Why ransomware has changed
Ransomware attacks have continued to increase globally, with 698 incidents reported in May 2026, representing a 48% rise compared to 472 incidents in May 2025 [1]. At the same time, the ransomware landscape is evolving. Several major ransomware groups, including LockBit [2], have been disrupted by successful joint law enforcement operations, resulting in a shift away from a small number of dominant actors towards a more fragmented and distributed ecosystem. This is increasingly composed of smaller groups who play a specialized role in the attack, such as initial access brokers, affiliates or developers.
As a result, ransomware tactics, techniques, and procedures (TTPs) are becoming more diverse and less predictable. On top of this, adversaries are leveraging native tools and legitimate penetration testing frameworks to evade detection. Anomaly-based detection is therefore critical to identify pre-ransomware activity, rather than relying on signatures associated with a handful of well-known ransomware groups.
As these attacks often unfold over several days, there is a critical window for defenders to act. In this context, behavioral-based detection plays a vital role in identifying suspicious pre-ransomware activity, and enabling early intervention before encryption or exfiltration occurs.
Inside a modern ransomware intrusion
In early 2026, Darktrace detected activity within a customer’s environment related to a multi-stage ransomware intrusion from the initial compromise. This activity does not appear to be attributable to a specific ransomware group, and no known ransomware payload was observed until the final stage.
The attack aligns with a broader industry trend in which compromised virtual private network (VPN) credentials are used as an entry point, followed by rapid internal reconnaissance and lateral movement using legitimate administrative tools. This growing preference for native tools and legitimate frameworks in cyber-attacks illustrates that it is increasingly unreliable to depend solely on traditional indicators of compromise such as known malware signatures or exploit detection.
The intrusion also involved the use of Sliver, an open-source adversary emulation framework, which is increasingly observed in real-world attacks. Originally designed for penetration testing and red teaming, Sliver has gained traction among threat actors as a stealthier alternative to more heavily signatured frameworks such as Cobalt Strike. As a legitimate framework, its use further complicates detection for security tools that rely on known malicious signatures.
Darktrace’s detection of a ransomware event in a customer’s environment
The initial compromise appears to have occurred via compromised credentials used over the VPN shortly before, or at the onset of the first indicators of suspicious activity. While it remains unclear as to how or when the threat actors gained access to these credentials, the use of initial access brokers (IABs) is a common feature of modern ransomware operations. This suggests that access to the environment may have been established several days or weeks beforehand.
The intrusion unfolded over three days, presenting multiple opportunities for early detection and intervention before ransomware deployment. The attack progressed through a compressed but structured sequence: initial access and reconnaissance were completed within hours, followed by privilege escalation and lateral movement the next day, and culminating in data exfiltration and encryption shortly thereafter. Throughout each stage, distinct behavioral anomalies emerged across the network providing clear indicators of malicious activity well before the ransomware was deployed.
While Darktrace’s Autonomous Response capability was enabled within the customer’s environment, it was not fully configured across the impacted devices, allowing the attack to progress to ransomware deployment. Had Autonomous Response been fully deployed across the affected systems, it could have taken targeted action against the earliest stages of malicious activity, potentially disrupting the intrusion before it escalated.
Day 1: Reconnaissance and privilege escalation
The threat actor gained access via compromised VPN credentials and initiated internal reconnaissance. Darktrace detected anomalous scanning behavior, including unusual port scanning activity and widespread network enumeration.
Specifically, Darktrace detected a high volume of east-west scanning activity across a broad range of ports, with TCP connections targeting ports 21, 80, 445, 4899 and 8080. Associated URIs suggested the use of Nmap, a widely used penetration testing tool. This highlights how attackers often leverage legitimate penetration testing tools for malicious reconnaissance, enabling them to blend into normal network activity and evade traditional signature-based detection methods.
Several devices were observed using administrative credentials to carry out privileged actions in a manner that was highly anomalous for the environment. This activity was accompanied by behavior consistent with SMB authentication scanning, suggesting efforts to identify and access additional systems. As the activity intensified, an increasing number of devices became involved, signalling lateral movement and further spread across the network.
Darktrace also identified privilege escalation through active directory (AD) replication abuse, specifically via the drsuapi::DRSGetNCChanges function. This technique allows an attacker with sufficient privileges to request directory replication data from a domain controller (DC), enabling them to extract credentials, including password hashes, without directly interacting with user accounts. Commonly associated with ‘DCSync’ attacks, this technique is frequently used to obtain highly privileged credentials and enable further escalation within an environment.
This activity was seen alongside the use of the now obsolete SMBv1, repeated NTLM authentication attempts using multiple variations of ‘Administrator’ credentials, reverse DNS scanning, and large-scale network scanning. Darktrace observed widespread use of SMBv1 across the customer’s environment, exposing a significant security weakness. As a legacy protocol with well-documented weaknesses, SMBv1 can be exploited to facilitate lateral movement, allowing the attackers to expand their access following initial compromise.
Day 3: Lateral Movement, Command & Control, and Exfiltration
Two days later, the attacker escalated privileges and expanded their foothold using living-off-the-land (LOTL) techniques such as PSExec, WMI, and RDP. Concurrently, Darktrace identified command-and-control (C2)-style communications consistent with the Sliver framework, alongside rare outbound connections to cloud infrastructure indicating potential data exfiltration. The volume and severity of observed activity increased as attack behavior intensified.
The device was observed conducting extensive lateral movement, leveraging LOTL techniques to evade detection. Activity included WMI execution (e.g. ExecQuery), DCE-RPC activity, SMB sessions and file writes, most of which were successful, as well as the deployment of PSEXESVC.exe via ADMIN$ shares and prolonged RDP sessions. Darktrace identified this behavior as highly anomalous for the environment. Such activity is commonly associated with the transfer of attacker tooling, remote command execution, and the establishment of persistent access across compromised systems.
On the same day, Darktrace detected C2-style SSL communications originating from multiple internal devices to rare external endpoints. These connections exhibited anomalous characteristics, including invalid SSL certificates and repeated connection patterns resembling beaconing. Analysis of the observed JA3 fingerprint further linked the activity to Sliver, the adversary simulation framework referenced earlier, as the hash has previously been associated with Sliver-related infrastructure [3]. The use of this framework reflects a broader trend of attackers repurposing legitimate offensive security tools for stealthy C2 communications. Connections to 137[.]220[.]59[.]55 (ASN AS20473 AS-VULTR) indicated that the communications were likely routed via a virtual private server (VPS) hosted by Vultr. Attackers often utilize VPS infrastructure from legitimate cloud providers like Vultr to obscure their true origin, blend into benign traffic, and evade IP-based detection mechanisms [4].
Darktrace also observed a device initiating SSL connections to safedata.s3[.]wasabisys[.]com, an endpoint associated with Wasabi cloud storage. Darktrace recognized that neither the destination nor the associated IP address had previously been observed within the environment. More than 200 MB of data was subsequently uploaded externally to endpoints sharing the same JA3 client hash, indicating a sustained transfer session and potential data exfiltration to third-party storage. The apparent exfiltration prior to encryption is consistent with a double-extortion ransomware strategy.
Day 4: Encryption
The attack culminated in ransomware deployment, marking the transition from suspicious network activity to a business-impacting incident. Using SMB-based propagation, the threat actor encrypted thousands of files across the network, affecting multiple systems and disrupting normal operations. Throughout the encryption event, the legacy SMBv1 protocol was used extensively across multiple internal systems, resulting in a significant increase in newly encrypted files.
Darktrace’s Cyber AI Analyst automatically investigated and correlated the encryption activity and related events into a single incident narrative, providing the customer with real-time visibility into the attack while significantly reducing investigation time.
Defender action recommendations
What Could Have Stopped the Attack Earlier?
Although the attack ultimately resulted in ransomware deployment, there were multiple opportunities to detect, contain, and disrupt the intrusion before encryption occurred. The following actions could have significantly reduced the overall impact:
Detect and investigate indicators of reconnaissance and lateral movement
- Unusual scanning
- Active Directory replication anomalies consistent with DCSync activity
- Anomalous use of native tools and processes indicative of LOTL attacks
- Unusual use of common reconnaissance tools such as Nmap and NetScan
Contain compromised credentials and affected devices
- Disable and reset compromised VPN credentials
- Isolate devices performing anomalous scanning and lateral movement activity
Block suspicious external communications and data exfiltration
- Use anomaly-based detection to detect and block repeated outbound connections to rare external infrastructure
- Prevent data exfiltration to unauthorized cloud storage services such as Wasabi
Conclusion
The incident highlights the importance of anomaly-based detection, particularly against attacks that primarily use native or legitimate tools to evade traditional security measures. Darktrace identified suspicious activity from the first day of the compromise, providing multiple opportunities to disrupt the intrusion before it progressed to lateral movement and data exfiltration.
In this instance, detection was not the limiting factor; response time was. Prompt investigation and containment of devices exhibiting anomalous behavior could have prevented lateral movement, data exfiltration, and ultimately ransomware deployment.
As adversaries increasingly prioritize stealth over custom malware, relying instead on legitimate tools, valid credentials, and trusted infrastructure, traditional signature-based detection becomes less effective. Identifying subtle behavioral deviations early remains critical to disrupting attacks before they escalate into full-scale ransomware incidents.
Credit to Alexandra Evzona (Cyber Analyst), Priya Thapa (Senior Cyber Analyst)
Edited by Ryan Traill (Content Manager)
Appendices
References
Indicators of Compromise (IoCs)
IP Addresses
- 137[.]220[.]59[.]55 – Potential C2 infrastructure (Vultr AS20473)
- 38[.]27[.]106[.]123 – Wasabi cloud storage endpoint associated with potential data exfiltration
- 38[.]27[.]106[.]128 – Wasabi cloud storage endpoint associated with potential data exfiltration
- 38[.]27[.]106[.]117 – Wasabi cloud storage endpoint associated with potential data exfiltration
Domains
- safedata[.]s3[.]wasabisys[.]com – Potential data exfiltration endpoint
- *.wasabisys[.]com – Associated Wasabi cloud storage infrastructure
JA3 Fingerprint
- d6828e30ab66774a91a96ae93be4ae4c – Associated with the Sliver adversary emulation framework
Files
- Delete[.]me – File observed during reconnaissance activity, commonly associated with NetScan
Darktrace Model Coverage
· Anomalous Connection / Active Remote Desktop Tunnel
· Anomalous Connection / Anomalous Remote Registry Service Control
· Anomalous Connection / Multiple Failed Windows UDP
· Anomalous Connection / New or Uncommon Service Control
· Anomalous Connection / New or Uncommon Service Enumeration
· Anomalous Connection / New User Agent to IP Without Hostname
· Anomalous Connection / SMB Enumeration
· Anomalous Connection / Suspicious Activity On High Risk Device
· Anomalous Connection / Suspicious Read Write Ratio
· Anomalous Connection / Sustained MIME Type Conversion
· Anomalous Connection / Uncommon 1 GiB Outbound
· Anomalous Connection / Unusual Admin RDP Session
· Anomalous Connection / Unusual Admin SMB Session
· Anomalous Connection / Unusual SMB Version 1 Connectivity
· Anomalous File / EXE from Rare External Location
· Anomalous File / Internal / Additional Extension Appended to SMB File
· Anomalous Server Activity / Outgoing from Server
· Compromise / Beaconing Activity To External Rare
· Compromise / Ransomware / Possible Ransom Note Read
· Compromise / Ransomware / Ransom or Offensive Words Written to SMB
· Compromise / Ransomware / Suspicious SMB Activity
· Device / Anonymous NTLM Logins
· Device / Attack and Recon Tools
· Device / Initial Attack Chain Activity
· Device / Large Number of Model Alerts
· Device / Long Agent Connection to New Endpoint
· Device / Multiple Lateral Movement Model Alerts
· Device / Network Scan
· Device / New or Uncommon SMB Named Pipe
· Device / New or Unusual Remote Command Execution
· Device / New User Agent
· Device / Possible RPC Lateral Movement
· Device / Possible SMB/NTLM Brute Force
· Device / RDP Scan
· Device / SMB Lateral Movement
· Device / SMB Session Brute Force (Non-Admin)
· Device / SMB Version 1 Access Failures
· Device / Suspicious File Delete Activity
· Device / Suspicious Network Scan Activity
· Device / Unusual SMB Error Detected
· Device / Unusual SMB To Critical Resource
· Device / Unusual Winreg Operation
· Unusual Activity / Multiple Failed Internal Connections
· Unusual Activity / Possible RPC Recon Activity
· Unusual Activity / Sustained Anomalous SMB Activity
· Unusual Activity / Unusual External Data to New Endpoint
· Unusual Activity / Unusual External Data Transfer
· Unusual Activity / Unusual File Storage Data Transfer
· Unusual Activity / Unusual Large Internal Transfer
· User / New Admin Credentials on Client
· User / NTLM Login from Unauthenticated Device
Autonomous Response Model Alerts
· Antigena / Network / External Threat / Antigena Ransomware Block
· Antigena / Network / External Threat / Antigena Suspicious File Block
· Antigena / Network / Insider Threat / Antigena Active Threat SMB Write Block
· Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity
· Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block
· Antigena / Network / Insider Threat / Antigena Network Scan Block
· Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Block
· Antigena / Network / Manual / Quarantine Device
· Antigena / Network / Significant Anomaly / Antigena Alerts Over Time Block
· Antigena / Network / Significant Anomaly / Antigena Controlled and Model Alert
· Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block
· Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block 100
· Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block
MITRE ATT&CK MAPPING
Command and control - Protocol Tunneling - T1572
Command and control – Web Protocols – T1071.001
Credential Access- Exploitation for Credential Access- T1212
Credential Access- Password Guessing- T1110
Discovery- File and Directory Discovery- T1083
Discovery- Network Service Discovery- T1046
Discovery- Network Share Discovery- T1135
Discovery- Remote System Discovery- T1018
Exfiltration- Exfiltration Over C2 Channel- T1041
Exfiltration- Exfiltration to Cloud Storage- T1567
Impact- Data Encrypted for Impact- T1486
Impact- Data Encrypted for Impact- T1486
Impact- Service Stop - T1489
Initial Access- Public-Facing Application- T1190
Lateral Movement- Exploitation of Remote Services- T1210
Lateral Movement- Remote Desktop Protocol- T1021
Lateral Movement- SMB/Windows Admin Shares- T1021
Lateral Movement- Taint Shared Content- T1080
Persistence- Modify Registry- T1112
Privilege Escalation- Exploitation for Privilege Escalation- T0890
Privilege Escalation- Valid Accounts- T1078
Reconnaissance- Scanning IP Blocks- T1595
Reconnaissance- Vulnerability Scanning- T1595
Resource Development- Malware- T1588
Stealth- File Deletion- T1070
