Blog
/
Network
/
June 19, 2023

Darktrace Detection of 3CX Supply Chain Attack

Explore how the 3CX supply chain compromise was uncovered, revealing key insights into the detection of sophisticated cyber threats.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Nahisha Nobregas
SOC Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
19
Jun 2023

Ever since the discovery of the SolarWinds hack that affected tens of thousands of organizations around the world in 2020, supply chain compromises have remained at the forefront of the minds of security teams and continue to pose a significant threat to their business operations. 

Supply chain compromises can have far-reaching implications, from disrupting an organization’s daily operations, incurring huge financial and reputational damage, to affecting the critical infrastructure of entire countries. As such, it is essential for organizations to have effective security measures in place able to identify and halt these attacks at the earliest possible stage.

In March 2023 the 3CX Desktop application became the latest victim of a supply chain compromise dubbed as the “SmoothOperator” by SentinelOne. This application is used by over 600,000 companies worldwide and the customer list contains high-profile customers across a variety of industries [2]. The 3CX Desktop application is a Voice over Internet Protocol (VoIP) communication software for enterprises that allows for chats, video calls, and voice calls. [3] The 3CX installers for both Windows and macOS systems were affected by information stealing malware. Researchers were able to discern that threat actors also known as UNC 4736 related to financially motivated North Korean operators also known as AppleJeus were responsible for the supply chain compromise.  Researchers have also linked it to another supply chain compromise that occurred prior on the Trading Technologies X_TRADER platform, making this the first known cascading software supply chain compromise used to distribute malware on a wide scale and still be able to align operator interests. [3] Customer reports following the compromise began to surface about the 3CX software being picked up as malicious by several cybersecurity vendors such as CrowdStrike, SentinelOne, and Palo Alto Networks. [6] 

By leveraging integrations with other security vendors like CrowdStrike and SentinelOne, Darktrace DETECT™ was able to identify activity from the “SmoothOperator” across the customer base at multiple stages of the kill chain in March 2023. Darktrace RESPOND™ was then able to autonomously intervene against these emerging threats, preventing significant disruption to customer networks. 

Background on the first known cascading supply chain attack 

Initial Access

In April 2023, security researchers identified the initial target in this story was not the 3CX desktop application, rather, it was another software application called X_TRADER by Trading Technologies. [3] Trading Technologies is a provider that offers high-performance financial trading packages, allowing financial professionals to analyze and trade assets within the stock market more efficiently. Unfortunately, a compromise already existed in the supply chain for this organization. The X_TRADER installer, which had been retired in 2020, still had its code signing certificate set to expire in October 2022. This code signing certificate was exploited by attackers to digitally sign the malicious software. [3] It also inopportunely led to 3CX when an employee unknowingly downloaded a trojanized installer for the X_TRADER software from Trading Technologies prior to the certificate’s expiration. [4]. This compromise of 3CX via X_TRADER was the first case of a cascading supply chain attack reported on within the wider threat landscape. 

Persistence and Privilege Escalation 

Following these findings, researchers were able to identify the likely kill chain that occurred on Windows systems, beginning with the download of the 3CX DesktopApp installer that executed an executable (.exe) file before dropping two trojanized Data Link Libraries (DLLs) alongside a benign executable that was used to sideload malicious DLLs. These DLLs contained and used SIGFLIP and DAVESHELL; both publicly available projects. [3] In this case, the DLLs were used to decrypt using an RC4 key and load a payload into the memory of a compromised system. [3] SIGFLIP and DAVESHELL also extract and decrypt the modular backdoor named VEILEDSIGNAL, which also contains a command and control (C2) configuration. This malware allowed the North Korean threat operators to gain administrative control to the 3CX employee’s device. [3] This was followed by access to the employee’s corporate credentials, ultimately leading to access to 3CX systems. [4] 

Lateral Movement and C2 activity

Security researchers were also able to identify other malware families that were mainly utilized in the supply chain attack to move laterally within the 3CX environment, and allow for C2 communication [3], these malware families are detailed below:

  • TaxHaul: when executed it decrypts shellcode payload, observed by Mandiant to persist via DLL search-order hijacking.
  • Coldcat: complex downloader, which also beacons to a C2 infrastructure.
  • PoolRat: collects system information and executes commands. This is the malware that was found to affect macOS systems.
  • IconicStealer: served as a third stage payload on 3CX systems to steal data or information.

Furthermore, it was also reported early on by Kaspersky that a backdoor named Gopuram, routinely used by the North Korean threat actors Lazarus and typically used against cryptocurrency companies, was also used as a second stage payload on a limited number of 3CX’s customers compromised systems. [5]

3CX detections observed by Darktrace

CrowdStrike and SentinelOne, two of the major detection platforms with which Darktrace partners through security integrations, initially revealed that their platforms had identified the campaign appeared to be targeting 3CXDesktopApp customers in March 2023. 

At this time, Darktrace was also observing this activity and alerting customers to unusual behavior on their networks. [1][7] Darktrace DETECT identified activity related to the supply chain compromise primarily through host-level alerts associated with CrowdStrike and SentinelOne integrations, as well as model breaches related to lateral movement and C2 activity. 

Some of the activity related to the 3CX supply chain compromise that Darktrace detected was observed solely via integration models picking up executable and Microsoft Software Installer (msi) file downloads for the 3CXDesktopApp, suggesting the compromise likely was stopped at the endpoint device. 

CrowdStrike integration model breach identifying 3CXDesktopApp[.]exe as possible malware
Figure 1: CrowdStrike integration model breach identifying 3CXDesktopApp[.]exe as possible malware on March 30, 2023.
showcases the Model Breach Event Log for the CrowdStrike integration model breach
Figure 2: The above figure, showcases the Model Breach Event Log for the CrowdStrike integration model breach shown in Figure 1.

In another case highlighted in Figure 3 and 4, security platforms were associating 3CX as malicious. The device in these figures was observed downloading a 3CXDesktopApp executable followed by an msi file about an hour later. This pattern of activity correlates with the compromise process that had been on reported, where the “SmoothOperator” malware that affected 3CX systems was able to persist through DLL side-loading of malicious DLL files delivered with benign executable files, making it difficult for traditional security tools to detect. [2][3][7]

The activity in this case was detected by the DETECT integration model, ‘High Severity Integration Malware Detection’ and was later blocked by the Darktrace RESPOND/Network model, ‘Antigena Significant Anomaly from Client Block’ which applied the “Enforce Pattern of Life” action to intercept the malicious download that was taking place. Darktrace RESPOND uses AI to learn every devices normal pattern of life and act autonomously to enforce its normal activity. In this event, RESPOND would not only intercept the malicious download that was taking place on the device, but also not allow the device to significantly deviate from its normal pattern of activity.

The Model Breach Event log for the device displays the moment in which the SentinelOne integration model breached for the 3CXDesktopApp.exe file
Figure 3: The Model Breach Event log for the device displays the moment in which the SentinelOne integration model breached for the 3CXDesktopApp.exe file followed subsequently by the RESPOND model, ‘Antigena Significant Anomaly from Client Block’, on March 29, 2023.
Another ‘High Severity Integration Malware Detection’ breached
Figure 4: Another ‘High Severity Integration Malware Detection’ breached for the same device in Figure 3 approximately one hour later because of the msi file, 3CXDesktopApp-18.12.416.msi, which also led to the Darktrace RESPOND model, ‘Antigena Significant Anomaly from Client Block’, on March 29, 2023.

In a separate case, Darktrace also detected a device performing unusual SMB drive writes for the file ‘3CXDesktopApp-18.10.461.msi’. This breached the DETECT model ‘SMB Drive Write’. This model detects when a device starts writing files to another internal device it does not usually communicate with via the SMB protocol using the admin$ or drive shares.

This Model Breach Event log highlights the moment Darktrace captured the msi application file for the 3CXDesktopApp being transferred internally on this customer’s network
Figure 5: This Model Breach Event log highlights the moment Darktrace captured the msi application file for the 3CXDesktopApp being transferred internally on this customer’s network, this was picked up as new activity for the device on March 28, 2023. 

In a couple of other cases observed by Darktrace, connections detected were made from affected devices to 3CX compromise related endpoints. In Figure 6, the device in question was detected connecting to the endpoint, journalide[.]org. This breached the model, ‘Suspicious Self-Signed SSL’, which looks for connections being made to an endpoint with a self-signed SSL certificate which is designed to look legitimate, as self-signed certificates are often used in malware communication.

Model Breach Event log for connections to the 3CX C2 related endpoint
Figure 6: Model Breach Event log for connections to the 3CX C2 related endpoint, journalide[.]org, these connections breached the model Suspicious Self-Signed SSL on April 24, 2023.

On another Darktrace customer environment, a 3CX C2 endpoint, pbxphonenetwork[.]com, had already been added to the Watched Domains list around the time reports of the 3CX application software being malicious had been reported. The Watched Domains list allows Darktrace to detect if any device on the network makes connections to these domains with more scrutiny and breach a model for further visibility of threats on the network. Activity in this case was detected and subsequently blocked by a Darktrace RESPOND action, “Block connections to 89.45.67[.]160 port 443 and pbxphonenetwork[.]com on port 443”, blocking the device from connecting to this 3CX C2 endpoints on the spot (see Figure 7). This activity subsequently breached the RESPOND model, ‘Antigena Watched Domain Block’. 

Figure 7: History log of the Darktrace RESPOND action applied to the device breaching the Darktrace RESPOND model, Antigena Watched Domain Block and applying the action, “Block connections to 89.45.67[.]160 port 443 and pbxphonenetwork[.]com on port 443” on March 31, 2023.

Darktrace Coverage 

Utilizing integrations with Darktrace such as those with CrowdStrike and SentinelOne, Darktrace was able to detect and respond to activity identified as malicious 3CX activity by CrowdStrike and SentinelOne as seen in Figures 1, 2, 3, and 4. This activity breached the following Darktrace DETECT models: 

  • Integration / CrowdStrike Alert
  • Security Integration / High Severity Integration Malware Detection

Darktrace was also able to identify lateral movement activity such as in the case illustrated in Figure 5.

  • Compliance / SMB Drive Write

Lastly, C2 beaconing activity from malicious endpoints associated with the 3CX compromise was also detected as seen in Figure 6, this activity breached the following Darktrace DETECT model:

  • Anomalous Connection / Suspicious Self-Signed SSL

For customers with Darktrace RESPOND configured in autonomous response mode, Darktrace RESPOND models also breached to activity related to the 3CX supply chain compromise as seen in Figures 3, 4, and 7. Below are the models that breached and the following autonomous actions that were applied:

  • Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block, “Enforce pattern of life”
  • Antigena / Network / External Threat / Antigena Watched Domain Block, “Block connections to 89.45.67[.]160 port 443 and pbxphonenetwork[.]com on port 443”

Conclusion 

The first known cascading supply chain compromise occurred inopportunely for 3CX but conveniently for UNC 4736 North Korean threat actors. This “SmoothOperator” compromise was detected by endpoint security platforms such as CrowdStrike who was at the cusp of this discovery when it became one of the first platforms to report on malicious activity related to the 3CX DesktopApp supply chain compromise.  

Although still novel at the time and largely without reported indicators of compromise, Darktrace was able to capture and identify activity related to the 3CX compromise across its customer base, as well as respond autonomously to contain it. Darktrace was able to amplify security integrations with CrowdStrike and SentinelOne, and via anomaly-based model breaches, contribute unique insights by highlighting activity in varied parts of the 3CX supply chain compromise kill chain. The “SmoothOperator” supply chain attack proves that the Darktrace suite of products, including DETECT and RESPOND, can not only act autonomously to identify and respond to novel threats, but also work with security integrations to further amplify intervention and prevent cyber disruption on customer networks. 

Credit to Nahisha Nobregas, SOC Analyst and Trent Kessler, SOC Analyst.

Appendices

MITRE ATT&CK Framework

Resource Development

  • T1588 Obtain Capabilities  
  • T1588.004 Digital Certificates
  • T1608 Stage Capabilities  
  • T1608.003 Install Digital Certificate

Initial Access

  • T1190 Exploit Public-Facing Application
  • T1195 Supply Chain Compromise  
  • T1195.002 Compromise Software Supply Chain

Persistence

  • T1574 Hijack Execution Flow
  • T1574.002 DLL Side-Loading

Privilege Escalation

  • T1055 Process Injection
  • T1574 Hijack Execution Flow  
  • T1574.002 DLL Side-Loading

Command and Control

  • T1071 Application Layer Protocol
  • T1071.001 Web Protocols
  • T1071.004 DNS  
  • T1105 Ingress Tool Transfer
  • T1573 Encrypted Channel

List of IOCs

C2 Hostnames

  • journalide[.]org
  • pbxphonenetwork[.]com

Likely C2 IP address

  • 89.45.67[.]160

References

  1. https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
  2. https://www.bleepingcomputer.com/news/security/3cx-confirms-north-korean-hackers-behind-supply-chain-attack/
  3. https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise
  4. https://www.securityweek.com/cascading-supply-chain-attack-3cx-hacked-after-employee-downloaded-trojanized-app/
  5. https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/
  6. https://www.bleepingcomputer.com/news/security/3cx-hack-caused-by-trading-software-supply-chain-attack/
  7. https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Nahisha Nobregas
SOC Analyst

More in this series

No items found.

Blog

/

Proactive Security

/

October 23, 2025

Patch Smarter, Not Harder: Now Empowering Security Teams with Business-Aligned Threat Context Agents

Default blog imageDefault blog image

Most risk management programs remain anchored in enumeration: scanning every asset, cataloging every CVE, and drowning in lists that rarely translate into action. Despite expensive scanners, annual pen tests, and countless spreadsheets, prioritization still falters at two critical points.

Context gaps at the device level: It’s hard to know which vulnerabilities actually matter to your business given existing privileges, what software it runs, and what controls already reduce risk.

Business translation: Even when the technical priority is clear, justifying effort and spend in financial terms—especially across many affected devices—can delay action. Especially if it means halting other areas of the business that directly generate revenue.

The result is familiar: alert fatigue, “too many highs,” and remediation that trails behind the threat landscape. Darktrace / Proactive Exposure Management addresses this by pairing precise, endpoint‑level context with clear, financial insight so teams can prioritize confidently and mobilize faster.

A powerful combination: No-Telemetry Endpoint Agent + Cost-Benefit Analysis

Darktrace / Proactive Exposure Management now uniquely combines technical precision with business clarity in a single workflow.  With this release, Darktrace / Proactive Exposure Management delivers a more holistic approach, uniting technical context and financial insight to drive proactive risk reduction. The result is a single solution that helps security teams stay ahead of threats while reducing noise, delays, and complexity.

  • No-Telemetry Endpoint: Collects installed software data and maps it to known CVEs—without network traffic—providing device-level vulnerability context and operational relevance.
  • Cost-Benefit Analysis for Patching: Calculates ROI by comparing patching effort with potential exploit impact, factoring in headcount time, device count, patch difficulty, and automation availability.

Introducing the No-Telemetry Endpoint Agent

Darktrace’s new endpoint agent inventories installed software on devices and maps it to known CVEs without collecting network data so you can prioritize using real device context and available security controls.

By grounding vulnerability findings in the reality of each endpoint, including its software footprint and existing controls, teams can cut through generic severity scores and focus on what matters most. The agent is ideal for remote devices, BYOD-adjacent fleets, or environments standardizing on Darktrace, and is available without additional licensing cost.

Darktrace / Proactive Exposure Management user interface
Figure 1: Darktrace / Proactive Exposure Management user interface

Built-In Cost-Benefit Analysis for Patching

Security teams often know what needs fixing but stakeholders need to understand why now. Darktrace’s new cost-benefit calculator compares the total cost to patch against the potential cost of exploit, producing an ROI for the patch action that expresses security action in clear financial terms.

Inputs like engineer time, number of affected devices, patch difficulty, and automation availability are factored in automatically. The result is a business-aligned justification for every patching decision—helping teams secure buy-in, accelerate approvals, and move work forward with one-click ticketing, CSV export, or risk acceptance.

Darktrace / Proactive Exposure Management Cost Benefit Analysis
Figure 2: Darktrace / Proactive Exposure Management Cost Benefit Analysis

A Smarter, Faster Approach to Exposure Management

Together, the no-telemetry endpoint and Cost–Benefit Analysis advance the CTEM motion from theory to practice. You gain higher‑fidelity discovery and validation signals at the device level, paired with business‑ready justification that accelerates mobilization. The result is fewer distractions, clearer priorities, and faster measurable risk reduction. This is not from chasing every alert, but by focusing on what moves the needle now.

  • Smarter Prioritization: Device‑level context trims noise and spotlights the exposures that matter for your business.
  • Faster Decisions: Built‑in ROI turns technical urgency into executive clarity—speeding approvals and action.
  • Practical Execution: Privacy‑conscious endpoint collection and ticketing/export options fit neatly into existing workflows.
  • Better Outcomes: Close the loop faster—discover, prioritize, validate, and mobilize—on the same operating surface.

Committed to innovation

These updates are part of the broader Darktrace release, which also included:

1. Major innovations in cloud security with the launch of the industry’s first fully automated cloud forensics solution, reinforcing Darktrace’s leadership in AI-native security.

2. Darktrace Network Endpoint eXtended Telemetry (NEXT) is revolutionizing NDR with the industry’s first mixed-telemetry agent using Self-Learning AI.

3. Improvements to our OT product, purpose built for industrial infrastructure, Darktrace / OT now brings dedicated OT dashboard, segmentation-aware risk modeling, and expanded visibility into edge assets and automation protocols.

Join our Live Launch Event

When? 

December 9, 2025

What will be covered?

Join our live broadcast to experience how Darktrace is eliminating blind spots for detection and response across your complete enterprise with new innovations in Agentic AI across our ActiveAI Security platform. Industry leaders from IDC will join Darktrace customers to discuss challenges in cross-domain security, with a live walkthrough reshaping the future of Network Detection & Response, Endpoint Detection & Response, Email Security, and SecOps in novel threat detection and autonomous investigations.

Continue reading
About the author

Blog

/

Proactive Security

/

October 23, 2025

Darktrace Announces Extended Visibility Between Confirmed Assets and Leaked Credentials from the Deep and Dark Web

Default blog imageDefault blog image

Why exposure management needs to evolve beyond scans and checklists

The modern attack surface changes faster than most security programs can keep up. New assets appear, environments change, and adversaries are increasingly aided by automation and AI. Traditional approaches like periodic scans, static inventories, or annual pen tests are no longer enough. Without a formal exposure program, many businesses are flying blind, unaware of where the next threat may emerge.

This is where Continuous Threat Exposure Management (CTEM) becomes essential. Introduced by Gartner, CTEM helps organizations continuously assess, validate, and improve their exposure to real-world threats. It reframes the problem: scope your true attack surface, prioritize based on business impact and exploitability, and validate what attackers can actually do today, not once a year.

With two powerful new capabilities, Darktrace / Attack Surface Management helps organizations evolve their CTEM programs to meet the demands of today’s threat landscape. These updates make CTEM a reality, not just a strategy.

Too much data, not enough direction

Modern Attack Surface Management tools excel at discovering assets such as cloud workloads, exposed APIs, and forgotten domains. But they often fall short when it comes to prioritization. They rely on static severity scores or generic CVSS ratings, which do not reflect real-world risk or business impact.

This leaves security teams with:

  • Alert fatigue from hundreds of “critical” findings
  • Patch paralysis due to unclear prioritization
  • Blind spots around attacker intent and external targeting

CISOs need more than visibility. They need confidence in what to fix first and context to justify those decisions to stakeholders.

Evolving Attack Surface Management

Attack Surface Management (ASM) must evolve from static lists and generic severity scores to actionable intelligence that helps teams make the right decision now.

Joining the recent addition of Exploit Prediction Assessment, which debuted in late June 2025, today we’re introducing two capabilities that push ASM into that next era:

  • Exploit Prediction Assessment: Continuously validates whether top-priority exposures are actually exploitable in your environment without waiting for patch cycles or formal pen tests.  
  • Deep & Dark Web Monitoring: Extends visibility across millions of sources in the deep and dark web to detect leaked credentials linked to your confirmed domains.
  • Confidence Score: our newly developed AI classification platform will compare newly discovered assets to assets that are known to belong to your organization. The more these newly discovered assets look similar to assets that belong to your organization, the higher the score will be.

Together, these features compress the window from discovery to decision, so your team can act with precision, not panic. The result is a single solution that helps teams stay ahead of attackers without introducing new complexities.

Exploit Prediction Assessment

Traditional penetration tests are invaluable, but they’re often a snapshot of that point-in-time, are potentially disruptive, and compliance frameworks still expect them. Not to mention, when vulnerabilities are present, teams can act immediately rather than relying solely on information from CVSS scores or waiting for patch cycles.  

Unlike full pen tests which can be obtrusive and are usually done only a couple times per year, Exploit Prediction Assessment is surgical, continuous, and focused only on top issues Instead of waiting for vendor patches or the next pen‑test window. It helps confirm whether a top‑priority exposure is actually exploitable in your environment right now.  

For more information on this visit our blog: Beyond Discovery: Adding Intelligent Vulnerability Validation to Darktrace / Attack Surface Management

Deep and Dark Web Monitoring: Extending the scope

Customers have been asking for this for years, and it is finally here. Defense against the dark web. Darktrace / Attack Surface Management’s reach now spans millions of sources across the deep and dark web including forums, marketplaces, breach repositories, paste sites, and other hard‑to‑reach communities to detect leaked credentials linked to your confirmed domains.  

Monitoring is continuous, so you’re alerted as soon as evidence of compromise appears. The surface web is only a fraction of the internet, and a sizable share of risk hides beyond it. Estimates suggest the surface web represents roughly ~10% of all online content, with the rest gated or unindexed—and the TOR-accessible dark web hosts a high proportion of illicit material (a King’s College London study found ~57% of surveyed onion sites contained illicit content), underscoring why credential leakage and brand abuse often appear in places traditional monitoring doesn’t reach. Making these spaces high‑value for early warning signals when credentials or brand assets appear. Most notably, this includes your company’s reputation, assets like servers and systems, and top executives and employees at risk.

What changes for your team

Before:

  • Hundreds of findings, unclear what to start with
  • Reactive investigations triggered by incidents

After:

  • A prioritized backlog based on confidence score or exploit prediction assessment verification
  • Proactive verification of exposure with real-world risk without manual efforts

Confidence Score: Prioritize based on the use-case you care most about

What is it?

Confidence Score is a metric that expresses similarity of newly discover assets compared to the confirmed asset inventory. Several self-learning algorithms compare features of assets to be able to calculate a score.

Why it matters

Traditional Attack Surface Management tools treat all new discovery equally, making it unclear to your team how to identify the most important newly discovered assets, potentially causing you to miss a spoofing domain or shadow IT that could impact your business.

How it helps your team

We’re dividing newly discovered assets into separate insight buckets that each cover a slightly different business case.

  • Low scoring assets: to cover phishing & spoofing domains (like domain variants) that are just being registered and don't have content yet.
  • Medium scoring assets: have more similarities to your digital estate, but have better matching to HTML, brand names, keywords. Can still be phishing but probably with content.
  • High scoring assets: These look most like the rest of your confirmed digital estate, either it's phishing that needs the highest attention, or the asset belongs to your attack surface and requires asset state confirmation to enable the platform to monitor it for risks.

Smarter Exposure Management for CTEM Programs

Recent updates to Darktrace / Attack Surface Management directly advance the core phases of Continuous Threat Exposure Management (CTEM): scope, discover, prioritize, validate, and mobilize. The new Exploit Prediction Assessment helps teams validate and prioritize vulnerabilities based on real-world exploitability, while Deep & Dark Web Monitoring extends discovery into hard-to-reach areas where stolen data and credentials often surface. Together, these capabilities reduce noise, accelerate remediation, and help organizations maintain continuous visibility over their expanding attack surface.

Building on these innovations, Darktrace / Attack Surface Management empowers security teams to focus on what truly matters. By validating exploitability, it cuts through the noise of endless vulnerability lists—helping defenders concentrate on exposures that represent genuine business risk. Continuous monitoring for leaked credentials across the deep and dark web further extends visibility beyond traditional asset discovery, closing critical blind spots where attackers often operate. Crucially, these capabilities complement, not replace, existing security controls such as annual penetration tests, providing continuous, low-friction validation between formal assessments. The result is a more adaptive, resilient security posture that keeps pace with an ever-evolving threat landscape.

If you’re building or maturing a CTEM program—and want fewer open exposures, faster remediation, and better outcomes, Darktrace / Attack Surface Management’s new Exploit Prediction Assessment and Deep & Dark Web Monitoring are ready to help.

  • Want a more in-depth look at how Exploit Prediction Assessment functions? Read more here

Committed to innovation

These updates are part of the broader Darktrace release, which also included:

1. Major innovations in cloud security with the launch of the industry’s first fully automated cloud forensics solution, reinforcing Darktrace’s leadership in AI-native security.

2. Darktrace Network Endpoint eXtended Telemetry (NEXT) is revolutionizing NDR with the industry’s first mixed-telemetry agent using Self-Learning AI.

3. Improvements to our OT product, purpose built for industrial infrastructure, Darktrace / OT now brings dedicated OT dashboard, segmentation-aware risk modeling, and expanded visibility into edge assets and automation protocols.

Join our Live Launch Event

When? 

December 9, 2025

What will be covered?

Join our live broadcast to experience how Darktrace is eliminating blind spots for detection and response across your complete enterprise with new innovations in Agentic AI across our ActiveAI Security platform. Industry leaders from IDC will join Darktrace customers to discuss challenges in cross-domain security, with a live walkthrough reshaping the future of Network Detection & Response, Endpoint Detection & Response, Email Security, and SecOps in novel threat detection and autonomous investigations.

Continue reading
About the author
Your data. Our AI.
Elevate your network security with Darktrace AI