Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Written by
Adam Stevens
Senior Director of Product, Cloud | Darktrace
Share
09
Aug 2023
TLDR: There are too many technical vulnerabilities and there is too little organizational context for IT teams to patch effectively. Attack path modelling provides the organizational context, allowing security teams to prioritize vulnerabilities. The result is a system where CVEs can be parsed in, organizational context added, and attack paths considered, ultimately providing a prioritized list of vulnerabilities that need to be patched.
Figure 1: The Darktrace user interface presents risk-prioritized vulnerabilities
This blog post explains how Darktrace addresses the challenge of vulnerability prioritization. Most of the industry focusses on understanding the technical impact of vulnerabilities globally (‘How could this CVE generally be exploited? Is it difficult to exploit? Are there pre-requisites to exploitation? …’), without taking local context of a vulnerability into account. We’ll discuss here how we create that local context through attack path modelling and map it to technical vulnerability information. The result is a stunningly powerful way to prioritize vulnerabilities.
We will explore:
1) The challenge and traditional approach to vulnerability prioritization 2) Creating local context through machine learning and attack path modelling 3) Examining the result – contextualized, vulnerability prioritization
The Challenge
Anyone dealing with Threat and Vulnerability Management (TVM) knows this situation:
You have a vulnerability scanning report with dozens or hundreds of pages. There is a long list of ‘critical’ vulnerabilities. How do you start prioritizing these vulnerabilities, assuming your goal is reducing the most risk?
Sometimes the challenge is even more specific – you might have 100 servers with the same critical vulnerability present (e.g. MoveIT). But which one should you patch first, as all of those have the same technical vulnerability priority (‘critical’)? Which one will achieve the biggest risk reduction (critical asset e.g.)? Which one will be almost meaningless to patch (asset with no business impact e.g.) and thus just a time-sink for the patch and IT team?
There have been recent improvements upon flat CVE-scoring for vulnerability prioritization by adding threat-intelligence about exploitability of vulnerabilities into the mix. This is great, examples of that additional information are Exploit Prediction Scoring System (EPSS) and Known Exploited Vulnerabilities Catalogue (KEV).
With CVE and CVSS scores we have the theoretical technical impact of vulnerabilities, and with EPSS and KEV we have information about the likelihood of exploitation of vulnerabilities. That’s a step forward, but still doesn’t give us any local context. Now we know even more about the global and generic technical risk of a vulnerability, but we still lack the local impact on the organization.
Let’s add that missing link via machine learning and attack path modelling.
Adding Attack Path Modelling for Local Context
To prioritize technical vulnerabilities, we need to know as much as we can about the asset on which the vulnerability is present in the context of the local organization. Is it a crown jewel? Is it a choke point? Does it sit on a critical attack path? Is it a dead end, never used and has no business relevance? Does it have organizational priority? Is the asset used by VIP users, as part of a core business or IT process? Does it share identities with elevated credentials? Is the human user on the device susceptible to social engineering?
Those are just a few typical questions when trying to establish local context of an asset. Knowing more about the threat landscape, exploitability, or technical information of a CVE won’t help answer any of the above questions. Gathering, evaluating, maintaining, and using this local context for vulnerability prioritization is the hard part. This local context often resides informally in the head of the TVM or IT team member, having been assembled by having been at the organization for a long time, ‘knowing’ systems, applications and identities in question and talking to asset and application owners if time permits. This does unfortunately not scale, is time-consuming and heavily dependent on individuals.
Understanding all attack paths for an organization provides this local context programmatically.
We discover those attack paths, and these are bespoke for each organization through Darktrace PREVENT™, using the following method (simplified):
1) Build an adaptive model of the local business. Collect, combine, and analyze (using machine learning and non-machine learning techniques) data from various data domains:
a. Network, Cloud, IT, and OT data (network-based attack paths, communication patterns, peer-groups, choke-points, …). Natively collected by Darktrace technology.
b. Email data (social engineering attack paths, phishing susceptibility, external exposure, security awareness level, …). Natively collected by Darktrace technology.
c. Identity data (account privileges, account groups, access levels, shared permissions, …). Collected via various integrations, e.g. Active Directory.
d. Attack surface data (internet-facing exposure, high-impact vulnerabilities, …). Natively collected by Darktrace technology.
e. SaaS information (further identity context). Natively collected by Darktrace
f. Vulnerability information (CVEs, CVSS, EPSS, KEV, …). Collected via integrations, e.g. Vulnerability Scanners or Endpoint products.
Figure 3: Darktrace PREVENT revealing each stage of an attack path
2) Understand what ‘crown jewels’ are and how to get to them. Calculate entity importance (user, technical asset), exposure levels, potential damage levels (blast radius) weakness levels, and other scores to identify most important entities and their relationships to each other (‘crown jewels’).
Various forms of machine learning and non-machine learning techniques are used to achieve this. Further details on some of the exact methods can be found here. The result is a holistic, adaptive and dynamic model of the organization that shows most important entities and how to get to them across various data domains.
The combination of local context and technical context, around the severity and likelihood of exploitation, creates the Darktrace Vulnerability Score. This enables effective risk-based prioritisation of CVE patching.
Figure 4: List of devices with the highest damage potential in the organization - local context
3) Map the attack path model of the organization to common cyber domain knowledge. We can then combine things like MITRE ATT&CK techniques with those identified connectivity patterns and attack paths – making it easy to understand which techniques, tools and procedures (TTPs) can be used to move through the organization, and how difficult it is to exploit each TTP.
Figure 5: An example attack path with associated MITRE techniques and difficulty scores for each TTP
We can now easily start prioritizing CVE patching based on actual, organizational risk and local context.
Bringing It All Together
Finally, we overlay the attack paths calculated by Darktrace with the CVEs collected from a vulnerability scanner or EDR. This can either happen as a native integration in Darktrace PREVENT, if we are already ingesting CVE data from another solution, or via CSV upload.
Figure 6: Darktrace's global CVE prioritization in action.
But you can also go further than just looking at the CVE that delivers the biggest risk reduction globally in your organization if it is patched. You can also look only at certain group of vulnerabilities, or a sub-set of devices to understand where to patch first in this reduced scope:
Figure 7: An example of the information Darktrace reveals around a CVE
This also provides the TVM team clear justification for the patch and infrastructure teams on why these vulnerabilities should be prioritized and what the positive impact will be on risk reduction.
Attack path modelling can be utilized for various other use cases, such as threat modelling and improving SOC efficiency. We’ll explore those in more depth at a later stage.
Want to explore more on using machine learning for vulnerability prioritization? Want to test it on your own data, for free? Arrange a demo today.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption
Núclea prevented a highly targeted phishing attack exploiting trusted relationships—avoiding financial loss, data exposure, and disruption. Darktrace stopped the threat at the point of risk, protecting business continuity and strengthening resilience across the financial ecosystem.
Defend What You Trust: Stories from the Front Lines of Modern Cyber Defense
Security leaders from global organizations across industries sat down with us to share their own front-line experiences and real-world perspectives on how modern attacks unfold, where hidden risks emerge, and how AI is reshaping the way organizations think about the role of security.
AI-powered security for a rapidly growing grocery enterprise
By combining AI-driven detection and autonomous response, this leading grocery holding group has built a security model that delivers continuous protection, accelerates growth, and empowers a small, highly efficient team to safeguard a complex retail ecosystem.
Hola VPN Abuse: From Proxy Traffic to Malware and Cryptomining
Introduction
In enterprise environments, non-compliant software traffic can introduce unexpected exposure by creating unmanaged paths for outbound connectivity. Hola VPN is a notable example because of its peer-to-peer design, which can effectively turn user devices into routing or exit nodes for other parties’ traffic, shifting the risk profile from that of a traditional virtual private network (VPN) to something closer to a distributed proxy.
As a result, the appearance of Hola-related activity, whether from prior installation or unintended background connections, should be treated with caution. Such activity may provide a foothold for malicious behavior, including lateral movement or command-and-control communication.
This blog explores how Hola-associated activity appeared as part of broader patterns of suspicious behavior observed across the Darktrace customer base.
The campaign
In February and March 2026, Darktrace observed similar anomalous activity across multiple customer environments, with affected devices showing consistent behavioral patterns. These included connections to multiple *.hola[.]org endpoints using Hola-related user agents, suggesting interaction with Hola infrastructure rather than isolated or incidental traffic.
Following these connections, affected customer environments showed downloads of suspicious executable files from rare external endpoints 188.241.219[.]55 and 184.241.218[.]111. Both endpoints have been flagged as potentially malicious by open-source intelligence (OSINT) [1][2].
These downloads were conducted using consistent user agents across impacted customers, specifically ‘Hola svc_js_win32/1.249.408’ and ‘Hola svc_js_win32/1.251.389’, suggesting a possible association with Hola-related activity.
Notably, this pattern aligns with recent reporting that, in some cases, Hola distributed an undeclared executable component, me[.]exe, which was later assessed to be a likely Monero-mining binary introduced via a compromised delivery pipeline [3].
Case Study 1
Darktrace first observed a new device on January 19, 2026, within a customer environment based in the Europe, Middle East, and Africa (EMEA) region. On the same day it appeared on the network, the device communicated with multiple pieces of Hola VPN-linked infrastructure before downloading a binary from a hola[.]org subdomain.
Figure 1: Cyber AI Analyst investigation highlighting Hola VPN service activity potentially associated with subsequent HTTP command-and-control (C2) connections.
Subsequent Darktrace telemetry revealed a recurring pattern of activity from the day the device was first observed through to March 4, 2026. During this period, the device repeatedly issued HTTP GET requests to the URI /bwfile?size=1048576, each returning a 200 OK response, indicating successful file retrieval.
This behavior was accompanied by a POST request to /bwfile, followed by an additional GET request for a significantly larger file at /bwfile?size=26214400, suggesting a deliberate and structured file transfer pattern.
Notably, the binary download activity was not tied to a single static host. Instead, it was observed across multiple URLs that changed over time while remaining within the same hola[.]org domain. This pattern suggests the use of rotating or distributed delivery infrastructure rather than a fixed endpoint.
Figure 2: Variation in URLs over time within the same hola[.]org domain, indicating the use of dynamically changing endpoints.
Across these events, the activity was consistently associated with the user agent Hola svc_js_win32/1.249.408, further linking the traffic to Hola-related service components. Amid these persistent and unusual connections, on February 22, Darktrace observed the device connecting to 188.241.219[.]55/proxy-peer-windows-amd64[.]exe, resulting in the download of an executable file.
Figure 3: File transfer event showing the download of an executable from the rare external endpoint 188.241.219[.]55.
Based on its file hash, the downloaded file was assessed as a likely Trojan downloader [4], with import hash (imphash) values showing similarities to samples linked to Vidar, Rhadamanthys, and Stealc according to OSINT [5]. Overall, this sequence of activity suggests that Hola-related connectivity may have been leveraged as part of a broader malware delivery chain.
Darktrace’s Autonomous Response
Due to the highly unusual activity observed, Darktrace Autonomous Response was triggered by the device’s behavior. However, as the customer deployment was configured in “Human Confirmation” mode, manual approval was required before any action could be taken.
Had the deployment been set to “Fully Autonomous” mode, Darktrace would have automatically:
Blocked connections to the associated ports and external endpoints
Prevented all outgoing network connections from the device
Enforced the device’s established ‘pattern of life’, allowing normal activity to continue while restricting any anomalous behavior
Figure 4: Example of a Darktrace Autonomous Response model highlighting the action that would have been taken, demonstrating how the system identifies anomalous behavior and applies targeted containment measures to restrict suspicious network activity.
Case Study 2
While the first case focused on anomalous activity from a newly observed device, Darktrace also identified cases in which devices had already been communicating with Hola-related endpoints prior to the suspected campaign. This may suggest pre-existing Hola usage within the environment, potentially increasing exposure and creating an avenue for subsequent suspicious activity.
One case involved three devices within a customer network based in the Americas (AMS). In this instance, a different payload was identified: me[.]exe, a potentially malicious cryptocurrency miner also referred to as HolaMonitorService[.]exe [6][7]. The downloads were observed from infrastructure similar to that seen in Case 1, including an IP address within the same 188.241.0.0/16 subnet.
Connections to *.hola[.]org, alongside the use of potential Hola-related user agents consistent with those in Case 1, were also identified, further suggesting a link between the observed activity and Hola-associated infrastructure.
Darktrace observed activity indicative of unusual VPN usage on the first affected device on February 2, followed by telemetry suggesting potential Tor usage. This was later followed by the download of me[.]exe on March 10 from 188.241.218[.]111. Notably, this device was the earliest among the three within the deployment to exhibit the presence of the suspicious executable.
Figure 5: Cyber AI Analyst detection highlighting the download of a suspicious executable from a similar external endpoint in a separate deployment.
On March 5, 2026, the second affected device exhibited a slightly different progression, initiating connections to http-test1[.]hola[.]org using the user agent ‘hola_get’. This activity was followed by the download of me[.]exe from the same endpoint on March 13, consistent with the broader pattern of Hola-related downloads observed across the environment.
Figure 6: Example of Hola VPN-related connectivity observed on the network prior to the suspected campaign, indicating pre-existing usage that may have contributed to subsequent activity.
The final affected device within this customer’s network demonstrated a more limited but related pattern, also downloading me[.]exe on March 17 using the same ‘hola_get’ user agent.
While the earlier Hola VPN usage observed across the deployment may not have been directly related to the suspected malware campaign, it may nonetheless have contributed to reduced visibility. The presence of pre-existing Hola-related traffic could have obscured malicious activity, making it more difficult to distinguish legitimate usage from attacker-driven behavior and, in turn, hindering the timely identification of the emerging compromise.
Darktrace’s Autonomous Response
For this deployment, the customer had their Autonomous Response capability configured in “Fully Autonomous” mode, allowing Darktrace to take action without human intervention. As a result, the system was able to autonomously disrupt the activity as soon as relevant events were identified through model detections.
Figure 7: Darktrace Autonomous Response actions taken against suspicious activity linked to Hola VPN.
Suspected cryptomining activity
As previously noted, some of the observed executable payloads appear to be linked to cryptomining malware. Across a subset of affected customer environments, this assessment was further supported by subsequent device activity consistent with Monero mining. Affected devices established follow-on connections to multiple external endpoints aligned with known mining infrastructure, indicating post-download execution.
Considering the broader sequence of activity, this pattern may point to a wider form of abuse in which legitimate VPN-related traffic is used to mask or facilitate malicious behavior following compromise.
On several devices, the download of executable files, including a newly observed peer[.]exe, was followed by alerts indicative of cryptocurrency mining activity. Mining-related credentials such as ‘x’ were observed using the Minergate protocol to communicate with endpoints within the 89.125.255.0/24 subnet and 188.241.218[.]111, the same endpoint involved in earlier download activity. Additional credentials appeared to reflect device-specific CPU identifiers, for example ‘12th Gen Intel(R) Core (TM) i5-1235U’.
Observed mining methods included login, submit, and job, consistent with active participation in a pool-based mining workflow rather than passive or incidental contact. The login method indicates that the host authenticated to the mining service as a worker, job reflects the assignment of computational tasks, and submit shows completed work being returned to the pool [8]. This sequence suggests that affected devices were actively contributing processing resources as part of an unauthorized distributed mining operation.
The presence of unauthorized cryptominers can lead to degraded system performance and reduced device stability. Beyond the immediate resource impact, such activity often serves as an indicator of a broader compromise rather than an isolated issue. This may increase the risk of further malware deployment, persistence mechanisms, and lateral movement, particularly in environments where the initial intrusion has not been fully contained.
Conclusion
Across affected environments, detections such as unusual VPN usage, connections to Hola infrastructure, anomalous HTTP activity, suspicious file downloads, and subsequent cryptomining behavior were linked into a single, evolving incident narrative. This aggregation provided a clearer view of attack progression, enabling security teams to understand not just isolated alerts, but the full sequence of compromise from initial contact through to post-exploitation.
Ultimately, these activities show that the risk posed by non-compliant software such as Hola VPN can extend far beyond simple policy violations. What began as traffic to Hola-related infrastructure was, in multiple cases, followed by behavior suggesting deliberate misuse, including suspicious executable downloads using Hola-related user agents and, in some instances, evidence of active cryptomining. These were not isolated anomalies, but elements of a broader pattern in which seemingly benign proxy or VPN-related communications may have created a pathway for malicious delivery and unauthorized resource exploitation.
The significance of this activity lies not only in the downloads or mining, but in what it reveals about an attacker’s ability to blend malicious operations into traffic associated with software that may already have a foothold in the environment. When unapproved software operates within an enterprise, it can reduce visibility, blur the distinction between legitimate and malicious traffic, and create opportunities to extend compromise in ways that are persistent and difficult to detect. Darktrace’s anomaly-based approach enables these behavioral distinctions to be identified, regardless of whether the device is new or long established within the network.
Credit to Min Kim (Associate Principal Analyst), Priya Thapa (Senior Cyber Analyst) Edited by Ryan Traill (Content Manager)
![Variation in URLs over time within the same hola[.]org domain, indicating the use of dynamically changing endpoints.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a304bdeff111215c0436931_Screenshot%202026-06-15%20at%2012.00.43%E2%80%AFPM.png)
![File transfer event showing the download of an executable from the rare external endpoint 188.241.219[.]55.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a304c2468d20aeff16a2721_Screenshot%202026-06-15%20at%2012.01.53%E2%80%AFPM.png)
