of industries, including arts, entertainment, real estate, public administration, defense, and social security.

Emerging in May 2023, BlackSuit is believed to be a spinoff of Royal ransomware due to similarities in code and Conti, and most likely consists of Russian and Eastern European hackers [1]. Recorded Future reported that the ransomware had affected 95 organizations worldwide, though the actual number is likely much higher [2]. While BlackSuit does not appear to focus on any particular sector, it has targeted multiple organizations in the healthcare, education, IT, government, retail and manufacturing industries [3]. Employing double extortion tactics, BlackSuit not only encrypts files but also steals sensitive data to leverage ransom payments.

BlackSuit has demanded over USD 500 million in ransoms, with the highest individual demand reaching USD 60 million [4]. Notable targets include CDK Global, Japanese media conglomerate Kadokawa, multiple educational institutions, Octapharma Plasma, and the government of Brazil [5][6][7][8].

Darktrace’s Coverage of BlackSuit Ransomware Attack

Case 1, November 2023

The earliest attack on a Darktrace customer by BlackSuit was detected at the start of November 2023. The unusual network activity began on a weekend—a time commonly chosen by ransomware groups to increase their chances of success, as many security teams operate with reduced staff. Darktrace identified indicators of the attackers’ presence on the network for almost two weeks, during which a total of 15 devices exhibited suspicious behavior.

The attack commenced with unusual internal SMB (Server Message Block) connections using a compromised service account. An internal device uploaded an executable (zzza.exe) to a domain controller (DC) and shortly after, wrote a script (socks5.ps1) to another device. According to a Cybersecurity Advisory from the CISA (Cybersecurity and Infrastructure Security Agency, US), the script file was a PowerShell reverse proxy [9].

Approximately an hour and a half later, the device to which the script was written exhibited uncommon WMI (Windows Management Instrumentation) activity. Two hours after receiving the executable file, the DC was observed making an outgoing NTLM request, using PowerShell to remotely execute commands, distributing differently named executable files (<PART OF THE CUSTOMER’S NAME>.exe), and controlling services on other devices.

Eighteen hours after the start of the unusual activity, Darktrace detected another device making repeated connections to “mystuff.bublup[.]com”, which the aforementioned CISA Advisory identifies as a domain used by BlackSuit for data exfiltration [9].

About ten minutes after the suspicious executables were distributed across the network, and less than 24 hours after the start of the unusual activity, file encryption began. A total of ten devices were seen appending the “.blacksuit” extension to files saved on other devices using SMB, as well as writing ransom notes (readme.blacksuit.txt). The file encryption lasted less than 20 minutes.

An example of the contents of a BlackSuit ransom note being written over SMB.
Figure 1: An example of the contents of a BlackSuit ransom note being written over SMB.

During this compromise, external connections to endpoints related to ConnectWise’s ScreenConnect remote management tool were also seen from multiple servers, suggesting that the tool was likely being abused for command-and-control (C2) activity. Darktrace identified anomalous connectivity associated with ScreenConnect was seen up to 11 days after the start of the attack.

10 days after the start of the compromise, an account belonging to a manager was detected adding “.blacksuit” extensions to the customer’s Software-a-Service (SaaS) resources while connecting from 173.251.109[.]106. Six minutes after file encryption began, Darktrace flagged the unusual activity and recommended a block. However, since Autonomous Response mode was not enabled, the customer’s security team needed to manually confirm the action. Consequently, suspicious activity continued for about a week after the initial encryption. This included disabling authentication on the account and an unusual Teams session initiated from the suspicious external endpoint 216.151.180[.]147.

Case 2, February 2024

Another BlackSuit compromise occurred at the start of February 2024, when Darktrace identified approximately 50 devices exhibiting ransomware-related activity in another US customer’s environment. Further investigation revealed that a significant number of additional devices had also been compromised. These devices were outside Darktrace’s purview to the customer’s specific deployment configuration. The threat actors managed to exfiltrate around 4 TB of data.

Initial access to the network was gained via a virtual private network (VPN) compromise in January 2024, when suspicious connections from a Romanian IP address were detected. According to CISA, the BlackSuit group often utilizes the services of initial access brokers (IAB)—actors who specialize in infiltrating networks, such as through VPNs, and then selling that unauthorized access to other threat actors [9]. Other initial access vectors include phishing emails, RDP (Remote Desktop Protocol) compromise, and exploitation of vulnerable public-facing applications.

Similar to the first case, the file encryption began at the end of the working week. During this phase of the attack, affected devices were observed encrypting files on other internal devices using two compromised administrator accounts. The encryption activity lasted for approximately six and a half hours. Multiple alerts were sent to the customer from Darktrace’s Security Operations Centre (SOC) team, who began reviewing the activity within four minutes of the start of the file encryption.

Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 2: Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 3: A spike in model alerts on the day when file encryption by BlackSuit was observed in the network.

In this case, the threat actor utilized SystemBC proxy malware for command and control (C2). A domain controller (DC) was seen connecting to 137.220.61[.]94 on the same day the file encryption took place. The DC was also observed connecting to a ProxyScrape domain around the same time, which is related to the SOCKS5 protocol used by SystemBC. During this compromise, RDP, SSH, and SMB were used for lateral movement within the network.

Figure 4: A Cyber AI Analyst investigation alerting to a device on the VPN subnet making suspicious internal SSH connections due to malicious actors moving laterally within the network.

Signs of threat actors potentially being on the network were observed as early as two days prior to the file encryption. This included unusual internal network scanning via multiple protocols (ICMP, SMB, RDP, etc.), credential brute-forcing, SMB access failures, and anonymous SMBv1 sessions. These activities were traced to IP addresses belonging to two desktop devices in the VPN subnet associated with two regular employee user accounts. Threat actors were seemingly able to exploit at least one of these accounts due to LDAP legacy policies being in place on the customer’s environment.

A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Figure 5: A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.
Figure 6: Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.

Case 3, August 2024

The most recently observed BlackSuit compromise occurred in August 2024, when a device was observed attempting to brute-force the credentials of an IT administrator. This activity continued for 11 days.

Once the admin’s account was successfully compromised, network scanning, unusual WMI, and SAMR (Security Account Manager Remote protocol) activity followed. A spike in the use of this account was detected on a Sunday—once again, the attackers seemingly targeting the weekend—when the account was used by nearly 50 different devices.

The compromised admin’s account was exploited for data gathering via SMB, resulting in the movement of 200 GB of data between internal devices in preparation for exfiltration. The files were then archived using the naming convention “*.part<number>.rar”.

Around the same time, Darktrace observed data transfers from 19 internal devices to “bublup-media-production.s3.amazonaws[.]com,” totaling just over 200 GB—the same volume of data gathered internally. Connections to other Bublup domains were also detected. The internal data download and external data transfer activity took approximately 8-9 hours.

Unfortunately, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning any mitigative actions to stop the data gathering or exfiltration required human confirmation.  

One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.
Figure 7: One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.

Once the information was stolen, the threat actor moved on to the final stage of the attack—file encryption. Five internal devices, using either the compromised admin account or connecting via anonymous SMBv1 sessions, were seen encrypting files and writing ransom notes to five other devices on the network. The attempts at file encryption continued for around two hours, but Darktrace’s Autonomous Response capability was able to block the activity and prevent the attack from escalating.

Conclusion

The persistent and evolving threat posed by ransomware like BlackSuit underscores the critical importance of robust cybersecurity measures across all sectors. Since its emergence in 2023, BlackSuit has demonstrated a sophisticated approach to infiltrating networks, leveraging double extortion tactics, and demanding substantial ransoms. The cases highlighted above illustrate the varied methods and persistence of BlackSuit attackers, from exploiting VPN vulnerabilities to abusing remote management tools and targeting off-hours to maximize impact.

Although many similar connection patterns, such as the abuse of Bublup services for data exfiltration or the use of SOCKS5 proxies for C2, were observed during cases investigated by Darktrace, BlackSuit actors are highly sophisticated and tailors their attacks to each target organization. The consequences of a successful attack can be highly disruptive, and remediation efforts can be time-consuming and costly. This includes taking the entire network offline while responding to the incident, restoring encrypted files from backups (if available), dealing with damage to the organization’s reputation, and potential lawsuits.

These BlackSuit ransomware incidents emphasize the need for continuous vigilance, timely updates to security protocols, and the adoption of autonomous response technologies to swiftly counteract such attacks. As ransomware tactics continue to evolve, organizations must remain agile and informed to protect their critical assets and data. By learning from these incidents and enhancing their cybersecurity frameworks, organizations can better defend against the relentless threat of ransomware and ensure the resilience of their operations in an increasingly digital world.

Credit to Signe Zaharka (Principal Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

Insights from Darktrace’s First 6: Half-year threat report for 2024

First 6: half year threat report darktrace screenshot

Darktrace’s First 6: Half-Year Threat Report 2024 highlights the latest attack trends and key threats observed by the Darktrace Threat Research team in the first six months of 2024.

  • Focuses on anomaly detection and behavioral analysis to identify threats
  • Maps mitigated cases to known, publicly attributed threats for deeper context
  • Offers guidance on improving security posture to defend against persistent threats

‍

‍

Appendices

Darktrace Model Detections

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / High Volume of New or Uncommon Service Control

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / Rare WinRM Outgoing

Anomalous Connection / SMB Enumeration

Anomalous Connection / Suspicious Activity On High Risk Device

Anomalous Connection / Suspicious Read Write Ratio

Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB

Anomalous Connection / Sustained MIME Type Conversion

Anomalous Connection / Uncommon 1 GiB Outbound

Anomalous Connection / Unusual Admin SMB Session

Anomalous File / Internal / Additional Extension Appended to SMB File

Anomalous File / Internal / Executable Uploaded to DC

Anomalous File / Internal / Unusual SMB Script Write

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous Server Activity / Outgoing from Server

Anomalous Server Activity / Rare External from Server

Anomalous Server Activity / Write to Network Accessible WebRoot

Compliance / Outgoing NTLM Request from DC

Compliance / Remote Management Tool On Server

Compliance / SMB Drive Write

Compromise / Beacon to Young Endpoint

Compromise / Beaconing Activity To External Rare

Compromise / Ransomware / Possible Ransom Note Read

Compromise / Ransomware / Possible Ransom Note Write

Compromise / Ransomware / SMB Reads then Writes with Additional Extensions

Compromise / Ransomware / Suspicious SMB Activity

Device / Anomalous RDP Followed By Multiple Model Breaches

Device / EXE Files Distributed to Multiple Devices

Device / Internet Facing Device with High Priority Alert

Device / Large Number of Model Breaches

Device / Large Number of Model Breaches from Critical Network Device

Device / Multiple Lateral Movement Model Breaches

Device / Network Scan

Device / New or Uncommon WMI Activity

Device / New or Unusual Remote Command Execution

Device / New User Agent To Internal Server

Device / SMB Lateral Movement

Device / SMB Session Brute Force (Admin)

Device / Suspicious SMB Scanning Activity

Device / Unusual LDAP Query For Domain Admins

SaaS / Access / Teams Activity from Rare Endpoint

SaaS / Resource / SaaS Resources With Additional Extensions

SaaS / Unusual Activity / Disabled Strong Authentication

SaaS / Unusual Activity / Multiple Unusual SaaS Activity Scores

SaaS / Unusual Activity / Unusual SaaS Activity Score

SaaS / Unusual Activity / Unusual Volume of SaaS Modifications

Unusual Activity / Anomalous SMB Delete Volume

Unusual Activity / Anomalous SMB Move & Write

Unusual Activity / High Volume Client Data Transfer

Unusual Activity / High Volume Server Data Transfer

Unusual Activity / Internal Data Transfer

Unusual Activity / SMB Access Failures

Unusual Activity / Sustained Anomalous SMB Activity

Unusual Activity / Unusual External Data to New Endpoint

User / New Admin Credentials on Client

User / New Admin Credentials on Server

User/ Kerberos Password Bruteforce

Autonomous Response Models

Antigena / Network / External Threat / Antigena File then New Outbound Block

Antigena / Network / External Threat / Antigena Ransomware Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

Antigena / Network / External Threat / SMB Ratio Antigena Block

Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity

Antigena / Network / Insider Threat / Antigena Internal Data Transfer Block

Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block

Antigena / Network / Insider Threat / Antigena Network Scan Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Pattern of Life Block

Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block

Antigena / Network / Significant Anomaly / Repeated Antigena Breaches

Antigena / SaaS / Antigena Unusual Activity Block

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

.blacksuit - File extension – When encrypting the files, this extension is appended to the filename – High

readme.blacksuit.txt – ransom note - A file demanding cryptocurrency payment in exchange for decrypting the victim's files and not leaking the stolen data – High

mystuff.bublup[.]com, bublup-media-production.s3.amazonaws[.]com – data exfiltration domains related to an organization and project management app that has document sharing functionality – High

137.220.61[.]94:4001 – SystemBC C2 related IP address (this tool is often used by other ransomware groups as well) - Medium

173.251.109[.]106 – IP address seen during a SaaS BlackSuit compromise (during file encryption) – Medium

216.151.180[.]147 – IP address seen during a SaaS BlackSuit compromise (during an unusual Teams session) - Medium

MITRE ATT&CK Mapping

Tactic - Technqiue

Account Manipulation - PERSISTENCE - T1098

Alarm Suppression - INHIBIT RESPONSE FUNCTION - T0878

Application Layer Protocol - COMMAND AND CONTROL - T1071

Automated Collection - COLLECTION - T1119

Block Command Message - INHIBIT RESPONSE FUNCTION - T0803

Block Reporting Message - INHIBIT RESPONSE FUNCTION - T0804

Browser Extensions - PERSISTENCE - T1176

Brute Force I/O - IMPAIR PROCESS CONTROL - T0806

Brute Force - CREDENTIAL ACCESS - T1110

Client Configurations - RECONNAISSANCE - T1592.004 - T1592

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Data Destruction - IMPACT - T1485

Data Destruction - INHIBIT RESPONSE FUNCTION - T0809

Data Encrypted for Impact - IMPACT - T1486

Data from Cloud Storage Object - COLLECTION - T1530

Data Staged - COLLECTION - T1074

Domain Groups - DISCOVERY - T1069.002 - T1069

Email Collection - COLLECTION - T1114

Exfiltration Over C2 Channel - EXFILTRATION - T1041

Exfiltration to Cloud Storage - EXFILTRATION - T1567.002 - T1567

Exploit Public - Facing Application - INITIAL ACCESS - T1190

Exploitation for Privilege Escalation - PRIVILEGE ESCALATION - T0890

Exploitation of Remote Services - LATERAL MOVEMENT - T1210

File and Directory Discovery - DISCOVERY - T1083

File Deletion - DEFENSE EVASION - T1070.004 - T1070

IP Addresses - RECONNAISSANCE - T1590.005 - T1590

Lateral Tool Transfer - LATERAL MOVEMENT - T1570

LLMNR/NBT - NS Poisoning and SMB Relay - CREDENTIAL ACCESS, COLLECTION - T1557.001 - T1557

Modify Alarm Settings - INHIBIT RESPONSE FUNCTION - T0838

Modify Control Logic - IMPAIR PROCESS CONTROL, INHIBIT RESPONSE FUNCTION - T0833

Modify Parameter - IMPAIR PROCESS CONTROL - T0836

Network Service Scanning - DISCOVERY - T1046

Network Share Discovery - DISCOVERY - T1135

Pass the Hash - DEFENSE EVASION, LATERAL MOVEMENT - T1550.002 - T1550

RDP Hijacking - LATERAL MOVEMENT - T1563.002 - T1563

Remote Access Software - COMMAND AND CONTROL - T1219

Remote Desktop Protocol - LATERAL MOVEMENT - T1021.001 - T1021

Remote System Discovery - DISCOVERY - T1018

Rename System Utilities - DEFENSE EVASION - T1036.003 - T1036

Scanning IP Blocks - RECONNAISSANCE - T1595.001 - T1595

Scheduled Transfer - EXFILTRATION - T1029

Service Execution - EXECUTION - T1569.002 - T1569

Service Stop - IMPACT - T1489

SMB/Windows Admin Shares - LATERAL MOVEMENT - T1021.002 - T1021

Stored Data Manipulation - IMPACT - T1565.001 - T1565

Taint Shared Content - LATERAL MOVEMENT - T1080

Valid Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078

Vulnerability Scanning - RECONNAISSANCE - T1595.002 - T1595

Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071

Web Services - RESOURCE DEVELOPMENT - T1583.006 - T1583

Web Shell - PERSISTENCE - T1505.003 - T1505

Windows Management Instrumentation - EXECUTION - T1047

Windows Remote Management - LATERAL MOVEMENT - T1021.006 - T1021

References

1.     https://www.trendmicro.com/en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal.html

2.     https://www.reuters.com/technology/cybersecurity/blacksuit-hacker-behind-cdk-global-attack-hitting-us-car-dealers-2024-06-27/

3.     https://www.sentinelone.com/anthology/blacksuit/

4.     https://thehackernews.com/2024/08/fbi-and-cisa-warn-of-blacksuit.html

5.     https://www.techtarget.com/whatis/feature/The-CDK-Global-outage-Explaining-how-it-happened

6.     https://therecord.media/japanese-media-kadokawa-investigating-cyber

7.     https://therecord.media/plasma-donation-company-cyberattack-blacksuit

8.     https://thecyberexpress.com/government-of-brazil-cyberattack-by-blacksuit/

9.     https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Written by
Signe Zaharka
Principal Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Signe Zaharka
Principal Cyber Analyst

Defending the Cloud: Stopping Cyber Threats in Azure and AWS with Darktrace

Identity
•
July 8, 2025
Alexandra Sentenac
Cyber Analyst
Watch the NIS2 Webinar
Trending blogs
1
The State of AI in Cybersecurity: The Impact of AI on Cybersecurity Solutions
May 13, 2024
2
How Empowering End Users can Improve Your Email Security and Decrease the Burden on the SOC
May 8, 2024
3
Elevating Network Security: Confronting Trust, Ransomware, & Novel Attacks
Jun 21, 2024
4
The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners
Apr 9, 2024
5
RansomHub Ransomware: investigación de Darktrace sobre la herramienta más nueva en ShadowSyndicate's Arsenal
Jan 14, 2025

More in this series

No items found.
Continue reading
Network
•
June 25, 2025

Patch and Persist: Darktrace’s Detection of Blind Eagle (APT-C-36)

Since 2018, Blind Eagle has targeted Latin American organizations using phishing and RATs. Darktrace detected Blind Eagle activity on a customer network involving C2 connectivity, malicious payload downloads and data exfiltration. Without Autonomous Response, the attack escalated, highlighting the need for proactive detection and response defense to counter fast-evolving threats.
Charlotte Thompson
Cyber Analyst
Read more
Network
•
June 17, 2025

Customer Case Study: Leading Petrochemical Manufacturer

An industry leading petrochemical manufacturer uses the Darktrace ActiveAI Security Platform to improve visibility, protect against supply chain attacks, and save the security team hundreds of hours of incident investigation.
The Darktrace Community
Read more
Network
•
June 16, 2025

Tracking CVE-2025-31324: Darktrace’s detection of SAP Netweaver exploitation before and after disclosure 

A critical SAP vulnerability, CVE-2025-31324, allows unauthenticated remote code execution via NetWeaver Visual Composer. Despite early mitigation guidance, many systems remain exposed. Darktrace detected exploitation attempts six days before public disclosure, highlighting the importance of proactive, threat-agnostic detection.
Signe Zaharka
Principal Cyber Analyst
Read more

Blog

/

/

July 17, 2025

Introducing the AI Maturity Model for Cybersecurity

AI maturity model for cybersecurityDefault blog imageDefault blog image

AI adoption in cybersecurity: Beyond the hype

Security operations today face a paradox. On one hand, artificial intelligence (AI) promises sweeping transformation from automating routine tasks to augmenting threat detection and response. On the other hand, security leaders are under immense pressure to separate meaningful innovation from vendor hype.

To help CISOs and security teams navigate this landscape, we’ve developed the most in-depth and actionable AI Maturity Model in the industry. Built in collaboration with AI and cybersecurity experts, this framework provides a structured path to understanding, measuring, and advancing AI adoption across the security lifecycle.

Overview of AI maturity levels in cybersecurity

Why a maturity model? And why now?

In our conversations and research with security leaders, a recurring theme has emerged:

There’s no shortage of AI solutions, but there is a shortage of clarity and understanding of AI uses cases.

In fact, Gartner estimates that “by 2027, over 40% of Agentic AI projects will be canceled due to escalating costs, unclear business value, or inadequate risk controls. Teams are experimenting, but many aren’t seeing meaningful outcomes. The need for a standardized way to evaluate progress and make informed investments has never been greater.

That’s why we created the AI Security Maturity Model, a strategic framework that:

  • Defines five clear levels of AI maturity, from manual processes (L0) to full AI Delegation (L4)
  • Delineating the outcomes derived between Agentic GenAI and Specialized AI Agent Systems
  • Applies across core functions such as risk management, threat detection, alert triage, and incident response
  • Links AI maturity to real-world outcomes like reduced risk, improved efficiency, and scalable operations

[related-resource]

How is maturity assessed in this model?

The AI Maturity Model for Cybersecurity is grounded in operational insights from nearly 10,000 global deployments of Darktrace's Self-Learning AI and Cyber AI Analyst. Rather than relying on abstract theory or vendor benchmarks, the model reflects what security teams are actually doing, where AI is being adopted, how it's being used, and what outcomes it’s delivering.

This real-world foundation allows the model to offer a practical, experience-based view of AI maturity. It helps teams assess their current state and identify realistic next steps based on how organizations like theirs are evolving.

Why Darktrace?

AI has been central to Darktrace’s mission since its inception in 2013, not just as a feature, but the foundation. With over a decade of experience building and deploying AI in real-world security environments, we’ve learned where it works, where it doesn’t, and how to get the most value from it. This model reflects that insight, helping security leaders find the right path forward for their people, processes, and tools

Security teams today are asking big, important questions:

  • What should we actually use AI for?
  • How are other teams using it — and what’s working?
  • What are vendors offering, and what’s just hype?
  • Will AI ever replace people in the SOC?

These questions are valid, and they’re not always easy to answer. That’s why we created this model: to help security leaders move past buzzwords and build a clear, realistic plan for applying AI across the SOC.

The structure: From experimentation to autonomy

The model outlines five levels of maturity :

L0 – Manual Operations: Processes are mostly manual with limited automation of some tasks.

L1 – Automation Rules: Manually maintained or externally-sourced automation rules and logic are used wherever possible.

L2 – AI Assistance: AI assists research but is not trusted to make good decisions. This includes GenAI agents requiring manual oversight for errors.

L3 – AI Collaboration: Specialized cybersecurity AI agent systems  with business technology context are trusted with specific tasks and decisions. GenAI has limited uses where errors are acceptable.

L4 – AI Delegation: Specialized AI agent systems with far wider business operations and impact context perform most cybersecurity tasks and decisions independently, with only high-level oversight needed.

Each level reflects a shift, not only in technology, but in people and processes. As AI matures, analysts evolve from executors to strategic overseers.

Strategic benefits for security leaders

The maturity model isn’t just about technology adoption it’s about aligning AI investments with measurable operational outcomes. Here’s what it enables:

SOC fatigue is real, and AI can help

Most teams still struggle with alert volume, investigation delays, and reactive processes. AI adoption is inconsistent and often siloed. When integrated well, AI can make a meaningful difference in making security teams more effective

GenAI is error prone, requiring strong human oversight

While there is a lot of hype around GenAI agentic systems, teams will need to account for inaccuracy and hallucination in Agentic GenAI systems.

AI’s real value lies in progression

The biggest gains don’t come from isolated use cases, but from integrating AI across the lifecycle, from preparation through detection to containment and recovery.

Trust and oversight are key initially but evolves in later levels

‍Early-stage adoption keeps humans fully in control. By L3 and L4, AI systems act independently within defined bounds, freeing humans for strategic oversight.

People’s roles shift meaningfully

As AI matures, analyst roles consolidate and elevate from labor intensive task execution to high-value decision-making, focusing on critical, high business impact activities, improving processes and AI governance.

Outcome, not hype, defines maturity

AI maturity isn’t about tech presence, it’s about measurable impact on risk reduction, response time, and operational resilience.

[related-resource]

Outcomes across the AI Security Maturity Model

The Security Organization experiences an evolution of cybersecurity outcomes as teams progress from manual operations to AI delegation. Each level represents a step-change in efficiency, accuracy, and strategic value.

L0 – Manual Operations

At this stage, analysts manually handle triage, investigation, patching, and reporting manually using basic, non-automated tools. The result is reactive, labor-intensive operations where most alerts go uninvestigated and risk management remains inconsistent.

L1 – Automation Rules

At this stage, analysts manage rule-based automation tools like SOAR and XDR, which offer some efficiency gains but still require constant tuning. Operations remain constrained by human bandwidth and predefined workflows.

L2 – AI Assistance

At this stage, AI assists with research, summarization, and triage, reducing analyst workload but requiring close oversight due to potential errors. Detection improves, but trust in autonomous decision-making remains limited.

L3 – AI Collaboration

At this stage, AI performs full investigations and recommends actions, while analysts focus on high-risk decisions and refining detection strategies. Purpose-built agentic AI systems with business context are trusted with specific tasks, improving precision and prioritization.

L4 – AI Delegation

At this stage, Specialized AI Agent Systems performs most security tasks independently at machine speed, while human teams provide high-level strategic oversight. This means the highest time and effort commitment activities by the human security team is focused on proactive activities while AI handles routine cybersecurity tasks

Specialized AI Agent Systems operate with deep business context including impact context to drive fast, effective decisions.

Join the webinar

Get a look at the minds shaping this model by joining our upcoming webinar using this link. We’ll walk through real use cases, share lessons learned from the field, and show how security teams are navigating the path to operational AI safely, strategically, and successfully.

Continue reading
About the author

Blog

/

/

July 17, 2025

Forensics or Fauxrensics: Five Core Capabilities for Cloud Forensics and Incident Response

people working and walking in officeDefault blog imageDefault blog image

The speed and scale at which new cloud resources can be spun up has resulted in uncontrolled deployments, misconfigurations, and security risks. It has had security teams racing to secure their business’ rapid migration from traditional on-premises environments to the cloud.

While many organizations have successfully extended their prevention and detection capabilities to the cloud, they are now experiencing another major gap: forensics and incident response.

Once something bad has been identified, understanding its true scope and impact is nearly impossible at times. The proliferation of cloud resources across a multitude of cloud providers, and the addition of container and serverless capabilities all add to the complexities. It’s clear that organizations need a better way to manage cloud incident response.

Security teams are looking to move past their homegrown solutions and open-source tools to incorporate real cloud forensics capabilities. However, with the increased buzz around cloud forensics, it can be challenging to decipher what is real cloud forensics, and what is “fauxrensics.”

This blog covers the five core capabilities that security teams should consider when evaluating a cloud forensics and incident response solution.

[related-resource]

1. Depth of data

There have been many conversations among the security community about whether cloud forensics is just log analysis. The reality, however, is that cloud forensics necessitates access to a robust dataset that extends far beyond traditional log data sources.

While logs provide valuable insights, a forensics investigation demands a deeper understanding derived from multiple data sources, including disk, network, and memory, within the cloud infrastructure. Full disk analysis complements log analysis, offering crucial context for identifying the root cause and scope of an incident.

For instance, when investigating an incident involving a Kubernetes cluster running on an EC2 instance, access to bash history can provide insights into the commands executed by attackers on the affected instance, which would not be available through cloud logs alone.

Having all of the evidence in one place is also a capability that can significantly streamline investigations, unifying your evidence be it disk images, memory captures or cloud logs, into a single timeline allowing security teams to reconstruct an attacks origin, path and impact far more easily. Multi–cloud environments also require platforms that can support aggregating data from many providers and services into one place. Doing this enables more holistic investigations and reduces security blind spots.

There is also the importance of collecting data from ephemeral resources in modern cloud and containerized environments. Critical evidence can be lost in seconds as resources are constantly spinning up and down, so having the ability to capture this data before its gone can be a huge advantage to security teams, rather than having to figure out what happened after the affected service is long gone.

darktrace / cloud, cado, cloud logs, ost, and memory information. value of cloud combined analysis

2. Chain of custody

Chain of custody is extremely critical in the context of legal proceedings and is an essential component of forensics and incident response. However, chain of custody in the cloud can be extremely complex with the number of people who have access and the rise of multi-cloud environments.

In the cloud, maintaining a reliable chain of custody becomes even more complex than it already is, due to having to account for multiple access points, service providers and third parties. Having automated evidence tracking is a must. It means that all actions are logged, from collection to storage to access. Automation also minimizes the chance of human error, reducing the risk of mistakes or gaps in evidence handling, especially in high pressure fast moving investigations.

The ability to preserve unaltered copies of forensic evidence in a secure manner is required to ensure integrity throughout an investigation. It is not just a technical concern, its a legal one, ensuring that your evidence handling is documented and time stamped allows it to stand up to court or regulatory review.

Real cloud forensics platforms should autonomously handle chain of custody in the background, recording and safeguarding evidence without human intervention.

3. Automated collection and isolation

When malicious activity is detected, the speed at which security teams can determine root cause and scope is essential to reducing Mean Time to Response (MTTR).

Automated forensic data collection and system isolation ensures that evidence is collected and compromised resources are isolated at the first sign of malicious activity. This can often be before an attacker has had the change to move latterly or cover their tracks. This enables security teams to prevent potential damage and spread while a deeper-dive forensics investigation takes place. This method also ensures critical incident evidence residing in ephemeral environments is preserved in the event it is needed for an investigation. This evidence may only exist for minutes, leaving no time for a human analyst to capture it.

Cloud forensics and incident response platforms should offer the ability to natively integrate with incident detection and alerting systems and/or built-in product automation rules to trigger evidence capture and resource isolation.

4. Ease of use

Security teams shouldn’t require deep cloud or incident response knowledge to perform forensic investigations of cloud resources. They already have enough on their plates.

While traditional forensics tools and approaches have made investigation and response extremely tedious and complex, modern forensics platforms prioritize usability at their core, and leverage automation to drastically simplify the end-to-end incident response process, even when an incident spans multiple Cloud Service Providers (CSPs).

Useability is a core requirement for any modern forensics platform. Security teams should not need to have indepth knowledge of every system and resource in a given estate. Workflows, automation and guidance should make it possible for an analyst to investigate whatever resource they need to.

Unifying the workflow across multiple clouds can also save security teams a huge amount of time and resources. Investigations can often span multiple CSP’s. A good security platform should provide a single place to search, correlate and analyze evidence across all environments.

Offering features such as cross cloud support, data enrichment, a single timeline view, saved search, and faceted search can help advanced analysts achieve greater efficiency, and novice analysts are able to participate in more complex investigations.

5. Incident preparedness

Incident response shouldn't just be reactive. Modern security teams need to regularly test their ability to acquire new evidence, triage assets and respond to threats across both new and existing resources, ensuring readiness even in the rapidly changing environments of the cloud.  Having the ability to continuously assess your incident response and forensics workflows enables you to rapidly improve your processes and identify and mitigate any gaps identified that could prevent the organization from being able to effectively respond to potential threats.

Real forensics platforms deliver features that enable security teams to prepare extensively and understand their shortcomings before they are in the heat of an incident. For example, cloud forensics platforms can provide the ability to:

  • Run readiness checks and see readiness trends over time
  • Identify and mitigate issues that could prevent rapid investigation and response
  • Ensure the correct logging, management agents, and other cloud-native tools are appropriately configured and operational
  • Ensure that data gathered during an investigation can be decrypted
  • Verify that permissions are aligned with best practices and are capable of supporting incident response efforts

Cloud forensics with Darktrace

Darktrace delivers a proactive approach to cyber resilience in a single cybersecurity platform, including cloud coverage. Darktrace / CLOUD is a real time Cloud Detection and Response (CDR) solution built with advanced AI to make cloud security accessible to all security teams and SOCs. By using multiple machine learning techniques, Darktrace brings unprecedented visibility, threat detection, investigation, and incident response to hybrid and multi-cloud environments.

Darktrace’s cloud offerings have been bolstered with the acquisition of Cado Security Ltd., which enables security teams to gain immediate access to forensic-level data in multi-cloud, container, serverless, SaaS, and on-premises environments.

[related-resource]

Continue reading
About the author
Your data. Our AI.
Elevate your network security with Darktrace AI