February 15, 2024

Detecting & Containing Gootloader Malware

Learn how Darktrace helps detect and contain multi-functional threats like the Gootloader malware. Stay ahead of cyber threats with Darktrace AI solutions.

Written by

Ashiq Shafee

Cyber Security Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Ashiq Shafee

Cyber Security Analyst

Feb 2024

What is multi-functional malware?

While traditional malware variants were designed with one specific objective in mind, the emergence of multi-functional malware, such as loader malware, means that organizations are likely to be confronted with multiple malicious tools and strains of malware at once. These threats often have non-linear attack patterns and kill chains that can quickly adapt and progress quicker than human security teams are able to react. Therefore, it is more important than ever for organizations to adopt an anomaly approach to combat increasingly versatile and fast-moving threats.

Example of Multi-functional malware

One example of a multi-functional malware recently observed by Darktrace can be seen in Gootloader, a multi-payload loader variant that has been observed in the wild since 2020. It is known to primarily target Windows-based systems across multiple industries in the US, Canada, France, Germany, and South Korea [1].

How does Gootloader malware work?

Once installed on a target network, Gootloader can download additional malicious payloads that allow threat actors to carry out a range of harmful activities, such as stealing sensitive information or encrypting files for ransom.

The Gootloader malware is known to infect networks via search engine optimization (SEO) poisoning, directing users searching for legitimate documents to compromised websites hosting a malicious payload masquerading as the desired file.

If the malware remains undetected, it paves the way for a second stage payload known as Gootkit, which functions as a banking trojan and information-stealer, or other malware tools including Cobalt Strike and Osiris [2].

Darktrace detection of Gootloader malware

In late 2023, Darktrace observed one instance of Gootloader affecting a customer in the US. Thanks to its anomaly-focused approach, Darktrace quickly identified the anomalous activity surrounding this emerging attack and brought it to the immediate attention of the customer’s security team. All the while, Darktrace's Autonomous Response was in place and able to autonomously intervene, containing the suspicious activity and ensuring the Gootloader compromise could not progress any further.

Autonomous Response was in place and able to autonomously intervene, containing the suspicious activity and ensuring the Gootloader compromise could not progress any further.

In September 2023, Darktrace identified an instance of the Gootloader malware attempting to propagate within the network of a customer in the US. Darktrace identified the first indications of the compromise when it detected a device beaconing to an unusual external location and performing network scanning. Following this, the device was observed making additional command-and-control (C2) connections, before finally downloading an executable (.exe) file which likely represented the download of a further malicious payload.

As this customer had subscribed to the Proactive Notification Service (PTN), the suspicious activity was escalated to the Darktrace Security Operations Center (SOC) for further investigation by Darktrace’s expert analysts. The SOC team were able to promptly triage the incident and advise urgent follow-up actions.

Gootloader Attack Overview

Figure 1: Timeline of Anomalous Activities seen on the breach device.

Initial Beaconing and Scanning Activity

On September 21, 2023, Darktrace observed the first indications of compromise on the network when a device began to make regular connections to an external endpoint that was considered extremely rare for the network, namely ‘analyzetest[.]ir’.

Although the endpoint did not overtly seem malicious in nature (it appeared to be related to laboratory testing), Darktrace recognized that it had never previously been seen on the customer’s network and therefore should be treated with caution. This initial beaconing activity was just the beginning of the malicious C2 communications, with several additional instances of beaconing detected to numerous suspicious endpoints, including funadhoo.gov[.]mv, tdgroup[.]ru’ and ‘army.mil[.]ng.

Figure 2: Initial beaconing activity detected on the breach device.

Soon thereafter, Darktrace detected the device performing internal reconnaissance, with an unusually large number of connections to other internal locations observed. This scanning activity appeared to primarily be targeting the SMB protocol by scanning port 445.

Within seconds of Darktrace's detection of this suspicious SMB scanning activity, Darktrace's Autonomous Response moved to contain the compromise by blocking the device from connecting to port 445 and enforcing its ‘pattern of life’. Darktrace’s Self-Learning AI enables it to learn a device’s normal behavior and recognize if it deviates from this; by enforcing a pattern of life on an affected device, malicious activity is inhibited but the device is allowed to continue its expected activity, minimizing disruption to business operations.

Figure 3: The breach device Model Breach Event Log showing Darktrace identifying suspicious SMB scanning activity and the corresponding respose actions.

Following the initial detection of this anomalous activity, Darktrace’s Cyber AI Analyst launched an autonomous investigation into the beaconing and scanning activity and was able to connect these seemingly separate events into one incident. AI Analyst analyzes thousands of connections to hundreds of different endpoints at machine speed and then summarizes its findings in a single pane of glass, giving customers the necessary information to assess the threat and begin remediation if necessary. This significantly lessens the burden for human security teams, saving them previous time and resources, while ensuring they maintain full visibility over any suspicious activity on their network.

Figure 4: Cyber AI Analyst incident log summarizing the technical details of the device’s beaconing and scanning behavior.

Beaconing Continues

Darktrace continued to observe the device carrying out beaconing activity over the next few days, likely representing threat actors attempting to establish communication with their malicious infrastructure and setting up a foothold within the customer’s environment. In one such example, the device was seen connecting to the suspicious endpoint ‘fysiotherapie-panken[.]nl’. Multiple open-source intelligence (OSINT) vendors reported this endpoint to be a known malware delivery host [3].

Once again, Darktrace Autonomous Response was in place to quickly intervene in response to these suspicious external connection attempts. Over the course of several days, Darktrace blocked the offending device from connecting to suspicious endpoints via port 443 and enforced its pattern of life. These autonomous actions by Darktrace effectively mitigated and contained the attack, preventing it from escalating further along the kill chain and providing the customer’s security team crucial time to take act and employ their own remediation.

Figure 5: A sample of the Autonomous Response actions that was applied on the affected device.

Possible Payload Retrieval

A few days later, on September 26, 2023, Darktrace observed the affected device attempting to download a Windows Portable Executable via file transfer protocol (FTP) from the external location ‘ftp2[.]sim-networks[.]com’, which had never previously been seen on the network. This download likely represented the next step in the Gootloader infection, wherein additional malicious tooling is downloaded to further cement the malicious actors’ control over the device. In response, Darktrace immediately blocked the device from making any external connections, ensuring it could not download any suspicious files that may have rapidly escalated the attackers’ efforts.

Figure 6: DETECT’s identification of the offending device downloading a suspicious executable file via FTP.

The observed combination of beaconing activity and a suspicious file download triggered an Enhanced Monitoring breach, a high-fidelity DETECT model designed to detect activities that are more likely to be indicative of compromise. These models are monitored by the Darktrace SOC round the clock and investigated by Darktrace’s expert team of analysts as soon as suspicious activity emerges.

In this case, Darktrace’s SOC triaged the emerging activity and sent an additional notice directly to the customer’s security team, informing them of the compromise and advising on next steps. As this customer had subscribed to Darktrace’s Ask the Expert (ATE) service, they also had a team of expert analysts available to them at any time to aid their investigations.

Figure 7: Enhanced Monitoring Model investigated by the Darktrace SOC.

Conclusion

Loader malware variants such as Gootloader often lay the groundwork for further, potentially more severe threats to be deployed within compromised networks. As such, it is crucial for organizations and their security teams to identify these threats as soon as they emerge and ensure they are effectively contained before additional payloads, like information-stealing malware or ransomware, can be downloaded.

In this instance, Darktrace demonstrated its value when faced with a multi-payload threat by detecting Gootloader at the earliest stage and responding to it with swift targeted actions, halting any suspicious connections and preventing the download of any additional malicious tooling.

Darktrace DETECT recognized that the beaconing and scanning activity performed by the affected device represented a deviation from its expected behavior and was indicative of a potential network compromise. Meanwhile, Darktrace ensured that any suspicious activity was promptly shut down, buying crucial time for the customer’s security team to work with Darktrace’s SOC to investigate the threat and quarantine the compromised device.

Credit to: Ashiq Shafee, Cyber Security Analyst, Qing Hong Kwa, Senior Cyber Analyst and Deputy Analyst Team Lead, Singapore

Appendices

Darktrace DETECT Model Detections

Anomalous Connection / Rare External SSL Self-Signed

Device / Suspicious SMB Scanning Activity

Anomalous Connection / Young or Invalid Certificate SSL Connections to Rare

Compromise / High Volume of Connections with Beacon Score

Compromise / Beacon to Young Endpoint

Compromise / Beaconing Activity To External Rare

Compromise / Slow Beaconing Activity To External Rare

Compromise / Beacon for 4 Days

Anomalous Connection / Suspicious Expired SSL

Anomalous Connection / Multiple Failed Connections to Rare Endpoint

Compromise / Sustained SSL or HTTP Increase

Compromise / Large Number of Suspicious Successful Connections

Compromise / Large Number of Suspicious Failed Connections

Device / Large Number of Model Breaches

Anomalous File / FTP Executable from Rare External Location

Device / Initial Breach Chain Compromise

RESPOND Models

Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network/Insider Threat/Antigena Network Scan Block

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block

Antigena / Network / External Threat / Antigena Suspicious File Block

Antigena / Network / External Threat / Antigena File then New Outbound Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

List of Indicators of Compromise (IoCs)

Type

Hostname

IoCs + Description

explorer[.]ee - C2 Endpoint

fysiotherapie-panken[.]nl- C2 Endpoint

devcxp2019.theclearingexperience[.]com- C2 Endpoint

campsite.bplaced[.]net- C2 Endpoint

coup2pompes[.]fr- C2 Endpoint

analyzetest[.]ir- Possible C2 Endpoint

tdgroup[.]ru- C2 Endpoint

ciedespuys[.]com- C2 Endpoint

fi.sexydate[.]world- C2 Endpoint

funadhoo.gov[.]mv- C2 Endpoint

geying.qiwufeng[.]com- C2 Endpoint

goodcomix[.]fun- C2 Endpoint

ftp2[.]sim-networks[.]com- Possible Payload Download Host

MITRE ATT&CK Mapping

Tactic – Technique

Reconnaissance - Scanning IP blocks (T1595.001, T1595)

Command and Control - Web Protocols , Application Layer Protocol, One-Way Communication, External Proxy, Non-Application Layer Protocol, Non-Standard Port (T1071.001/T1071, T1071, T1102.003/T1102, T1090.002/T1090, T1095, T1571)

Collection – Man in the Browser (T1185)

Resource Development - Web Services, Malware (T1583.006/T1583, T1588.001/T1588)

Persistence - Browser Extensions (T1176)

References

1. https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/gootloader

2. https://redcanary.com/threat-detection-report/threats/gootloader/

3. https://www.virustotal.com/gui/domain/fysiotherapie-panken.nl

Written by

Ashiq Shafee

Cyber Security Analyst

Inside the SOC

Written by

Ashiq Shafee

Cyber Security Analyst

Product Marketing Manager, OT Security & Compliance

Watch the NIS2 Webinar

Blog

Email

September 30, 2025

Out of Character: Detecting Vendor Compromise and Trusted Relationship Abuse with Darktrace

What is Vendor Email Compromise?

Vendor Email Compromise (VEC) refers to an attack where actors breach a third-party provider to exploit their access, relationships, or systems for malicious purposes. The initially compromised entities are often the target’s existing partners, though this can extend to any organization or individual the target is likely to trust.

It sits at the intersection of supply chain attacks and business email compromise (BEC), blending technical exploitation with trust-based deception. Attackers often infiltrate existing conversations, leveraging AI to mimic tone and avoid common spelling and grammar pitfalls. Malicious content is typically hosted on otherwise reputable file sharing platforms, meaning any shared links initially seem harmless.

While techniques to achieve initial access may have evolved, the goals remain familiar. Threat actors harvest credentials, launch subsequent phishing campaigns, attempt to redirect invoice payments for financial gain, and exfiltrate sensitive corporate data.

Why traditional defenses fall short

These subtle and sophisticated email attacks pose unique challenges for defenders. Few busy people would treat an ongoing conversation with a trusted contact with the same level of suspicion as an email from the CEO requesting ‘URGENT ASSISTANCE!’ Unfortunately, many traditional secure email gateways (SEGs) struggle with this too. Detecting an out-of-character email, when it does not obviously appear out of character, is a complex challenge. It’s hardly surprising, then, that 83% of organizations have experienced a security incident involving third-party vendors [1].

This article explores how Darktrace detected four different vendor compromise campaigns for a single customer, within a two-week period in 2025. Darktrace / EMAIL successfully identified the subtle indicators that these seemingly benign emails from trusted senders were, in fact, malicious. Due to the configuration of Darktrace / EMAIL in this customer’s environment, it was unable to take action against the malicious emails. However, if fully enabled to take Autonomous Response, it would have held all offending emails identified.

How does Darktrace detect vendor compromise?

The answer lies at the core of how Darktrace operates: anomaly detection. Rather than relying on known malicious rules or signatures, Darktrace learns what ‘normal’ looks like for an environment, then looks for anomalies across a wide range of metrics. Despite the resourcefulness of the threat actors involved in this case, Darktrace identified many anomalies across these campaigns.

Different campaigns, common traits

A wide variety of approaches was observed. Individuals, shared mailboxes and external contractors were all targeted. Two emails originated from compromised current vendors, while two came from unknown compromised organizations - one in an associated industry. The sender organizations were either familiar or, at the very least, professional in appearance, with no unusual alphanumeric strings or suspicious top-level domains (TLDs). Subject line, such as “New Approved Statement From [REDACTED]” and “[REDACTED] - Proposal Document” appeared unremarkable and were not designed to provoke heightened emotions like typical social engineering or BEC attempts.

All emails had been given a Microsoft Spam Confidence Level of 1, indicating Microsoft did not consider them to be spam or malicious [2]. They also passed authentication checks (including SPF, and in some cases DKIM and DMARC), meaning they appeared to originate from an authentic source for the sender domain and had not been tampered with in transit.

All observed phishing emails contained a link hosted on a legitimate and commonly used file-sharing site. These sites were often convincingly themed, frequently featuring the name of a trusted vendor either on the page or within the URL, to appear authentic and avoid raising suspicion. However, these links served only as the initial step in a more complex, multi-stage phishing process.

‍

Figure 1: A legitimate file sharing site used in phishing emails to host a secondary malicious link.

Figure 2: Another example of a legitimate file sharing endpoint sent in a phishing email and used to host a malicious link.

If followed, the recipient would be redirected, sometimes via CAPTCHA, to fake Microsoft login pages designed to capturing credentials, namely http://pub-ac94c05b39aa4f75ad1df88d384932b8.r2[.]dev/offline[.]html and https://s3.us-east-1.amazonaws[.]com/s3cure0line-0365cql0.19db86c3-b2b9-44cc-b339-36da233a3be2ml0qin/s3cccql0.19db86c3-b2b9-44cc-b339-36da233a3be2%26l0qn[.]html#.

The latter made use of homoglyphs to deceive the user, with a link referencing ‘s3cure0line’, rather than ‘secureonline’. Post-incident investigation using open-source intelligence (OSINT) confirmed that the domains were linked to malicious phishing endpoints [3] [4].

Figure 3: Fake Microsoft login page designed to harvest credentials.

Figure 4: Phishing kit with likely AI-generated image, designed to harvest user credentials. The URL uses ‘s3cure0line’ instead of ‘secureonline’, a subtle misspelling intended to deceive users.

Darktrace Anomaly Detection

Some senders were unknown to the network, with no previous outbound or inbound emails. Some had sent the email to multiple undisclosed recipients using BCC, an unusual behavior for a new sender.

Where the sender organization was an existing vendor, Darktrace recognized out-of-character behavior, in this case it was the first time a link to a particular file-sharing site had been shared. Often the links themselves exhibited anomalies, either being unusually prominent or hidden altogether - masked by text or a clickable image.

Crucially, Darktrace / EMAIL is able to identify malicious links at the time of processing the emails, without needing to visit the URLs or analyze the destination endpoints, meaning even the most convincing phishing pages cannot evade detection – meaning even the most convincing phishing emails cannot evade detection. This sets it apart from many competitors who rely on crawling the endpoints present in emails. This, among other things, risks disruption to user experience, such as unsubscribing them from emails, for instance.

Darktrace was also able to determine that the malicious emails originated from a compromised mailbox, using a series of behavioral and contextual metrics to make the identification. Upon analysis of the emails, Darktrace autonomously assigned several contextual tags to highlight their concerning elements, indicating that the messages contained phishing links, were likely sent from a compromised account, and originated from a known correspondent exhibiting out-of-character behavior.

A summary of the anomalous email, confirming that it contained a highly suspicious link. — Figure 5: Tags assigned to offending emails by Darktrace / EMAIL.

‍

Figure 6: A summary of the anomalous email, confirming that it contained a highly suspicious link.

Out-of-character behavior caught in real-time

In another customer environment around the same time Darktrace / EMAIL detected multiple emails with carefully crafted, contextually appropriate subject lines sent from an established correspondent being sent to 30 different recipients. In many cases, the attacker hijacked existing threads and inserted their malicious emails into an ongoing conversation in an effort to blend in and avoid detection. As in the previous, the attacker leveraged a well-known service, this time ClickFunnels, to host a document containing another malicious link. Once again, they were assigned a Microsoft Spam Confidence Level of 1, indicating that they were not considered malicious.

Figure 7: The legitimate ClickFunnels page used to host a malicious phishing link.

This time, however, the customer had Darktrace / EMAIL fully enabled to take Autonomous Response against suspicious emails. As a result, when Darktrace detected the out-of-character behavior, specifically, the sharing of a link to a previously unused file-sharing domain, and identified the likely malicious intent of the message, it held the email, preventing it from reaching recipients’ inboxes and effectively shutting down the attack.

Figure 8: Darktrace / EMAIL’s detection of malicious emails inserted into an existing thread.*

*To preserve anonymity, all real customer names, email addresses, and other identifying details have been redacted and replaced with fictitious placeholders.

Legitimate messages in the conversation were assigned an Anomaly Score of 0, while the newly inserted malicious emails identified and were flagged with the maximum score of 100.

Key takeaways for defenders

Phishing remains big business, and as the landscape evolves, today’s campaigns often look very different from earlier versions. As with network-based attacks, threat actors are increasingly leveraging legitimate tools and exploiting trusted relationships to carry out their malicious goals, often staying under the radar of security teams and traditional email defenses.

As attackers continue to exploit trusted relationships between organizations and their third-party associates, security teams must remain vigilant to unexpected or suspicious email activity. Protecting the digital estate requires an email solution capable of identifying malicious characteristics, even when they originate from otherwise trusted senders.

Credit to Jennifer Beckett (Cyber Analyst), Patrick Anjos (Senior Cyber Analyst), Ryan Traill (Analyst Content Lead), Kiri Addison (Director of Product)

Appendices

IoC - Type - Description + Confidence

- http://pub-ac94c05b39aa4f75ad1df88d384932b8.r2[.]dev/offline[.]html#p – fake Microsoft login page

- https://s3.us-east-1.amazonaws[.]com/s3cure0line-0365cql0.19db86c3-b2b9-44cc-b339-36da233a3be2ml0qin/s3cccql0.19db86c3-b2b9-44cc-b339-36da233a3be2%26l0qn[.]html# - link to domain used in homoglyph attack

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique

Initial Access - Phishing – (T1566)

References

1. https://gitnux.org/third-party-risk-statistics/

2. https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about

3. https://www.virustotal.com/gui/url/5df9aae8f78445a590f674d7b64c69630c1473c294ce5337d73732c03ab7fca2/detection

4. https://www.virustotal.com/gui/url/695d0d173d1bd4755eb79952704e3f2f2b87d1a08e2ec660b98a4cc65f6b2577/details

^{The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.}

^{Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.}

^{Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.}

^{The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content}

About the author

Blog

OT

October 1, 2025

Announcing Unified OT Security with Dedicated OT Workflows, Segmentation-Aware Risk Insights, and Next-Gen Endpoint Visibility for Industrial Teams

The challenge of convergence without clarity

Convergence is no longer a roadmap idea, it is the daily reality for industrial security teams. As Information Technology (IT) and Operational Technology (OT) environments merge, the line between a cyber incident and an operational disruption grows increasingly hard to define. A misconfigured firewall rule can lead to downtime. A protocol misuse might look like a glitch. And when a pump stalls but nothing appears in the Security Operations Center (SOC) dashboard, teams are left asking: is this operational or is this a threat?

The lack of shared context slows down response, creates friction between SOC analysts and plant engineers, and leaves organizations vulnerable at exactly the points where IT and OT converge. Defenders need more than alerts, they need clarity that both sides can trust.

The breakthrough with Darktrace / OT

This latest Darktrace / OT release was built to deliver exactly that. It introduces shared context between Security, IT, and OT operations, helping reduce friction and close the security gaps at the intersection of these domains.

With a dedicated dashboard built for operations teams, extended visibility into endpoints for new forms of detection and CVE collection, expanded protocol coverage, and smarter risk modeling aligned to segmentation policies, teams can now operate from a shared source of truth. These enhancements are not just incremental upgrades, they are foundational improvements designed to bring clarity, efficiency, and trust to converged environments.

A dashboard built for OT engineers

The new Operational Overview provides OT engineers with a workspace designed for them, not for SOC analysts. It brings asset management, risk insights and operational alerts into one place. Engineers can now see activity like firmware changes, controller reprograms or the sudden appearance of a new workstation on the network, providing a tailored view for critical insights and productivity gains without navigating IT-centric workflows. Each device view is now enriched with cross-linked intelligence, make, model, firmware version and the roles inferred by Self-Learning AI, making it easier to understand how each asset behaves, what function it serves, and where it fits within the broader industrial process. By suppressing IT-centric noise, the dashboard highlights only the anomalies that matter to operations, accelerating triage, enabling smoother IT/OT collaboration, and reducing time to root cause without jumping between tools.

This is usability with purpose, a view that matches OT workflows and accelerates response.

Figure 1: The Operational Overview provides an intuitive dashboard summarizing all OT Assets, Alerts, and Risk.

Full-spectrum coverage across endpoints, sensors and protocols

The release also extends visibility into areas that have traditionally been blind spots. Engineering workstations, Human-Machine Interfaces (HMIs), contractor laptops and field devices are often the entry points for attackers, yet the hardest to monitor.

Darktrace introduces Network Endpoint eXtended Telemetry (NEXT) for OT, a lightweight collector built for segmented and resource-constrained environments. NEXT for OT uses Endpoint sensors to capture localized network, and now process-level telemetry, placing it in context alongside other network and asset data to:

Identify vulnerabilities and OS data, which is leveraged by OT Risk Management for risk scoring and patching prioritization, removing the need for third-party CVE collection.

Surface novel threats using Self-Learning AI that standalone Endpoint Detection and Response (EDR) would miss.

Extend Cyber AI Analyst investigations through to the endpoint root cause.

NEXT is part of our existing cSensor endpoint agent, can be deployed standalone or alongside existing EDR tools, and allows capabilities to be enabled or disabled depending on factors such as security or OT team objectives and resource utilization.

Figure 2: Darktrace / OT delivers CVE patch priority insights by combining threat intelligence with extended network and endpoint telemetry

The family of Darktrace Endpoint sensors also receive a boost in deployment flexibility, with on-prem server-based setups, as well as a Windows driver tailored for zero-trust and high-security environments.

Protocol coverage has been extended where it matters most. Darktrace now performs protocol analysis of a wider range of GE and Mitsubishi protocols, giving operators real-time visibility into commands and state changes on Programmable Logic Controllers (PLCs), robots and controllers. Backed by Self-Learning AI, this inspection does more than parse traffic, it understands what normal looks like and flags deviations that signal risk.

Integrated risk and governance workflows

Security data is only valuable when it drives action. Darktrace / OT delivers risk insights that go beyond patching, helping teams take meaningful steps even when remediation isn't possible. Risk is assessed not just by CVE presence, but by how network segmentation, firewall policies, and attack path logic neutralize or contain real-world exposure. This approach empowers defenders to deprioritize low-impact vulnerabilities and focus effort where risk truly exists. Building on the foundation introduced in release 6.3, such as KEV enrichment, endpoint OS data, and exploit mapping, this release introduces new integrations that bring Darktrace / OT intelligence directly into governance workflows.

Fortinet FortiGate firewall ingestion feeds segmentation rules into attack path modeling, revealing real exposure when policies fail and closing feeds into patching prioritization based on a policy to CVE exposure assessment.

ServiceNow Configuration Management Database (CMDB) sync ensures asset intelligence stays current across governance platforms, eliminating manual inventory work.

Risk modeling has also been made more operationally relevant. Scores are now contextualized by exploitability, asset criticality, firewall policy, and segmentation posture. Patch recommendations are modeled in terms of safety, uptime and compliance rather than just Common Vulnerability Scoring System (CVSS) numbers. And importantly, risk is prioritized across the Purdue Model, giving defenders visibility into whether vulnerabilities remain isolated to IT or extend into OT-critical layers.

Figure 3: Attack Path Modeling based on NetFlow and network topology reveals high risk points of IT/OT convergence.

The real-world impact for defenders

In today’s environments, attackers move fluidly between IT and OT. Without unified visibility and shared context, incidents cascade faster than teams can respond.

With this release, Darktrace / OT changes that reality. The Operational Overview gives Engineers a dashboard they can use daily, tailored to their workflows. SOC analysts can seamlessly investigate telemetry across endpoints, sensors and protocols that were once blind spots. Operators gain transparency into PLCs and controllers. Governance teams benefit from automated integrations with platforms like Fortinet and ServiceNow. And all stakeholders work from risk models that reflect what truly matters: safety, uptime and compliance.

This release is not about creating more alerts. It is about providing more clarity. By unifying context across IT and OT, Darktrace / OT enables defenders to see more, understand more and act faster.

Because in environments where safety and uptime are non-negotiable, clarity is what matters most.

Join us for our live event where we will discuss these product innovations in greater detail

About the author

Pallavi Singh

Product Marketing Manager, OT Security & Compliance

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Detecting & Containing Gootloader Malware

What is multi-functional malware?

Example of Multi-functional malware

How does Gootloader malware work?

Darktrace detection of Gootloader malware

Gootloader Attack Overview

Initial Beaconing and Scanning Activity

Beaconing Continues

Possible Payload Retrieval

Conclusion

Appendices

Darktrace DETECT Model Detections

RESPOND Models

List of Indicators of Compromise (IoCs)

MITRE ATT&CK Mapping

References

Out of Character: Detecting Vendor Compromise and Trusted Relationship Abuse with Darktrace

Announcing Unified OT Security with Dedicated OT Workflows, Segmentation-Aware Risk Insights, and Next-Gen Endpoint Visibility for Industrial Teams

Enjoying the blog?

More in this series

ShadowV2: An emerging DDoS for hire botnet

SEO Poisoning and Fake PuTTY sites: Darktrace’s Investigation into the Oyster backdoor

The Benefits of Bringing Together Network and Email Security

Blog

Email

September 30, 2025

Out of Character: Detecting Vendor Compromise and Trusted Relationship Abuse with Darktrace

What is Vendor Email Compromise?

Why traditional defenses fall short

How does Darktrace detect vendor compromise?

Different campaigns, common traits

Darktrace Anomaly Detection

Out-of-character behavior caught in real-time

Key takeaways for defenders

Appendices

IoC - Type - Description + Confidence

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique

References

Blog

OT

October 1, 2025

Announcing Unified OT Security with Dedicated OT Workflows, Segmentation-Aware Risk Insights, and Next-Gen Endpoint Visibility for Industrial Teams

The challenge of convergence without clarity

The breakthrough with Darktrace / OT

A dashboard built for OT engineers

Full-spectrum coverage across endpoints, sensors and protocols

Integrated risk and governance workflows

The real-world impact for defenders

Join us for our live event where we will discuss these product innovations in greater detail