Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Tara Gould
Malware Research Lead
Share
21
Jan 2026
はじめに
ダークトレースのアナリストは、韓国のユーザーを標的とした、北朝鮮（DPRK）が関係していると思われる攻撃を検知しました。このキャンペーンはJavascriptEncoded（JSE）スクリプトと政府機関を装ったおとり文書を使ってVisual Studio Code（VS Code）トンネルを展開し、リモートアクセスを確立していました。
技術分析
図1: 「2026年上半期国立大学院夜間プログラムの学生選抜に関する文書」という表題のおとり文書。
このキャンペーンで確認されたサンプルは、Hangul Word Processor （HWPX） 文書に偽装したJSEファイルであり、スピアフィッシングEメールを使って標的に送付されたと考えられます。このJSEファイルは複数のBase64エンコードされたブロブを含み、Windows Script Hostによって実行されます。このHWPXファイルは“2026年上半期国立大学院夜間プログラムの学生選抜に関する文書(1)”という名前で、C:\ProgramDataにあり、おとりとして開かれます。この文書は韓国の公務員に関連する事務を管掌する政府機関、人事革新処を装ったものでした。文書内のメタデータから、脅威アクターは文書を本物らしくみせるため、政府ウェブサイトから文書を取得し、編集したと思われます。
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
ダークトレースは、React2Shellの脆弱性をエクスプロイトするAI/LLM生成によるマルウェアを自社のCloudypots環境内で検知しました。この事例は、LLM（Large Language Model：大規模原語モデル）支援の開発によって低スキルの攻撃者であっても効果的なエクスプロイトツールを迅速に作成できることを示しています。このブログではその攻撃チェーンとAIで生成されたペイロードを分析し、容易に入手可能なAIサイバー脅威がもたらす、防御上の問題の深刻化について解説します。
AppleScript Abuse: Unpacking a macOS Phishing Campaign
This blog explores a macOS phishing campaign that leverages social engineering, AppleScript loaders, and attempted abuse of the macOS’ TCC feature to gain privileged access. It highlights a broader trend: attackers increasingly exploit user trust rather than system vulnerabilities, using staged payload delivery and persistence techniques to maintain long‑term access.
his blog details how to unpack malware like SnappyBee, a modular backdoor linked to Salt Typhoon, revealing its custom packing, DLL sideloading, dynamic API resolution, and multi‑stage in‑memory decryption. It provides analysts with a step‑by‑step guide to extract hidden payloads and understand advanced evasion techniques by sophisticated malware strains.
CVE-2026-1731: How Darktrace Sees the BeyondTrust Exploitation Wave Unfolding
Note: Darktrace's Threat Research team is publishing now to help defenders. We will update continue updating this blog as our investigations unfold.
Background
On February 6, 2026, the Identity & Access Management solution BeyondTrust announced patches for a vulnerability, CVE-2026-1731, which enables unauthenticated remote code execution using specially crafted requests. This vulnerability affects BeyondTrust Remote Support (RS) and particular older versions of Privileged Remote Access (PRA) [1].
A Proof of Concept (PoC) exploit for this vulnerability was released publicly on February 10, and open-source intelligence (OSINT) reported exploitation attempts within 24 hours [2].
Previous intrusions against Beyond Trust technology have been cited as being affiliated with nation-state attacks, including a 2024 breach targeting the U.S. Treasury Department. This incident led to subsequent emergency directives from the Cybersecurity and Infrastructure Security Agency (CISA) and later showed attackers had chained previously unknown vulnerabilities to achieve their goals [3].
Additionally, there appears to be infrastructure overlap with React2Shell mass exploitation previously observed by Darktrace, with command-and-control (C2) domain avg.domaininfo[.]top seen in potential post-exploitation activity for BeyondTrust, as well as in a React2Shell exploitation case involving possible EtherRAT deployment.
Darktrace Detections
Darktrace’s Threat Research team has identified highly anomalous activity across several customers that may relate to exploitation of BeyondTrust since February 10, 2026. Observed activities include:
- Outbound connections and DNS requests for endpoints associated with Out-of-Band Application Security Testing; these services are commonly abused by threat actors for exploit validation. Associated Darktrace models include:
o Compromise / Possible Tunnelling to Bin Services
o Compromise / High Priority Crypto Currency Mining
And model alerts for:
o Compromise / Rare Domain Pointing to Internal IP
IT Defenders: As part of best practices, we highly recommend employing an automated containment solution in your environment. For Darktrace customers, please ensure that Autonomous Response is configured correctly. More guidance regarding this activity and suggested actions can be found in the Darktrace Customer Portal.
Appendices
Potential indicators of post-exploitation behavior:
def execute_rce_command(base_url, command, timeout=120): """ ACTUAL EXPLOIT METHOD - Next.js React Server Component RCE DO NOT MODIFY THIS FUNCTION Returns: (success, output) """ try: # Disable SSL warnings urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
.jpg)
