Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Share
31
Mar 2021
Ransomware: An unwanted present
Darktrace regularly observes an increase in cyber-attacks carried out during holidays, weekends, and outside of working hours. It is clear that such ‘off peak’ attacks allow easy exploitation of standard organizational practices and human vulnerabilities.
As reduced staff wind down and employees mentally and physically log off from the workplace, there is a decline in the speed of detection and triage within an enterprise. This allows threat actors to sneak in unnoticed. Without real-time autonomous systems, when executed these unexpected attacks have a much greater impact on response and recovery.
One of the most frequent threats detected out of hours is ransomware. In 76% of infections, the encryption process begins either after hours or during the weekend. Darktrace was alerted to a ransomware incident which was executed in the early hours of a client’s network on Christmas Day, when most employees were offline.
Figure 1: Timeline of the Christmas Day ransomware breach
Over a week before the encryption began, an initial foothold was established on an unassuming desktop. Using this vector, the threat actor was able to move laterally and gain access to two domain controllers – servers used to verify users and authenticate requests. The two servers then made unusual command and control (C2) connections to a rare endpoint linked to ransomware. Next, the threat went into hiding. Although Darktrace had alerted to this activity at every stage, the security team was under great stress during the December period and did not manage to action even these highly critical alerts. Without Darktrace / NETWORK or Proactive Threat Notifications (PTNs), the threat remained uninterrupted.
It suddenly re-emerged after hours on December 24 and utilized its additional privileges to write suspicious executable files to a range of internal devices. A pre-determined set of company data was exfiltrated and a ransomware payload downloaded from the same cloud destination.
A cyber-attack striking on a public holiday is likely to destabilize communication – who is responsible for dealing with it? Are they hard to reach? Are there different protocols for an out-of-hours breach? When unexpected during the holidays, these questions may be surprisingly hard to answer. When answers finally arrive, it is often too late – the damage has already been done.
Once dealt with, there are also repercussions for evaluation: security personnel will be needed to investigate what happened and the future consequences of the attack. If internal staff are hard to mobilize, and external security services come at a premium, this process can be arduous and key evidence may be lost. In turn, the company will be left open to similar attacks in the future.
Saturday night fearware
Holidays clearly pose a human and logistical vulnerability. However, it is often overlooked that these same down periods occur on a small scale throughout the year – at the end of every week. Darktrace has observed a huge surge in weekend attacks in recent months.
Figure 2: Diagram of the key terms Darktrace has observed over the past six months in out-of-hours model breaches
This includes another ransomware incident, which struck a hospitality organization based in the UK. A company device was compromised when a user unintentionally accessed a harmful email. The infection exploited cleartext password files to laterally move to four other devices, including critical servers which it then used to host outbound spam and further disseminate. For several following weekends, compromised devices made a large volume of open or Tor-hosted C2 connections to endpoints associated with the XINOF ransomware.
This example shows that out-of-hours infections can come from any vector, and human compliance errors can be exploited to quickly propagate malware and hide before the security team returns to work on Monday. With many data breaches already taking months to discover, threat actors are looking to extend their concealment by implementing the initial compromise at times with decreased monitoring.
Improving detection of these first compromises and adapting to smaller out-of-hours periods may lead to improved response and adjustment for larger holidays as well. But for a permanent fix, enterprises need a proactive approach.
The solution which never sleeps
In the case study above, Autonomous Response was possible at every attack stage, had it been switched on in active mode. Darktrace / EMAIL would have stopped the initial compromise by identifying the anomalous attachment and quarantining the infection before it could enter the network. Once inside, the critical servers exploited would not have been compromised, as the malicious login activity using gathered passwords would have been halted until verified. Finally, connections to the malicious sites containing the XINOF payload could have been blocked, stopping further damages from occurring.
Unlike a human, AI never sleeps, and never takes a holiday. Instead, the AI stays active around the clock, containing all types of threats in their earliest stages. This prevents malicious activity from escalating while giving human security teams valuable airtime to react and remediate the root cause of any incidents.
If a security team requires an extra set of eyes to augment their investigation, incidents can also be mitigated with Proactive Threat Notifications (PTNs). This service funnels high-severity detections straight into Darktrace’s customer-dedicated SOC to be investigated by expert cyber analysts. The Darktrace PTN SOC has a follow-the-sun approach to monitoring customer environments, meaning that organizations are protected from attacks around the clock.
Timing is everything
The case studies in this blog should serve as a reminder of the need for 24/7 attentiveness. As security professionals increase their skills and creativity in combating threats, malicious actors continue to adapt themselves and are using timing to their advantage during attacks. Now more than ever, it is clear that autonomous AI-based detection is the only means to remove the advantage of timing from threat actors so that even when the office is closed or the laptop is switched off, your security remains on.
Thanks to Darktrace Product Manager Gabriel Few-Wiegratz for his insights.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Darktrace Named the Only 2025 Gartner® Peer Insights™ Customers’ Choice for Network Detection and Response
Darktrace has been named the only Customers’ Choice in the 2025 Gartner® Peer Insights™ Voice of the Customer for Network Detection and Response, earning a 4.8/5 rating from 242 reviews and being named both Gartner Customers’ Choice and a Magic Quadrant Leader recognition.
Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace
Darktrace investigates a DragonForce-affiliated ransomware attack targeting the manufacturing sector. The blog details the attack lifecycle, from network scanning and credential brute-forcing to data exfiltration and file encryption.
WSUS Exploited: Darktrace’s Analysis of Post-Exploitation Activities Related to CVE-2025-59287
In October 2025, Microsoft disclosed a critical vulnerability in its Windows Server Update Service (WSUS). This blog details Darktrace’s analysis of the vulnerability, focusing on two US customers where active exploitation was detected.
Darktrace Named the Only 2025 Gartner® Peer Insights™ Customers’ Choice for Network Detection and Response
Darktrace: The only Customers’ Choice for NDR in 2025
In a year defined by rapid change across the threat landscape, recognition from those who use and rely on security technology every day means the most.
That’s why we’re proud to share that Darktrace has been named the only Customers’ Choice in the 2025 Gartner® Peer Insights™ Voice of the Customer for Network Detection and Response (NDR).
Out of 11 leading NDR vendors evaluated, Darktrace stood alone as the sole Customers’ Choice, a recognition that we feel reflects not just our innovation, but the trust and satisfaction of the customers who secure their networks with Darktrace every day.
What the Gartner® Peer Insights™ Voice of the Customer means
“Voice of the Customer” is a document that synthesizes Gartner Peer Insights reviews into insights for buyers of technology and services. This aggregated peer perspective, along with the individual detailed reviews, is complementary to Gartner expert research and can play a key role in your buying process. Peers are verified reviewers of a technology product or service, who not only rate the offering, but also provide valuable feedback to consider before making a purchase decision. Vendors placed in the upper-right “Customers’ Choice” quadrant of the “Voice of the Customer” have scores that meet or exceed the market average for both axes (User Interest and Adoption, and Overall Experience).It’s not just a rating. We feel it’s a reflection of genuine customer sentiment and success in the field.
In our view, Customers consistently highlight Darktrace’s ability to:
Detect and respond to unknown threats in real time
Deliver unmatched visibility across IT, OT, and cloud environments
Automate investigations and responses through AI-driven insights
We believe this recognition reinforces what our customers already know: that Darktrace helps them see, understand, and stop attacks others miss.
A rare double: recognized by customers and analysts alike
This distinction follows another major recogniton. Darktrace’s placement as a Leader in the Gartner® Magic Quadrant™ for Network Detection and Response earlier this year.
That makes Darktrace the only vendor to achieve both:
A Leader status in the Gartner Magic Quadrant for NDR, and
A Customers’ Choice in Gartner Peer Insights 2025
It’s a rare double that we feel reflects both industry leadership and customer trust, two perspectives that, together, define what great cybersecurity looks like.
A Customers’ Choice across the network and the inbox
To us, this recognition also builds on Darktrace’s momentum across multiple domains. Earlier this year, Darktrace was also named a Customers’ Choice for Email Security Platforms in the Gartner® Peer Insights™ report.
With more than 1,000 verified reviews across Network Detection and Response, Email Security Platforms, and Cyber Physical Systems (CPS), we at Darktrace are proud to be trusted across the full attack surface, from the inbox to the industrial network.
Thank you to our customers
We’re deeply grateful to every customer who shared their experience with Darktrace on Gartner Peer Insights. Your insights drive our innovation and continue to shape how we protect complex, dynamic environments across the world.
Gartner® Peer Insights™ content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
Magic Quadrant and Peer Insights are registered trademarks of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.
Gartner, Voice of the Customer for Network Detection and Response, By Peer Community Contributor, 30 October 2025
Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace
What is DragonForce?
DragonForce is a Ransomware-as-a-Service (RaaS) platform that emerged in late 2023, offering broad-scale capabilities and infrastructure to threat actors. Recently, DragonForce has been linked to attacks targeting the UK retail sector, resulting in several high-profile cases [1][2]. Moreover, the group launched an affiliate program offering a revenue share of roughly 20%, significantly lower than commissions reported across other RaaS platforms [3].
This Darktrace case study examines a DragonForce-linked RaaS infection within the manufacturing industry. The earliest signs of compromise were observed during working hours in August 2025, where an infected device started performing network scans and attempted to brute-force administrative credentials. After eight days of inactivity, threat actors returned and multiple devices began encrypting files via the SMB protocol using a DragonForce-associated file extension. Ransom notes referencing the group were also dropped, suggesting the threat actor is claiming affiliation with DragonForce, though this has not been confirmed.
Despite Darktrace’s detection of the attack in its early stages, the customer’s deployment did not have Darktrace’s Autonomous Response capability configured, allowing the threat to progress to data exfiltration and file encryption.
Darktrace's Observations
While the initial access vector was not clearly defined in this case study, it was likely achieved through common methods previously employed out by DragonForce affiliates. These include phishing emails leveraging social engineering tactics, exploitation of public-facing applications with known vulnerabilities, web shells, and/or the abuse of remote management tools.
Darktrace’s analysis identified internal devices performing internal network scanning, brute-forcing credentials, and executing unusual Windows Registry operations. Notably, Windows Registry events involving "Schedule\Taskcache\Tasks" contain subkeys for individual tasks, storing GUIDs that can be used to locate and analyze scheduled tasks. Additionally, Control\WMI\Security holds security descriptors for WMI providers and Event Tracing loggers that use non-default security settings respectively.
Furthermore, Darktrace identified data exfiltration activity over SSH, including connections to an ASN associated with a malicious hosting service geolocated in Russia.
1. Network Scan & Brute Force
Darktrace identified anomalous behavior in late August to early September 2025, originating from a source device engaging in internal network scanning followed by brute-force attempts targeting administrator credential, including “administrator”, “Admin”, “rdpadmin”, “ftpadmin”.
Upon further analysis, one of the HTTP connections seen in this activity revealed the use of the user agent string “OpenVAS-VT”, suggesting that the device was using the OpenVAS vulnerability scanner. Subsequently, additional devices began exhibiting network scanning behavior. During this phase, a file named “delete.me” was deleted by multiple devices using SMB protocol. This file is commonly associated with network scanning and penetration testing tool NetScan.
2. Windows Registry Key Update
Following the scanning phase, Darktrace observed the initial device then performing suspicious Winreg operations. This included the use of the ”BaseRegOpenKey” function across multiple registry paths.
Additional operations such as “BaseRegOpenKey” and “BaseRegQueryValue” were also seen around this time. These operations are typically used to retrieve specific registry key values and allow write operations to registry keys.
The registry keys observed included “SYSTEM\CurrentControlSet\Control\WMI\Security” and “Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks”. These keys can be leveraged by malicious actors to update WMI access controls and schedule malicious tasks, respectively, both of which are common techniques for establishing persistence within a compromised system.
3. New Administrator Credential Usage
Darktrace subsequently detected the device using a highly privileged credential, “administrator”, via a successful Kerberos login for the first time. Shortly after, the same credential was used again for a successful SMB session.
These marked the first instances of authentication using the “administrator” credential across the customer’s environment, suggesting potential malicious use of the credential following the earlier brute-force activity.
Figure 1: Darktrace’s detection of administrator credentials being used in Kerberos login events by an infected device.
Figure 2: Darktrace’s detection of administrator credentials being used in SMB sessions by an infected device.
4. Data Exfiltration
Prior to ransomware deployment, several infected devices were observed exfiltrating data to the malicious IP 45.135.232[.]229 via SSH connections [7][8]. This was followed by the device downloading data from other internal devices and transferring an unusually large volume of data to the same external endpoint.
The IP address was first seen on the network on September 2, 2025 - the same date as the observed data exfiltration activity preceding ransomware deployment and encryption.
Further analysis revealed that the endpoint was geolocated in Russia and registered to the malicious hosting provider Proton66. Multiple external researchers have reported malicious activity involving the same Proton66 ASN (AS198953 Proton66 OOO) as far back as April 2025. These activities notably included vulnerability scanning, exploitation attempts, and phishing campaigns, which ultimately led to malware [4][5][6].
Data Exfiltration Endpoint details.
Endpoint: 45.135.232[.]229
ASN: AS198953 Proton66 OOO
Transport protocol: TCP
Application protocol: SSH
Destination port: 22
Figure 3: Darktrace’s summary of the external IP 45.135.232[.]229, first detected on September 2, 2025. The right-hand side showcases model alerts triggered related to this endpoint including multiple data exfiltration related model alerts.
Further investigation into the endpoint using open-source intelligence (OSINT) revealed that it led to a Microsoft Internet Information Services (IIS) Manager console webpage. This interface is typically used to configure and manage web servers. However, threat actors have been known to exploit similar setups, using fake certificate warnings to trick users into downloading malware, or deploying malicious IIS modules to steal credentials.
Figure 4: Live screenshot of the destination (45.135.232[.]229), captured via OSINT sources, displaying a Microsoft IIS Manager console webpage.
5. Ransomware Encryption & Ransom Note
Multiple devices were later observed connecting to internal devices via SMB and performing a range of actions indicative of file encryption. This suspicious activity prompted Darktrace’s Cyber AI Analyst to launch an autonomous investigation, during which it pieced together associated activity and provided concrete timestamps of events for the customer’s visibility.
During this activity, several devices were seen writing a file named “readme.txt” to multiple locations, including network-accessible webroot paths such as inetpub\ and wwwroot\. This “readme.txt” file, later confirmed to be the ransom note, claimed the threat actors were affiliated with DragonForce.
At the same time, devices were seen performing SMB Move, Write and ReadWrite actions involving files with the “.df_win” extension across other internal devices, suggesting that file encryption was actively occurring.
Figure 5: Darktrace’s detection of SMB events (excluding Read events) where the device was seen moving or writing files with the “.df_win” extension.
Figure 6: Darktrace’s detection of a spike in SMB Write events with the filename “readme.txt” on September 9, indicating the start of file encryption.
Conclusion
The rise of Ransomware-as-a-Service (RaaS) and increased attacker customization is fragmenting tactics, techniques, and procedures (TTPs), making it increasingly difficult for security teams to prepare for and defend against each unique intrusion. RaaS providers like DragonForce further complicate this challenge by enabling a wide range of affiliates, each with varying levels of sophistication [9].
In this instance, Darktrace was able to identify several stages of the attack kill chain, including network scanning, the first-time use of privileged credentials, data exfiltration, and ultimately ransomware encryption. Had the customer enabled Darktrace’s Autonomous Response capability, it would have taken timely action to interrupt the attack in its early stages, preventing the eventual data exfiltration and ransomware detonation.
Credit to Justin Torres, Senior Cyber Analyst, Nathaniel Jones, VP, Security & AI Strategy, FCISO, & Emma Foulger, Global Threat Research Operations Lead.
Darktrace Cyber AI Analyst Coverage/Investigation Events:
· Web Application Vulnerability Scanning of Multiple Devices
· Port Scanning
· Large Volume of SMB Login Failures
· Unusual RDP Connections
· Widespread Web Application Vulnerability Scanning
· Unusual SSH Connections
· Unusual Repeated Connections
· Possible Application Layer Reconnaissance Activity
· Unusual Administrative Connections
· Suspicious Remote WMI Activity
· Extensive Unusual Administrative Connections
· Suspicious Directory Replication Service Activity
· Scanning of Multiple Devices
· Unusual External Data Transfer
· SMB Write of Suspicious File
· Suspicious Remote Service Control Activity
· Access of Probable Unencrypted Password Files
· Internal Download and External Upload
· Possible Encryption of Files over SMB
· SMB Writes of Suspicious Files to Multiple Devices
The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.
Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.
Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.
The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content.
![Darktrace’s summary of the external IP 45.135.232[.]229, first detected on September 2, 2025. The right-hand side showcases model alerts triggered related to this endpoint including multiple data exfiltration related model alerts.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/690baa3e2f4def9f29b1ecae_Screenshot%202025-11-05%20at%2011.48.57%E2%80%AFAM.png)
![Live screenshot of the destination (45.135.232[.]229), captured via OSINT sources, displaying a Microsoft IIS Manager console webpage.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/690baa68a5b7b13fba715069_Screenshot%202025-11-05%20at%2011.49.52%E2%80%AFAM.png)
