Key Insights
- Darktrace identified behavioral indicators associated with two campaigns linked to AI-assisted threat activity, highlighting the growing role of AI in modern cyber-attacks.
- Observed activity involved suspicious WebDAV file transfers, disguised executable downloads, beaconing to rare infrastructure, unusual process execution, and communications with C2 infrastructure linked to active intrusion campaigns.
Introduction
Just as organizations are incorporating AI into their operations to take advantage of its benefits, threat actors are doing the same, creating new challenges for defenders.
Much of the discussion around AI risk has focused on the expanding attack surface created by AI systems within organizations. These systems are often granted privileged access and heightened permissions to carry out their duties, introducing new security risks and unintended consequences.
At the same time, threat actors are learning to leverage AI to enable malicious activities such as vulnerability discovery, exploit creation, and progressing through the Cyber Kill Chain more quickly. By accelerating development, adaptation, and scaling, AI enables attackers to operate more efficiently while making some capabilities more accessible to less skilled operators.
Whether AI is the target or the enabler, the resulting activity still manifests through networks, identities, endpoints and cloud services. Those interactions create observable signals that defenders can investigate, regardless of how the attack was developed.
AI as part of the attacker’s workflow
Darktrace has previously documented how threat actors are increasingly incorporating AI into offensive operations [1]. Two recent investigations from open-source intelligence (OSINT) illustrate this. In both cases, researchers identified the role of AI within malicious operations. Separately, Darktrace detected activity in customer environments that aligned with the infrastructure and techniques reported in those campaigns. These perspectives provide a view of both attacker workflow and operational consequences.
Although AI played different roles in each campaign, it did not remove the need for the attackers to interact with their targets. Payloads still had to be delivered, processes executed, and command-and-control (C2) connections established, creating behavioral anomalies that Darktrace was able to identify.
Case 1: A Mexican government impersonation campaign with LLM-assisted malware development
Rapid7 reported on a malware delivery operation that used generative AI to assist development, testing, documentation and refinement of attacker infrastructure. Between May and June 2026, Darktrace similarly observed two chains of suspicious activity across customer environments in the Americas that exhibited clear similarities in behavior.
In both cases Darktrace observed:
- WebDAV communication with onedrive[.]cv·138.124.123[.]87, retrieving a file from the path /Downloads/CURP/
- Transfer of a masqueraded .scr executable
- Subsequent communication with google.services[.]ug·77.110.127[.]205 over unusual high ports
- Additional Darktrace detections correlating the unusual behavior seen spanning payload delivery and C2 communication
- Darktrace’s Autonomous Response capability alerted across multiple stages of the attack
The infrastructure and behavior observed by Darktrace closely aligned with a campaign reported by Rapid7, in which a WebDAV malware delivery environment was exposed. Rapid7 assessed that threat actors had used generative AI to support the development, testing, documentation and refinement of the operation. The observed activity also aligned with reporting on a campaign in which impersonation of Mexico’s government Unique Population Registry Code (CURP) identity-record service led to delivery of PureRAT, a .NET-based information stealer and remote access trojan (RAT) [2]. The infrastructure overlap and consistent behavioural sequence provides strong alignment and offers a view of how an AI-assisted development pipeline ultimately manifested inside target environments.
Case 2: A suspected China-linked intrusion campaign with AI-assisted automation
In July 2026, Hunt.io published research into a suspected China-based intrusion operation targeting government and financial services organizations [3]. Material recovered from exposed attacker infrastructure by Hunt.io indicated that Claude Code and DeepSeek-v4-pro were being used as active components of the attacker’s workflow. According to the research, the models supported activities including attack reasoning, script generation, execution, exploit adaptation, and phishing-page development.
The investigation identified 192.229.115[.]229 and 192.229.115[.]230 as infrastructure associated with suspected TencShell operations and a possible second C2 framework known as Gshell [3].
Darktrace identified likely related activity within a financial services customer environment involving a newly observed laptop running the Windows 11 Pro operating system. Over a six-day period in July, the device made repeated outbound connections to 192.229.115[.]229 over port 8083.
Darktrace recognized the destination was highly rare for the environment, and the connectivity exhibited beaconing characteristics. During the same timeframe, Darktrace also identified suspicious process behavior associated with process chains involving svchost.exe and cmd.exe. The device repeatedly communicated with infrastructure identified in the Hunt.io research while exhibiting beaconing characteristics and suspicious process activity, strengthening the assessment that the activity likely was associated with the same operation.
Unlike many previous examples of AI-assisted cybercrime, the Hunt.io investigation provided rare visibility into how large language models were being incorporated directly into operational workflows rather than being used solely for content generation. Darktrace, meanwhile, observed how activity associated with that operation ultimately manifested inside a target environment, providing a complementary view of its operational impact.
Operational consequences of AI-assisted attacks
These investigations provide two complementary perspectives on AI-assisted cyber operations. OSINT research revealed how AI was incorporated into attacker workflows, while Darktrace observed the resulting activity within customer environments.
Although AI played different roles in each campaign, it did not remove the need for attackers to interact with their targets, deliver payloads, execute processes, and communicate with C2, all of which generated observable signals.
In these cases, Darktrace identified suspicious file delivery, unusual process behavior, beaconing activity, and communication with rare external infrastructure that aligned with campaigns later linked to AI-assisted operations. While AI may influence how attacks are developed, adapted, and scaled, it does not make them operationally invisible.
For defenders, the broader lesson extends beyond these specific campaigns. As AI becomes increasingly embedded within both enterprise operations and attacker workflows, understanding what a model was asked to do is often less important than understanding the actions it ultimately took and the consequences those actions produced. Whether the actor is human, AI-assisted, or increasingly autonomous, activity still manifests through identities, endpoints, applications, cloud services and network infrastructure.
Credit to Angel Arribas Lopez (Associate Principal Cyber Analyst), Emma Foulger (Global Threat Research Operations Lead), Nathaniel Jones, SVP Global Threat Intelligence
Edited by Ryan Traill (Content Manager)
Appendices
Darktrace Model Detections
Case 1
Anomalous File / Masqueraded File Transfer from New External Endpoint
Anomalous File / Script from Rare External Location
Anomalous File / EXE from Rare External Location
Anomalous File / Script and EXE from Rare External
Anomalous Connection / Multiple Failed Connections to Rare Endpoint
Anomalous Connection / Rare External SSL Self-Signed
Compromise / New or Repeated to Unusual SSL Port
Compromise / Large Number of Suspicious Failed Connections
Device / Initial Attack Chain Activity
Antigena / Network / External Threat::Antigena Suspicious File Block
Antigena / Network / Significant Anomaly::Antigena Enhanced Monitoring from Client Block
Antigena / Network / Significant Anomaly::Antigena Controlled and Model Alert
Antigena / Network / External Threat::Antigena File then New Outbound Block
Antigena / Network / Significant Anomaly::Antigena Significant Anomaly from Client Block
Antigena / Network / Significant Anomaly::Antigena Alerts Over Time Block
Case 2
Anomalous Connection / Multiple Failed Connections to Rare Endpoint
Compromise / High Volume of Connections with Beacon Score
Compromise / Large Number of Suspicious Failed Connections
Indicators of Compromise (IoCs)
Case 1
| IoC |
Type |
Description + Confidence |
| onedrive[.]cv |
Hostname |
Likely C2 server |
| 138.124.123[.]87 |
IP Address |
Possible C2 server |
| hXXp://onedrive[.]cv/Downloads/CURP/ReportFinal.%E2%80%AE%E1%BA%9D%D4%81%EF%BD%90.scr |
URI |
Possible payload |
| google.services[.]ug |
Hostname |
Likely C2 server |
| 77.110.127[.]205 |
IP Address |
Likely C2 server |
| google.services[.]ug:57666 |
Hostname + Port |
Likely C2 communication |
| google.services[.]ug:57888 |
Hostname + Port |
Likely C2 communication |
| google.services[.]ug:56001 |
Hostname + Port |
Likely C2 communication |
Case 2
| IoC |
Type |
Description + Confidence |
| 192.229.115[.]229 |
IP Address |
Likely C2 communication |
.avif)
.avif)
