Darktrace Analysis: Inside the SOC

Patch and Persist: Darktrace’s Detection of Blind Eagle (APT-C-36)

Charlotte Thompson

Tracking CVE-2025-31324: Darktrace’s detection of SAP Netweaver exploitation before and after disclosure

Industry Insights

Pre-CVE Threat Detection: 10 Examples Identifying Malicious Activity Prior to Public Disclosure of a Vulnerability

Darktrace leverages AI-driven anomaly detection to identify cyber threats before public CVE disclosures. By analyzing behavioral patterns, Darktrace can help organizations detect and contain zero-day exploits early. This proactive approach strengthens cybersecurity posture against nation-state actors, ransomware gangs, and evolving threats across the threat landscape.

Nathaniel Jones

Continue reading

Bytesize Security

Bytesize Security: Insider Threats in Google Workspace

Don’t Take the Bait: How Darktrace Keeps Microsoft Teams Phishing Attacks at Bay

Malicious Use of Dropbox in Phishing Attacks

How an Insider Exfiltrated Corporate Data to Google Cloud

On the Case: Incident Analysis

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Campaign Trail: Threat Research

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Newsletter

Stay ahead of threats with the Darktrace blog newsletter

Get the latest insights from the cybersecurity landscape, including threat trends, incident analysis, and the latest Darktrace product developments – delivered directly to your inbox, monthly.

Tech Talk: Maximising Integrations

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Industry Insights: Systemic Change

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Incidident analyis

Darktrace’s Detection of a Large-Scale Account Hijack that Led to a Phishing Attack

February 11, 2023

by Mariana Pereira

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Industry Insights

Pre-CVE Threat Detection: 10 Examples Identifying Malicious Activity Prior to Public Disclosure of a Vulnerability

Nathaniel Jones

Patch and Persist: Darktrace’s Detection of Blind Eagle (APT-C-36)

Charlotte Thompson

Tracking CVE-2025-31324: Darktrace’s detection of SAP Netweaver exploitation before and after disclosure

Industry Insights

Proactive OT Security: Lessons on Supply Chain Risk Management from a Rogue Raspberry Pi

Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic

Keanna Grelicha

PumaBot: Novel Botnet Targeting IoT Surveillance Devices

From Rockstar2FA to FlowerStorm: Investigating a Blooming Phishing-as-a-Service Platform

Catching a RAT: How Darktrace Neutralized AsyncRAT

Industry Insights

Anomaly-Based Threat Hunting: Darktrace's Approach in Action

Nathaniel Jones

SocGholish: From loader and C2 activity to RansomHub deployment

Christina Kreza

MFA Under Attack: AiTM Phishing Kits Abusing Legitimate Services

Alexandra Sentenac

Industry Insights

Obfuscation Overdrive: Next-Gen Cryptojacking with Layers

Email bombing exposed: Darktrace’s email defense in action

Maria Geronikolou

Cyberhaven Supply Chain Attack: Exploiting Browser Extensions

Rajendra Rushanth

Darktrace's Detection of State-Linked ShadowPad Malware

Darktrace's Early Detection of the Latest Ivanti Exploits

New Threat on the Prowl: Investigating Lynx Ransomware

Detecting and Containing Account Takeover with Darktrace

Defending Against Living-off-the-Land Attacks: Anomaly Detection in Action

Alexandra Sentenac

RansomHub Revisited: New Front-Runner in the Ransomware-as-a-Service Marketplace

Maria Geronikolou

Bytesize Security: Insider Threats in Google Workspace

RansomHub Ransomware: Darktrace’s Investigation of the Newest Tool in ShadowSyndicate's Arsenal

Detecting and Mitigating Adversary-in-the-Middle Phishing Attacks with Darktrace Services

Cleo File Transfer Vulnerability: Patch Pitfalls and Darktrace’s Detection of Post-Exploitation Activities

Maria Geronikolou

Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Defending AITM Phishing and Mamba Attacks

Behind the Veil: Darktrace's Detection of VPN Exploitation in SaaS Environments

Tactics Behind the Royal and Blacksuit Ransomware

Onomastics Gymnastics: How Darktrace Detects Spoofing and Business Email Compromise in Multi-Name Users

Post-Exploitation Activities on Fortinet Devices: A Network-Based Analysis

Phishing and Persistence: Darktrace’s Role in Defending Against a Sophisticated Account Takeover

From Call to Compromise: Darktrace’s Response to a Vishing-Induced Network Attack

Rajendra Rushanth

Thread Hijacking: Infiltration Tactics Explained

Maria Geronikolou

FortiClient EMS Exploited: Attack Chain & Post Exploitation Tactics

Emily Megan Lim

Decrypting the Matrix: How Darktrace Uncovered a KOK08 Ransomware Attack

Christina Kreza

How Darktrace Detects TeamCity Exploitation Activity

Industry Insights

How Darktrace’s AI Applies a Zero-Trust Mentality within Critical Infrastructure Supply Chains

Understanding the WarmCookie Backdoor Threat

Investigating the Adaptive Jupyter Information Stealer

Nahisha Nobregas

How Darktrace Detects NTLM Hash Theft

Charlotte Thompson

Qilin Ransomware: Detection and Analysis

Alexandra Sentenac

Following up on our Conversation: Detecting & Containing a LinkedIn Phishing Attack with Darktrace

Post-Exploitation Activities on PAN-OS Devices: A Network-Based Analysis

Darktrace Investigation Into Medusa Ransomware

Maria Geronikolou

The Price of Admission: Countering Stolen Credentials with Darktrace

Charlotte Thompson

Stemming the Citrix Bleed Vulnerability with Darktrace’s ActiveAI Security Platform

Don’t Take the Bait: How Darktrace Keeps Microsoft Teams Phishing Attacks at Bay

Lost in Translation: Darktrace Blocks Non-English Phishing Campaign Concealing Hidden Payloads

Rajendra Rushanth

Exploitation of ConnectWise ScreenConnect Vulnerabilities

Industry Insights

Detecting Attacks Across Email, SaaS, and Network Environments with Darktrace’s ActiveAI Security Platform

How Cactus Ransomware Was Detected and Stopped

Sliver C2: How Darktrace Provided a Sliver of Hope

Natalia Sánchez Rocafort

Balada Injector: Darktrace’s Investigation into the Malware Exploiting WordPress Vulnerabilities

Darktrace's Investigation of Raspberry Robin Worm

Alexandra Sentenac

What are Botnets and How Darktrace Uncovers Them

Pikabot Malware: Insights, Impact, & Attack Analysis

Industry Insights

Simulated vs. Real Malware: What You Need To Know

Malicious Use of Dropbox in Phishing Attacks

Incident Analysis

Protecting Against AlphV BlackCat Ransomware

Quasar Remote Access Tool and Its Security Risks

Detecting & Containing Gootloader Malware

How CoinLoader Hijacks Networks

How Darktrace Defeated SmokeLoader Malware

Industry Insights

Post-Exploitation Activities of Ivanti CS/PS Appliances

Industry Insights

Detecting Trusted Network Relationship Abuse

Uncovering CyberCartel Threats in Latin America

Alexandra Sentenac

Ivanti Sentry Vulnerability | Analysis & Insights

Industry Insights

How Darktrace Halted A DarkGate in MS Teams

Natalia Sánchez Rocafort

How Darktrace Triumphed Over MyKings Botnet

Oluwatosin Aturaka

Detecting PurpleFox Rootkit with Darktrace AI

Piramol Krishnan

Understanding and Mitigating Sectop RAT

Using Darktrace for Threat Hunting

How PlugX Malware Has Evolved & Adapted

Nahisha Nobregas

Industry Insights

Exploring AI Threats: Package Hallucination Attacks

Charlotte Thompson

Protecting Brazilian Organizations from Malware

Unveiling ViperSoftX: A Darktrace Investigation

How Darktrace Stopped an Account Hijack Fast

How Darktrace Detected Black Basta Ransomware

How Darktrace Stopped Akira Ransomware

The Rise of MaaS & Lumma Info Stealer

Emily Megan Lim

Analyzing Post-Exploitation on Papercut Servers

Darktrace’s Detection of Unattributed Ransomware

Natalia Sánchez Rocafort

Successfully Containing an Admin Credential Attack

Darktrace's Detection of Ransomware & Syssphinx

Detection of an Evasive Credential Harvester | IPFS Phishing

How Darktrace SOC Thwarted a BEC Attack

Revealing Outlaw's Returning Features & New Tactics

Detecting and Responding to Vendor Email Compromises (VEC)

Industry Insights

How Darktrace Foiled QR Code Phishing

Alexandra Sentenac

How Darktrace Quickly Foiled An Information Stealer

Alexandra Sentenac

Darktrace Detection of 3CX Supply Chain Attack

Nahisha Nobregas

PerfectData Software Abuse and Account Takeover Risks

Darktrace’s Detection of a Hive Ransomware-as-Service

Emily Megan Lim

Darktrace Stops Large-Scale Account Hijack

Gozi ISFB Malware Detection Insights and Analysis

Enhancing Darktrace with Microsoft Defender

Detecting Malicious Email Activity & AI Impersonating

Isabelle Cheong

Amadey Info Stealer and N-Day Vulnerabilities

Industry Insights

Multi-Factor Authentication: Not the Silver Bullet

Protecting Yourself from Laplas Clipper Crypto Theives

Anna Gilbertson