December 9, 2024

Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Darktrace’s Threat Research team investigated a major campaign exploiting vulnerabilities in Palo Alto firewall devices (CVE 2024-0012 and 2024-9474). Learn about the spike in post-exploitation activities and understand the need for anomaly-based detection to stay ahead of evolving threats.

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Adam Potter

Senior Cyber Analyst

Dec 2024

Introduction: Spike in exploitation and post-exploitation activity affecting Palo Alto firewall devices

As the first line of defense for many organizations, perimeter devices such as firewalls are frequently targeted by threat actors. If compromised, these devices can serve as the initial point of entry to the network, providing access to vulnerable internal resources. This pattern of malicious behavior has become readily apparent within the Darktrace customer base. In 2024, Darktrace Threat Research analysts identified and investigated at least two major campaigns targeting internet-exposed perimeter devices. These included the exploitation of PAN-OS firewall exploitation via CVE 2024-3400 and FortiManager appliances via CVE 2024-47575.

More recently, at the end of November, Darktrace analysts observed a spike in exploitation and post-exploitation activity affecting, once again, Palo Alto firewall devices in the days following the disclosure of the CVE 2024-0012 and CVE-2024-9474 vulnerabilities.

Threat Research analysts had already been investigating potential exploitation of the firewalls’ management interface after Palo Alto published a security advisory (PAN-SA-2024-0015) on November 8. Subsequent analysis of data from Darktrace’s Security Operations Center (SOC) and external research uncovered multiple cases of Palo Alto firewalls being targeted via the likely exploitation of these vulnerabilities since November 13, through the end of the month. Although this spike in anomalous behavior may not be attributable to a single malicious actor, Darktrace Threat Research identified a clear increase in PAN-OS exploitation across the customer base by threat actors likely utilizing the recently disclosed vulnerabilities, resulting in broad patterns of post-exploitation activity.

How did exploitation occur?

CVE 2024-0012 is an authentication bypass vulnerability affecting unpatched versions of Palo Alto Networks Next-Generation Firewalls. The vulnerability resides in the management interface application on the firewalls specifically, which is written in PHP. When attempting to access highly privileged scripts, users are typically redirected to a login page. However, this can be bypassed by supplying an HTTP request where a Palo Alto related authentication header can be set to “off”. Users can supply this header value to the Nginx reverse proxy server fronting the application which will then send it without any prior processing [1].

CVE-2024-9474 is a privilege escalation vulnerability that allows a PAN-OS administrator with access to the management web interface to execute root-level commands, granting full control over the affected device [2]. When combined, these vulnerabilities enable unauthenticated adversaries to execute arbitrary commands on the firewall with root privileges.

Post-Exploitation Patterns of Activity

Darktrace Threat Research analysts examined potential indicators of PAN-OS software exploitation via CVE 2024-0012 and CVE-2024-9474 during November 2024. The investigation identified three main groupings of post-exploitation activity:

Exploit validation and initial payload retrieval
Command and control (C2) connectivity, potentially featuring further binary downloads
Potential reconnaissance and cryptomining activity

Exploit Validation

Across multiple investigated customers, Darktrace analysts identified likely vulnerable PAN-OS devices conducting external network connectivity to bin services. Specifically, several hosts performed DNS queries for, and HTTP requests to Out-of-Band Application Security Testing (OAST) domains, such as csv2im6eq58ujueonqs0iyq7dqpak311i.oast[.]pro. These endpoints are commonly used by network administrators to harden defenses, but they are increasingly used by threat actors to verify successful exploitation of targeted devices and assess their potential for further compromise. Although connectivity involving OAST domains were prevalent across investigated incidents, this activity was not necessarily the first indicator observed. In some cases, device behavior involving OAST domains also occurred shortly after an initial payload was downloaded.

Figure 1: Darktrace model alert logs detailing the HTTP request to an OAST domain immediately following PAN-OS device compromise.

Initial Payload Retrieval

Following successful exploitation, affected devices commonly performed behaviors indicative of initial payload download, likely in response to incoming remote command execution. Typically, the affected PAN-OS host would utilize the command line utilities curl and Wget, seen via use of user agents curl/7.61.1 and Wget/1.19.5 (linux-gnu), respectively.

In some cases, the use of these command line utilities by the infected devices was considered new behavior. Given the nature of the user agents, interaction with the host shell suggests remote command execution to achieve the outgoing payload requests.

While additional binaries and scripts were retrieved in later stages of the post-exploitation activity in some cases, this set of behaviors and payloads likely represent initial persistence and execution mechanisms that will enable additional functionality later in the kill chain. During the investigation, Darktrace analysts noted the prevalence of shell script payload requests. Devices analyzed would frequently make HTTP requests over the usual destination port 80 using the command line URL utility (curl), as seen in the user-agent field.

The observed URIs often featured requests for text files, such as “1.txt”, or shell scripts such as “y.sh”. Although packet capture (PCAP) samples were unavailable for review, external researchers have noted that the IP address hosting such “1.txt” files (46.8.226[.]75) serves malicious PHP payloads. When examining the contents of the “y.sh” shell script, Darktrace analysts noticed the execution of bash commands to upload a PHP-written web shell on the affected server.

Figure 2: PCAP showing the client request and server response associated with the download of the y.sh script from 45.76.141[.]166. The body content of the HTTP response highlights a shebang command to run subsequent code as bash script. The content is base64 encoded and details PHP script for what appears to be a webshell that will likely be written to the firewall device.

While not all investigated cases saw initial shell script retrieval, affected systems would commonly make an external HTTP connection, almost always via Wget, for the Executable and Linkable Format (ELF) file “/palofd” from the rare external IP 38.180.147[.]18.

Such requests were frequently made without prior hostname lookups, suggesting that the process or script initiating the requests already contained the external IP address. Analysts noticed a consistent SHA1 hash present for all identified instances of “/palofd” downloads (90f6890fa94b25fbf4d5c49f1ea354a023e06510). Multiple open-source intelligence (OSINT) vendors have associated this hash sample with Spectre RAT, a remote access trojan with capabilities including remote command execution, payload delivery, process manipulation, file transfers, and data theft [3][4].

Figure 3: Advanced Search log metrics highlighting details of the “/palofd” file download over HTTP.

Several targeted customer devices were observed initiating TLS/SSL connections to rare external IPs with self-signed TLS certificates following exploitation. Model data from across the Darktrace fleet indicated some overlap in JA3 fingerprints utilized by affected PAN-OS devices engaging in the suspicious TLS activity. Although JA3 hashes alone cannot be used for process attribution, this evidence suggests some correlation of source process across instances of PAN-OS exploitation.

These TLS/SSL sessions were typically established without the specification of a Server Name Indication (SNI) within the TLS extensions. The SNI extension prevents servers from supplying an incorrect certificate to the requesting client when multiple sites are hosted on the same IP. SSL connectivity without SNI specification suggests a potentially malicious running process as most software establishing TLS sessions typically supply this information during the handshake. Although the encrypted nature of the connection prevented further analysis of the payload packets, external sources note that JavaScript content is transmitted during these sessions, serving as initial payloads for the Sliver C2 platform using Wget [5].

C2 Communication and Additional Payloads

Following validation and preliminary post-compromise actions, examined hosts would commonly initiate varying forms of C2 connectivity. During this time, devices were frequently detected making further payload downloads, likely in response to directives set within C2 communications.

Palo Alto firewalls likely exploited via the newly disclosed CVEs would commonly utilize the Sliver C2 platform for external communication. Sliver’s functionality allows for different styles and formatting for communication. An open-source alternative to Cobalt Strike, this framework has been increasingly popular among threat actors, enabling the generation of dynamic payloads (“slivers”) for multiple platforms, including Windows, MacOS, Linux.

These payloads allow operators to establish persistence, spawn new shells, and exfiltrate data. URI patterns and PCAPs analysis yielded evidence of both English word type encoding within Sliverand Gzip formatting.

For example, multiple devices contacted the Sliver-linked IP address 77.221.158[.]154 using HTTP to retrieve Gzip files. The URIs present for these requests follow known Sliver Gzip formatted communication patterns [6]. Investigations yielded evidence of both English word encoding within Sliver, identified through PCAP analysis, and Gzip formatting.

Figure 4: Sample of URIs observed in Advanced Searchhighlighting HTTP requests to 77.221.158[.]154 for Gzip content suggest of Sliver communication.

Figure 5: PCAP showing English word encoding for Sliver communication observed during post-exploitation C2 activity.

External connectivity during this phase also featured TCP connection attempts over uncommon ports for common application protocols. For both Sliver and non-Sliver related IP addresses, devices utilized destination ports such as 8089, 3939, 8880, 8084, and 9999 for the HTTP protocol. The use of uncommon destination ports may represent attempts to avoid detection of connectivity to rare external endpoints. Moreover, some external beaconing within included URIs referencing the likely IP of the affected device. Such behavior can suggest the registration of compromised devices with command servers.

Targeted devices also proceeded to download additional payloads from rare external endpoints as beaconing/C2 activity was ongoing. For example, the newly registered domain repositorylinux[.]org (IP: 103.217.145[.]112) received numerous HTTP GET requests from investigated devices throughout the investigation period for script files including “linux.sh” and “cron.sh”. Young domains, especially those that present as similar to known code repositories, tend to host harmful content. Packet captures of the cron.sh file reveal commands within the HTTP body content involving crontab operations, likely to schedule future downloads. Some hosts that engaged in connectivity to the fake repository domain were later seen conducting crypto-mining connections, potentially highlighting the download of miner applications from the domain.

Additional payloads observed during this time largely featured variations of shell scripts, PHP content, and/or executables. Typically, shell scripts direct the device to retrieve additional content from external servers or repositories or contain potential configuration details for subsequent binaries to run on the device. For example, the “service.sh” retrieves a tar-compressed archive, a configuration JSON file as well as a file with the name “solr” from GitHub, potentially associated with the Apache Solr tool used for enterprise search. These could be used for further enumeration of the host and/or the network environment. PHP scripts observed may involve similar web shell functionality and were retrieved from both rare external IPs identified as well by external researchers [7]. Darktrace also detected the download of octet-stream data occurring mid-compromise from an Amazon Web Services (AWS) S3 bucket. Although no outside research confirmed the functionality, additional executable downloads for files such as “/initd”(IP: 178.215.224[.]246) and “/x6” (IP: 223.165.4[.]175) may relate to tool ingress, further Trojan/backdoor functionality, or cryptocurrency mining.

Figure 7: PCAP specifying the HTTP response headers and body content for the service.sh file request. The body content shown includes variable declarations for URLs that will eventually be called by the device shell via bash command.

Reconnaissance and Cryptomining

Darktrace analysts also noticed additional elements of kill chain operations from affected devices after periods of initial exploit activity. Several devices initiated TCP connections to endpoints affiliated with cryptomining pools such as us[.]zephyr[.]herominers[.]com and xmrig[.]com. Connectivity to these domains indicates likely successful installation of mining software during earlier stages of post-compromise activity. In a small number of instances, Darktrace observed reconnaissance and lateral movement within the time range of PAN-OS exploitation. Firewalls conducted large numbers of internal connectivity attempts across several critical ports related to privileged protocols, including SMB and SSH. Darktrace detected anonymous NTLM login attempts and new usage of potential PAN-related credentials. These behaviors likely constitute attempts at lateral movement to adjacent devices to further extend network compromise impact.

Figure 8: Model alert connection logs detailing the uncommon failed NTLM logins using an anonymous user account following PAN-OS exploitation.

Conclusion

Darktrace Threat Research and SOC analysts increasingly detect spikes in malicious activity on internet-facing devices in the days following the publication of new vulnerabilities. The latest iteration of this trend highlighted how threat actors quickly exploited Palo Alto firewall using authentication bypass and remote command execution vulnerabilities to enable device compromise. A review of the post-exploitation activity during these events reveals consistent patterns of perimeter device exploitation, but also some distinct variations.

Prior campaigns targeting perimeter devices featured activity largely confined to the exfiltration of configuration data and some initial payload retrieval. Within the current campaign, analysts identified a broader scope post-compromise activity consisting not only of payloads downloads but also extensive C2 activity, reconnaissance, and coin mining operations. While the use of command line tools like curl featured prominently in prior investigations, devices were seen retrieving a generally wider array of payloads during the latest round of activity. The use of the Sliver C2 platform further differentiates the latest round of PAN-OS compromises, with evidence of Sliver activity in about half of the investigated cases.

Several of the endpoints contacted by the infected firewall devices did not have any OSINT associated with them at the time of the attack. However, these indicators were noted as unusual for the devices according to Darktrace based on normal network traffic patterns. This reality further highlights the need for anomaly-based detection that does not rely necessarily on known indicators of compromise (IoCs) associated with CVE exploitation for detection. Darktrace’s experience in 2024 of multiple rounds of perimeter device exploitation may foreshadow future increases in these types of comprise operations.

Credit to Adam Potter (Senior Cyber Analyst), Alexandra Sentenac (Senior Cyber Analyst), Emma Foulger (Principal Cyber Analyst) and the Darktrace Threat Research team.

Get the latest insights on emerging cyber threats

Attackers are adapting, are you ready? This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.

Identity-based attacks: How attackers are bypassing traditional defenses
Zero-day exploitation: The rise of previously unknown vulnerabilities
AI-driven threats: How adversaries are leveraging AI to outmaneuver security controls

Stay ahead of evolving threats with expert analysis from Darktrace. Download the report here.

References

[1]: https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

[2]: https://security.paloaltonetworks.com/CVE-2024-9474

[3]: https://threatfox.abuse[.]ch/ioc/1346254/

[4]:https://www.virustotal.com/gui/file/4911396d80baff80826b96d6ea7e54758847c93fdbcd3b86b00946cfd7d1145b/detection

[5]: https://arcticwolf.com/resources/blog/arctic-wolf-observes-threat-campaign-targeting-palo-alto-networks-firewall-devices/

[6] https://www.immersivelabs.com/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide

[7] https://arcticwolf.com/resources/blog/arctic-wolf-observes-threat-campaign-targeting-palo-alto-networks-firewall-devices/

Appendices

Darktrace Model Alerts

Anomalous Connection / Anomalous SSL without SNI to New External

Anomalous Connection / Application Protocol on Uncommon Port

Anomalous Connection / Multiple Failed Connections to Rare Endpoint

Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

Anomalous Connection / New User Agent to IP Without Hostname

Anomalous Connection / Posting HTTP to IP Without Hostname

Anomalous Connection / Rare External SSL Self-Signed

Anomalous File / EXE from Rare External Location

Anomalous File / Incoming ELF File

Anomalous File / Mismatched MIME Type From Rare Endpoint

Anomalous File / Multiple EXE from Rare External Locations

Anomalous File / New User Agent Followed By Numeric File Download

Anomalous File / Script from Rare External Location

Anomalous File / Zip or Gzip from Rare External Location

Anomalous Server Activity / Rare External from Server

Compromise / Agent Beacon (Long Period)

Compromise / Agent Beacon (Medium Period)

Compromise / Agent Beacon to New Endpoint

Compromise / Beacon for 4 Days

Compromise / Beacon to Young Endpoint

Compromise / Beaconing Activity To External Rare

Compromise / High Priority Tunnelling to Bin Services

Compromise / High Volume of Connections with Beacon Score

Compromise / HTTP Beaconing to New IP

Compromise / HTTP Beaconing to Rare Destination

Compromise / Large Number of Suspicious Failed Connections

Compromise / Large Number of Suspicious Successful Connections

Compromise / Slow Beaconing Activity To External Rare

Compromise / SSL Beaconing to Rare Destination

Compromise / Suspicious Beaconing Behavior

Compromise / Suspicious File and C2

Compromise / Suspicious HTTP and Anomalous Activity

Compromise / Suspicious TLS Beaconing To Rare External

Compromise / Sustained SSL or HTTP Increase

Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

Device / Initial Attack Chain Activity

Device / New User Agent

MITRE ATT&CK Mapping

Tactic – Technique

INITIAL ACCESS – Exploit Public-Facing Application

RESOURCE DEVELOPMENT – Malware

EXECUTION – Scheduled Task/Job (Cron)

EXECUTION – Unix Shell

PERSISTENCE – Web Shell

DEFENSE EVASION – Masquerading (Masquerade File Type)

DEFENSE EVASION - Deobfuscate/Decode Files or Information

CREDENTIAL ACCESS – Brute Force

DISCOVERY – Remote System Discovery

COMMAND AND CONTROL – Ingress Tool Transfer

COMMAND AND CONTROL – Application Layer Protocol (Web Protocols)

COMMAND AND CONTROL – Encrypted Channel

COMMAND AND CONTROL – Non-Standard Port

COMMAND AND CONTROL – Data Obfuscation

IMPACT – Resource Hijacking (Compute)

List of IoCs

IoC – Type – Description

sys.traceroute[.]vip – Hostname - C2 Endpoint
77.221.158[.]154 – IP - C2 Endpoint
185.174.137[.]26 – IP - C2 Endpoint
93.113.25[.]46 – IP - C2 Endpoint
104.131.69[.]106 – IP - C2 Endpoint
95.164.5[.]41 – IP - C2 Endpoint
bristol-beacon-assets.s3.amazonaws[.]com – Hostname - Payload Server
img.dxyjg[.]com – Hostname - Payload Server
38.180.147[.]18 – IP - Payload Server
143.198.1[.]178 – IP - Payload Server
185.208.156[.]46 – IP - Payload Server
185.196.9[.]154 – IP - Payload Server
46.8.226[.]75 – IP - Payload Server
223.165.4[.]175 – IP - Payload Server
188.166.244[.]81 – IP - Payload Server
bristol-beaconassets.s3[.]amazonaws[.]com/Y5bHaYxvd84sw – URL - Payload
img[.]dxyjg[.]com/KjQfcPNzMrgV – URL - Payload
38.180.147[.]18/palofd – URL - Payload
90f6890fa94b25fbf4d5c49f1ea354a023e06510 – SHA1 - Associated to file /palofd
143.198.1[.]178/7Z0THCJ – URL - Payload
8d82ccdb21425cf27b5feb47d9b7fb0c0454a9ca – SHA1 - Associated to file /7Z0THCJ
fefd0f93dcd6215d9b8c80606327f5d3a8c89712 – SHA1 - Associated to file /7Z0THCJ
e5464f14556f6e1dd88b11d6b212999dd9aee1b1 – SHA1 - Associated to file /7Z0THCJ
143.198.1[.]178/o4VWvQ5pxICPm – URL - Payload
185.208.156[.]46/lUuL095knXd62DdR6umDig – URL - Payload
185.196.9[.]154/ykKDzZ5o0AUSfkrzU5BY4w – URL - Payload
46.8.226[.]75/1.txt – URL - Payload
223.165.4[.]175/x6 – URL - Payload
45.76.141[.]166/y.sh – URL - Payload
repositorylinux[.]org/linux.sh – URL - Payload
repositorylinux[.]org/cron.sh – URL - Payload

‍

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Written by

Adam Potter

Senior Cyber Analyst

Principal Solutions Engineer, Cyber Technician

Watch the NIS2 Webinar

Blog

July 6, 2026

NIST Just Proved It: AI Security Can’t Be Solved With Rules

Static AI guardrails are inherently limited

As organizations adopt generative AI, many still assume that the right set of guardrails will be enough. The problem is you can’t anticipate every way these systems might be misused, abused or attacked. What NIST has done is put a mathematical foundation under that intuition.

In recent research building on Gödel’s incompleteness theorems, which showed that any system built on a fixed set of rules will always have gaps, NIST demonstrates that there is no finite set of guardrails that can be universally robust against adversarial prompts. In plain terms, if your defense is based on a fixed set of rules, there will always be inputs that bypass them. Not because the rules are badly written, but because the problem space is bigger than static rules can ever cover.

This is not new in cybersecurity - detection rules have always had to live with this trade-off. What is different with GenAI is the scale and shape of that problem. These systems are built on human language, and human language is not bounded. It is fluid, contextual and deliberately ambiguous. The number of ways intent can be hidden is effectively limitless. You are not defending against a defined protocol or a fixed exploit chain. You are defending against the entire expressive capacity of people.

So attempting to create a complete set of rules is the wrong starting point. It assumes the problem can be deterministically described. NIST’s work shows that it cannot. Organizations still need a way to manage AI risk, but the traditional approach of defining allowed and disallowed patterns is always going to lag behind what is actually happening. The same input can be benign in one context and risky in another, and static rules struggle to capture that distinction.

The question then is what fills that gap?

AI security must shift from rules to behavior

What's required is a shift in what you are trying to understand. Rules try to describe what should and shouldn't happen. Behavior shows you what is happening. Or to put it another way, if inputs are unbounded and adversaries adapt, the only stable signal is behavior.

In a GenAI context, that means analyzing how an AI model is being used, how prompts evolve over time, how outputs are shaped, and where AI agent interactions start to drift from what is expected. It means moving from static definitions of bad to a more dynamic understanding of intent.

Instead of trying to predict every bad prompt, you focus on identifying when behavior starts to move outside expected norms. Instead of asking whether a single input matches a rule, you ask whether the overall pattern of activity makes sense for the system and how it’s being used.

Guardrails remain important but they are only one layer

This does not eliminate the need for guardrails. They still play a role. But they will never address the entire problem space and are simply one part of your defense in depth approach.

NIST’s proof is useful because it makes this explicit. It removes the assumption that with enough effort, a complete rule set is achievable. It isn’t.

Once you accept that, the shift becomes unavoidable. This is no longer a problem of writing better rules, but of understanding behavior in a space where the possible inputs are effectively unbounded.

For security leaders, that changes the nature of the problem. It is less about defining what should be allowed, and more about recognizing when something is no longer consistent with expected behavior.

That does not remove the need for guardrails, but it does change their role. They set boundaries, but they do not define understanding. The gap between the two is where risk now sits.

In the end, this is what “can’t be solved with rules” really means. Rules will always leave gaps, and those gaps are not theoretical. They show up in how systems actually behave Not what we expect them to do, or what we intended them to do, but what they are doing in practice. That is where the signal is, and increasingly, that is where the security problem sits.

References:

https://www.nist.gov/news-events/news/2026/06/nist-mathematical-proof-supports-transition-continuous-monitor-and-update

https://ieeexplore.ieee.org/document/11475847

About the author

Andrew Hollister

Principal Solutions Engineer, Cyber Technician

Blog

July 1, 2026

5 Ways AI is changing traditional security models according to modern CISOs

The Reality of Securing AI in Motion

Traditional security tools were built for environments defined by fixed rules and predictable workflows. But AI behavior is non-deterministic. The same prompt can produce different outcomes, and risk often emerges gradually as AI behavior adapts, and permissions drift over time. This creates a constantly shifting environment where security teams are working to define control in a system that resists stability. “In AI security, yesterday's priorities can become tomorrow's blind spots. The landscape shifts that fast,” warned the SVP and Head of Technology and Cybersecurity of a real estate investment trust. Conventional approaches, which rely on establishing and maintaining a steady baseline, struggle to keep up with that level of change.

At the same time, AI adoption is accelerating across organizations, often faster than security teams can implement the controls needed to manage it. “The car is being built while it’s already on the road,” explained the CISO of a global private fund administrator. “The threats we're securing against today won't be the threats we're facing tomorrow. What kept us up three months ago looks nothing like what we're dealing with today.”

As businesses move quickly to unlock value from AI, security teams are left closing gaps in real time, while also facing adversaries who are using AI to make their attacks more scalable, adaptive, and difficult to detect. In this recent roundtable discussion of CISOs and security leaders, five themes emerged around AI cyber risk.

1. AI agents with human access but no human judgment

In Darktrace’s 2026 State of AI Cybersecurity report, 96% of the surveyed security professionals agree that AI significantly improves the speed and efficiency with which they work. Yet, 92% admitted that they’re concerned with the security implications of the use of AI agents across their workforce.

AI agents now operate with human-level permissions across systems, acting at machine speed, orchestrating actions across platforms, and making decisions without the judgment or caution a person would apply. Unlike human users, they cannot be expected to pause and question whether a given action is appropriate.

Their identities are also difficult to inventory, govern, and audit. As agents become easier to deploy than legacy IT systems ever were, organizations are quickly losing track of what is running, what it has access to, and what it is doing. This creates a growing class of highly privileged, autonomous actors operating without the visibility or oversight that traditional identity and access controls were designed to provide.“While AI adoption is critical to running a modern business, AI alone can’t solve all our cybersecurity challenges,” said a global financial sector CISO. “We still need think critically and use human judgement. Those are two things AI can’t do.”

This lack of human judgment becomes especially risky as new architectures, such as Model Context Protocol (MCP), can expand how agents connect to data, tools, and external systems. By design, MCP enables agents to dynamically discover and interact with new resources, increasing flexibility but also introducing new pathways for unintended access, data exposure, or abuse if not properly governed.

The CISO of a fund administrator highlighted one emerging vector as an example: rogue MCP servers. “Our developers want to move quickly and bring value to the business, but technologies like these can unintentionally expose sensitive data in ways that would never have happened before.”

2. Increased digital complexity and expanded attack surface

AI activity rarely stays contained. A single prompt can trigger a chain of actions across networks, email, cloud infrastructure, SaaS platforms, endpoints, identity systems, and development environments, spanning systems that were never designed to be secured as a single, connected flow. This expands both the scale and complexity of what security teams need to monitor and defend.

Yet no single control has visibility across that entire chain. “You can’t defend effectively what you can’t see,” cautioned the private fund administrator CISO. As AI-driven activity moves fluidly across environments, gaps in coverage become inevitable, creating blind spots that attackers can exploit.

Threat actors are already capitalizing on this lack of visibility. “Threat actors have advanced their use of generative AI to launch more convincing phishing campaigns, automate social engineering, and scale attacks with greater precision down to the individual level,” said the SVP of Technology and Cybersecurity for the real estate investment trust. What was once manual and targeted can now be automated and personalized at scale, making attacks harder to detect and easier to execute.

At the same time, the pace of exploitation is accelerating. As a global CISO operating across 40+ countries described it: “Zero-day vulnerabilities are no longer zero day; it’s minus one day. By the time you get to it and address it, it’s already a problem.” By the time risk is identified, it has often already been realized.

The result is a rapidly expanding and increasingly interconnected attack surface that challenges security teams to maintain visibility, context, and control across AI-driven activity.

3. Shadow AI is already everywhere

76% of organizations now cite shadow AI as a problem, one that is spreading through organizations in ways that are hard to track and even harder to control.

Employees are experimenting with publicly available Gen AI tools. Teams are spinning up low-code automations on their own. SaaS providers are quietly embedding AI into existing products. Developers are plugging AI services directly into workflows, often without pausing to consider what that exposure means.

The result is a lack of visibility into:

What AI tools are being used
What data those tools can access
Where prompts and outputs are going
Which AI agents are interacting with enterprise systems

The SVP of Cybersecurity at a real estate investment trust described the shift: “Before, I was worried about someone sending data erroneously to their personal email. Now we have all these agents online that people are utilizing, and we’re looking at those vectors as well.” For security teams, this means operating without a complete view of how AI is being used, what it can access, and where risk may already be emerging.

4. Built-in guardrails are not enough

Organizations often assume that native AI guardrails or provider-level controls are sufficient to manage AI risk. But securing AI requires ongoing visibility, oversight, and governance, not just controls configured at deployment. "It’s a misconception that adopting AI is going to solve all your problems,” warns a global financial services CISO.

Security leaders are increasingly recognizing the limitations of these controls as:

Fragmented and difficult to enforce consistently across multiple AI systems, workflows, and environments
Ambiguous in terms of accountability due to shared responsibility for AI governance between IT, security, developers, business teams, and third-party providers
Limited in end-to-end oversight, leaving gaps that stretch from the initial prompt all the way through to the downstream impact of an agent's actions

Securing AI demands more than simple prompt filtering or static policy enforcement. It requires understanding intent, behavior, and context across both human and AI activity.

The next phase of cybersecurity: securing AI

To safely and responsibly adopt AI at scale, organizations need a new operational model for cybersecurity that’s capable of:

• Understanding AI behavior

• Identifying risk in real time

• Maintaining governance without slowing innovation

The CSO of a $10 billion municipal utility organization described the challenge with precision: “We have to move at the speed of innovation and risk, because both are accelerating faster than ever.”

Embrace AI with confidence with Darktrace / SECURE AI

Darktrace has introduced Darktrace / SECURE AI™, a new product within the Darktrace ActiveAI Security Platform™ ,designed to provide enterprise-wide security for AI by applying industry leading behavioral analysis to how prompts, agents, and AI systems are used.

Darktrace / SECURE AI^TMdelivers real-time visibility and control across Enterprise and SaaS GenAI prompts, AI agent identities, development and production environments, and Shadow AI - detecting even subtle misuse, misconfiguration, and drift that traditional, rule-based controls simply do not understand. By interpreting context and intent across humans and machines, Darktrace enables organizations to adopt AI at scale without introducing unmanaged risk

What makes this possible is Darktrace’s decade-long maturity and expertise in behavioral understanding and AI-native cybersecurity. Achieved with Self-Learning AI that has been proven across more than 10,000 organizations, Darktrace understands what “normal” looks like for a business, across its users, systems, and now AI, so that meaningful deviations can be detected and acted on before they become incidents.

With one CISO describing Darktrace’s Self-Learning AI as “a leap forward compared to other tools” and another as a “force multiplier,” the technology can interpret ambiguous interactions, understand how access accumulates over time, and recognize when behavior, human or machine, begins to drift.

“Strategically, we’re looking to gain more visibility into how AI is operating across the environment and achieve greater control over what AI should be allowed to access and do,” shared the CISO at a private fund administrator.

“What I’ve seen from Darktrace / SECURE AI is extremely promising. I have tremendous confidence in Darktrace’s vision for where this is headed and its ability to execute on this new solution.”

‍

About the author

The Darktrace Community

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Introduction: Spike in exploitation and post-exploitation activity affecting Palo Alto firewall devices

How did exploitation occur?

Post-Exploitation Patterns of Activity

Exploit Validation

Initial Payload Retrieval

C2 Communication and Additional Payloads

Reconnaissance and Cryptomining

Conclusion

Get the latest insights on emerging cyber threats

References

Appendices

MITRE ATT&CK Mapping

List of IoCs

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

NIST Just Proved It: AI Security Can’t Be Solved With Rules

Enjoying the blog?

More in this series

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

Hola VPN Abuse: From Proxy Traffic to Malware and Cryptomining

How Attackers Abuse the Chinese Nezha Monitoring Tool

Blog

July 6, 2026

NIST Just Proved It: AI Security Can’t Be Solved With Rules

Static AI guardrails are inherently limited

AI security must shift from rules to behavior

Guardrails remain important but they are only one layer

Blog

July 1, 2026

5 Ways AI is changing traditional security models according to modern CISOs

The Reality of Securing AI in Motion

The next phase of cybersecurity: securing AI

Embrace AI with confidence with Darktrace / SECURE AI