December 7, 2023

How Darktrace Triumphed Over MyKings Botnet

Darktrace has provided full visibility over the MyKings botnet kill chain from the beginning of its infections to the eventual cryptocurrency mining activity.

Written by

Oluwatosin Aturaka

Analyst Team Lead, Cambridge

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Oluwatosin Aturaka

Analyst Team Lead, Cambridge

Dec 2023

Botnets: A persistent cyber threat

Since their appearance in the wild over three decades ago, botnets have consistently been the attack vector of choice for many threat actors. The most prevalent of these attack vectors are distributed denial of service (DDoS) and phishing campaigns. Their persistent nature means that even if a compromised device in identified, attackers can continue to operate by using the additional compromised devices they will likely have on the target network. Similarly, command and control (C2) infrastructure can easily be restructured between infected systems, making it increasingly difficult to remove the infection.

MyKings Botnet

One of the most prevalent and sophisticated examples in recent years is the MyKings botnet, also known as Smominru or DarkCloud. Darktrace has observed numerous cases of MyKings botnet compromises across multiple customer environments in several different industries as far back as August 2022. The diverse tactics, techniques, and procedures (TTPs) and sophisticated kill chains employed by MyKings botnet may prove a challenge to traditional rule and signature-based detections.

However, Darktrace’s anomaly-centric approach enabled it to successfully detect a wide-range of indicators of compromise (IoCs) related to the MyKings botnet and bring immediate awareness to customer security teams, as it demonstrated on the network of multiple customers between March and August 2023.

Background on MyKings Botnet

MyKings has been active and spreading steadily since 2016 resulting in over 520,000 infections worldwide.^[1] Although verified attribution of the botnet remains elusive, the variety of targets and prevalence of crypto-mining software on affected devices suggests the threat group behind the malware is financially motivated. The operators behind MyKings appear to be highly opportunistic, with attacks lacking an obvious specific target industry. Across Darktrace’s customer base, the organizations affected were representative of multiple industries such as entertainment, mining, education, information technology, health, and transportation.

Given its longevity, the MyKings botnet has unsurprisingly evolved since its first appearance years ago. Initial analyses of the botnet showed that the primary crypto-related activity on infected devices was the installation of Monero-mining software. However, in 2019 researchers discovered a new module within the MyKings malware that enabled clipboard-jacking, whereby the malware replaces a user's copied cryptowallet address with the operator's own wallet address in order to siphon funds.^[2]

Similar to other botnets such as the Outlaw crypto-miner, the MyKings botnet can also kill running processes of unrelated malware on the compromised hosts that may have resulted from prior infection.^[3] MyKings has also developed a comprehensive set of persistence techniques, including: the deployment of bootkits, initiating the botnet immediately after a system reboot, configuring Registry run keys, and generating multiple Scheduled Tasks and WMI listeners.^[4] MyKings have also been observed rotating tools and payloads over time to propagate the botnet. For example, some operators have been observed utilizing PCShare, an open-source remote access trojan (RAT) customized to conduct C2 services, execute commands, and download mining software^[5].

Darktrace Coverage

Across observed customer networks between March and August 2023, Darktrace identified the MyKings botnet primarily targeting Windows-based servers that supports services like MySQL, MS-SQL, Telnet, SSH, IPC, WMI, and Remote Desktop (RDP). In the initial phase of the attack, the botnet would initiate a variety of attacks against a target including brute-forcing and exploitation of unpatched vulnerabilities on exposed servers. The botnet delivers a variety of payloads to the compromised systems including worm downloaders, trojans, executable files and scripts.

This pattern of activity was detected across the network of one particular Darktrace customer in the education sector in early March 2023. Unfortunately, this customer did not have Darktrace RESPOND™ deployed on their network at the time of the attack, meaning the MyKings botnet was able to move through the cyber kill chain ultimately achieving its goal, which in this case was mining cryptocurrency.

Initial Access

On March 6, Darktrace observed an internet-facing SQL server receiving an unusually large number of incoming MySQL connections from the rare external endpoint 171.91.76[.]31 via port 1433. While it is not possible to confirm whether these suspicious connections represented the exact starting point of the infection, such a sudden influx of SQL connection from a rare external endpoint could be indicative of a malicious attempt to exploit vulnerabilities in the server's SQL database or perform password brute-forcing to gain unauthorized access. Given that MyKings typically spreads primarily through such targeting of internet-exposed devices, the pattern of activity is consistent with potential initial access by MyKings.^[6]

Initial Command and Control

The device then proceeded to initiate a series of repeated HTTP connections between March 6 and March 10^, to the domain www[.]back0314[.]ru (107.148.239[.]111). These connections included HTTP GET requests featuring URIs such as ‘/back.txt', suggesting potential beaconing and C2 communication. The device continued this connectivity to the external host over the course of four days, primarily utilizing destination ports 80, and 6666. While port 80 is commonly utilized for HTTP connections, port 6666 is a non-standard port for the protocol. Such connectivity over non-standard ports can indicate potential detection evasion and obfuscation tactics by the threat actors. During this time, the device also initiated repeated connections to additional malicious external endpoints with seemingly algorithmically generated hostnames such as pc.pc0416[.]xyz.

Darktrace UI image — Figure 1: Model breach showing details of the malicious domain generation algorithm (DGA) connections.

Tool Transfer

While this beaconing activity was taking place, the affected device also began to receive potential payloads from unusual external endpoints. On April 29, the device made an HTTP GET request for “/power.txt” to the endpoint 192.236.160[.]237, which was later discovered to have multiple open-source intelligence (OSINT) links to malware. Power.txt is a shellcode written in PowerShell which is downloaded and executed with the purpose of disabling Windows Defenders related functions.^[7] After the initial script was downloaded (and likely executed), Darktrace went on to detect the device making a series of additional GET requests for several varying compressed and executable files. For example, the device made HTTP requests for '/pld/cmd.txt' to the external endpoint 104.233.224[.]173. In response the external server provided numerous files, including ‘u.exe’, and ‘upsup4.exe’ for download, both of which share file names with previously identified MyKings payloads.

MyKings deploys a diverse array of payloads to expand the botnet and secure a firm position within a compromised system. This multi-faceted approach may render conventional security measures less effective due to the intricacies of and variety of payloads involved in compromises. Darktrace, however, does not rely on static or outdated lists of IoCs in order to detect malicious activity. Instead, DETECT’s Self-Learning AI allows it to identify emerging compromise activity by recognizing the subtle deviations in an affected device’s behavior that could indicate it has fallen into the hands of malicious actors.

Figure 2: External site summary of the endpoint 103.145.106[.]242 showing the rarity of connectivity to the external host.

Achieving Objectives – Crypto-Mining

Several weeks after the initial payloads were delivered and beaconing commenced, Darktrace finally detected the initiation of crypto-mining operations. On May 27, the originally compromised server connected to the rare domain other.xmrpool[.]ru over port 1081. As seen in the domain name, this endpoint appears to be affiliated with pool mining activity and the domain has various OSINT affiliations with the cryptocurrency Monero coin. During this connection, the host was observed passing Monero credentials, activity which parallels similar mining operations observed on other customer networks that had been compromised by the MyKings botnet.

Although mining activity may not pose an immediate or urgent concern for security unauthorized cryptomining on devices can result in detrimental consequences, such as compromised hardware integrity, elevated energy costs, and reduced productivity, and even potential involvement in money laundering.

Figure 3: Event breach log showing details of the connection to the other.xmrpool[.]ru endpoint associated with cryptocurrency mining activity.

Conclusion

Detecting future iterations of the MyKings botnet will likely demand a shift away from an overreliance on traditional rules and signatures and lists of “known bads”, instead requiring organizations to employ AI-driven technology that can identify suspicious activity that represents a deviation from previously established patterns of life.

Despite the diverse range of payloads, malicious endpoints, and intricate activities that constitute a typical MyKing botnet compromise, Darktrace was able successfully detect multiple critical phases within the MyKings kill chain. Given the evolving nature of the MyKings botnet, it is highly probable the botnet will continue to expand and adapt, leveraging new tactics and technologies. By adopting Darktrace’s product of suites, including Darktrace DETECT, organizations are well-positioned to identify these evolving threats as soon as they emerge and, when coupled with the autonomous response technology of Darktrace RESPOND, threats like the MyKings botnet can be stopped in their tracks before they can achieve their ultimate goals.

Credit to: Oluwatosin Aturaka, Analyst Team Lead, Cambridge, Adam Potter, Cyber Analyst

Appendix

IoC Table

IoC - Type - Description + Confidence

162.216.150[.]108- IP - C2 Infrastructure

103.145.106[.]242 - IP - C2 Infrastructure

137.175.56[.]104 - IP - C2 Infrastructure

138.197.152[.]201 - IP - C2 Infrastructure

139.59.74[.]135 - IP - C2 Infrastructure

pc.pc0416[.]xyz - Domain - C2 Infrastructure (DGA)

other.xmrpool[.]ru - Domain - Cryptomining Endpoint

xmrpool[.]ru - Domain - Cryptomining Endpoint

103.145.106[.]55 - IP - Cryptomining Endpoint

ntuser[.]rar - Zipped File - Payload

/xmr1025[.]rar - Zipped File - Payload

/20201117[.]rar - Zipped File - Payload

wmi[.]txt - File - Payload

u[.]exe - Executable File - Payload

back[.]txt - File - Payload

upsupx2[.]exe - Executable File - Payload

cmd[.]txt - File - Payload

power[.]txt - File - Payload

ups[.]html - File - Payload

xmr1025.rar - Zipped File - Payload

171.91.76[.]31- IP - Possible Initial Compromise Endpoint

www[.]back0314[.]ru - Domain - Probable C2 Infrastructure

107.148.239[.]111 - IP - Probable C2 Infrastructure

194.67.71[.]99 - IP- Probable C2 Infrastructure

Darktrace DETECT Model Breaches

Device / Initial Breach Chain Compromise
Anomalous File / Masqueraded File Transfer (x37)
Compromise / Large DNS Volume for Suspicious Domain
Compromise / Fast Beaconing to DGA
Device / Large Number of Model Breaches
Anomalous File / Multiple EXE from Rare External Locations (x30)
Compromise / Beacon for 4 Days (x2)
Anomalous Server Activity / New User Agent from Internet Facing System
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous Server Activity / New Internet Facing System
Anomalous File / EXE from Rare External Location (x37)
Device / Large Number of Connections to New Endpoints
Anomalous Server Activity / Server Activity on New Non-Standard Port (x3)
Device / Threat Indicator (x3)
Unusual Activity / Unusual External Activity
Compromise / Crypto Currency Mining Activity (x37)
Compliance / Internet Facing SQL Server
Device / Anomalous Scripts Download Followed By Additional Packages
Device / New User Agent

MITRE ATT&CK Mapping

ATT&CK Technique - Technique ID

Reconnaissance – T1595.002 Vulnerability Scanning

Resource Development – T1608 Stage Capabilities

Resource Development – T1588.001 Malware

Initial Access – T1190 Exploit Public-Facing Application

Command and Control – T15568.002 Domain Generated Algorithms

Command and Control – T1571 Non-Standard Port

Execution – T1047 Windows Management Instrumentation

Execution – T1059.001 Command and Scripting Interpreter

Persistence – T1542.003 Pre-OS Boot

Impact – T1496 Resource Hijacking

References

^[1] https://www.binarydefense.com/resources/threat-watch/mykings-botnet-is-growing-and-remains-under-the-radar/

^[2] https://therecord.media/a-malware-botnet-has-made-more-than-24-7-million-since-2019

^[3] https://www.darktrace.com/blog/outlaw-returns-uncovering-returning-features-and-new-tactics

^[4] https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophoslabs-uncut-mykings-report.pdf

^[5] https://www.antiy.com/response/20190822.html

^[6] https://ethicaldebuggers.com/mykings-botnet/

^[7] https://ethicaldebuggers.com/mykings-botnet/

執筆者

Oluwatosin Aturaka

Analyst Team Lead, Cambridge

Inside the SOC

Written by

Oluwatosin Aturaka

Analyst Team Lead, Cambridge

•

August 7, 2026

Nathaniel Jones

SVP, Global Threat Intelligence

•

August 10, 2026

Watch the NIS2 Webinar

Blog

AI

August 10, 2026

Securing AI: Analysis of the Complete Security Stack with Governance and Controls

Key takeaways

Protecting enterprise AI requires defense in depth: Organizations should combine governance, identity and access controls, data security, secure development, runtime monitoring, behavioral detection, containment, and incident response rather than rely on a single control.

Agentic AI expands enterprise risk beyond the model: Autonomous agents interact with tools, APIs, identities, data, and other agents, creating identity, behavioral, structural, and accountability risks that can propagate across trusted systems.

An effective AI security stack spans multiple layers: Security teams should evaluate governance and visibility, identity and agent controls, data protection, secure MLOps and LLMOps, runtime security, and response and recovery capabilities.

Security controls should develop alongside enterprise AI adoption: Organizations should establish ownership, visibility, access controls, testing, monitoring, and recovery capabilities while using behavior-based detection and containment to address risks that static policies may not reveal.

Why traditional cybersecurity approaches are not enough for AI

AI adoption outpaces most security programs’ ability to adapt. That gap is now one of the most consequential sources of cyber risk facing enterprises. As organizations embed generative and agentic AI into development workflows, business operations, and security tooling itself, the question is no longer whether AI will introduce risk. The question is whether organizations understand where that risk actually lives and how to manage it operationally.

Two recent pieces of guidance underscore this shift:

The upcoming Cybersecurity Framework Profile for AI from NIST

The Five Eyes government guidance on the careful adoption of agentic AI services

Taken together, they point to a critical conclusion. AI security cannot be reduced to model hardening or prompt filtering. It requires a defense in depth strategy that treats AI as both a new attack surface and a force multiplier for defense, while accounting for how AI fundamentally changes scale, speed, and autonomy.

Recent threat research suggests that today's cyber risk is driven less by initial compromise and more by an adversary's ability to blend into normal operations over time. AI systems create the same exposure in a new form: more autonomy, more scale, and more opportunities for risky behavior to blend into normal operations.

How NIST defines the three core pillars of AI security

The NIST profile organizes AI risk across three inseparable focus areas that span all cybersecurity functions, Secure, Defend and Thwart. These areas are not sequential. They exist simultaneously and must be addressed together.

Secure

This treats AI as an attack surface. It includes models, prompts, agents, pipelines, training and inference data, retrieval augmented generation corpora, and the AI supply chain itself. AI systems are opaque, probabilistic, and non-deterministic by design. Some vulnerabilities are inherent in how models are trained or how data is sourced. Traditional patching does not fully mitigate these risks. This is also where many enterprises are weakest today and, critically, where many security programs stop.

Defend

This is AI as a defensive force multiplier. AI can improve detection speed, scale, correlation, and response, but only if the right models are used and operationalized correctly. Machine-speed behavior-based detection, response and containment becomes critical in defending non-deterministic systems. Accuracy, explainability, governance, testing, validation, and integration into SOC workflows matter as much as capability. Without those controls, hallucination risk, over automation, and misplaced trust become security risks themselves.

Thwart

This treats AI as an adversarial accelerant. Threat actors are already using AI to generate targeted social engineering attacks, deepfakes, malware, and autonomous attack agents. Asymmetric warfare is highlighting faster vulnerability discovery and exploitation with a lag on patch development, testing and deployment.

How this looks in practice

Darktrace researchers observed scaled, automated exploitation of the React2Shell vulnerability within days of disclosure. A vulnerable cloud asset was exploited in under 120 seconds of being deployed. Darktrace research team observed an AI/LLM-generated malware sample used in exploitation activity tied to React2Shell. The significance isn't novelty. It is that AI lowers the barrier to producing usable offensive tooling and compresses the time between experimentation and deployment.

Tactics are getting more and more creative in order to string together steps of an attack kill chain. This creates a dependency on behavior-based detection, autonomous investigation, autonomous containment, training, resilience investment, and recovery planning across the entire enterprise.

Why agentic AI fundamentally changes enterprise cyber risk

The Five Eyes guidance on agentic AI highlights material changes to the cyber risk profile of an organization. Unlike generative AI systems that produce content for human consumption, agentic AI systems reason, plan, and act autonomously across tools, data, and environments. That autonomy, combined with access to real systems, amplifies the impact of traditional cyber failures and introduces new system level risks that are difficult to predict, observe, and contain.

Risk in agentic systems does not live in the model alone. It emerges from interactions between models, prompts, memory, tools, APIs, identities, privileges, inter-agent trust relationships, and human assumptions baked into design. Vulnerabilities are often introduced through data, connectors, natural language interfaces, protocols, and drift by design.

In supply-chain incidents, attackers did not need sophisticated exploits to scale impact. They abused trusted systems built for automation and implicit access. Agentic AI inherits that model. Once a system can act across tools, data, and workflows, compromise propagates through trust relationships that were never designed for machine autonomy.

The major agentic AI risk classes include the following:

The identity control for non-human identities or autonomous agents makes it difficult to mitigate over-permissioning, limiting access, scope, and duration, as well as access hygiene

Agents are frequently over permissioned

Compromised tools inherit agent authority

Static secrets enable impersonation

Implicit trust between agents enables lateral movement

Design and configuration risks compound this, including privileges evaluated once at startup, poor segmentation, unvetted third party tools, reused authorization decisions outside their original context, and guardrail limitations.

Behavioral risk

Agents can optimize for goals in unsafe ways, misinterpret ambiguous intent, chain actions into unintended sequences, change behavior during evaluation, and exhibit deceptive or sycophantic responses.

Structural risk

Structural risk follows from agentic systems that are tightly coupled, multicomponent ecosystems. Failures can propagate across agents. Hallucinations cascade downstream. Resource exhaustion becomes systemic. Tool misuse enables indirect prompt injection and command execution. Rogue agents can poison peer agents through trust relationships.

Accountability

Accountability becomes unclear as autonomy increases. Autonomous agents assume human identity permissions, and humans should have clear ownership of these agents, but they don’t, and this model is flawed. Decision paths are opaque and non-deterministic. Logs are fragmented and difficult to interpret. Reproducing an incident will be impossible without explicit design for observability and forensics. An agent compromise is functionally an insider threat, often with better access and fewer behavioral constraints than a human.

What is the most effective way to protect enterprise AI?

The most effective way to protect enterprise AI is through a defense-in-depth strategy that combines governance, identity and access controls, data security, secure AI development, runtime monitoring, behavioral detection, containment, and incident response. No single control can address AI risk across models, agents, data, infrastructure, and enterprise environments.

Agentic AI runs on software, networks, identities, and data. It must be governed using the same foundational principles that have proven resilient under uncertainty, including secure by design, defense in depth, zero trust, least privilege, continuous monitoring, behavior-based advanced threat detection and containment, and incident response and recovery.

Core components to a Defense in depth Strategy for Securing the use of AI:

Strong, precise identity control plane to include an identity per agent (cryptographic, non‑shared)
- Privilege monitoring and just‑in‑time access

Data Governance

Secure‑by‑default configurations
- Security Posture Management
- Zero Trust principles

Strong guardrails, deny‑by‑default policies, and isolation

Explicit instruction hierarchies and controlled context

Behavioral-based detection across entire enterprise to include inputs, tools, and outputs as well as AI used on the endpoint, across the network, cloud, SaaS, email, and OT
- Runtime anomaly detection and goal‑drift detection
- Autonomous containment to mitigate risk and minimize damage

Hard boundaries on autonomy and delegation

Testing, Evaluation, Validation and Verification
- Determine when autonomous action and when human in the loop
- Adversarial training and agent‑specific testing
- Simulation, red teaming, and chaos testing

Kill‑switches, rollback, and containment mechanisms
- Forensics data captures, interpretability, autonomous containment, and remediation/recovery plans

Until standards, tooling, and assurance methods mature, organizations should assume agentic AI systems will behave unexpectedly and design deployments around resilience, behavior-based detection, reversibility, and containment, not efficiency.

How security leaders should prepare for enterprise AI adoption

AI security is not model security alone. Data, pipelines, identities, and agents are first class assets. Many AI attacks succeed through standard cyber failures amplified by AI. Identity, data, and supply chain risk dominate. Behavior-based detection and response are critical, not optional. Logging, provenance, versioning, and forensics data capture of detections are mandatory because you cannot investigate or recover from AI incidents without them.

Risk will often be visible in behavior before it is clearly defined in policy or guidance. The same pattern has been seen in pre-CVE disclosure detection, where abnormal activity appears before the industry has named or described the vulnerability. AI systems introduce that uncertainty by design.

Security leaders should prioritize controls before AI is fully deployed, avoid generic AI security checklists, integrate AI risk into existing cyber programs, and mitigate the risk of non-deterministic technology with continuous oversight, monitoring, behavior analytics, anomaly detection, autonomous investigation, and autonomous containment.

Visibility has a different connotation with AI. Previously, audit logging worked for software/people, but with Generative AI-based systems, interpretability and explainability is difficult to understand, you cannot "undo" what has been done, or see the logic or control a chain of events. This is why behavioral-based detections and containment becomes critical.

What capabilities should every AI security program include?

If an organization asked “what must be in place before scaling AI?”:

AI Risk board and approval workflow

IAM + PAM for all AI services and agents

AI asset inventory

Prompt/output DLP with sanctioned AI access – This is not just pre- and post- filters, but behavior-based detections of semantic interface as well as behavior-based analysis of output with associated risk context.

Shadow AI identification

Secure MLOps – This is an entire paper itself

Runtime guardrails and tool restrictions
- Including AI Gateway/SASE/Zero trust/

Runtime security with behavior-based detections
- Complete visibility, monitoring, behavior analytics, anomaly detection, risk/intent/context evaluation of anomalies, autonomous investigation and autonomous containment of all AI assets across endpoint, network, SaaS, SASE, cloud, OT, email, and messaging platforms

Secure data pipelines and data governance

SOC workflow changes from malicious classification workflows to behavior-based detection workflows

Remediation plans for AI-related incidents

Layered Governance and Security Stack for Securing AI

An enterprise AI security stack should span six integrated layers: governance and visibility; identity, access, and agent control; data security and privacy; secure MLOps and LLMOps; runtime security; and response and recovery. These layers should work together rather than as a linear maturity sequence, with runtime controls helping manage risk as governance evolves.

These considerations do not need to be implemented in order. Runtime Detect and Respond will help mitigate risk while Governance, Visibility, and Identity mature.

Category	Tooling	Controls
Governance & Visibility	AI asset inventory / AI CMDB Shadow AI discovery SaaS discovery AI usage on non-endpoint managed systems via network or cloud telemetry MCP server/client usage via protocols Browser telemetry Gateway or SASE telemetry	Establish a risk board to set up controls Mandatory registration of AI systems Owner, data classification, intended use, and risk tier Supplier disclosure requirements Risk mitigation plan for AI adoption, innovation, or development
Identity, Access & Agent Control	Non-human autonomous agents should not have the full permissions associated with a human user. IAM with workload identities PAM for AI service accounts Secrets management with short-lived tokens Zero Trust principles Identity, permission, and token hygiene	Unique identities per model, agent, and pipeline Least privilege for tools, data, and APIs Explicit approval for autonomous actions
Data Security & Privacy	Data classification and labeling Enterprise DLP across endpoint, email, network, cloud, and SaaS Forensics data capture after risky detections	Prompt-level DLP through behavior-based semantic analysis with risk and intent context Input/interface analysis for risky data requests Output analysis for sensitive data Data integrity evaluation Retention and redaction policies for prompts and responses
Secure MLOps / LLMOps	Secure CI/CD with AI-specific gates Model registries with approval workflows Dependency, container, and artifact scanning SBOM/AIBOM generation IaC security scanning Security posture management Misconfiguration identification Hardening recommendations	Signed models and prompts Versioned datasets, configurations, logging, and controls Securing data pipelines Controlled promotion Quality assurance Adversarial testing
Runtime Security	Securing runtime goes beyond guardrails and model firewalls to include behavior-based detections, response, and containment. Detection, monitoring, and SOC integration Centralized visibility into prompts, outputs, and tool calls AI-specific detections Behavior-based detection for AI usage patterns Model drift and behavior monitoring Autonomous containment Behavior-based detection of model inputs and outputs Prompt injection detection Model manipulation, including jailbreaking, poisoning, and related attacks Sensitive data access attempts Behavior-based detection across low-code agents, high-code agents, MCP clients and servers, endpoint, network, cloud, email, SaaS, SASE, IoT, and OT	Policy enforcement between users, models, tools, agents, SaaS models/tools, and MCP servers/clients Risk, intent, and context evaluation for detections and response actions
Response & Recovery	Autonomous containment AI-assisted playbooks Forensics data capture for AI-related events Model rollback mechanisms Backup and restore for models and datasets	Kill switch for agents Autonomous response to agents performing risky behaviors Model and dataset rollback Remediation plans Tabletop exercises Supplier coordination plans Post-incident AI performance validation

AI security requires continuous visibility and behavioral detection

AI changes how fast systems move, how decisions are made, and how risk propagates. It does not change the fundamentals of security. Organizations that succeed will be the ones that apply those fundamentals rigorously, assume failure, and build systems that can detect, contain, and recover when AI behaves in ways they did not anticipate. Security is not what AI is allowed to do. It is whether the organization can understand, trust, and control what AI actually does in practice.

Take this guidance to understand different initiatives that organizations should be considering. Securing AI is the most critical component to AI safety. As organizations invest more in AI adoption, they should be investing in security in order to mitigate the risk of AI adoption. Organizations should be evaluating their governance and security stack to include well-integrated tools that are deployed, tested, operationalized and embedded within security workflows. While organizations mature in governance, visibility and identity access management, they should be investing in behavior-based detection and autonomous containment to mitigate AI risk.

See how Darktrace / SECURE AI can strengthen the visibility and runtime security layers of your broader AI security program.

[related-resource]

About the author

Blog

AI

August 11, 2026

Reimagining Your SOC: Overcoming Alert Fatigue with AI-Led Investigations

Key takeaways

AI-led investigation can help combat SOC alert fatigue by extending automation beyond detection into triage, contextual analysis, prioritization, and investigation, reducing repetitive analyst work while preserving human judgment for critical security decisions.

Alert fatigue becomes an operational risk when high alert volumes, fragmented context, manual investigation, and limited analyst capacity prevent SOC teams from efficiently assessing potentially meaningful security activity.

Effective alert fatigue solutions should combine automated triage, contextual analysis, intelligent prioritization, and explainable investigation workflows so analysts can understand why activity matters and focus attention on higher-priority incidents.

AI-led investigation can improve SOC efficiency by expanding investigation coverage and freeing analysts from repetitive evidence gathering, creating more capacity for threat hunting, recovery activities, strategic decisions, and proactive cyber risk reduction.

The efficiency of a Security Operations Center (SOC) hinges on its ability to detect, analyze and respond to threats effectively. With advancements in AI and automation, key early SOC team metrics such as Mean Time to Detect (MTTD) have seen significant improvements:

‍96% of defenders believing AI-powered solutions significantly boost the speed and efficiency of prevention, detection, response, and recovery.
Organizations leveraging AI and automation can shorten their breach lifecycle by an average of 108 days compared to those without these technologies.

While tool advances have improved performance and effectiveness in the detection phase, this has not been as beneficial to the next step of the process where initial alerts are investigated further to determine their relevance and how they relate to other activities. This is often measured with the metric Mean Time to Analysis (MTTA), although some SOC teams operate a two-level process with teams for initial triage to filter out more obviously uninteresting alerts and for more detailed analysis of the remainder. SOC teams continue to grapple with alert fatigue, overwhelmed analysts, and inefficient triage processes, preventing them from achieving the operational efficiency necessary for a high-performing SOC.

Addressing this core inefficiency requires extending AI's capabilities beyond detection to streamline and optimize the following investigative workflows that underpin effective analysis.

Challenges with SOC alert investigation

Detecting cyber threats is only the beginning of a much broader challenge of SOC efficiency. The real bottleneck often lies in the investigation process.

Detection tools and techniques have evolved significantly with the use of machine learning methods, improving early threat detection. However, after a detection pops up, human analysts still typically step in to evaluate the alert, gather context, and determine whether it’s a true threat or a false alarm and why. If it is a threat, further investigation must be performed to understand the full scope of what may be a much larger problem. This phase, measured by the mean time to analysis, is critical for swift incident response.

Challenges with manual alert investigation:

Too many alerts
Alerts lack context
Cognitive load sits with analysts
Insufficient talent in the industry
Fierce competition for experienced analysts

For many organizations, investigation is where the struggle of efficiency intensifies. Analysts face overwhelming volumes of alerts, a lack of consolidated context, and the mental strain of juggling multiple systems. With a worldwide shortage of 4 million experienced level two and three SOC analysts, the cognitive burden placed on teams is immense, often leading to alert fatigue and missed threats.

Even with advanced systems in place not all potential detections are investigated. In many cases, only a quarter of initial alerts are triaged (or analyzed). However, the issue runs deeper. Triaging occurs after detection engineering and alert tuning, which often disable many alerts that could potentially reveal true threats but are not accurate enough to justify the time and effort of the security team. This means some potential threats slip through unnoticed.

What are the key stages of detecting and stopping a cyber-attack?

Detecting and stopping a cyber incident involves several connected stages: identifying a trace of suspicious activity, generating a detection, investigating the alert to determine its context and scope, and containing confirmed threats. Each stage affects how quickly a SOC can move from identifying potentially malicious activity to taking effective action.

First we need a trace of an attack…

The attack will produce some sort of digital trace. Novel attacks, insider threats, and attacker techniques such as living-off-the-land can make attacker activities extremely hard to distinguish.

A detection is created…

Then we have to detect the trace, for example some beaconing to a rare domain. Initial detection alerts being raised underpin the MTTD (mean time to detection). Reducing this initial unseen duration is where we have seen significant improvement with modern threat detection tools.

When it comes to threat detection, the possibilities are vast. Your initial lead could come from anything: an alert about unusual network activity, a potential known malware detection, or an odd email. Once that lead comes in, it’s up to your security team to investigate further and determine if this is this a legitimate threat or a false alarm and what the context is behind the alert.

Investigation begins…

It doesn’t just stop at a detection. Typically, humans also need to look at the alert, investigate, understand, analyze, and conclude whether this is a genuine threat that needs a response. We normally measure this as MTTA (mean time to analyze).

Conducting the investigation effectively requires a high degree of skill and efficiency, as every second counts in mitigating potential damage. Security teams must analyze the available data, correlate it across multiple sources, and piece together the timeline of events to understand the full scope of the incident. This process involves navigating through vast amounts of information, identifying patterns, and discerning relevant details. All while managing the pressure of minimizing downtime and preventing further escalation.

Containment begins…

Once we confirm something as a threat, and the human team determines a response is required and understand the scope, we need to contain the incident. That's normally the MTTC (mean time to containment) and can be further split into immediate and more permanent measures.

For more about how AI-led solutions can help in the containment stage read here: Autonomous Response: Streamlining Cybersecurity and Business Operations

The challenge is not only in 1) detecting threats quickly, but also 2) triaging and investigating them rapidly and with precision, and 3) prioritizing the most critical findings to avoid missed opportunities. Effective investigation demands a combination of advanced tools, robust workflows, and the expertise to interpret and act on the insights they generate. Without these, organizations risk delaying critical containment and response efforts, leaving them vulnerable to greater impacts.

While there are further steps (remediation, and of course complete recovery) here we will focus on investigation.

Developing an AI analyst: How Darktrace replicates human investigation

Darktrace has been working on understanding the investigative process of a skilled analyst since 2017. By conducting internal research between Darktrace expert SOC analysts and machine learning engineers, we developed a formalized understanding of investigative processes. This understanding formed the basis of a multi-layered AI system that systematically investigates data, taking advantage of the speed and breadth afforded by machine systems.

With this research we found that the investigative process often revolves around iterating three key steps: hypothesis creation, data collection, and results evaluation.

All these details are crucial for an analyst to determine the nature of a potential threat. Similarly, they are integral components of our Cyber AI Analyst which is an integral component across our product suite. In doing so, Darktrace has been able to replicate the human-driven approach to investigating alerts using machine learning speed and scale.

Here’s how it works:

When an initial or third-party alert is triggered, the Cyber AI Analyst initiates a forensic investigation by building multiple hypotheses and gathering relevant data to confirm or refute the nature of suspicious activity, iterating as necessary, and continuously refining the original hypothesis as new data emerges throughout the investigation.
Using a combination of machine learning including supervised and unsupervised methods, NLP and graph theory to assess activity, this investigation engine conducts a deep analysis with incidents raised to the human team only when the behavior is deemed sufficiently concerning.
After classification, the incident information is organized and processed to generate the analysis summary, including the most important descriptive details, and priority classification, ensuring that critical alerts are prioritized for further action by the human-analyst team.
If the alert is deemed unimportant, the complete analysis process is made available to the human team so that they can see what investigation was performed and why this conclusion was drawn.

Darktrace cyber ai analyst workflow, how it works

To illustrate this via example, if a laptop is beaconing to a rare domain, the Cyber AI Analyst would create hypotheses including whether this could be command and control traffic, data exfiltration, or something else. The AI analyst then collects data, analyzes it, makes decisions, iterates, and ultimately raises a new high-level incident alert describing and detailing its findings for human analysts to review and follow up.

Learn more about Darktrace's Cyber AI Analyst

Cost savings: Equivalent to adding up to 30 full-time Level 2 analysts without increasing headcount
Minimize business risk: Takes on the busy work from human analysts and elevates a team’s overall decision making
Improve security outcomes: Identifies subtle, sophisticated threats through holistic investigations

‍

How does AI-led investigation improve SOC efficiency?

AI-led investigation can improve SOC efficiency by shifting repetitive evidence gathering and triage away from analysts while preserving human judgment for higher-value decisions. The operational benefit is broader investigation coverage, faster prioritization, clearer reasoning, and more analyst time for activities such as threat hunting, recovery, and proactive cyber risk reduction.

Every relevant alert is investigated

The Cyber AI Analyst is not a generative AI system, or an XDR or SEIM aggregator that simply prompts you on what to do next. It uses a multi-layered combination of many different specialized AI methods to investigate every relevant alert from across your enterprise, native, 3^rd party, and manual triggers, operating at machine speed and scale. This also positively affects detection engineering and alert tuning, because it does not suffer from fatigue when presented with low accuracy but potentially valuable alerts.

Retain and improve analyst skills

Transferring most analysis processes to AI systems can risk team skills if they don't maintain or build them and if the AI doesn't explain its process. This can reduce the ability to challenge or build on AI results and cause issues if the AI is unavailable. The Cyber AI Analyst, by revealing its investigation process, data gathering, and decisions, promotes and improves these skills. Its deep understanding of cyber incidents can be used for skill training and incident response practice by simulating incidents for security teams to handle.

Create time for cyber risk reduction

Human cybersecurity professionals excel in areas that require critical thinking, strategic planning, and nuanced decision-making. With alert fatigue minimized and investigations streamlined, your analysts can avoid the tedious data collection and analysis stages and instead focus on critical decision-making tasks such as implementing recovery actions and performing threat hunting.

Stay tuned for part 3/3

Part 3/3 in the Reimagine your SOC series explores the preventative security solutions market and effective risk management strategies.

Coming soon!

About the author

Brittany Woodsmall

Product Marketing Manager, AI

あなたのデータ × DarktraceのAI

唯一無二のDarktrace AIで、ネットワークセキュリティを次の次元へ

デモを予約

Check out this article by Darktrace: How Darktrace Triumphed Over MyKings Botnet

How Darktrace Triumphed Over MyKings Botnet

Botnets: A persistent cyber threat

MyKings Botnet

Background on MyKings Botnet

Darktrace Coverage

Initial Access

Initial Command and Control

Tool Transfer

Achieving Objectives – Crypto-Mining

Conclusion

Appendix

IoC Table

Darktrace DETECT Model Breaches

MITRE ATT&CK Mapping

References

信頼が新たなアタックサーフェスである理由：ダークトレースの2026年度中間脅威アップデート

Securing AI: Analysis of the Complete Security Stack with Governance and Controls

ブログをお楽しみ頂けましたか？

More in this series

9 Stages of Ransomware & How AI Responds

When AI Agents Attack: The Case for Behavioral Anomaly Detection

Hiding in Plain Sight: Uncovering a Multi-Stage Ransomware Attack Through Behavioral Detection

Blog

AI

August 10, 2026

Securing AI: Analysis of the Complete Security Stack with Governance and Controls

Key takeaways

Why traditional cybersecurity approaches are not enough for AI

How NIST defines the three core pillars of AI security

Secure

Defend

Thwart

How this looks in practice

Why agentic AI fundamentally changes enterprise cyber risk

Behavioral risk

Structural risk

Accountability

What is the most effective way to protect enterprise AI?

How security leaders should prepare for enterprise AI adoption

What capabilities should every AI security program include?

Layered Governance and Security Stack for Securing AI

AI security requires continuous visibility and behavioral detection

Blog

AI

August 11, 2026

Reimagining Your SOC: Overcoming Alert Fatigue with AI-Led Investigations

Key takeaways

Challenges with SOC alert investigation

What are the key stages of detecting and stopping a cyber-attack?

First we need a trace of an attack…

A detection is created…

Investigation begins…

Containment begins…

Developing an AI analyst: How Darktrace replicates human investigation

Here’s how it works:

How does AI-led investigation improve SOC efficiency?

Every relevant alert is investigated

Retain and improve analyst skills

Create time for cyber risk reduction

Stay tuned for part 3/3