Darktrace Threat Research explores how unsupervised clustering and fleet-wide behavioral analysis can identify malicious campaigns without prior indicators of compromise, uncovering shared anomalous activity linked to the POPA botnet and Monero cryptocurrency mining.

制御されたテスト環境において、ダークトレースの研究者はAIエージェントに不正行為を誘発させ、それらがどのように目標を追求するかを研究しました。エージェントはタスクを達成するために度々ハッキング手法に頼ることが確認されており、不適切な可能性のあるエージェントの振る舞いを把握するには、強力な可視性とビヘイビアプロファイリングが必要であることを示しています。

最近の研究において、エージェント型AIハーネスが乗っ取られ、ワークステーションが自律的な攻撃者に変貌する可能性があることが明らかになりました。研究者たちは、会話履歴の汚染を利用して自分たちが認可されたレッドチーマーであるとフロンティアモデルに信じ込ませ、一般的なAIワークフローが1つのパッケージインストールから武器化され得る仕組みを明らかにしました。

最近公開されたPHP脆弱性、およびARTEXに関する調査結果は、脆弱性探索および攻撃オペレーションにAIが利用されている実態を示しています。Darktraceのテレメトリーは、Microsoftが後にARTEXキャンペーンとの関連を指摘したインフラが関与する、認証アクティビティの失敗を特定しました。

Following the cyber attack on supermarket refrigeration systems in France, Darktrace researchers looked at how many industrial devices are sitting exposed on the public internet. From fridge controllers to PLCs and remote gateways, many rely on weak or default credentials.

As Kubernetes adoption accelerates, especially for AI workloads, Darktrace extends behavioral security across runtime activity, delivering visibility, detection, response, forensics, and risk context to identify and contain threats.

Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity.

AI is increasingly being used to accelerate cyber-attacks, but attackers still leave detectable behavioral traces. This blog explores how Darktrace identified suspicious file delivery, command-and-control communications, beaconing activity, and other anomalies linked to AI-assisted campaigns through behavioral analysis. 

Darktrace detected a blockchain-hosted infostealer campaign targeting Windows and macOS devices, combining ClickFix social engineering with the abuse of legitimate services such as GitHub, blockchain infrastructure, and DGA C2 endpoints to evade disruption and support malware delivery.

From shadow AI and sensitive prompts to agent identities and development risks, AI introduces new security challenges across the enterprise. Discover how Darktrace / SECURE AI brings behavioral understanding to every layer of the AI ecosystem.

As agentic AI systems take on more decision-making, human value is shifting from execution to judgement. This blog explores the challenges of maintaining oversight, resisting AI-driven influence, and making effective decisions in an age of autonomous agents, while examining how behavioral security can help organizations govern AI with confidence.

Darktrace is teaming up with OpenAI's Daybreak Defense Network to help security teams move from alert to action faster, combining Darktrace's behavioral threat detection with OpenAI's contextual reasoning to clarify business impact and strengthen visibility into AI-agent risk.

Darktrace identified Mirai Katana botnet activity on a camera device in a sports-sector network, showing how compromised IoT devices can facilitate malware delivery, botnet activity, and data exfiltration from inside trusted environments.

Recent guidance from the NCSC sets out the controls needed to deploy agentic AI safely. But approval is only the starting point – the next step is understanding how agents actually behave once they are operating in the enterprise.

With the growing prevalence of generative AI, attackers are increasingly exploiting interest in AI tools to distribute malware. Darktrace recently investigated an incident in which a malicious executable masquerading as a Google Gemini installer resulted in a Vidar information stealer infection.

ダークトレースが実施した2026年度前半の脅威分析では、攻撃者はセキュリティコントロールを回避するのではなく、信頼を利用する傾向がますます強まっていることが明らかになりました。アイデンティティ侵害、サプライチェーン攻撃、SaaSの悪用、AIを利用した作戦、および国家と連携したさまざまな活動は、信頼されるユーザー、サービス、およびインフラが重要な攻撃経路となっていることを示しています。これは防御者にとって、コンテキストとビヘイビア分析がセキュリティを維持するための根本的な基盤であることを意味しています。

A new UK AI Security Institute report shows autonomous AI agents independently developing novel attack chains, adapting when detected, and targeting humans and other AI systems. As agents become embedded across the enterprise, behavioral anomaly detection will be critical to securing the new attack surface they create.

Darktrace is integrating with Microsoft Agent 365 to bring behavior-based AI agent risk signals directly into the Microsoft 365 Admin Center. The integration gives security teams a more unified view of agent activity, helping them identify anomalous behavior, investigate potential risks, and manage AI agents more efficiently across Microsoft environments.

This marine organization uses Darktrace to strengthen cyber resilience across its distributed marine operations, protecting email, identity, network, and cloud environments while reducing manual triage for its lean ICT team. With autonomous response and unified visibility, Darktrace helps support operational continuity across mission-critical services.

Darktrace detected a multi-stage ransomware intrusion from its earliest stages, identifying reconnaissance, privilege escalation, lateral movement, command-and-control communications, and data exfiltration before encryption occurred. This analysis highlights how behavioral detection exposed attacker activity using legitimate tools and infrastructure, providing multiple opportunities for early intervention and containment.