Pre-CVE Threat Detection: 10 Examples Identifying Malicious Activity Prior to Public Disclosure of a Vulnerability
Darktrace leverages AI-driven anomaly detection to identify cyber threats before public CVE disclosures. By analyzing behavioral patterns, Darktrace can help organizations detect and contain zero-day exploits early. This proactive approach strengthens cybersecurity posture against nation-state actors, ransomware gangs, and evolving threats across the threat landscape.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Nathaniel Jones
VP, Security & AI Strategy, Field CISO
Share
02
Jul 2025
Tracking CVEs isn’t enough: Why context is critical
Vulnerabilities are weaknesses in a system that can be exploited by malicious actors to gain unauthorized access or to disrupt normal operations. Common Vulnerabilities and Exposures (or CVEs) are a list of publicly disclosed cybersecurity vulnerabilities that can be tracked and mitigated by the security community.
When a vulnerability is discovered, the standard practice is to report it to the vendor or the responsible organization, allowing them to develop and distribute a patch or fix before the details are made public. This is known as responsible disclosure.
With a record-breaking 40,000 CVEs reported for 2024 and a predicted higher number for 2025 by the Forum for Incident Response and Security Teams (FIRST) [1], anomaly-detection is essential for identifying these potential risks. The gap between exploitation of a zero-day and disclosure of the vulnerability can sometimes be considerable, and retroactively attempting to identify successful exploitation on your network can be challenging, particularly if taking a signature-based approach.
Detecting threats without relying on CVE disclosure
Abnormal behaviors in networks or systems, such as unusual login patterns or data transfers, can indicate attempted cyber-attacks, insider threats, or compromised systems. Since Darktrace does not rely on rules or signatures, it can detect malicious activity that is anomalous even without full context of the specific device or asset in question.
For example, during the Fortinet exploitation late last year, the Darktrace Threat Research team were investigating a different Fortinet vulnerability, namely CVE 2024-23113, for exploitation when Mandiant released a security advisory around CVE 2024-47575, which aligned closely with Darktrace’s findings.
Retrospective analysis like this is used by Darktrace’s threat researchers to better understand detections across the threat landscape and to add additional context.
Below are ten examples from the past year where Darktrace detected malicious activity days or even weeks before a vulnerability was publicly disclosed.
Trends in pre-CVE exploitation
Often, the disclosure of an exploited vulnerability can be off the back of an incident response investigation related to a compromise by an advanced threat actor using a zero-day. Once the vulnerability is registered and publicly disclosed as having been exploited, it can kick off a race between the attacker and defender: attack vs patch.
Nation-state actors, highly skilled with significant resources, are known to use a range of capabilities to achieve their target, including zero-day use. Often, pre-CVE activity is “low and slow”, last for months with high operational security. After CVE disclosure, the barriers to entry lower, allowing less skilled and less resourced attackers, like some ransomware gangs, to exploit the vulnerability and cause harm. This is why two distinct types of activity are often seen: pre and post disclosure of an exploited vulnerability.
Darktrace saw this consistent story line play out during several of the Fortinet and PAN OS threat actor campaigns highlighted above last year, where nation-state actors were seen exploiting vulnerabilities first, followed by ransomware gangs impacting organizations [2].
The same applies with the recent SAP Netweaver exploitations being tied to a China based threat actor earlier this spring with subsequent ransomware incidents being observed [3].
Autonomous response
Anomaly-based detection offers the benefit of identifying malicious activity even before a CVE is disclosed; however, security teams still need to quickly contain and isolate the activity.
For example,during the Ivanti chaining exploitation in the early part of 2025, a customer had Darktrace’s Autonomous Response capability enabled on their network. As a result, Darktrace was able to contain the compromise and shut down any ongoing suspicious connectivity by blocking internal connections and enforcing a “pattern of life” on the affected device.
This pre-CVE detection and response by Darktrace occurred 11 days before any public disclosure, demonstrating the value of an anomaly-based approach.
In some cases, customers have even reported that Darktrace stopped malicious exploitation of devices several days before a public disclosure of a vulnerability.
For example, During the ConnectWise exploitation, a customer informed the team that Darktrace had detected malicious software being installed via remote access. Upon further investigation, four servers were found to be impacted, while Autonomous Response had blocked outbound connections and enforced patterns of life on impacted devices.
Beyond signatures: Spotting anomalies before CVEs
By continuously analyzing behavioral patterns, systems can spot unusual activities and patterns from users, systems, and networks to detect anomalies that could signify a security breach.
Through ongoing monitoring and learning from these behaviors, anomaly-based security systems can detect threats that traditional signature-based solutions might miss, while also providing detailed insights into threat tactics, techniques, and procedures (TTPs). This type of behavioral intelligence supports pre-CVE detection, allows for a more adaptive security posture, and enables systems to evolve with the ever-changing threat landscape.
Darktrace's Self-Learning AI Approach
As leaders in cybersecurity AI for over a decade, Darktrace has the expertise to effectively integrate the right AI for optimal results. Darktrace’s Self-Learning AI uses a multi-layered AI approach, learning your unique organization to detect and respond to malicious activity before vulnerabilities are publicly known, often days or even weeks in advance.
By strategically integrating a diverse set of AI techniques, such as machine learning, deep learning, LLMs, and natural language processing, both sequentially and hierarchically, Darktrace's multi-layered AI approach provides a robust defense mechanism that is unique to your organization and adapts to the evolving threat landscape.
Techniques such as Bayesian learning and behavioral clustering allow Darktrace to evaluate different models adaptively, ensuring an accurate understanding of entity behavior. This layer applies behavioral analysis to detect patterns across similar entities and helps predict behaviors, even with sparse data from specific devices or systems. The AI continuously adjusts its frame of reference to remain effective in dynamic environments.
To learn more about Darktrace's AI, read our AI Arsenal White Paper where we break down the different applications of AI in cybersecurity.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption
Núclea prevented a highly targeted phishing attack exploiting trusted relationships—avoiding financial loss, data exposure, and disruption. Darktrace stopped the threat at the point of risk, protecting business continuity and strengthening resilience across the financial ecosystem.
Defend What You Trust: Stories from the Front Lines of Modern Cyber Defense
Security leaders from global organizations across industries sat down with us to share their own front-line experiences and real-world perspectives on how modern attacks unfold, where hidden risks emerge, and how AI is reshaping the way organizations think about the role of security.
AI-powered security for a rapidly growing grocery enterprise
By combining AI-driven detection and autonomous response, this leading grocery holding group has built a security model that delivers continuous protection, accelerates growth, and empowers a small, highly efficient team to safeguard a complex retail ecosystem.
Advancing the Use of Frontier AI in Cybersecurity: Darktrace Joins the OpenAI Daybreak Cyber Partner Program to Explore Defensive AI Integrations
Darktrace joins the OpenAI Daybreak Cyber Partner Program
Today, we announced that Darktrace is joining the OpenAI Daybreak Cyber Partner Program. We’ll be partnering with OpenAI to explore how their cyber capabilities can be integrated within Darktrace products and services to bring new capabilities to our customers.
This partnership is an exciting opportunity to bring together Darktrace’s behavioral AI modelling of the organization with OpenAI’s advanced contextual capabilities to create a new level of understanding for security teams. To understand the impact, it’s helpful to start with how we think about the problem.
At Darktrace, we built our AI in support of the core belief that cybersecurity needs to understand the business it is defending. That's why our Self-Learning AI is designed to help organizations understand normal and abnormal behavior for each organization across their digital environment, including users and identities, networks and cloud, email and collaboration tools, and now AI systems and agents with the rollout of Darktrace / SECURE AI™.
Our goal was never simply to spot known attacks faster. It was to help defenders understand how their organization behaves, potential risks and impact, and where disruption could take hold so they could prepare for the unknown threats that they may not have seen or even imagined before.
That’s exactly what is happening across the threat landscape today. Attacks keep changing; techniques shift, infrastructure evolves, and attackers move with more speed, precision, and context. And now they have even more AI and automation on their side. Attackers are exploiting identities, trusted services, SaaS applications, and business workflows. They are not always breaking in; often, the threat may come from within the organization in the form of insider threat or even rogue agents.
In this reality, defenders need a combination of deep AI modelling of the organization and AI that can connect identified threats to concrete business context, translating this information into real world value, and allow action before risk becomes disruption.
That is the opportunity we see in partnering with OpenAI.
What is the OpenAI Daybreak Cyber Partner Program and why is Darktrace joining
The OpenAI Daybreak Cyber Partner Program is focused on advancing the safe use of AI for cybersecurity. As part of the program’s next phase, OpenAI is working with a select group of trusted partners including Darktrace on scoped product integrations, managed services, and partner-delivered defensive capabilities. We’ll be exploring how OpenAI’s advanced frontier AI capabilities can support defenders in the tools and workflows they already use each day.
For Darktrace, this is a natural extension of our expertise and the work we have been doing for a decade: safely and securely applying the most effective AI techniques in combination to understand organizations, detecting malicious activity at the earliest indicators, and helping cyber defenders act faster.
By using the advanced models and more precise safeguards available in the OpenAI Daybreak Cyber Partner Program, Darktrace and OpenAI will combine Darktrace’s real-time behavioral understanding of an organization's digital estate with OpenAI's ability to interpret wider business context.
This is a unique and powerful combination of insights that could give organizations deeper context on technical risk and help them prioritize workloads and investigations based on potential impact to revenue, operations, and resilience. It can also provide security teams and executives with intelligence into which events matter most to the business, why they matter, and what action to take. Not just finding, for instance, that an agent is compromised, but highlighting that the compromised agent could shut down order fulfilment within the next three hours.
Why the Darktrace and OpenAI partnership matters for defenders
Security teams today have more attack surface, more complex environments to protect, and an increasing volume of threats. The ability to act quickly is critical, but they also need to be able to focus on the risks that could have the greatest business impact.
That is especially important as attackers use AI to scale phishing, automate reconnaissance, find weaknesses, and blend into normal business activity. At the same time, organizations and their employees are using AI to innovate, which introduces an even broader attack surface and new set of risks. Defenders need AI that can operate across the same complexity, but safely, transparently, and in service of building more resilience. And they need a way to safely adopt, govern, and defend AI across their organizations.
Joining the OpenAI Daybreak Cyber Partner Program is another step in that direction. We are still early in this work, and we will take a careful, disciplined approach. But the direction is clear: protecting organizations requires AI that understands the business, not just the attack.
At Darktrace, that is exactly where we remain focused and why we are so excited about this partnership with OpenAI.
Hola VPN Abuse: From Proxy Traffic to Malware and Cryptomining
Introduction
In enterprise environments, non-compliant software traffic can introduce unexpected exposure by creating unmanaged paths for outbound connectivity. Hola VPN is a notable example because of its peer-to-peer design, which can effectively turn user devices into routing or exit nodes for other parties’ traffic, shifting the risk profile from that of a traditional virtual private network (VPN) to something closer to a distributed proxy.
As a result, the appearance of Hola-related activity, whether from prior installation or unintended background connections, should be treated with caution. Such activity may provide a foothold for malicious behavior, including lateral movement or command-and-control communication.
This blog explores how Hola-associated activity appeared as part of broader patterns of suspicious behavior observed across the Darktrace customer base.
The campaign
In February and March 2026, Darktrace observed similar anomalous activity across multiple customer environments, with affected devices showing consistent behavioral patterns. These included connections to multiple *.hola[.]org endpoints using Hola-related user agents, suggesting interaction with Hola infrastructure rather than isolated or incidental traffic.
Following these connections, affected customer environments showed downloads of suspicious executable files from rare external endpoints 188.241.219[.]55 and 184.241.218[.]111. Both endpoints have been flagged as potentially malicious by open-source intelligence (OSINT) [1][2].
These downloads were conducted using consistent user agents across impacted customers, specifically ‘Hola svc_js_win32/1.249.408’ and ‘Hola svc_js_win32/1.251.389’, suggesting a possible association with Hola-related activity.
Notably, this pattern aligns with recent reporting that, in some cases, Hola distributed an undeclared executable component, me[.]exe, which was later assessed to be a likely Monero-mining binary introduced via a compromised delivery pipeline [3].
Case Study 1
Darktrace first observed a new device on January 19, 2026, within a customer environment based in the Europe, Middle East, and Africa (EMEA) region. On the same day it appeared on the network, the device communicated with multiple pieces of Hola VPN-linked infrastructure before downloading a binary from a hola[.]org subdomain.
Figure 1: Cyber AI Analyst investigation highlighting Hola VPN service activity potentially associated with subsequent HTTP command-and-control (C2) connections.
Subsequent Darktrace telemetry revealed a recurring pattern of activity from the day the device was first observed through to March 4, 2026. During this period, the device repeatedly issued HTTP GET requests to the URI /bwfile?size=1048576, each returning a 200 OK response, indicating successful file retrieval.
This behavior was accompanied by a POST request to /bwfile, followed by an additional GET request for a significantly larger file at /bwfile?size=26214400, suggesting a deliberate and structured file transfer pattern.
Notably, the binary download activity was not tied to a single static host. Instead, it was observed across multiple URLs that changed over time while remaining within the same hola[.]org domain. This pattern suggests the use of rotating or distributed delivery infrastructure rather than a fixed endpoint.
Figure 2: Variation in URLs over time within the same hola[.]org domain, indicating the use of dynamically changing endpoints.
Across these events, the activity was consistently associated with the user agent Hola svc_js_win32/1.249.408, further linking the traffic to Hola-related service components. Amid these persistent and unusual connections, on February 22, Darktrace observed the device connecting to 188.241.219[.]55/proxy-peer-windows-amd64[.]exe, resulting in the download of an executable file.
Figure 3: File transfer event showing the download of an executable from the rare external endpoint 188.241.219[.]55.
Based on its file hash, the downloaded file was assessed as a likely Trojan downloader [4], with import hash (imphash) values showing similarities to samples linked to Vidar, Rhadamanthys, and Stealc according to OSINT [5]. Overall, this sequence of activity suggests that Hola-related connectivity may have been leveraged as part of a broader malware delivery chain.
Darktrace’s Autonomous Response
Due to the highly unusual activity observed, Darktrace Autonomous Response was triggered by the device’s behavior. However, as the customer deployment was configured in “Human Confirmation” mode, manual approval was required before any action could be taken.
Had the deployment been set to “Fully Autonomous” mode, Darktrace would have automatically:
Blocked connections to the associated ports and external endpoints
Prevented all outgoing network connections from the device
Enforced the device’s established ‘pattern of life’, allowing normal activity to continue while restricting any anomalous behavior
Figure 4: Example of a Darktrace Autonomous Response model highlighting the action that would have been taken, demonstrating how the system identifies anomalous behavior and applies targeted containment measures to restrict suspicious network activity.
Case Study 2
While the first case focused on anomalous activity from a newly observed device, Darktrace also identified cases in which devices had already been communicating with Hola-related endpoints prior to the suspected campaign. This may suggest pre-existing Hola usage within the environment, potentially increasing exposure and creating an avenue for subsequent suspicious activity.
One case involved three devices within a customer network based in the Americas (AMS). In this instance, a different payload was identified: me[.]exe, a potentially malicious cryptocurrency miner also referred to as HolaMonitorService[.]exe [6][7]. The downloads were observed from infrastructure similar to that seen in Case 1, including an IP address within the same 188.241.0.0/16 subnet.
Connections to *.hola[.]org, alongside the use of potential Hola-related user agents consistent with those in Case 1, were also identified, further suggesting a link between the observed activity and Hola-associated infrastructure.
Darktrace observed activity indicative of unusual VPN usage on the first affected device on February 2, followed by telemetry suggesting potential Tor usage. This was later followed by the download of me[.]exe on March 10 from 188.241.218[.]111. Notably, this device was the earliest among the three within the deployment to exhibit the presence of the suspicious executable.
Figure 5: Cyber AI Analyst detection highlighting the download of a suspicious executable from a similar external endpoint in a separate deployment.
On March 5, 2026, the second affected device exhibited a slightly different progression, initiating connections to http-test1[.]hola[.]org using the user agent ‘hola_get’. This activity was followed by the download of me[.]exe from the same endpoint on March 13, consistent with the broader pattern of Hola-related downloads observed across the environment.
Figure 6: Example of Hola VPN-related connectivity observed on the network prior to the suspected campaign, indicating pre-existing usage that may have contributed to subsequent activity.
The final affected device within this customer’s network demonstrated a more limited but related pattern, also downloading me[.]exe on March 17 using the same ‘hola_get’ user agent.
While the earlier Hola VPN usage observed across the deployment may not have been directly related to the suspected malware campaign, it may nonetheless have contributed to reduced visibility. The presence of pre-existing Hola-related traffic could have obscured malicious activity, making it more difficult to distinguish legitimate usage from attacker-driven behavior and, in turn, hindering the timely identification of the emerging compromise.
Darktrace’s Autonomous Response
For this deployment, the customer had their Autonomous Response capability configured in “Fully Autonomous” mode, allowing Darktrace to take action without human intervention. As a result, the system was able to autonomously disrupt the activity as soon as relevant events were identified through model detections.
Figure 7: Darktrace Autonomous Response actions taken against suspicious activity linked to Hola VPN.
Suspected cryptomining activity
As previously noted, some of the observed executable payloads appear to be linked to cryptomining malware. Across a subset of affected customer environments, this assessment was further supported by subsequent device activity consistent with Monero mining. Affected devices established follow-on connections to multiple external endpoints aligned with known mining infrastructure, indicating post-download execution.
Considering the broader sequence of activity, this pattern may point to a wider form of abuse in which legitimate VPN-related traffic is used to mask or facilitate malicious behavior following compromise.
On several devices, the download of executable files, including a newly observed peer[.]exe, was followed by alerts indicative of cryptocurrency mining activity. Mining-related credentials such as ‘x’ were observed using the Minergate protocol to communicate with endpoints within the 89.125.255.0/24 subnet and 188.241.218[.]111, the same endpoint involved in earlier download activity. Additional credentials appeared to reflect device-specific CPU identifiers, for example ‘12th Gen Intel(R) Core (TM) i5-1235U’.
Observed mining methods included login, submit, and job, consistent with active participation in a pool-based mining workflow rather than passive or incidental contact. The login method indicates that the host authenticated to the mining service as a worker, job reflects the assignment of computational tasks, and submit shows completed work being returned to the pool [8]. This sequence suggests that affected devices were actively contributing processing resources as part of an unauthorized distributed mining operation.
The presence of unauthorized cryptominers can lead to degraded system performance and reduced device stability. Beyond the immediate resource impact, such activity often serves as an indicator of a broader compromise rather than an isolated issue. This may increase the risk of further malware deployment, persistence mechanisms, and lateral movement, particularly in environments where the initial intrusion has not been fully contained.
Conclusion
Across affected environments, detections such as unusual VPN usage, connections to Hola infrastructure, anomalous HTTP activity, suspicious file downloads, and subsequent cryptomining behavior were linked into a single, evolving incident narrative. This aggregation provided a clearer view of attack progression, enabling security teams to understand not just isolated alerts, but the full sequence of compromise from initial contact through to post-exploitation.
Ultimately, these activities show that the risk posed by non-compliant software such as Hola VPN can extend far beyond simple policy violations. What began as traffic to Hola-related infrastructure was, in multiple cases, followed by behavior suggesting deliberate misuse, including suspicious executable downloads using Hola-related user agents and, in some instances, evidence of active cryptomining. These were not isolated anomalies, but elements of a broader pattern in which seemingly benign proxy or VPN-related communications may have created a pathway for malicious delivery and unauthorized resource exploitation.
The significance of this activity lies not only in the downloads or mining, but in what it reveals about an attacker’s ability to blend malicious operations into traffic associated with software that may already have a foothold in the environment. When unapproved software operates within an enterprise, it can reduce visibility, blur the distinction between legitimate and malicious traffic, and create opportunities to extend compromise in ways that are persistent and difficult to detect. Darktrace’s anomaly-based approach enables these behavioral distinctions to be identified, regardless of whether the device is new or long established within the network.
Credit to Min Kim (Associate Principal Analyst), Priya Thapa (Senior Cyber Analyst) Edited by Ryan Traill (Content Manager)
.avif)
![Variation in URLs over time within the same hola[.]org domain, indicating the use of dynamically changing endpoints.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a304bdeff111215c0436931_Screenshot%202026-06-15%20at%2012.00.43%E2%80%AFPM.avif)
![File transfer event showing the download of an executable from the rare external endpoint 188.241.219[.]55.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a304c2468d20aeff16a2721_Screenshot%202026-06-15%20at%2012.01.53%E2%80%AFPM.avif)
