ブログ
/
Network
/
November 7, 2022

[Part 1] Analysis of a Raccoon Stealer v1 Infection

Darktrace’s SOC team observed a fast-paced compromise involving Raccoon Stealer v1. See which steps the Raccoon Stealer v1 took to extract company data!
Written by
Mark Turner
SOC Shift Supervisor
Written by
Sam Lister
Specialist Security Researcher
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Mark Turner
SOC Shift Supervisor
Written by
Sam Lister
Specialist Security Researcher
Default blog image
07
Nov 2022

Introduction

Towards the end of March 2022, the operators of Raccoon Stealer announced the closure of the Raccoon Stealer project [1]. In May 2022, Raccoon Stealer v2 was unleashed onto the world, with huge numbers of cases being detected across Darktrace’s client base. In this series of blog posts, we will follow the development of Raccoon Stealer between March and September 2022. We will first shed light on how Raccoon Stealer functioned before its demise, by providing details of a Raccoon Stealer v1 infection which Darktrace’s SOC saw within a client network on the 18th March 2022. In the follow-up post, we will provide details about the surge in Raccoon Stealer v2 cases that Darktrace’s SOC has observed since May 2022.  

What is Raccoon Stealer?

The misuse of stolen account credentials is a primary method used by threat actors to gain initial access to target environments [2]. Threat actors have several means available to them for obtaining account credentials. They may, for example, distribute phishing emails which trick their recipients into divulging account credentials. Alternatively, however, they may install information-stealing malware (i.e, info-stealers) onto users’ devices. The results of credential theft can be devastating. Threat actors may use the credentials to gain access to an organization’s SaaS environment, or they may use them to drain users’ online bank accounts or cryptocurrency wallets. 

Raccoon Stealer is a Malware-as-a-Service (MaaS) info-stealer first publicized in April 2019 on Russian-speaking hacking forums. 

Figure 1: One of the first known mentions of Raccoon Stealer on a Russian-speaking hacking forum named ‘Hack Forums’ on the 13th April 2019

The team of individuals behind Raccoon Stealer provide a variety of services to their customers (known as ‘affiliates’), including access to the info-stealer, an easy-to-use automated backend panel, hosting infrastructure, and 24/7 customer support [3]. 

Once Raccoon Stealer affiliates gain access to the info-stealer, it is up to them to decide how to distribute it. Since 2019, affiliates have been observed distributing the info-stealer via a variety of methods, such as exploit kits, phishing emails, and fake cracked software websites [3]/[4]. Once affiliates succeed in installing Raccoon Stealer onto target systems, the info-stealer will typically seek to obtain sensitive information saved in browsers and cryptocurrency wallets. The info-stealer will then exfiltrate the stolen data to a Command and Control (C2) server. The affiliate can then use the stolen data to conduct harmful follow-up activities. 

Towards the end of March 2022, the team behind Raccoon Stealer publicly announced that they would be suspending their operations after one of their core developers was killed during the Russia-Ukraine conflict [5]. 

Figure 2: Raccoon Stealer resignation post on March 25th 2022

Recent details shared by the US Department of Justice [6]/[7] indicate that it was in fact the arrest, rather than the death, of a key Raccoon Stealer operator which led the Raccoon Stealer team to suspend their operations [8].  

The closure of the Raccoon Stealer project, which ultimately resulted from the FBI-backed dismantling of Raccoon Stealer’s infrastructure in March 2022, did not last long, with the completion of Raccoon Stealer v2 being announced on the Raccoon Stealer Telegram channel on the 17th May 2022 [9]. 

 

Figure 3: Telegram post about new version of Raccoon Stealer

In the second part of this blog series, we will provide details of the recent surge in Raccoon Stealer v2 activity. In this post, however, we will provide insight into how the old version of Raccoon Stealer functioned just before its demise, by providing details of a Raccoon Stealer v1 infection which occurred on the 18th March 2022. 

Attack Details

On the 18th March, at around 13:00 (UTC), a user’s device within a customer’s network was seen contacting several websites providing fake cracked software. 

Figure 4: The above figure — obtained from the Darktrace Event Log for the infected device — highlights its connections to cracked software websites such as ‘licensekeysfree[.]com’ and ‘hdlicense[.]com’ before contacting ‘lion-files[.]xyz’ and ‘www.mediafire[.]com’

The user’s attempt to download cracked software from one of these websites resulted in their device making an HTTP GET request with a URI string containing ‘autodesk-revit-crack-v2022-serial-number-2022’ to an external host named ‘lion-filez[.]xyz’

Figure 5: Screenshot from hdlicense[.]com around the time of the infection shows a “Download” button linking to the ‘lion-filez[.]xyz’ endpoint

The device’s HTTP GET request to lion-filez[.]xyz was immediately followed by an HTTPS connection to the file hosting service, www.mediafire[.]com. Given that threat actors are known to abuse platforms such as MediaFire and Discord CDN to host their malicious payloads, it is likely that the user’s device downloaded the Raccoon Stealer v1 sample over its HTTPS connection to www.mediafire[.]com.  

After installing the info-stealer sample, the user’s device was seen making an HTTP GET request with the URI string ‘/g_shock_casio_easy’ to 194.180.191[.]185. The endpoint responded to the request with data related to a Telegram channel named ‘G-Shock’.

Figure 6: Telegram channel ‘@g_shock_casio_easy’

The returned data included the Telegram channel’s description, which in this case, was a base64 encoded and RC4 encrypted string of characters [10]/[11]. The Raccoon Stealer sample decoded and decrypted this string of characters to obtain its C2 IP address, 188.166.49[.]196. This technique used by Raccoon Stealer v1 closely mirrors the espionage method known as ‘dead drop’ — a method in which an individual leaves a physical object such as papers, cash, or weapons in an agreed hiding spot so that the intended recipient can retrieve the object later on without having to come in to contact with the source. In this case, the operators of Raccoon Stealer ‘left’ the malware’s C2 IP address within the description of a Telegram channel. Usage of this method allowed the operators of Raccoon Stealer to easily change the malware’s C2 infrastructure.  

After obtaining the C2 IP address from the ‘G-Shock’ Telegram channel, the Raccoon Stealer sample made an HTTP POST request with the URI string ‘/’ to the C2 IP address, 188.166.49[.]196. This POST request contained a Windows GUID,  a username, and a configuration ID. These details were RC4 encrypted and base64 encoded [12]. The C2 server responded to this HTTP POST request with JSON-formatted configuration information [13], including an identifier string, URL paths for additional files, along with several other fields. This configuration information was also concealed using RC4 encryption and base64 encoding.  

Figure 7- Fields within the JSON-formatted configuration data [13]

In this case, the server’s response included the identifier string ‘hv4inX8BFBZhxYvKFq3x’, along with the following URL paths:

  • /l/f/hv4inX8BFBZhxYvKFq3x/77d765d8831b4a7d8b5e56950ceb96b7c7b0ed70
  • /l/f/hv4inX8BFBZhxYvKFq3x/0cb4ab70083cf5985b2bac837ca4eacb22e9b711
  • /l/f/hv4inX8BFBZhxYvKFq3x/5e2a950c07979c670b1553b59b3a25c9c2bb899b
  • /l/f/hv4inX8BFBZhxYvKFq3x/2524214eeea6452eaad6ea1135ed69e98bf72979

After retrieving configuration data, the user’s device was seen making HTTP GET requests with the above URI strings to the C2 server. The C2 server responded to these requests with legitimate library files such as sqlite3.dll. Raccoon Stealer uses these libraries to extract data from targeted applications. 

Once the Raccoon Stealer sample had collected relevant data, it made an HTTP POST request with the URI string ‘/’ to the C2 server. This posted data likely included a ZIP file (named with the identifier string) containing stolen credentials [13]. 

The observed infection chain, which lasted around 20 minutes, consisted of the following steps:

1. User’s device installs Raccoon Stealer v1 samples from the user attempting to download cracked software

2. User’s device obtains the info-stealer’s C2 IP address from the description text of a Telegram channel

3. User’s device makes an HTTP POST request with the URI string ‘/’ to the C2 server. The request contains a Windows GUID,  a username, and a configuration ID. The response to the request contains configuration details, including an identifier string and URL paths for additional files

4. User’s device downloads library files from the C2 server

5. User’s device makes an HTTP POST request with the URI string ‘/’ to the C2 server. The request contains stolen data

Darktrace Coverage 

Although RESPOND/Network was not enabled on the customer’s deployment, DETECT picked up on several of the info-stealer’s activities. In particular, the device’s downloads of library files from the C2 server caused the following DETECT/Network models to breach:

  • Anomalous File / Masqueraded File Transfer
  • Anomalous File / EXE from Rare External Location
  • Anomalous File / Zip or Gzip from Rare External Location
  • Anomalous File / EXE from Rare External Location
  • Anomalous File / Multiple EXE from Rare External Locations
Figure 8: Event Log for the infected device shows 'Anomalous File / Masqueraded File Transfer' model breach after the device's download of a library file from the C2 server

Since the customer was subscribed to the Darktrace Proactive Threat Notification (PTN) service, they were proactively notified of the info-stealer’s activities. The quick response by Darktrace’s 24/7 SOC team helped the customer to contain the infection and to prevent further damage from being caused. Having been alerted to the info-stealer activity by the SOC team, the customer would also have been able to change the passwords for the accounts whose credentials were exfiltrated.

If RESPOND/Network had been enabled on the customer’s deployment, then it would have blocked the device’s connections to the C2 server, which would have likely prevented any stolen data from being exfiltrated.

Conclusion

Towards the end of March 2022, the team behind Raccoon Stealer announced that they would be suspending their operations. Recent developments suggest that the arrest of a core Raccoon Stealer developer was responsible for this suspension. Just before the Raccoon Stealer team were forced to shut down, Darktrace’s SOC team observed a Raccoon Stealer infection within a client’s network. In this post, we have provided details of the network-based behaviors displayed by the observed Raccoon Stealer sample. Since these v1 samples are no longer active, the details provided here are only intended to provide historical insight into the development of Raccoon Stealer’s operations and the activities carried out by Raccoon Stealer v1 just before its demise. In the next post of this series, we will discuss and provide details of Raccoon Stealer v2 — the new and highly prolific version of Raccoon Stealer. 

Thanks to Stefan Rowe and the Threat Research Team for their contributions to this blog.

References

[1] https://twitter.com/3xp0rtblog/status/1507312171914461188

[2] https://www.gartner.com/doc/reprints?id=1-29OTFFPI&ct=220411&st=sb

[3] https://www.cybereason.com/blog/research/hunting-raccoon-stealer-the-new-masked-bandit-on-the-block

[4] https://www.cyberark.com/resources/threat-research-blog/raccoon-the-story-of-a-typical-infostealer

[5] https://www.bleepingcomputer.com/news/security/raccoon-stealer-malware-suspends-operations-due-to-war-in-ukraine/

[6] https://www.justice.gov/usao-wdtx/pr/newly-unsealed-indictment-charges-ukrainian-national-international-cybercrime-operation

[7] https://www.youtube.com/watch?v=Fsz6acw-ZJY

[8] https://riskybiznews.substack.com/p/raccoon-stealer-dev-didnt-die-in

[9] https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d

[10] https://blog.cyble.com/2021/10/21/raccoon-stealer-under-the-lens-a-deep-dive-analysis/

[11] https://decoded.avast.io/vladimirmartyanov/raccoon-stealer-trash-panda-abuses-telegram/

[12] https://blogs.blackberry.com/en/2021/09/threat-thursday-raccoon-infostealer

[13] https://cyberint.com/blog/research/raccoon-stealer/

Appendices

執筆者
Mark Turner
SOC Shift Supervisor
執筆者
Sam Lister
Specialist Security Researcher
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Mark Turner
SOC Shift Supervisor
Written by
Sam Lister
Specialist Security Researcher

中国系APTキャンペーン、アップデートされたFDMTPバックドアで企業を狙う

Network
•
May 14, 2026
Tara Gould
Malware Research Lead
Watch the NIS2 Webinar
よく読まれているブログ
1
ダークトレース、2026年度Gartner® CPS Protection Platforms部門のMagic Quadrant™ において唯一のVisionaryの評価を受ける
Mar 20, 2026
2
How Empowering End Users can Improve Your Email Security and Decrease the Burden on the SOC
May 8, 2024
3
Elevating Network Security: Confronting Trust, Ransomware, & Novel Attacks
Jun 21, 2024
4
The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners
Apr 9, 2024
5
The State of AI in Cybersecurity: The Impact of AI on Cybersecurity Solutions
May 13, 2024

More in this series

No items found.
さらに読む
Network
•
May 21, 2026

Darktrace named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) For the Second Consecutive Year

Darktrace has been named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) for the second consecutive year. We believe this reflects continued execution in NDR, ongoing AI innovation, and strong outcomes delivered for customers globally.
Mikey Anderson
Product Marketing Manager, Network Detection & Response
Read more
Network
•
May 19, 2026

When Open Source Is Weaponized: Analysis of a Trojanized 7 Zip Installer

Attackers abused a trojanized 7‑Zip installer distributed via a typo‑squatted domain to establish proxyware infections worldwide. This blog analyzes how social engineering, trusted open‑source software, and stealthy command‑and‑control activity enabled widespread compromise, highlighting the importance of software validation, user awareness, and proactive network‑level detection.
Justin Torres
Cyber Analyst
Read more
Network
•
May 14, 2026

中国系APTキャンペーン、アップデートされたFDMTPバックドアで企業を狙う

ダークトレースの研究者はTwill Typhoonに関連するAPJ地域の顧客を標的とした中国系攻撃キャンペーンを特定しました。 観測されたアクティビティには、CDNなりすまし、正規のバイナリ、DLL サイドローディングによる .NET RATの展開が含まれていました。
Tara Gould
Malware Research Lead
Read more

Blog

/

Proactive Security

/

June 2, 2026

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

Default blog imageDefault blog image

Núclea is a Brazilian data and technology company that supports the country’s financial system by delivering digital services exclusively to banks and financial institutions. Operating in an environment where trust, availability, and data integrity are critical, the company faces a threat landscape that has evolved rapidly—particularly with the rise of AI-driven cyberattacks.

Brazil has experienced a wave of successful cyber incidents targeting financial institutions, many of them enabled by insiders or compromised credentials. The result was a noticeable shift in attacker strategy: instead of focusing on end customers, threat actors began targeting the institutions and platforms that underpin the financial ecosystem itself.

“Attacks became far more directed and contextual,” explains Guilherme, who leads incident response within Núclea’s security platform engineering team. “They weren’t noisy or obviously malicious—they were precise, patient, and designed to blend into normal operations.”

That precision was on full display in January 2026, when Núclea faced one of the most convincing phishing attacks the team had seen.

A real attack, built on trust and context

The attack began with a seemingly routine email.

It was sent from a real Brazilian government institution, using legitimate infrastructure and valid credentials that were later confirmed to have been compromised. Núclea had an established, ongoing relationship with this organization, and the email’s language, tone, and subject matter aligned perfectly with the type of communication the recipient team handled every day.

Attached to the email was a PDF document containing content that looked entirely legitimate.

The problem? A single URL embedded inside that PDF.

“The message itself was correct. The sender was real. The context was familiar. Even the document content made sense,” Guilherme explains. “There was just one small element that didn’t belong.”

That small detail was enough to initiate a full attack chain.

What the attackers were trying to do

If clicked, the URL would have downloaded a malicious payload designed to:

  • Collect information about the user and device
  • Identify where the system was located within the financial ecosystem
  • Install remote access tools to maintain control
  • Deploy an infostealer to extract sensitive data
  • Execute anti-forensic scripts to erase traces of the intrusion

In other words, it was a carefully engineered operation designed for persistence and stealth, not immediate disruption.

The attack also employed urgency—a classic social engineering technique. When the link didn’t open as expected, employees requested assistance from the security team, insisting the document was important and needed to be accessed quickly.

This is precisely the kind of scenario where traditional security tools struggle: almost everything about the interaction is legitimate.

Where Darktrace made the difference

Instead of blocking the entire message or relying on known indicators of compromise, Darktrace focused on behavioral context.

Darktrace recognized:

  • That the sending organization was normally trusted
  • That the communication pattern matched historical behavior
  • That the PDF content itself was not suspicious

But it also identified that the URL embedded within the document deviated from established behavioral patterns.

Rather than disrupting business operations, Darktrace took precise action: it rewrote the URL, preventing the malicious download while leaving the rest of the email untouched.

“When we analyzed it afterward, it became clear how dangerous the attack would have been,” says Guilherme. “But it never progressed—because Darktrace acted at exactly the right point.”

Subsequent forensic analysis confirmed the payload’s malicious intent. The attack never succeeded.

Precision over disruption

For Núclea, this incident reinforced a critical lesson: modern attacks don’t always look malicious—they hide within normal activity.

“What stands out to me is the precision,” Guilherme says. “Darktrace doesn’t rely on big, obvious signals. It’s effective in situations that fall outside the standard patterns we all know.”

Building resilience in a high trust ecosystem

For Núclea, cybersecurity is not just a defensive measure—it’s a business enabler.

Availability failures or successful breaches in the financial ecosystem can have immediate, large-scale consequences, from financial loss to reputational damage. Preventing those outcomes protects not just Núclea, but its partners and customers as well.

“Cyber resilience means keeping the business running—even under attack,” Guilherme explains. “And that requires people, processes, and technology working together.”

As AI continues to accelerate both attacks and defenses, the role of security is evolving. Precision, behavioral understanding, and intelligent automation are no longer optional—they’re essential.

“The easy days were yesterday,” Guilherme says. “The challenges ahead are bigger. We need to be prepared—internally and with partners that help us build resilience.”

‍

‍

Continue reading
About the author

Blog

/

AI

/

June 1, 2026

効率化の裏にあるリスク：AI導入が製造現場にもたらす見えない脆弱性

Default blog imageDefault blog image

AIエージェントが製造業に与える影響

製造業界のセキュリティチームやIT担当者は、生産を守り、稼働時間を維持し、重要資産を保護するという絶え間ないプレッシャー下にあります。そしてAIは非常に大きなチャンスとともに、新たなサイバーリスクももたらしています。製造業全体で、AIはワークフローや意思決定に組み込まれつつあり、自律型AIエージェントが従業員やシステムに代わって行動する場面が増えています。

エージェント型システムは独立して行動できるため強力ですが、その同じ自律性がサイバーリスク、運用上のリスクも生み出します。エージェントは広範な権限を持ち、複雑なタスクの実行、意思決定、ツールや外部システムとのやり取りを、ほとんどまたは全く人間の介入なしに行うことができます。

あらかじめ定義されたタスクを実行する従来のAIモデルとは異なり、AIエージェントは高度なテクニックを使用して人間の意思決定プロセスを模倣することにより、新たな課題に動的に適応し、また自らの判断に基づいて意思決定し、アクションを実行します。彼らは業務の上では従業員のように見えますが、人間が持つ判断力、倫理観、または行動の結果に対する恐れが欠けています。これは、サイバー犯罪者によって簡単に操られる可能性があることを意味しており、OTネットワーク全体に埋め込まれたAIエージェントは、データ漏洩をはるかに超える脅威を生み出します。たとえば、BMWでは、AI は溶接プロセスのエラーの発生を識別するのに使われています。同社のスパータンバーグ（米サウスカロライナ州）の工場では、すべてのSUVフレーム上の300-400個のスタッドの溶接をAIが監視し、スタッドの配置間違いや欠陥を検知し直ちに修正します。このAIシステムが破損すれば壊滅的な品質管理問題につながる恐れがあります。

製造全体にエージェント型AIシステムを導入することについて多くのセキュリティチームはさまざまな懸念を示しています。ダークトレースの行ったAIサイバーセキュリティの現状調査では、製造業のセキュリティプロフェッショナルの78%が従業員によるAIエージェントの利用に懸念を抱いており、これは彼らの最も大きな危惧でした。それに続く問題点が従業員によるCopilotやChatGPT等の生成AIツールの使用であり、製造業のセキュリティプロフェッショナルの76%が懸念を抱いていました。これらのツールがますます多くのビジネスデータやプロセスにアクセスし、組織内でより多くの自律性を持つようになるにつれ、エージェントのアクティビティがほとんど可視化されていない現在、セキュリティチームにおいては機密データの露出（60%）や偶発的なポリシーおよび規制違反（59%）への懸念が高まっています。

外部からのAIによる脅威も急激に進化

製造業を変革しているのと同じAIの能力が、サイバー攻撃の形も変貌させています。

AIにより攻撃者は偵察を自動化し、標的をより高度に絞り込み、リアルタイムで適応できるようになっています。かつては人手による作業と時間を要していたことが、今では継続的かつ大規模に実行できるようになりました。そして、製造業はすでにその影響を実感しています。当社が調査した製造業のセキュリティプロフェッショナルの76%は、すでにAIを活用した脅威の影響を受けており、90%がAIによってソーシャルエンジニアリング攻撃の成功率が高まっていると回答しています。

また、攻撃のテクニック自体も進化しています。製造業界全体で、AIを利用した攻撃の経路の多様化に対する懸念が高まっています。特にリアルタイムで進化する適応型マルウェアについて、調査対象の製造業のセキュリティプロフェッショナルの半数近く（49%）が懸念しており、これは全産業の平均よりも9%高い数値です。AIを使った適応型マルウェアに続くその他の懸念には次が含まれます：

  • 自動化された脆弱性スキャンとエクスプロイトチェイニング（48%）：Anthropicの新しいMythos AIモデルにより脆弱性探索が深刻化する中で、この問題は一層差し迫ったものとなっています。
  • 超パーソナライズされたフィッシングキャンペーン（46%）：フィッシングは依然としてハッカーの主力兵器の1つであり、AIによってフィッシングメールはより説得力が高く検知困難なものとなり、その効果は増幅されました。

これは単に攻撃の量の増加だけでなく、攻撃の展開につれて静的な防御が対応できるよりも速く進化する脅威への変化なのです。

こうした認識が高まっているにもかかわらず、製造業の多くはまだこの変化に対応する準備ができていません。半数以上（51%）がAI駆動の脅威への準備が十分にできていないと回答し、AIの導入を管理する正式なポリシーを持っている組織はわずか37%でした。  

可視性、コンテキスト、およびガードレールを通じてAIのセキュリティを確保

これらの問題に対処するためにAIイノベーションを遅らせる必要はありません。それには、AIと同じスピードと規模で動作できる、これまでとは異なるアプローチのセキュリティが必要です。具体的には、製造業がAIの力を活用する上で、次の3つの優先課題が浮上しています。

可視性はすべての土台  

AIがどこで使用されているか、何にアクセスできるか、そしてITおよびOT環境にわたってどのように動作するかを理解する必要があります。それがなければ、リスクを測定したり管理したりすることはできません。ダークトレースの調査において、製造業のセキュリティプロフェッショナルの91%が、AIを信頼する前に、それがどのように意思決定を行うかを理解する必要があると回答したのは当然のことです。OT環境においてこのことはさらに重要です。稼働の中断は安全や環境、財務、および評判に大きな影響を及ぼすからです。

可視性をアクションにつなげるにはコンテキストが必要  

AIによって形作られる環境において、正常とされる挙動は絶えず変化します。つまり、脅威を検知するにはビヘイビアベースのアプローチが必要なのです。組織全体で生活パターンを理解し、わずかな逸脱をリアルタイムに検知すること－ これは従来のセキュリティとリスク管理に対するアプローチからの根本的な変化です。

エージェントからの露出を防ぐガードレール  

AIシステムがより大きな責任を担うようになるなかで、組織はAIが何をできるか、そしていつ独立して行動できるかについて、明確な境界を設ける必要があります。これらのコントロールは何かがあってから適用されるのではなく、システム自体に組み込んでおかなければなりません。  

製造業のITおよびOT環境におけるAIエージェントのセキュリティ

エージェント型AIの出現は製造業を変革し、次世代のオペレーションを支える一方で、脅威ランドスケープも一変させています。これは単なる脅威の増加ではなく、自律型システムへの移行、挙動の絶え間ない変化、そしてマシンスピードで進行するリスクです。AIを活用しつつリスクを管理するという課題に取り組む組織にとって、可視性、コンテキスト、ガードレールはセキュリティの基盤となります。

Darktraceはこの基盤を実現することにより、製造業の安全なAIアプローチ構築を支援します。ITおよびOT環境全体を可視化し、異常なアクティビティに対するリアルタイムの検知および対応を提供することにより、従業員が使用するプロンプトや構築するエージェントから、それらのエージェントの環境全体での動作に至るまで、AIアクティビティの理解を可能にします。これにより、AIの導入を拡大する製造業はコントロールを犠牲にすることなくイノベーションの基盤を構築することができます。

Continue reading
About the author
Dr. Oakley Cox-Robinson
Senior Director of Product
あなたのデータ × DarktraceのAI
唯一無二のDarktrace AIで、ネットワークセキュリティを次の次元へ