Blog
/
/
January 2, 2023

Analyst's Guide to the ActiveAI Security Platform

Understand Darktrace's full functionality in preventing and detecting cyber threats, and how analysts can benefit from Darktrace's AI technology.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Gabriel Hernandez
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
02
Jan 2023

On countless occasions, Darktrace has observed cyber-attacks disrupting business operations by using a vulnerable internet-facing asset as a starting point for infection. Finding that one entry point could be all a threat actor needs to compromise an entire organization. With the objective to prevent such vulnerabilities from being exploited, Darktrace’s latest product family includes Attack Surface Management (ASM) to continuously monitor customer attack surfaces for risks, high-impact vulnerabilities and potential external threats. 

An attack surface is the sum of exposed and internet-facing assets and the associated risks a hacker can exploit to carry out a cyber-attack. Darktrace / Attack Surface Management uses AI to understand what external assets belong to an organization by searching beyond known servers, networks, and IPs across public data sources. 

This blog discusses how Darktrace / Attack Surface Management could combine with Darktrace / NETWORK to find potential vulnerabilities and subsequent exploitation within network traffic. In particular, this blog will investigate the assets of a large Australian company which operates in the environmental sciences industry.   

Introducing ASM

In order to understand the link between PREVENT and DETECT, the core features of ASM should first be showcased.

Figure 1: The PREVENT/ASM dashboard.

When facing the landing page, the UI highlights the number of registered assets identified (with zero prior deployment). The tool then organizes the information gathered online in an easily assessable manner. Analysts can see vulnerable assets according to groupings like ‘Misconfiguration’, ‘Social Media Threat’ and ‘Information Leak’ which shows the type of risk posed to said assets.

Figure 2: The Network tab identifies the external facing assets and their hierarchy in a graphical format.

The Network tab helps analysts to filter further to take more rapid action on the most vulnerable assets and interact with them to gather more information. The image below has been filtered by assets with the ‘highest scoring’ risk.

Figure 3: PREVENT/ASM showing a high scoring asset.

Interacting with the showcased asset selected above allows pivoting to the following page, this provides more granular information around risk metrics and the asset itself. This includes a more detailed description of what the vulnerabilities are, as well as general information about the endpoint including its location, URL, web status and technologies used.

  Figure 4: Asset pages for an external web page at risk.

Filtering does not end here. Within the Insights tab, analysts can use the search bar to craft personalized queries and narrow their focus to specific types of risk such as vulnerable software, open ports, or potential cybersquatting attempts from malicious actors impersonating company brands. Likewise, filters can be made for assets that may be running software at risk from a new CVE. 

Figure 5: Insights page with custom queries to search for assets at risk of Log4J exploitation.

For each of the entries that can be read on the left-hand side, a query that could resemble the one on the top right exists. This allows users to locate specific findings beyond those risks that are categorized as critical. These broader searches can range from viewing the inventory as a whole, to seeing exposed APIs, expiring certificates, or potential shadow IT. Queries will return a list with all the assets matching the given criteria, and users can then explore them further by viewing the asset page as seen in Figure 4.

Compromise Scenario

Now that a basic explanation of PREVENT/ASM has been given, this scenario will continue to look at the Australian customer but show how Darktrace can follow a potential compromise of an at-risk ASM asset into the network. 

Having certain ports open could make it particularly easy for an attacker to access an internet-facing asset, particularly those sensitive ones such as 3389 (RDP), 445 (SMB), 135 (RPC Epmapper). Alternatively, a vulnerable program with a well-known exploitation could also aid the task for threat actors.

In this specific case, PREVENT/ASM identified multiple external assets that belonged to the customer with port 3389 open. One of these assets can be labelled as ‘Server A'. Whilst RDP connections can be protected with a password for a given user, if those were weak to bruteforce, it could be an easy task for an attacker to establish an admin session remotely to the victim machine.

Figure 6: Insights tab query filtering for open RDP port 3389.

N or zero-day vulnerabilities associated with the protocol could also be exploited; for example, CVE-2019-0708 exploits an RCE vulnerability in Remote Desktop where an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. 

Certain protocols are known to be sensitive according to the control they provide on a destination machine. These are developed for administrative purposes but have the potential to ease an attacker’s job if accessible. Thanks to PREVENT/ASM, security teams can anticipate such activity by having visibility over those assets that could be vulnerable. If this RDP were successfully exploited, DETECT/Network would then highlight the unusual activity performed by the compromised device as the attacker moved through the kill chain.  

There are several models within Darktrace which monitor for risks against internet facing assets. For example, ‘Server A’ which had an open 3389 port on ASM registered the following model breach in the network:

Figure 7: Breach log showing Anomalous Server Activity / New Internet Facing System model for ‘Server A’.

A model like this could highlight a misconfiguration that has caused an internal device to become unexpectedly open to the internet. It could also suggest a compromised device that has now been opened to the internet to allow further exploitation. If the result of a sudden change, such an asset would also be detected by ASM and highlighted within the ‘New Assets’ part of the Insights page. Ultimately this connection was not malicious, however it shows the ability for security teams to track between PREVENT to DETECT and verify an initial compromise.  

A mock scenario can take this further. Using the continued example of an open port 3389 intrusion, new RDP cookies may be registered (perhaps even administrative). This could enable further lateral movement and eventual privilege escalation. Various DETECT models would highlight actions of this nature, two examples are below:

Figure 8: RDP Lateral Movement related model breaches on customer.

Alongside efforts to move laterally, Darktrace may find attempts at reconnaissance or C2 communication from compromised internet facing devices by looking at Darktrace DETECT model breaches including ‘Network Scan’, ‘SMB Scanning’ and ‘Active Directory Reconnaissance’. In this case the network also saw repeated failed internal connections followed by the ‘LDAP Brute-Force Activity model’ around the same time as the RDP activity. Had this been malicious, DETECT would then continue to provide visibility into the C2 and eventual malware deployment stages. 

With the combined visibility of both tools, Darktrace users have support for greater triage across the whole kill chain. For customers also using RESPOND, actions will be taken from the DETECT alerting to subsequently block malicious activity. In doing so, inputs will have fed across the whole Cyber AI Loop by having learnt from PREVENT, DETECT and RESPOND.

This feed from the Cyber AI Loop works both ways. In Figure 9, below, a DETECT model breach shows a customer alert from an internet facing device: 

Figure 9: Model breach on internet-facing server.

This breach took place because an established server suddenly started serving HTTP sessions on a port commonly used for HTTPS (secure) connections. This could be an indicator that a criminal may have gained control of the device and set it to listen on the given port and enable direct connection to the attacker’s machine or command and control server. This device can be viewed by an analyst in its Darktrace PREVENT version, where new metrics can be observed from a perspective outside of the network.

Figure 10: Assets page for server. PREVENT shows few risks for this asset. 

This page reports the associated risks that could be leveraged by malicious actors. In this case, the events are not correlated, but in the event of an attack, this backwards pivoting could help to pinpoint a weak link in the chain and show what allowed the attacker into the network. In doing so this supports the remediation and recovery process. More importantly though, it allows organizations to be proactive and take appropriate security measures required before it could ever be exploited.

Concluding Thoughts

The combination of Darktrace / Attack Surface Management with Darktrace / NETWORK provides wide and in-depth visibility over a company’s infrastructure. Through the Darktrace platform, this coverage is continually learning and updating based on inputs from both. ASM can show companies the potential weaknesses that a cybercriminal could take advantage of. In turn this allows them to prioritize patching, updating, and management of their internet facing assets. At the same time, Darktrace will show the anomalous behavior of any of these internet facing devices, enabling security teams or respond to stop an attack. Use of these tools by an analyst together is effective in gaining informed security data which can be fed back to IT management. Leveraging this allows normal company operations to be performed without the worry of cyber disruption.

Credit to: Emma Foulger, Senior Cyber Analyst at Darktrace

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Gabriel Hernandez

More in this series

No items found.

Blog

/

Network

/

October 23, 2025

Darktrace Redefines NDR: Industry-First Autonomous Threat Investigation from Network to Endpoint with Agentic AI

autonomous investigations, endpoint, ndr, network detection and responseDefault blog imageDefault blog image

Darktrace delivers the next evolution of unified and proactive NDR

Darktrace Network Endpoint eXtended Telemetry (NEXT) is revolutionizing NDR with the industry’s first mixed-telemetry agent using Self-Learning AI.  

The combined context of native network and endpoint process data significantly reduces incident triage and investigation times for threats spanning both domains. Our business-centric approach learns what normal looks like for each endpoint, and now uses process context to extend our ability to identify novel threats that existing EDR/XDR tools often  miss.

Summary of what’s new:

  • Native endpoint process telemetry combined with NDR, bridging the EDR gap
  • Self-Learning AI on the endpoint to stop novel threats missed by EDR
  • Sophisticated Agentic AI to automate SecOps investigations across all major IT domains
  • AI-native, real-time threat detection, investigation, and response (TDIR) for cross-domain activity throughout the enterprise

Why is this an important next step in NDR?

Security analysts are buried under a flood of alerts that lack the context needed to separate genuine threats from noise. The root problem is that most security tools only see one slice of the environment. IT and OT networks, endpoints, and cloud systems are monitored in isolation, with little correlation between them.

As a result, investigations are highly manual. Analysts are forced to pivot between siloed point-products, each providing only a fragment of the incident. This slows response, creates blind spots, and limits the team’s ability to understand and contain threats effectively.

In many cases, the high degree of skill it takes to pivot tools and conduct investigations leads even the most experienced analysts closer to burnout, especially when they are already exhausted by the quantity of alerts. Ultimately, the human personnel managing these systems are using their skills to accommodate for the lack of synergy between tools they are using in their security stack, rather than developing the higher-value expertise needed to anticipate, prevent, and respond to emerging threats.

Many organizations have attempted to overcome this challenge by implementing XDR solutions. But, XDR does not cover NDR related use cases. This is especially true in OT/CPS environments where it is not possible to install an agent on devices.

XDR is an Endpoint-focused tool that cannot see the full picture of threats moving laterally across the network, targeting unmanaged devices, or blending into legitimate traffic. While XDR is still a strong tool in the arsenal, attackers are noticing where the gaps are:

  • A CISA Red Team assessment found that one U.S. critical infrastructure organization suffered prolonged compromise because it overly relied on host‑based EDR and lacked sufficient network-layer defenses.  

Bottom line: Without native network detection and response (NDR), critical incidents slip through undetected.

Not all NDR tools are built the same

When it comes to NDR, the details matter. Here are a few reasons why not all NDR solutions are created equal:

  • Most NDR solutions depend on EDR/XDR integrations to ingest endpoint alerts, which are raised based on activity that is already known to be malicious
  • They can’t investigate beyond what the EDR already flags, lacking process-level context in network investigations
  • Almost no NDR solutions have a native endpoint agent to extend NDR visibility to remote worker devices

This reliance on EDR leaves critical gaps in network coverage, since EDRs themselves don’t provide network-level visibility.

The NEXT evolution of NDR

Darktrace Network Endpoint eXtended Telemetry (NEXT) is revolutionizing NDR with the industry’s first mixed-telemetry agent using Self-Learning AI.  

The combined context of native network and endpoint process data significantly reduces incident triage and investigation times for threats spanning both domains, our business-centric approach with new data also extends our ability to identify novel threats that existing EDR/XDR may miss.

Darktrace / ENDPOINT agents are now able to utilize new Network Endpoint eXtended Telemetry (NEXT) capabilities. This combines full network visibility with native endpoint process data, enabling autonomous investigations that trace threats from initial network activity all the way to the root cause at the endpoint, without manual correlation or tool switching. This bridges the gap between NDR and the endpoint, while adding value to existing EDR investments.

Darktrace natively shows the endpoint process context in relation to network events, complete with parent/child process relationships, adding immediate context to network investigations without needing to pivot to your EDR.
Figure 1: Darktrace natively shows the endpoint process context in relation to network events, complete with parent/child process relationships, adding immediate context to network investigations without needing to pivot to your EDR.

Leveraging this data in investigations

This additional context is then leveraged by Cyber AI Analyst, a sophisticated agentic AI system that autonomously performs end-to-end investigations of all relevant alerts and prioritizes incidents. With the new endpoint process visibility, Cyber AI Analyst now incorporates process context into its decision-making, which improves detection accuracy, filters out benign activity, and enhances incident narratives with process-level insights.

This makes Darktrace the first NDR to natively investigate threats across network and endpoint telemetry with an autonomous, agentic AI analyst. And with our Self-Learning AI, Darktrace continuously evolves by understanding what’s normal for each unique environment, now adding process data to extend visibility and range of detections. This enables Darktrace to detect and contain novel threats, including zero-days, insider threats, and emerging attack techniques, up to 8 days before public disclosure.

This is more than a solution to a visibility problem. It’s a fundamental evolution in how threats are detected, investigated, and stopped. By applying agentic AI, Darktrace empowers security teams to move from reactive alert triage to proactive, autonomous defense, surfacing and blocking threats that others simply can’t see.

An excerpt from a Darktrace Cyber AI Analyst incident, showing the inclusion of native endpoint process context alongside other network events.
Figure 2: An excerpt from a Darktrace Cyber AI Analyst incident, showing the inclusion of native endpoint process context alongside other network events.

Continued innovation in detection and response

Darktrace also continues to invest in our core NDR capabilities, delivering enhancements and innovations to solve modern network security challenges. In the latest release, Darktrace / NETWORK has been enhanced to increase detection efficacy and performance. This includes increased protocol detection fidelity and new support for custom port mappings, plus expanded visibility into HTTP traffic to support more targeted threat hunting across a wider range of application layer activity. In addition, vSensor performance has been upgraded for tunnel protocols such as Geneve.

We have also released enhancements to Autonomous Response, which is already trusted by thousands of organizations to contain threats at the earliest stages without causing business disruption. This includes enhanced support for highly complex and segmented networks, plus the ability to extend Autonomous Response actions to more areas with additional firewall integration support. This enables faster and more effective response to network threats, and continues Darktrace’s proven ability to contain zero-day threats up to 8 days before public disclosure.

Providing seamless operations with the new Darktrace ActiveAI Security Portal

As part of Darktrace’s commitment to breaking down silos across the cyber defense lifecycle, this release also introduces major platform enhancements that tackle often-overlooked operational gaps specifically around user access, permissions, and integration workflows. With the launch of the new Darktrace ActiveAI Security Portal, organizations can now manage security at scale across diverse environments, making it ideal for large enterprises, MSSPs, and partners overseeing multiple tenants. These updates ensure that visibility, control, and scalability extend beyond detection and response and into how teams manage and interact with the platform itself.

Committed to innovation

These updates are part of the broader Darktrace release, which also included major innovations in cloud security with the launch of the industry’s first fully automated cloud forensics solution, reinforcing Darktrace’s leadership in AI-native security. As attackers exploit gaps between tools, the Darktrace ActiveAI Security Platform delivers unified detection, automated investigation, and autonomous response across cloud, endpoint, email, network, and OT. With full-stack visibility and AI-native workflows, Darktrace empowers security teams to detect, understand, and stop novel threats before they escalate.

Join our Live Launch Event

When? 

December 9, 2025

What will be covered?

Join our live broadcast to experience how Darktrace is eliminating blind spots for detection and response across your complete enterprise with new innovations in Agentic AI across our ActiveAI Security platform. Industry leaders from IDC will join Darktrace customers to discuss challenges in cross-domain security, with a live walkthrough reshaping the future of Network Detection & Response, Endpoint Detection & Response, Email Security, and SecOps in novel threat detection and autonomous investigations.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response

Blog

/

/

October 20, 2025

Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion

salt typhoonDefault blog imageDefault blog image

What is Salt Typhoon?

Salt Typhoon represents one of the most persistent and sophisticated cyber threats targeting global critical infrastructure today. Believed to be linked to state-sponsored actors from the People’s Republic of China (PRC), this advanced persistent threat (APT) group has executed a series of high-impact campaigns against telecommunications providers, energy networks, and government systems—most notably across the United States.

Active since at least 2019, the group—also tracked as Earth Estries, GhostEmperor, and UNC2286—has demonstrated advanced capabilities in exploiting edge devices, maintaining deep persistence, and exfiltrating sensitive data across more than 80 countries. While much of the public reporting has focused on U.S. targets, Salt Typhoon’s operations have extended into Europe, the Middle East, and Africa (EMEA) where it has targeted telecoms, government entities, and technology firms. Its use of custom malware and exploitation of high-impact vulnerabilities (e.g., Ivanti, Fortinet, Cisco) underscores the strategic nature of its campaigns, which blend intelligence collection with geopolitical influence [1].

Leveraging zero-day exploits, obfuscation techniques, and lateral movement strategies, Salt Typhoon has demonstrated an alarming ability to evade detection and maintain long-term access to sensitive environments. The group’s operations have exposed lawful intercept systems, compromised metadata for millions of users, and disrupted essential services, prompting coordinated responses from intelligence agencies and private-sector partners worldwide. As organizations reassess their threat models, Salt Typhoon serves as a stark reminder of the evolving nature of nation-state cyber operations and the urgent need for proactive defense strategies.

Darktrace’s coverage

In this case, Darktrace observed activity in a European telecommunications organisation consistent with Salt Typhoon’s known tactics, techniques and procedures (TTPs), including dynamic-link library (DLL) sideloading and abuse of legitimate software for stealth and execution.

Initial access

The intrusion likely began with exploitation of a Citrix NetScaler Gateway appliance in the first week of July 2025. From there, the actor pivoted to Citrix Virtual Delivery Agent (VDA) hosts in the client’s Machine Creation Services (MCS) subnet. Initial access activities in the intrusion originated from an endpoint potentially associated with the SoftEther VPN service, suggesting infrastructure obfuscation from the outset.

Tooling

Darktrace subsequently observed the threat actor delivering a backdoor assessed with high confidence to be SNAPPYBEE (also known as Deed RAT) [2][3] to multiple Citrix VDA hosts. The backdoor was delivered to these internal endpoints as a DLL alongside legitimate executable files for antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This pattern of activity indicates that the attacker relied on DLL side-loading via legitimate antivirus software to execute their payloads. Salt Typhoon and similar groups have a history of employing this technique [4][5], enabling them to execute payloads under the guise of trusted software and bypassing traditional security controls.

Command-and-Control (C2)

The backdoor delivered by the threat actor leveraged LightNode VPS endpoints for C2, communicating over both HTTP and an unidentified TCP-based protocol. This dual-channel setup is consistent with Salt Typhoon’s known use of non-standard and layered protocols to evade detection. The HTTP communications displayed by the backdoor included POST requests with an Internet Explorer User-Agent header and Target URI patterns such as “/17ABE7F017ABE7F0”. One of the C2 hosts contacted by compromised endpoints was aar.gandhibludtric[.]com (38.54.63[.]75), a domain recently linked to Salt Typhoon [6].

Detection timeline

Darktrace produced high confidence detections in response to the early stages of the intrusion, with both the initial tooling and C2 activities being strongly covered by both investigations by Darktrace Cyber AI AnalystTM investigations and Darktrace models. Despite the sophistication of the threat actor, the intrusion activity identified and remediated before escalating beyond these early stages of the attack, with Darktrace’s timely high-confidence detections likely playing a key role in neutralizing the threat.

Cyber AI Analyst observations

Darktrace’s Cyber AI Analyst autonomously investigated the model alerts generated by Darktrace during the early stages of the intrusion. Through its investigations, Cyber AI Analyst discovered the initial tooling and C2 events and pieced them together into unified incidents representing the attacker’s progression.

Cyber AI Analyst weaved together separate events from the intrusion into broader incidents summarizing the attacker’s progression.
Figure 1: Cyber AI Analyst weaved together separate events from the intrusion into broader incidents summarizing the attacker’s progression.

Conclusion

Based on overlaps in TTPs, staging patterns, infrastructure, and malware, Darktrace assesses with moderate confidence that the observed activity was consistent with Salt Typhoon/Earth Estries (ALA GhostEmperor/UNC2286). Salt Typhoon continues to challenge defenders with its stealth, persistence, and abuse of legitimate tools. As attackers increasingly blend into normal operations, detecting behavioral anomalies becomes essential for identifying subtle deviations and correlating disparate signals. The evolving nature of Salt Typhoon’s tradecraft, and its ability to repurpose trusted software and infrastructure, ensures it will remain difficult to detect using conventional methods alone. This intrusion highlights the importance of proactive defense, where anomaly-based detections, not just signature matching, play a critical role in surfacing early-stage activity.

Credit to Nathaniel Jones (VP, Security & AI Strategy, FCISO), Sam Lister (Specialist Security Researcher), Emma Foulger (Global Threat Research Operations Lead), Adam Potter (Senior Cyber Analyst)

Edited by Ryan Traill (Analyst Content Lead)

Appendices

Indicators of Compromise (IoCs)

IoC-Type-Description + Confidence

89.31.121[.]101 – IP Address – Possible C2 server

hxxp://89.31.121[.]101:443/WINMM.dll - URI – Likely SNAPPYBEE download

b5367820cd32640a2d5e4c3a3c1ceedbbb715be2 - SHA1 – Likely SNAPPYBEE download

hxxp://89.31.121[.]101:443/NortonLog.txt - URI - Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/123.txt - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/123.tar - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/pdc.exe - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443//Dialog.dat - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/fltLib.dll - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/DisplayDialog.exe - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/DgApi.dll - URI - Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/dbindex.dat - URI - Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/1.txt - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/imfsbDll.dll – Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/imfsbSvc.exe - URI – Likely DLL side-loading activity

aar.gandhibludtric[.]com – Hostname – Likely C2 server

38.54.63[.]75 – IP – Likely C2 server

156.244.28[.]153 – IP – Possible C2 server

hxxp://156.244.28[.]153/17ABE7F017ABE7F0 - URI – Possible C2 activity

MITRE TTPs

Technique | Description

T1190 | Exploit Public-Facing Application - Citrix NetScaler Gateway compromise

T1105 | Ingress Tool Transfer – Delivery of backdoor to internal hosts

T1665 | Hide Infrastructure – Use of SoftEther VPN for C2

T1574.001 | Hijack Execution Flow: DLL – Execution of backdoor through DLL side-loading

T1095 | Non-Application Layer Protocol – Unidentified application-layer protocol for C2 traffic

T1071.001| Web Protocols – HTTP-based C2 traffic

T1571| Non-Standard Port – Port 443 for unencrypted HTTP traffic

Darktrace Model Alerts during intrusion

Anomalous File::Internal::Script from Rare Internal Location

Anomalous File::EXE from Rare External Location

Anomalous File::Multiple EXE from Rare External Locations

Anomalous Connection::Possible Callback URL

Antigena::Network::External Threat::Antigena Suspicious File Block

Antigena::Network::Significant Anomaly::Antigena Significant Server Anomaly Block

Antigena::Network::Significant Anomaly::Antigena Controlled and Model Alert

Antigena::Network::Significant Anomaly::Antigena Alerts Over Time Block

Antigena::Network::External Threat::Antigena File then New Outbound Block  

References

[1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a

[2] https://www.trendmicro.com/en_gb/research/24/k/earth-estries.html

[3] https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/k/earth-estries/IOC_list-EarthEstries.txt

[4] https://www.trendmicro.com/en_gb/research/24/k/breaking-down-earth-estries-persistent-ttps-in-prolonged-cyber-o.html

[5] https://lab52.io/blog/deedrat-backdoor-enhanced-by-chinese-apts-with-advanced-capabilities/

[6] https://www.silentpush.com/blog/salt-typhoon-2025/

The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.

Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.

Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.

The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content.

Continue reading
About the author
Nathaniel Jones
VP, Security & AI Strategy, Field CISO
Your data. Our AI.
Elevate your network security with Darktrace AI