Beyond the Office: Tracking Identity-Based Threats in a Hybrid World
As remote and hybrid work reshape the threat landscape, identity has become the new perimeter. This investigation examines a multi-stage account takeover where attackers used social engineering and legitimate credentials to exfiltrate large amounts of data.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Andre Davidian
Senior Cyber Analyst
Share
Identity as the New Perimeter
In today’s cyber landscape, remote and hybrid working have become firmly established across a wide range of businesses. As a result, threat actors have adapted to this new reality, leading to a growing range of techniques and attack vectors targeting Software-as-a-Service (SaaS) and cloud environments, where the traditional network perimeter offers little protection.
In hybrid and cloud environments, identity has become the primary control point governing access to corporate networks and resources. As users increasingly log-in from home networks, personal devices, and locations that may change daily, the one constant is the identity they carry with them. Once an identity is compromised, an attacker can move between platforms, access sensitive information, and operate using legitimate credentials, often without needing an exploit or malicious payload. This makes identity both a critical control point for defenders and an attractive target for threat actors seeking initial access.
Darktrace's Annual Threat Report 2026 describes identity as the “new perimeter”, noting that identity compromise and trust exploitation have emerged as dominant attack vectors. Armed with legitimate credentials, attackers are able to log in, live off the land, and remain undetected until they are ready to act. The following investigation illustrates how identity-centric attacks can provide access to multiple business-critical platforms without the need for malware or exploits.
Identifying an Identity Compromise with Darktrace
Earlier this year, Darktrace investigated a compromise in which a threat actor gained access to a customer Microsoft 365 account and used it to reach data stored across both Microsoft 365 and Salesforce. The initial account was compromised and subsequently contained by Darktrace within approximately 20 minutes. Three days later, the attacker returned, compromised two additional SaaS accounts within two and a half hours, and collected data for around six hours. At no stage did this intrusion involve malware or an exploit, demonstrating how access to a trusted account can remove the need for many of the traditional techniques associated with cyber-attacks.
Day 1: The first account
Initial Intrusion
The intrusion began with a password reset rather than a stolen password. The attacker used Microsoft Entra ID's Self-Service Password Reset (SSPR) feature to request a new password for the initial compromised account. The request came from commodity virtual private server (VPS) infrastructure, which threat actors commonly use to obscure the true origin of their connections. SSPR sends a verification code by SMS to the account owner's phone, meaning the reset could only succeed if the attacker obtained that code. The entire sequence was completed within three minutes.
Further investigation revealed that the compromise followed a voice-based social engineering attempt, suggesting the user was persuaded to share the SSPR verification code over the phone. SSPR is designed to reduce helpdesk workload; however, when its verification step can be talked out of an end user, the process becomes a direct route to account takeover. In this case, a security control intended to protect the account instead exploited what is often the weakest link in any environment: the end user.
Within seconds of logging in, the attacker registered a new device to the organization's Entra ID tenant and gave it a generic name in the format “WINDOWS-XXX”. A registered device gives an attacker a persistent foothold that access policies may treat as a known, trusted system. As soon as the attacker logged in, Darktrace identified the unusual activity, recognizing that the sign-in originated from a location and infrastructure highly unusual for the user. Darktrace also drew on additional context from Microsoft Entra ID Protection, which had also flagged the sign-in as risky. Within a minute, the same identity was used to access the organization’s Salesforce environment through single-sign on (SSO), illustrating how a single compromised account can become a gateway to multiple business-critical platforms.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Why Kubernetes Security Needs A Behavioral Approach
As Kubernetes adoption accelerates, especially for AI workloads, Darktrace extends behavioral security across runtime activity, delivering visibility, detection, response, forensics, and risk context to identify and contain threats.
Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity.
A Chain Reaction: Blockchain-Hosted Infostealer Campaign Targets Windows and macOS
Darktrace detected a blockchain-hosted infostealer campaign targeting Windows and macOS devices, combining ClickFix social engineering with the abuse of legitimate services such as GitHub, blockchain infrastructure, and DGA C2 endpoints to evade disruption and support malware delivery.
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
エージェンティックハーネスは会話履歴をローカルに保存しますが、ダークトレースの研究者たちは、保存されたAIの応答が本当にモデルによって生成されたものであるかどうかの検証が行われていないことを発見しました。また、この設計上の選択がAnthropic Claude Code、AWS Kiro-CLI、OpenAI Codex、およびオープンソースのPiにわたって共通していることを確認しました。
会話履歴は多くの場合クライアント側に保存されます。例えば、Anthropic Claude Code、OpenAI Codex、AWS Kiro-CLI、Piなどでもそうです。そのため、ユーザーはセッションを自由に再開でき、一部の製品にはその履歴を操作する機能が組み込まれています。たとえば、会話の中の特定の時点に戻り、送信したメッセージを編集して、会話を別の軌道へ進めていくことができます。きわめて重要な点として、私たちが調査したすべてのケースにおいて、保存されているAIの応答が対応するモデルから生成されたものであり改ざんされていないことの検証は行われていませんでした。
.jpeg)
