Darktrace Analysis: Inside the SOC

React2Shell: How Opportunist Attackers Exploited CVE-2025-55182 Within Hours

Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

During a customer trial of Darktrace / EMAIL and Darktrace / IDENTITY, Darktrace detected an adversary-in-the-middle (AiTM) attack that compromised a user’s Office 365 account via a business email compromise (BEC) phishing email. Following the breach, the compromised account was used to launch both internal and external phishing campaigns.

Continue reading

Bytesize Security

Bytesize Security: Insider Threats in Google Workspace

Don’t Take the Bait: How Darktrace Keeps Microsoft Teams Phishing Attacks at Bay

Malicious Use of Dropbox in Phishing Attacks

How an Insider Exfiltrated Corporate Data to Google Cloud

On the Case: Incident Analysis

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Campaign Trail: Threat Research

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Tech Talk: Maximising Integrations

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Industry Insights: Systemic Change

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

React2Shell: How Opportunist Attackers Exploited CVE-2025-55182 Within Hours

Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

From Amazon to Louis Vuitton: How Darktrace Detects Black Friday Phishing Attacks

CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System

Xillen Stealer Updates to Version 5 to Evade AI Detection

Unmasking Vo1d: Inside Darktrace’s Botnet Detection

Christina Kreza

Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace

WSUS Exploited: Darktrace’s Analysis of Post-Exploitation Activities Related to CVE-2025-59287

Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion

Nathaniel Jones

Inside Akira’s SonicWall Campaign: Darktrace’s Detection and Response

Emily Megan Lim

Out of Character: Detecting Vendor Compromise and Trusted Relationship Abuse with Darktrace

ShadowV2: An emerging DDoS for hire botnet

From the Depths: Analyzing the Cthulhu Stealer Malware for macOS

Tracking Diicot: An Emerging Romanian Threat Actor

Legion: An AWS Credential Harvester and SMTP Hijacker

The Darktrace Community

Updates to Legion: A Cloud Credential Harvester and SMTP Hijacker

The Darktrace Community

SEO Poisoning and Fake PuTTY sites: Darktrace’s Investigation into the Oyster backdoor

Christina Kreza

From Automation to Exploitation: The Growing Misuse of Selenium Grid for Cryptomining and Proxyjacking

Forensic Victory: Catching the Ransomware EDR Couldn't See

Unpacking the Salesloft Incident: Insights from Darktrace Observations

Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows

The Nine Lives of Commando Cat: Analyzing a Novel Malware Campaign Targeting Docker

Migo: A Redis Miner with Novel System Weakening Techniques

The Darktrace Community

GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry

The Growing Threat of Docusign Phishing Attacks

Python-based Triton RAT Targeting Roblox Credentials

Chinese APT Target Royal Thai Police in Malware Campaign

WARPscan: Cloudflare WARP Abused to Hijack Cloud Services

From Dormant to Dangerous: P2Pinfect Evolves to Deploy New Ransomware and Cryptominer

Cerber Ransomware: Dissecting the three heads

Containerised Clicks: Malicious Use of 9hits on Vulnerable Docker Hosts

Exposed Jupyter Notebooks Targeted to Deliver Cryptominer

Vigilance in Action: Monitoring Typosquatting Domains

Spinning YARN: A New Linux Malware Campaign Targets Docker, Apache Hadoop, Redis and Confluence

The Darktrace Community

P2Pinfect - New Variant Targets MIPS Devices

The Darktrace Community

OracleIV: A dockerized DDoS botnet

Qubitstrike: An Emerging Malware Campaign Targeting Jupyter Notebooks

From VPS to Phishing: How Darktrace Uncovered SaaS Hijacks through Virtual Infrastructure Abuse

Rajendra Rushanth

From Exploit to Escalation: Tracking and Containing a Real-World Fortinet SSL-VPN Attack

Ivanti Under Siege: Investigating the Ivanti Endpoint Manager Mobile Vulnerabilities (CVE-2025-4427 & CVE-2025-4428)

Nahisha Nobregas

Industry Insights

2025 Cyber Threat Landscape: Darktrace’s Mid-Year Review

Auto-Color Backdoor: How Darktrace Thwarted a Stealthy Linux Intrusion

Industry Insights

Darktrace's Cyber AI Analyst in Action: 4 Real-World Investigations into Advanced Threat Actors

Nathaniel Jones

Untangling the web: Darktrace’s investigation of Scattered Spider’s evolving tactics

Crypto Wallets Continue to be Drained in Elaborate Social Media Scam

Defending the Cloud: Stopping Cyber Threats in Azure and AWS with Darktrace

Alexandra Sentenac

Industry Insights

Pre-CVE Threat Detection: 10 Examples Identifying Malicious Activity Prior to Public Disclosure of a Vulnerability

Nathaniel Jones

Patch and Persist: Darktrace’s Detection of Blind Eagle (APT-C-36)

Charlotte Thompson

Tracking CVE-2025-31324: Darktrace’s detection of SAP Netweaver exploitation before and after disclosure

Industry Insights

Proactive OT Security: Lessons on Supply Chain Risk Management from a Rogue Raspberry Pi

Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic

PumaBot: una nueva botnet dirigida a dispositivos de vigilancia de IoT.

De Rockstar2FA a FlowerStorm: Investigando de una plataforma nueva de phishing as a service.

Catching a RAT: How Darktrace Neutralized AsyncRAT

Industry Insights

Anomaly-Based Threat Hunting: Darktrace's Approach in Action

Nathaniel Jones

SocGholish: From loader and C2 activity to RansomHub deployment

Christina Kreza

MFA Under Attack: AiTM Phishing Kits Abusing Legitimate Services

Alexandra Sentenac

Industry Insights

Obfuscation Overdrive: Next-Gen Cryptojacking with Layers

Email bombing exposed: Darktrace’s email defense in action

Maria Geronikolou

Cyberhaven Supply Chain Attack: Exploiting Browser Extensions

Rajendra Rushanth

Darktrace's Detection of State-Linked ShadowPad Malware

Darktrace's Early Detection of the Latest Ivanti Exploits

New Threat on the Prowl: Investigating Lynx Ransomware

Detecting and Containing Account Takeover with Darktrace

Defending Against Living-off-the-Land Attacks: Anomaly Detection in Action

Alexandra Sentenac

RansomHub Revisited: New Front-Runner in the Ransomware-as-a-Service Marketplace

Maria Geronikolou

Bytesize Security: Insider Threats in Google Workspace

RansomHub Ransomware: investigación de Darktrace sobre la herramienta más nueva en ShadowSyndicate's Arsenal

Detecting and Mitigating Adversary-in-the-Middle Phishing Attacks with Darktrace Services

Cleo File Transfer Vulnerability: Patch Pitfalls and Darktrace’s Detection of Post-Exploitation Activities

Maria Geronikolou

Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Defending AITM Phishing and Mamba Attacks

Behind the veil: Darktrace's detection of VPN exploitation in SaaS environments

Tactics Behind the Royal and Blacksuit Ransomware

Onomastics Gymnastics: How Darktrace Detects Spoofing and Business Email Compromise in Multi-Name Users

Post-Exploitation Activities on Fortinet Devices: A Network-Based Analysis

Phishing and Persistence: Darktrace’s Role in Defending Against a Sophisticated Account Takeover

From Call to Compromise: Darktrace’s Response to a Vishing-Induced Network Attack

Rajendra Rushanth

Thread Hijacking: Infiltration Tactics Explained

Maria Geronikolou

FortiClient EMS Exploited: Attack Chain & Post Exploitation Tactics

Emily Megan Lim

Decrypting the Matrix: How Darktrace Uncovered a KOK08 Ransomware Attack

Christina Kreza

How Darktrace Detects TeamCity Exploitation Activity

Industry Insights

How Darktrace’s AI Applies a Zero-Trust Mentality within Critical Infrastructure Supply Chains

Understanding the WarmCookie Backdoor Threat

Investigating the Adaptive Jupyter Information Stealer

Nahisha Nobregas

How Darktrace Detects NTLM Hash Theft

Charlotte Thompson

A Busy Agenda: Darktrace's Detection of Qilin Ransomware as a Service Operator

Alexandra Sentenac

Following up on our Conversation: Detecting & Containing a LinkedIn Phishing Attack with Darktrace

Post-Exploitation Activities on PAN-OS Devices: A Network-Based Analysis

Uncovering the Sysrv-Hello Crypto-Jacking Bonet

Prevent Data Exfiltration & Know When to Respond

Anna Gilbertson

Strategies to Prolong Quantum Ransomware Attacks

Industry Insights

Exploring AI Threats: Package Hallucination Attacks

Charlotte Thompson

Industry Insights

Explore Internet-Facing System Vulnerabilities

Unveiling ViperSoftX: A Darktrace Investigation

How Vidar Malware Spreads via Malvertising on Google

Roberto Martinez

Detecting and Responding to Vendor Email Compromises (VEC)

Self-Learning AI for Zero-Day and N-Day Attack Defense

Using Darktrace for Threat Hunting