Blog
/
Network
/
June 23, 2023

How Darktrace Quickly Foiled An Information Stealer

Discover how Darktrace thwarted the CryptBot malware in just 2 seconds. Learn about this fast-moving threat and the defense strategies employed.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Alexandra Sentenac
Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
23
Jun 2023

The recent trend of threat actors using information stealer malware, designed to gather and exfiltrate confidential data, shows no sign of slowing. With new or updated info-stealer strains appearing in the wild on a regular basis, it came as no surprise to see a surge in yet another prolific variant in late 2022, CryptBot.

What is CryptBot?

CryptBot is a Windows-based trojan malware that was first discovered in the wild in December 2019. It belongs to the prolific category of information stealers whose primary objective, as the name suggests, is to gather information from infected devices and send it to the threat actor.

ZeuS was reportedly the first info-stealer to be discovered, back in 2006. After its code was leaked, many other variants came to light and have been gaining popularity amongst cyber criminals [1] [2] [3]. Indeed, Inside the SOC has discussed multiple infections across its customer base associated with several types of stealers in the past months [4] [5] [6] [7]. 

The Darktrace Threat Research team investigated CryptBot infections on the digital environments of more than 40 different Darktrace customers between October 2022 and January 2023. Darktrace DETECT™ and its anomaly-based approach to threat detection allowed it to successfully identify the unusual activity surrounding these info-stealer infections on customer networks. Meanwhile, Darktrace RESPOND™, when enabled in autonomous response mode, was able to quickly intervene and prevent the exfiltration of sensitive company data.

Why is info-stealer malware popular?

It comes as no surprise that info-stealers have “become one of the most discussed malware types on the cybercriminal underground in 2022”, according to Accenture’s Cyber Threat Intelligence team [10]. This is likely in part due to the fact that:

More sensitive data on devices

Due to the digitization of many aspects of our lives, such as banking and social interactions, a trend accelerated by the COVID-19 pandemic.

Cost effective

Info-stealers provide a great return on investment (ROI) for threat actors looking to exfiltrate data without having to do the traditional internal reconnaissance and data transfer associated with data theft. Info-stealers are usually cheap to purchase and are available through Malware-as-a-Service (MaaS) offerings, allowing less technical and resourceful threat actors in on the stealing action. This makes them a prevalent threat in the malware landscape. 

How does CryptBot work?

The techniques employed by info-stealers to gather and exfiltrate data as well as the type of data targeted vary from malware to malware, but the data targeted typically includes login credentials for a variety of applications, financial information, cookies and global information about the infected computer [8]. Given its variety and sensitivity, threat actors can leverage the stolen data in several ways to make a profit. In the case of CryptBot, the data obtained is sold on forums or underground data marketplaces and can be later employed in higher profile attacks [9]. For example, stolen login information has previously been leveraged in credential-based attacks, which can successfully bypass authentication-based security measures, including multi-factor authentication (MFA). 

CryptBot functionalities

Like many information stealers, CryptBot is designed to steal a variety of sensitive personal and financial information such as browser credentials, cookies and history information and social media accounts login information, as well as cryptocurrency wallets and stored credit card information [11]. General information (e.g., OS, installed applications) about the infected computer is also retrieved. Browsers targeted by CryptBot include Chrome, Firefox, and Edge. In early 2022, CryptBot’s code was revamped in order to streamline its data extraction capabilities and improve its overall efficiency, an update that coincided with a rise in the number of infections [11] [12].

Some of CryptBot's functionalities were removed and its exfiltration process was streamlined, which resulted in a leaner payload, around half its original size and a quicker infection process [11]. Some of the features removed included sandbox detection and evasion functionalities, the collection of desktop text files and screen captures, which were deemed unnecessary. At the same time, the code was improved in order to include new Chrome versions released after CryptBot’s first appearance in 2019. Finally, its exfiltration process was simplified: prior to its 2022 update, the malware saved stolen data in two separate folders before sending it to two separate command and control (C2) domains. Post update, the data is only saved in one location and sent to one C2 domain, which is hardcoded in the C2 transmission function of the code. This makes the infection process much more streamlined, taking only a few minutes from start to finish. 

Aside from the update to its malware code, CryptBot regularly updates and refreshes its C2 domains and dropper websites, making it a highly fluctuating malware with constantly new indicators of compromise and distribution sites. 

Even though CryptBot is less known than other info-stealers, it was reportedly infecting thousands of devices daily in the first months of 2020 [13] and its continued prevalence resulted in Google taking legal action against its distribution infrastructure at the end of April 2023 [14].  

How is CryptBot obtained?

CryptBot is primarily distributed through malicious websites offering free and illegally modified software (i.e., cracked software) for common commercial programs (e.g., Microsoft Windows and Office, Adobe Photoshop, Google Chrome, Nitro PDF Pro) and video games. From these ‘malvertising’ pages, the user is redirected through multiple sites to the actual payload dropper page [15]. This distribution method has seen a gain in popularity amongst info-stealers in recent months and is also used by other malware families such as Raccoon Stealer and Vidar [16] [17].

A same network of cracked software websites can be used to download different malware strains, which can result in multiple simultaneous infections. Additionally, these networks often use search engine optimization (SEO) in order to make adverts for their malware distributing sites appear at the top of the Google search results page, thus increasing the chances of the malicious payloads being downloaded.

Furthermore, CryptBot leverages Pay-Per-Install (PPI) services such as 360Installer and PrivateLoader, a downloader malware family used to deliver payloads of multiple malware families operated by different threat actors [18] [19] [20]. The use of this distribution method for CryptBot payloads appears to have stemmed from its 2022 update. According to Google, 161 active domains were associated with 360Installer, of which 90 were associated with malware delivery activities and 29 with the delivery of CryptBot malware specifically. Google further identified hundreds of domains used by CryptBot as C2 sites, all of which appear to be hosted on the .top top-level domain [21].

This simple yet effective distribution tactic, combined with the MaaS model and the lucrative prospects of selling the stolen data resulted in numerous infections. Indeed, CryptBot was estimated to have infected over 670,000 computers in 2022 [14]. Even though the distribution method chosen means that most of the infected devices are likely to be personal computers, bring your own device (BYOD) policies and users’ tendency to reuse passwords means that corporate environments are also at risk. 

CryptBot Attack Overview

In some cases observed by Darktrace, after connecting to malvertising websites, devices were seen making encrypted SSL connections to file hosting services such as MediaFire or Mega, while in others devices were observed connecting to an endpoint associated with a content delivery network. This is likely the location from where the malware payload was downloaded alongside cracked software, which is executed by the unsuspecting user. As the user expects to run an executable file to install their desired software, the malware installation often happens without the user noticing.

Some of the malvertising sites observed by Darktrace on customer deployments were crackful[.]com, modcrack[.]net, windows-7-activator[.]com and office-activator[.]com. However, in many cases detected by Darktrace, CryptBot was propagated via websites offering trojanized KMSPico software (e.g., official-kmspico[.]com, kmspicoofficial[.]com). KMSPico is a popular Microsoft Windows and Office product activator that emulates a Windows Key Management Services (KMS) server to activate licenses fraudulently. 

Once it has been downloaded and executed, CryptBot will search the system for confidential information and create a folder with a seemingly randomly generated name, matching the regex [a-zA-Z]{10}, to store the gathered sensitive data, ready for exfiltration. 

Figure 1: Packet capture (PCAP) of an HTTP POST request showing the file with the stolen data being sent over the connection.
Figure 1: Packet capture (PCAP) of an HTTP POST request showing the file with the stolen data being sent over the connection.

This data is then sent to the C2 domain via HTTP POST requests on port 80 to the URI /gate.php. As previously stated, CryptBot C2 infrastructure is changed frequently and many of the domains seen by Darktrace had been registered within the previous 30 days. The domain names detected appeared to have been generated by an algorithm, following the regex patterns [a-z]{6}[0-9]{2,3}.top or [a-z]{6}[0-9]{2,3}.cfd. In several cases, the C2 domain had not been flagged as malicious by other security vendors or had just one detection. This is likely because of the frequent changes in the C2 infrastructure operated by the threat actors behind CryptBot, with new malicious domains being created periodically to avoid detection. This makes signature-based security solutions much less efficient to detect and block connections to malicious domains. Additionally, the fact that the stolen data is sent over regular HTTP POST requests, which are used daily as part of a multitude of legitimate processes such as file uploads or web form submissions, allows the exfiltration connections to blend in with normal and legitimate traffic making it difficult to isolate and detect as malicious activity. 

In this context, anomaly-based security detections such as Darktrace DETECT are the best way to pick out these anomalous connections amidst legitimate Internet traffic. In the case of CryptBot, two DETECT models were seen consistently breaching for CryptBot-related activity: ‘Device / Suspicious Domain’, breaching for connections to 100% rare C2 .top domains, and ‘Anomalous Connection / POST to PHP on New External Host’, breaching on the data exfiltration HTTP POST request. 

In deployments where Darktrace RESPOND was deployed, a RESPOND model breached within two seconds of the first HTTP POST request. If enabled in autonomous mode, RESPOND would block the data exfiltration connections, thus preventing the data safe from being sold in underground forums to other threat actors. In one of the cases investigated by Darktrace’s Threat Research team, DETECT was able to successfully identify and alert the customer about CryptBot-related malicious activity on a device that Darktrace had only begun to monitor one day before, showcasing how fast Darktrace’s Self-Learning AI learns every nuance of customer networks and the devices within it.

In most cases investigated by Darktrace, fewer than 5 minutes elapsed between the first connection to the endpoint offering free cracked software and the data being exfiltrated to the C2 domain. For example, in one of the attack chains observed in a university’s network, a device was seen connecting to the 100% rare endpoint official-kmspico[.]com at 16:53:47 (UTC).

Device Event Log showing SSL connections to the official-kmspico[.]com malvertising website.
Figure 2: Device Event Log showing SSL connections to the official-kmspico[.]com malvertising website.

One minute later, at 16:54:19 (UTC), the same device was seen connecting to two mega[.]co[.]nz subdomains and downloading around 13 MB of data from them. As mentioned previously, these connections likely represent the CryptBot payload and cracked software download.

Device Event Log showing SSL connections to mega[.]com endpoints following the connection to the malvertising site.
Figure 3: Device Event Log showing SSL connections to mega[.]com endpoints following the connection to the malvertising site.

At 16:56:01 (UTC), Darktrace detected the device making a first HTTP POST request to the 100% rare endpoint, avomyj24[.]top, which has been associated with CryptBot’s C2 infrastructure [22]. This initial HTTP POST connection likely represents the transfer of confidential data to the attacker’s infrastructure.

Device Event Log showing HTTP connections made by the infected device to the C2 domain. 
Figure 4: Device Event Log showing HTTP connections made by the infected device to the C2 domain. 

The full attack chain, from visiting the malvertising website to the malicious data egress, took less than three minutes to complete. In this circumstance, the machine-speed detection and response capabilities offered by Darktrace DETECT and RESPOND are paramount in order to stop CryptBot before it can successfully exfiltrates sensitive data. This is an incredibly quick infection timeline, with no lateral movement nor privilege escalation required to carry out the malware’s objective. 

Device Event Log showing the DETECT and RESPOND models breached during the attack. 
Figure 5: Device Event Log showing the DETECT and RESPOND models breached during the attack. 

Darktrace Cyber AI Analyst incidents were also generated as a result of this activity, displaying all relevant information in one panel for easy review by customer security teams.

Cyber AI Analyst event log showing the HTTP connections made by the breach device to the C2 endpoint.
Figure 6: Cyber AI Analyst event log showing the HTTP connections made by the breach device to the C2 endpoint.

Conclusion 

CryptBot info-stealer is fast, efficient, and apt at evading detection given its small size and swift process of data gathering and exfiltration via legitimate channels. Its constantly changing C2 infrastructure further makes it difficult for traditional security tools that really on rules and signatures or known indicators of compromise (IoCs) to detect these infections. 

In the face of such a threat, Darktrace’s anomaly-based detection allows it to recognize subtle deviations in a device’s pattern of behavior that may signal an evolving threat and instantly bring it to the attention of security teams. Darktrace DETECT is able to distinguish between benign activity and malicious behavior, even from newly monitored devices, while Darktrace RESPOND can move at machine-speed to prevent even the fastest moving threat actors from stealing confidential company data, as it demonstrated here by stopping CryptBot infections in as little as 2 seconds.

Credit to Alexandra Sentenac, Cyber Analyst, Roberto Romeu, Senior SOC Analyst

Darktrace Model Detections  

AI Analyst Coverage 

  • Possible HTTP Command and Control  

DETECT Model Breaches  

  • Device / Suspicious Domain 
  • Anomalous Connection / POST to PHP on New External Host 
  • Anomalous Connection / Multiple HTTP POSTs to Rare Hostname 
  • Compromise / Multiple SSL to Rare DGA Domains

List of IOCs

Indicator Type Description
luaigz34[.]top Hostname CryptBot C2 endpoint
watibt04[.]top Hostname CryptBot C2 endpoint
avolsq14[.]top Hostname CryptBot C2 endpoint

MITRE ATT&CK Mapping

Category Technique Tactic
INITIAL ACCESS Drive-by Compromise - T1189 N/A
COMMAND AND CONTROL Web Protocols - T1071.001 N/A
COMMAND AND CONTROL Domain Generation Algorithm - T1568.002 N/A

References

[1] https://www.malwarebytes.com/blog/threats/info-stealers

[2] https://cybelangel.com/what-are-infostealers/

[3] https://ke-la.com/information-stealers-a-new-landscape/

[4] https://darktrace.com/blog/vidar-info-stealer-malware-distributed-via-malvertising-on-google

[5] https://darktrace.com/blog/a-surge-of-vidar-network-based-details-of-a-prolific-info-stealer 

[6] https://darktrace.com/blog/laplas-clipper-defending-against-crypto-currency-thieves-with-detect-respond

[7] https://darktrace.com/blog/amadey-info-stealer-exploiting-n-day-vulnerabilities 

[8] https://cybelangel.com/what-are-infostealers/

[9] https://webz.io/dwp/the-top-10-dark-web-marketplaces-in-2022/

[10] https://www.accenture.com/us-en/blogs/security/information-stealer-malware-on-dark-web

[11] https://www.bleepingcomputer.com/news/security/revamped-cryptbot-malware-spread-by-pirated-software-sites/

[12] https://blogs.blackberry.com/en/2022/03/threat-thursday-cryptbot-infostealer

[13] https://www.deepinstinct.com/blog/cryptbot-how-free-becomes-a-high-price-to-pay

[14] https://blog.google/technology/safety-security/continuing-our-work-to-hold-cybercriminal-ecosystems-accountable/

[15] https://asec.ahnlab.com/en/31802/

[16] https://darktrace.com/blog/the-last-of-its-kind-analysis-of-a-raccoon-stealer-v1-infection-part-1

[17] https://www.trendmicro.com/pt_br/research/21/c/websites-hosting-cracks-spread-malware-adware.html

[18] https://intel471.com/blog/privateloader-malware

[19] https://cyware.com/news/watch-out-pay-per-install-privateloader-malware-distribution-service-is-flourishing-888273be 

[20] https://regmedia.co.uk/2023/04/28/handout_google_cryptbot_complaint.pdf

[21] https://www.bankinfosecurity.com/google-wins-court-order-to-block-cryptbot-infrastructure-a-21905

[22] https://github.com/stamparm/maltrail/blob/master/trails/static/malware/cryptbot.txt

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Alexandra Sentenac
Cyber Analyst

More in this series

No items found.

Blog

/

Email

/

September 30, 2025

Out of Character: Detecting Vendor Compromise and Trusted Relationship Abuse with Darktrace

Default blog imageDefault blog image

What is Vendor Email Compromise?

Vendor Email Compromise (VEC) refers to an attack where actors breach a third-party provider to exploit their access, relationships, or systems for malicious purposes. The initially compromised entities are often the target’s existing partners, though this can extend to any organization or individual the target is likely to trust.

It sits at the intersection of supply chain attacks and business email compromise (BEC), blending technical exploitation with trust-based deception. Attackers often infiltrate existing conversations, leveraging AI to mimic tone and avoid common spelling and grammar pitfalls. Malicious content is typically hosted on otherwise reputable file sharing platforms, meaning any shared links initially seem harmless.

While techniques to achieve initial access may have evolved, the goals remain familiar. Threat actors harvest credentials, launch subsequent phishing campaigns, attempt to redirect invoice payments for financial gain, and exfiltrate sensitive corporate data.

Why traditional defenses fall short

These subtle and sophisticated email attacks pose unique challenges for defenders. Few busy people would treat an ongoing conversation with a trusted contact with the same level of suspicion as an email from the CEO requesting ‘URGENT ASSISTANCE!’ Unfortunately, many traditional secure email gateways (SEGs) struggle with this too. Detecting an out-of-character email, when it does not obviously appear out of character, is a complex challenge. It’s hardly surprising, then, that 83% of organizations have experienced a security incident involving third-party vendors [1].  

This article explores how Darktrace detected four different vendor compromise campaigns for a single customer, within a two-week period in 2025.  Darktrace / EMAIL successfully identified the subtle indicators that these seemingly benign emails from trusted senders were, in fact, malicious. Due to the configuration of Darktrace / EMAIL in this customer’s environment, it was unable to take action against the malicious emails. However, if fully enabled to take Autonomous Response, it would have held all offending emails identified.

How does Darktrace detect vendor compromise?

The answer lies at the core of how Darktrace operates: anomaly detection. Rather than relying on known malicious rules or signatures, Darktrace learns what ‘normal’ looks like for an environment, then looks for anomalies across a wide range of metrics. Despite the resourcefulness of the threat actors involved in this case, Darktrace identified many anomalies across these campaigns.

Different campaigns, common traits

A wide variety of approaches was observed. Individuals, shared mailboxes and external contractors were all targeted. Two emails originated from compromised current vendors, while two came from unknown compromised organizations - one in an associated industry. The sender organizations were either familiar or, at the very least, professional in appearance, with no unusual alphanumeric strings or suspicious top-level domains (TLDs). Subject line, such as “New Approved Statement From [REDACTED]” and “[REDACTED] - Proposal Document” appeared unremarkable and were not designed to provoke heightened emotions like typical social engineering or BEC attempts.

All emails had been given a Microsoft Spam Confidence Level of 1, indicating Microsoft did not consider them to be spam or malicious [2]. They also passed authentication checks (including SPF, and in some cases DKIM and DMARC), meaning they appeared to originate from an authentic source for the sender domain and had not been tampered with in transit.  

All observed phishing emails contained a link hosted on a legitimate and commonly used file-sharing site. These sites were often convincingly themed, frequently featuring the name of a trusted vendor either on the page or within the URL, to appear authentic and avoid raising suspicion. However, these links served only as the initial step in a more complex, multi-stage phishing process.

A legitimate file sharing site used in phishing emails to host a secondary malicious link.
Figure 1: A legitimate file sharing site used in phishing emails to host a secondary malicious link.
Another example of a legitimate file sharing endpoint sent in a phishing email and used to host a malicious link.
Figure 2: Another example of a legitimate file sharing endpoint sent in a phishing email and used to host a malicious link.

If followed, the recipient would be redirected, sometimes via CAPTCHA, to fake Microsoft login pages designed to capturing credentials, namely http://pub-ac94c05b39aa4f75ad1df88d384932b8.r2[.]dev/offline[.]html and https://s3.us-east-1.amazonaws[.]com/s3cure0line-0365cql0.19db86c3-b2b9-44cc-b339-36da233a3be2ml0qin/s3cccql0.19db86c3-b2b9-44cc-b339-36da233a3be2%26l0qn[.]html#.

The latter made use of homoglyphs to deceive the user, with a link referencing ‘s3cure0line’, rather than ‘secureonline’. Post-incident investigation using open-source intelligence (OSINT) confirmed that the domains were linked to malicious phishing endpoints [3] [4].

Fake Microsoft login page designed to harvest credentials.
Figure 3: Fake Microsoft login page designed to harvest credentials.
Phishing kit with likely AI-generated image, designed to harvest user credentials. The URL uses ‘s3cure0line’ instead of ‘secureonline’, a subtle misspelling intended to deceive users.
Figure 4: Phishing kit with likely AI-generated image, designed to harvest user credentials. The URL uses ‘s3cure0line’ instead of ‘secureonline’, a subtle misspelling intended to deceive users.

Darktrace Anomaly Detection

Some senders were unknown to the network, with no previous outbound or inbound emails. Some had sent the email to multiple undisclosed recipients using BCC, an unusual behavior for a new sender.  

Where the sender organization was an existing vendor, Darktrace recognized out-of-character behavior, in this case it was the first time a link to a particular file-sharing site had been shared. Often the links themselves exhibited anomalies, either being unusually prominent or hidden altogether - masked by text or a clickable image.

Crucially, Darktrace / EMAIL is able to identify malicious links at the time of processing the emails, without needing to visit the URLs or analyze the destination endpoints, meaning even the most convincing phishing pages cannot evade detection – meaning even the most convincing phishing emails cannot evade detection. This sets it apart from many competitors who rely on crawling the endpoints present in emails. This, among other things, risks disruption to user experience, such as unsubscribing them from emails, for instance.

Darktrace was also able to determine that the malicious emails originated from a compromised mailbox, using a series of behavioral and contextual metrics to make the identification. Upon analysis of the emails, Darktrace autonomously assigned several contextual tags to highlight their concerning elements, indicating that the messages contained phishing links, were likely sent from a compromised account, and originated from a known correspondent exhibiting out-of-character behavior.

A summary of the anomalous email, confirming that it contained a highly suspicious link.
Figure 5: Tags assigned to offending emails by Darktrace / EMAIL.

Figure 6: A summary of the anomalous email, confirming that it contained a highly suspicious link.

Out-of-character behavior caught in real-time

In another customer environment around the same time Darktrace / EMAIL detected multiple emails with carefully crafted, contextually appropriate subject lines sent from an established correspondent being sent to 30 different recipients. In many cases, the attacker hijacked existing threads and inserted their malicious emails into an ongoing conversation in an effort to blend in and avoid detection. As in the previous, the attacker leveraged a well-known service, this time ClickFunnels, to host a document containing another malicious link. Once again, they were assigned a Microsoft Spam Confidence Level of 1, indicating that they were not considered malicious.

The legitimate ClickFunnels page used to host a malicious phishing link.
Figure 7: The legitimate ClickFunnels page used to host a malicious phishing link.

This time, however, the customer had Darktrace / EMAIL fully enabled to take Autonomous Response against suspicious emails. As a result, when Darktrace detected the out-of-character behavior, specifically, the sharing of a link to a previously unused file-sharing domain, and identified the likely malicious intent of the message, it held the email, preventing it from reaching recipients’ inboxes and effectively shutting down the attack.

Figure 8: Darktrace / EMAIL’s detection of malicious emails inserted into an existing thread.*

*To preserve anonymity, all real customer names, email addresses, and other identifying details have been redacted and replaced with fictitious placeholders.

Legitimate messages in the conversation were assigned an Anomaly Score of 0, while the newly inserted malicious emails identified and were flagged with the maximum score of 100.

Key takeaways for defenders

Phishing remains big business, and as the landscape evolves, today’s campaigns often look very different from earlier versions. As with network-based attacks, threat actors are increasingly leveraging legitimate tools and exploiting trusted relationships to carry out their malicious goals, often staying under the radar of security teams and traditional email defenses.

As attackers continue to exploit trusted relationships between organizations and their third-party associates, security teams must remain vigilant to unexpected or suspicious email activity. Protecting the digital estate requires an email solution capable of identifying malicious characteristics, even when they originate from otherwise trusted senders.

Credit to Jennifer Beckett (Cyber Analyst), Patrick Anjos (Senior Cyber Analyst), Ryan Traill (Analyst Content Lead), Kiri Addison (Director of Product)

Appendices

IoC - Type - Description + Confidence  

- http://pub-ac94c05b39aa4f75ad1df88d384932b8.r2[.]dev/offline[.]html#p – fake Microsoft login page

- https://s3.us-east-1.amazonaws[.]com/s3cure0line-0365cql0.19db86c3-b2b9-44cc-b339-36da233a3be2ml0qin/s3cccql0.19db86c3-b2b9-44cc-b339-36da233a3be2%26l0qn[.]html# - link to domain used in homoglyph attack

MITRE ATT&CK Mapping  

Tactic – Technique – Sub-Technique  

Initial Access - Phishing – (T1566)  

References

1.     https://gitnux.org/third-party-risk-statistics/

2.     https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about

3.     https://www.virustotal.com/gui/url/5df9aae8f78445a590f674d7b64c69630c1473c294ce5337d73732c03ab7fca2/detection

4.     https://www.virustotal.com/gui/url/695d0d173d1bd4755eb79952704e3f2f2b87d1a08e2ec660b98a4cc65f6b2577/details

The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.

Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.

Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.

The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content

Continue reading
About the author

Blog

/

OT

/

October 1, 2025

Announcing Unified OT Security with Dedicated OT Workflows, Segmentation-Aware Risk Insights, and Next-Gen Endpoint Visibility for Industrial Teams

Default blog imageDefault blog image

The challenge of convergence without clarity

Convergence is no longer a roadmap idea, it is the daily reality for industrial security teams. As Information Technology (IT) and Operational Technology (OT) environments merge, the line between a cyber incident and an operational disruption grows increasingly hard to define. A misconfigured firewall rule can lead to downtime. A protocol misuse might look like a glitch. And when a pump stalls but nothing appears in the Security Operations Center (SOC) dashboard, teams are left asking: is this operational or is this a threat?

The lack of shared context slows down response, creates friction between SOC analysts and plant engineers, and leaves organizations vulnerable at exactly the points where IT and OT converge. Defenders need more than alerts, they need clarity that both sides can trust.

The breakthrough with Darktrace / OT

This latest Darktrace / OT release was built to deliver exactly that. It introduces shared context between Security, IT, and OT operations, helping reduce friction and close the security gaps at the intersection of these domains.

With a dedicated dashboard built for operations teams, extended visibility into endpoints for new forms of detection and CVE collection, expanded protocol coverage, and smarter risk modeling aligned to segmentation policies, teams can now operate from a shared source of truth. These enhancements are not just incremental upgrades, they are foundational improvements designed to bring clarity, efficiency, and trust to converged environments.

A dashboard built for OT engineers

The new Operational Overview provides OT engineers with a workspace designed for them, not for SOC analysts. It brings asset management, risk insights and operational alerts into one place. Engineers can now see activity like firmware changes, controller reprograms or the sudden appearance of a new workstation on the network, providing a tailored view for critical insights and productivity gains without navigating IT-centric workflows. Each device view is now enriched with cross-linked intelligence, make, model, firmware version and the roles inferred by Self-Learning AI, making it easier to understand how each asset behaves, what function it serves, and where it fits within the broader industrial process. By suppressing IT-centric noise, the dashboard highlights only the anomalies that matter to operations, accelerating triage, enabling smoother IT/OT collaboration, and reducing time to root cause without jumping between tools.

This is usability with purpose, a view that matches OT workflows and accelerates response.

Figure 1: The Operational Overview provides an intuitive dashboard summarizing all OT Assets, Alerts, and Risk.

Full-spectrum coverage across endpoints, sensors and protocols

The release also extends visibility into areas that have traditionally been blind spots. Engineering workstations, Human-Machine Interfaces (HMIs), contractor laptops and field devices are often the entry points for attackers, yet the hardest to monitor.

Darktrace introduces Network Endpoint eXtended Telemetry (NEXT) for OT, a lightweight collector built for segmented and resource-constrained environments. NEXT for OT uses Endpoint sensors to capture localized network, and now process-level telemetry, placing it in context alongside other network and asset data to:

  1. Identify vulnerabilities and OS data, which is leveraged by OT Risk Management for risk scoring and patching prioritization, removing the need for third-party CVE collection.
  1. Surface novel threats using Self-Learning AI that standalone Endpoint Detection and Response (EDR) would miss.
  1. Extend Cyber AI Analyst investigations through to the endpoint root cause.

NEXT is part of our existing cSensor endpoint agent, can be deployed standalone or alongside existing EDR tools, and allows capabilities to be enabled or disabled depending on factors such as security or OT team objectives and resource utilization.

Figure 2: Darktrace / OT delivers CVE patch priority insights by combining threat intelligence with extended network and endpoint telemetry

The family of Darktrace Endpoint sensors also receive a boost in deployment flexibility, with on-prem server-based setups, as well as a Windows driver tailored for zero-trust and high-security environments.

Protocol coverage has been extended where it matters most. Darktrace now performs protocol analysis of a wider range of GE and Mitsubishi protocols, giving operators real-time visibility into commands and state changes on Programmable Logic Controllers (PLCs), robots and controllers. Backed by Self-Learning AI, this inspection does more than parse traffic, it understands what normal looks like and flags deviations that signal risk.

Integrated risk and governance workflows

Security data is only valuable when it drives action. Darktrace / OT delivers risk insights that go beyond patching, helping teams take meaningful steps even when remediation isn't possible. Risk is assessed not just by CVE presence, but by how network segmentation, firewall policies, and attack path logic neutralize or contain real-world exposure. This approach empowers defenders to deprioritize low-impact vulnerabilities and focus effort where risk truly exists. Building on the foundation introduced in release 6.3, such as KEV enrichment, endpoint OS data, and exploit mapping, this release introduces new integrations that bring Darktrace / OT intelligence directly into governance workflows.

Fortinet FortiGate firewall ingestion feeds segmentation rules into attack path modeling, revealing real exposure when policies fail and closing feeds into patching prioritization based on a policy to CVE exposure assessment.

  • ServiceNow Configuration Management Database (CMDB) sync ensures asset intelligence stays current across governance platforms, eliminating manual inventory work.

Risk modeling has also been made more operationally relevant. Scores are now contextualized by exploitability, asset criticality, firewall policy, and segmentation posture. Patch recommendations are modeled in terms of safety, uptime and compliance rather than just Common Vulnerability Scoring System (CVSS) numbers. And importantly, risk is prioritized across the Purdue Model, giving defenders visibility into whether vulnerabilities remain isolated to IT or extend into OT-critical layers.

Figure 3: Attack Path Modeling based on NetFlow and network topology reveals high risk points of IT/OT convergence.

The real-world impact for defenders

In today’s environments, attackers move fluidly between IT and OT. Without unified visibility and shared context, incidents cascade faster than teams can respond.

With this release, Darktrace / OT changes that reality. The Operational Overview gives Engineers a dashboard they can use daily, tailored to their workflows. SOC analysts can seamlessly investigate telemetry across endpoints, sensors and protocols that were once blind spots. Operators gain transparency into PLCs and controllers. Governance teams benefit from automated integrations with platforms like Fortinet and ServiceNow. And all stakeholders work from risk models that reflect what truly matters: safety, uptime and compliance.

This release is not about creating more alerts. It is about providing more clarity. By unifying context across IT and OT, Darktrace / OT enables defenders to see more, understand more and act faster.

Because in environments where safety and uptime are non-negotiable, clarity is what matters most.

Join us for our live event where we will discuss these product innovations in greater detail

Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance
Your data. Our AI.
Elevate your network security with Darktrace AI