Introduction

In enterprise environments, non-compliant software traffic can introduce unexpected exposure by creating unmanaged paths for outbound connectivity. Hola VPN is a notable example because of its peer-to-peer design, which can effectively turn user devices into routing or exit nodes for other parties’ traffic, shifting the risk profile from that of a traditional virtual private network (VPN) to something closer to a distributed proxy.

As a result, the appearance of Hola-related activity, whether from prior installation or unintended background connections, should be treated with caution.  Such activity may provide a foothold for malicious behavior, including lateral movement or command-and-control communication.

This blog explores how Hola-associated activity appeared as part of broader patterns of suspicious behavior observed across the Darktrace customer base.

The campaign

In February and March 2026, Darktrace observed similar anomalous activity across multiple customer environments, with affected devices showing consistent behavioral patterns. These included connections to multiple *.hola[.]org endpoints using Hola-related user agents, suggesting interaction with Hola infrastructure rather than isolated or incidental traffic.

Following these connections, affected customer environments showed downloads of suspicious executable files from rare external endpoints 188.241.219[.]55 and 184.241.218[.]111. Both endpoints have been flagged as potentially malicious by open-source intelligence (OSINT) [1][2].

These downloads were conducted using consistent user agents across impacted customers, specifically ‘Hola svc_js_win32/1.249.408’ and ‘Hola svc_js_win32/1.251.389’, suggesting a possible association with Hola-related activity.

Notably, this pattern aligns with recent reporting that, in some cases, Hola distributed an undeclared executable component, me[.]exe, which was later assessed to be a likely Monero-mining binary introduced via a compromised delivery pipeline [3].

Case Study 1

Darktrace first observed a new device on January 19, 2026, within a customer environment based in the Europe, Middle East, and Africa (EMEA) region. On the same day it appeared on the network, the device communicated with multiple pieces of Hola VPN-linked infrastructure before downloading a binary from a hola[.]org subdomain.

Subsequent Darktrace telemetry revealed a recurring pattern of activity from the day the device was first observed through to March 4, 2026. During this period, the device repeatedly issued HTTP GET requests to the URI /bwfile?size=1048576, each returning a 200 OK response, indicating successful file retrieval.

This behavior was accompanied by a POST request to /bwfile, followed by an additional GET request for a significantly larger file at /bwfile?size=26214400, suggesting a deliberate and structured file transfer pattern.

Notably, the binary download activity was not tied to a single static host. Instead, it was observed across multiple URLs that changed over time while remaining within the same hola[.]org domain. This pattern suggests the use of rotating or distributed delivery infrastructure rather than a fixed endpoint.

Across these events, the activity was consistently associated with the user agent Hola svc_js_win32/1.249.408, further linking the traffic to Hola-related service components. Amid these persistent and unusual connections, on February 22, Darktrace observed the device connecting to 188.241.219[.]55/proxy-peer-windows-amd64[.]exe, resulting in the download of an executable file.

Based on its file hash, the downloaded file was assessed as a likely Trojan downloader [4], with import hash (imphash) values showing similarities to samples linked to Vidar, Rhadamanthys, and Stealc according to OSINT [5]. Overall, this sequence of activity suggests that Hola-related connectivity may have been leveraged as part of a broader malware delivery chain.

Darktrace’s Autonomous Response

Due to the highly unusual activity observed, Darktrace Autonomous Response was triggered by the device’s behavior. However, as the customer deployment was configured in “Human Confirmation” mode, manual approval was required before any action could be taken.

Had the deployment been set to “Fully Autonomous” mode, Darktrace would have automatically:

1. Blocked connections to the associated ports and external endpoints
2. Prevented all outgoing network connections from the device
3. Enforced the device’s established ‘pattern of life’, allowing normal activity to continue while restricting any anomalous behavior

Case Study 2

While the first case focused on anomalous activity from a newly observed device, Darktrace also identified cases in which devices had already been communicating with Hola-related endpoints prior to the suspected campaign. This may suggest pre-existing Hola usage within the environment, potentially increasing exposure and creating an avenue for subsequent suspicious activity.

One case involved three devices within a customer network based in the Americas (AMS). In this instance, a different payload was identified: me[.]exe, a potentially malicious cryptocurrency miner also referred to as HolaMonitorService[.]exe [6][7]. The downloads were observed from infrastructure similar to that seen in Case 1, including an IP address within the same 188.241.0.0/16 subnet.

Connections to *.hola[.]org, alongside the use of potential Hola-related user agents consistent with those in Case 1, were also identified, further suggesting a link between the observed activity and Hola-associated infrastructure.

Darktrace observed activity indicative of unusual VPN usage on the first affected device on February 2, followed by telemetry suggesting potential Tor usage. This was later followed by the download of me[.]exe on March 10 from 188.241.218[.]111. Notably, this device was the earliest among the three within the deployment to exhibit the presence of the suspicious executable.

On March 5, 2026, the second affected device exhibited a slightly different progression, initiating connections to http-test1[.]hola[.]org using the user agent ‘hola_get’. This activity was followed by the download of me[.]exe from the same endpoint on March 13, consistent with the broader pattern of Hola-related downloads observed across the environment.

The final affected device within this customer’s network demonstrated a more limited but related pattern, also downloading me[.]exe on March 17 using the same ‘hola_get’ user agent.

While the earlier Hola VPN usage observed across the deployment may not have been directly related to the suspected malware campaign, it may nonetheless have contributed to reduced visibility. The presence of pre-existing Hola-related traffic could have obscured malicious activity, making it more difficult to distinguish legitimate usage from attacker-driven behavior and, in turn, hindering the timely identification of the emerging compromise.

Darktrace’s Autonomous Response

For this deployment, the customer had their Autonomous Response capability configured in “Fully Autonomous” mode, allowing Darktrace to take action without human intervention. As a result, the system was able to autonomously disrupt the activity as soon as relevant events were identified through model detections.

Suspected cryptomining activity

As previously noted, some of the observed executable payloads appear to be linked to cryptomining malware. Across a subset of affected customer environments, this assessment was further supported by subsequent device activity consistent with Monero mining. Affected devices established follow-on connections to multiple external endpoints aligned with known mining infrastructure, indicating post-download execution.

Considering the broader sequence of activity, this pattern may point to a wider form of abuse in which legitimate VPN-related traffic is used to mask or facilitate malicious behavior following compromise.

On several devices, the download of executable files, including a newly observed peer[.]exe, was followed by alerts indicative of cryptocurrency mining activity. Mining-related credentials such as ‘x’ were observed using the Minergate protocol to communicate with endpoints within the 89.125.255.0/24 subnet and 188.241.218[.]111, the same endpoint involved in earlier download activity. Additional credentials appeared to reflect device-specific CPU identifiers, for example ‘12th Gen Intel(R) Core (TM) i5-1235U’.

Observed mining methods included login, submit, and job, consistent with active participation in a pool-based mining workflow rather than passive or incidental contact. The login method indicates that the host authenticated to the mining service as a worker, job reflects the assignment of computational tasks, and submit shows completed work being returned to the pool [8]. This sequence suggests that affected devices were actively contributing processing resources as part of an unauthorized distributed mining operation.

The presence of unauthorized cryptominers can lead to degraded system performance and reduced device stability. Beyond the immediate resource impact, such activity often serves as an indicator of a broader compromise rather than an isolated issue. This may increase the risk of further malware deployment, persistence mechanisms, and lateral movement, particularly in environments where the initial intrusion has not been fully contained.

Conclusion

Across affected environments, detections such as unusual VPN usage, connections to Hola infrastructure, anomalous HTTP activity, suspicious file downloads, and subsequent cryptomining behavior were linked into a single, evolving incident narrative. This aggregation provided a clearer view of attack progression, enabling security teams to understand not just isolated alerts, but the full sequence of compromise from initial contact through to post-exploitation.

Ultimately, these activities show that the risk posed by non-compliant software such as Hola VPN can extend far beyond simple policy violations. What began as traffic to Hola-related infrastructure was, in multiple cases, followed by behavior suggesting deliberate misuse, including suspicious executable downloads using Hola-related user agents and, in some instances, evidence of active cryptomining. These were not isolated anomalies, but elements of a broader pattern in which seemingly benign proxy or VPN-related communications may have created a pathway for malicious delivery and unauthorized resource exploitation.

The significance of this activity lies not only in the downloads or mining, but in what it reveals about an attacker’s ability to blend malicious operations into traffic associated with software that may already have a foothold in the environment. When unapproved software operates within an enterprise, it can reduce visibility, blur the distinction between legitimate and malicious traffic, and create opportunities to extend compromise in ways that are persistent and difficult to detect. Darktrace’s anomaly-based approach enables these behavioral distinctions to be identified, regardless of whether the device is new or long established within the network.

Credit to Min Kim (Associate Principal Analyst), Priya Thapa (Senior Cyber Analyst)
Edited by Ryan Traill (Content Manager)

Appendices

References

[1] https://www.virustotal.com/gui/ip-address/188.241.219.55

[2]  https://www.virustotal.com/gui/ip-address/188.241.218.111

[3] https://www.sophos.com/en-us/blog/you-do-surprise-me-exe-an-unexpected-executable-in-hola-browser

[4] https://www.virustotal.com/gui/file/d275abca286cd75af971d0459fdf1df37c7b19c514abafae5d0b04bf42ccfb45/detection

[5] https://bazaar.abuse.ch/sample/d275abca286cd75af971d0459fdf1df37c7b19c514abafae5d0b04bf42ccfb45/

[6] https://any.run/report/4cdeb5df217764a8b6a20d518b76ccb30cbe623365a13d9dcd40900950f1ed99/de3a756a-3101-4369-8922-52c586c939fb

[7] https://www.virustotal.com/gui/file/e3541caf708c075f0bb22fc68b03acd8457fea7cf0732ea935b1eb016d1c7721/community

[8] https://bitcoinwiki.org/wiki/stratum

Darktrace Model Detections

·      Anomalous File / EXE from Rare External Location

·      Anomalous File / Multiple EXE from Rare External Locations

·      Compromise / Crypto Currency Mining Activity

·      Compromise / High Priority Crypto Currency Mining (EM)

·      Device / New User Agent

·      Anomalous Connection / New User Agent to IP Without Hostname

·      Antigena / Network / Significant Anomaly / Antigena Controlled and Model Alert

·      Antigena / Network / Significant Anomaly / Antigena Alerts Over Time Block

·      Antigena / Network / External Threat / Antigena Tor Block

·      Antigena / Network / External Threat / Antigena File then New Outbound Block

·      Antigena / Network / External Threat / Antigena Suspicious Activity Block

·      Antigena / Network / External Threat / Antigena Suspicious File Pattern of Life Block

·      Antigena / Network / External threat / Antigena Suspicious File Block

Indicators of Compromise (IoCs)

IoC –Type -Description + Confidence

188.241.219[.]55 - IP Address - Malware distribution source

188.241.218[.]111 - IP Address -Malware distribution source

hxxp://188.241.218[.]111:8080/me[.]exe - URI - Malicious payload

hxxp://188.241.219[.]55:9000/proxy-peer-windows-amd64[.]exe - URI - Malicious payload

hxxp://188.241.219[.]55:9000/peer[.]exe - URI - Malicious payload

C8088f3c8bc3542eb1ad78a7cc5306d866c8ac81 - SHA1 - Malicious payload, me[.]exe

b595a6de0f6a18975b29e6f8ebe604956a173478 - SHA1 - Malicious payload, me[.]exe

e9139a2e0839e8b9e5c9787ea936347ae56e5460 - SHA1 - Possible malicious payload

c2e80073e4cafe757d5643bd8fd45f28ad89bff9 - SHA1 - Possible malicious payload

695355eceedcdd337d8fcbd35e6a531cda75b847 - SHA1 - Possible malicious payload

f0b0d8068a1b9ab5d68a8a46842d72b870b292e7 - SHA1 - Possible malicious payload

a21c8b8cabc7670ea45bc175e185a0f9bfcf4733 - SHA1 - Malicious payload, me[.]exe

0353ca44b9f397d8f492db0b2f7a1d00a9e4406a - SHA1 - Possible malicious payload

56824c8a110e35ab303dc27a6c758cd50c36174c - SHA1 - Malicious payload, peer[.]exe

c141fa0fa505fe7f9ad5dd21d9d4d6d411739682 - SHA1 - Malicious payload, peer[.]exe

0417ec988b16f1267065185a6eea98f0bd2e17cd - SHA1 - Possible malicious payload

c54f7eaaeb3e0b528cd2584bdcb3a4b13cc0f8a2 - SHA1 - Malicious payload, peer[.]exe

11c78f15fafd53f8cc5a52b828d7cbf2a99e0b09 - SHA1 - Malicious payload, peer[.]exe

0258bf7dbb0123247db29e8799991140bbdbd9bb - SHA1 - Malicious payload, proxy-peer-windows-amd64[.]exe

b46043a06dd9bbd63e4214d5fbc7fd56e1ff0618 - SHA1 - Possible malicious payload

753afdecd9f5402d004e8e5f768170ae9a468ca5 - SHA1 - Possible malicious payload

8f533c7cb1524b00f7b0311c2ea8603298d6b2ca - SHA1 - Possible malicious payload

3a3bc6a5b4db1a4e961abcb002d26fe9d5e5c349 - SHA1 - Possible malicious payload

897f70eb41d302b045fcb05ed0693675e778ce57 - SHA1 - Possible malicious payload

6ddd5644809606e3dc1e2cc06059c3f5e6176f85 - SHA1 - Malicious payload, proxy-peer-windows-amd64[.]exe

68a94f7cdcaf8853ea99251c1ecc67ae9b32eba8 - SHA1 - Malicious payload, proxy-peer-windows-amd64[.]exe

MITRE ATT&CK Mapping

T1659 -Initial Access, Command and Control -Content Injection

T1588.001 -Resource Development -Malware

T1189 -Initial Access -Drive-by Compromise

T1105 -Command and Control -Ingress Tool Transfer

T1657 -Impact -Financial Theft

T1497.001 -Impact -Compute Hijacking

T1496 -Impact -Resource Hijacking

T1210 -Lateral Movement -Exploitation of Remote Services

T1036.012 -Stealth -Browser Fingerprint

T1071.001 -Command and Control -Web Protocols

2026年のスポーツイベントを保護する

試合開催日にスタジアムに足を踏み入れるとき、あなたは小さなスマートシティを訪れています。チケット販売、回転ゲート、決済システム、何万ものファンが利用する公共Wi-Fi、CCTV、照明、そしてHVACまでもがすべて、相互に接続されたシステム上で稼働しています。ファンの体験はこれまでになく向上しましたが、この接続への依存は人々が想像するよりもはるかに大きなアタックサーフェスを作り出しています。

私たちの最新の調査結果はそれを裏付けています。ダークトレースが委託して実施した調査によれば、調査対象のプロスポーツ組織の84%は過去1年間に少なくとも1回のサイバーインシデントを経験しており、57%は複数回遭遇していました。試合が行われるライブ時間にすべてがかかっている業界にとって、これらの数字は直接的に運営上のリスクを意味します。

なぜスポーツがサイバー攻撃の標的になるのか

スポーツは非常に目立つターゲットであり、スケジュールが決まっているため、攻撃者は障害が最も影響を与える時期を正確に知っています。また、貴重なデータであるアスリートの医療記録、契約書、スポンサー契約書などが保管されており、これらが漏洩すれば財務上、評判上、規制上のリスクを伴います。同時に、イベントの開催もチケット発行、放送局、クラウドサービス、スタジアム関連テクノロジーなど、多くの第三者に依存しています。それらのシステムとの接続はいずれも侵入点になる可能性があります。注目度、スケジュール、データ、依存関係、これらが組み合わされることにより、小さな足がかりから、影響の大きな、時間的余裕の許されないインシデントに発展する環境が生まれます。

攻撃者はどのようにEメールとアイデンティティを標的にするか

Eメールとアイデンティティは主要な侵入経路です。2025年10月から2026年3月にかけて、Darktrace / EMAIL™は当社の顧客ベースにおいてスポーツ組織を狙った11万6,000通以上のフィッシングEメールを検知しました。また、スポーツ業界の顧客は他の業界の組織よりも19％多くのフィッシングEメールを受け取っています。数字がこれを物語っています：

数値が示すもの

• フィッシングEメールの21%はVIPを標的‍
• 37%は新手のソーシャルエンジニアリングを使用‍
• 悪意あるEメールの84%がDMARC認証を通過

これらのEメールの大部分は認証チェックを通過しており、従来のセキュリティ対策がもはや信頼できる防壁ではないことを意味しています。攻撃者はなりすましドメインに頼っているのではなく、正規のインフラストラクチャと信頼されたプラットフォームを利用しています。ここで、動作が大きな意味を持ちます。アカウントが侵害されると、動作は急速に変化します。ログインパターンが変わり、返信を隠すための受信トレイルールが作成され、アカウントが内部偵察やさらなるフィッシングに使用され始めます。これらは大きな騒音を伴う出来事ではありません。それらは通常のワークフローに紛れ込み、多くのケースで見落とされています。

ランサムウェアも同じような経緯で発生しています。あるスポーツ関連の顧客内では、攻撃者は暗号化を開始する前の2週間もの間、静かにデータを外部サーバーに移動していました。身代金要求文が出現するときには、すでにお膳立てができていたというわけです。一貫して見られるシーケンスとして、まずアクセスがあり、次に移動があり、そして最後に障害が発生しています。暗号化の時点で検知されても、既に手遅れです。

AIがスポーツ組織の新たなブラインドスポットとなる理由

AI導入の増加は潜在的アタックサーフェスを拡大させています。当社が調査を行ったセキュリティプロフェッショナルの72%は、今後1年間でAIがリスク増大につながると予想しています。しかし35%はスタジアムの運営という保護すべき最も重要な機能に既にAIを使用しているか、使用を計画しているのです。プロンプトインジェクションやAI構築リスクに加えて、シャドーAIがより切迫したリスクとなりつつあります。スタッフはすでに、パフォーマンス指標、スカウティングレポート、契約、健康データなどの機密データを、ほとんどまたはまったく管理されていないツールに入力しています。AIのもたらす利点は明らかですが、リスクも同様に明白であり、しかもそれはほとんどの組織が何の可視性やコントロールも持たないうちに発生しています。その一方で、攻撃者は同じAI技術を使ってフィッシングやソーシャルエンジニアリングを拡大しています。その結果はシンプルです－より大きな露出リスクが、より速いスピードで発生しているのです。

サイバーセキュリティプロフェッショナルはどう備えるべきか

大規模なイベントにおいて、効果的なサイバー防御には準備、リアルタイムの可視性が重要です。限られたタイミング、複雑さ、一般の注目、そしてこれらが重なるなかで、動的かつ決定的に対応する能力が必要であることを、ダークトレースの経験は物語っています。

サイバーセキュリティチームにとって戦略的に重要ないくつかの項目があります：

• コーポレートシステムだけでなく、ITおよびOT全体の動作の可視性を確保すること。
• アイデンティティをコントロールプレーンとして扱うこと。 この分野でのほとんどの攻撃は、マルウェアではなく認証情報から始まります。ビヘイビア検知を用いた多要素認証（MFA）は、その課題の解決に役立ちます。
• 自社の環境を管理するのと同じように第三者とAIのアクセスも制御すること。
• 数分で意思決定を行う、ライブ条件で対応を訓練すること。 検知と対応は、エンジニアにプレッシャーがかかり、時間が制約される非理想的な条件を考慮する必要があります。スポーツにおいて小さな問題を重大インシデントに発展させるのは、このタイミング条件です。平日であれば問題なく対応できる事象も、イベント開催中は重大な事態になりかねません。

2026年、スポーツにおいてサイバーセキュリティのリスクが拡大する理由

FIFAワールドカップ2026は3か国と数十の開催都市にまたがるため、アタックサーフェスは広範であり、スケジュールも厳しいものとなります。

地政学的なシグナリングは脅威プロファイルをさらに深刻化させています。これまでの国際スポーツイベントでは、国家を背後に持つ脅威アクターがサイバー領域を利用してその意思を示し、ナラティブに影響を及ぼし、象徴的な報復を行うことが実証されています。2026年ワールドカップの文脈において、国際スポーツからのロシアの継続的な排除、ウクライナでの現在の紛争、米国のウクライナへの防衛支援、そしてイランの大会参加の可能性は、国家に関係したアクター、そして非伝統的なアフィリエイト達が武力攻撃未満のサイバー攻撃を展開するさらなる動機を与えています。それには新しい技術は必要ありません — ただ適切なタイミングと注目度があればよいのです。

実務においては、結局準備に行きつくことになります。ITとOT全体で正常な状態がどのようなものかを把握し、第三者のアクセスを管理し、動作の変化を識別することです。

スポーツにおいて、障害は徐々に蓄積するのではなく、リアルタイムに、衆人環視の下で発生します。試合開始のホイッスルが鳴るずっと前に、その段取りはすでに完了しているのです。

調査について

調査結果は、スポーツセクターの顧客におけるDarktraceの脅威調査テレメトリー（2025年第4四半期～2026年第1四半期）および2026年5月28日から6月3日にOpinion Mattersが実施した米国、英国、オーストラリア、ドイツの875人のITサイバーセキュリティ専門家を対象とした調査に基づいています。調査手法の詳細、インシデント分析、および戦略的推奨事項については、レポート全文をお読みください。

‍

[related-resource]