Recent PHP disclosures and published investigations into ARTEX indicate that AI is being used across vulnerability research and offensive operations. Darktrace telemetry identified failed authentication activity involving infrastructure that Microsoft later publicly associated with the ARTEX campaign.

Following the cyber attack on supermarket refrigeration systems in France, Darktrace researchers looked at how many industrial devices are sitting exposed on the public internet. From fridge controllers to PLCs and remote gateways, many rely on weak or default credentials.

As Kubernetes adoption accelerates, especially for AI workloads, Darktrace extends behavioral security across runtime activity, delivering visibility, detection, response, forensics, and risk context to identify and contain threats.

Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity.

AI is increasingly being used to accelerate cyber-attacks, but attackers still leave detectable behavioral traces. This blog explores how Darktrace identified suspicious file delivery, command-and-control communications, beaconing activity, and other anomalies linked to AI-assisted campaigns through behavioral analysis. 

Darktrace detected a blockchain-hosted infostealer campaign targeting Windows and macOS devices, combining ClickFix social engineering with the abuse of legitimate services such as GitHub, blockchain infrastructure, and DGA C2 endpoints to evade disruption and support malware delivery.

In a controlled test environment, Darktrace researchers induced cheating behavior in AI agents to study how they pursue objectives. Agents regularly turned to hacking methods to accomplish tasks, demonstrating the need for robust visibility and behavioral profiling to identify potentially misaligned agent actions.

New research reveals how agentic AI harnesses can be hijacked, turning a workstation into an autonomous attacker. Using conversation history poisoning, researchers convinced a frontier model it was an authorized red teamer, exposing how common AI workflows may be weaponized through a single package install.

From shadow AI and sensitive prompts to agent identities and development risks, AI introduces new security challenges across the enterprise. Discover how Darktrace / SECURE AI brings behavioral understanding to every layer of the AI ecosystem.

As agentic AI systems take on more decision-making, human value is shifting from execution to judgement. This blog explores the challenges of maintaining oversight, resisting AI-driven influence, and making effective decisions in an age of autonomous agents, while examining how behavioral security can help organizations govern AI with confidence.

Darktrace is teaming up with OpenAI's Daybreak Defense Network to help security teams move from alert to action faster, combining Darktrace's behavioral threat detection with OpenAI's contextual reasoning to clarify business impact and strengthen visibility into AI-agent risk.

Darktrace identified Mirai Katana botnet activity on a camera device in a sports-sector network, showing how compromised IoT devices can facilitate malware delivery, botnet activity, and data exfiltration from inside trusted environments.

Recent guidance from the NCSC sets out the controls needed to deploy agentic AI safely. But approval is only the starting point – the next step is understanding how agents actually behave once they are operating in the enterprise.

With the growing prevalence of generative AI, attackers are increasingly exploiting interest in AI tools to distribute malware. Darktrace recently investigated an incident in which a malicious executable masquerading as a Google Gemini installer resulted in a Vidar information stealer infection.

ダークトレースが実施した2026年度前半の脅威分析では、攻撃者はセキュリティコントロールを回避するのではなく、信頼を利用する傾向がますます強まっていることが明らかになりました。アイデンティティ侵害、サプライチェーン攻撃、SaaSの悪用、AIを利用した作戦、および国家と連携したさまざまな活動は、信頼されるユーザー、サービス、およびインフラが重要な攻撃経路となっていることを示しています。これは防御者にとって、コンテキストとビヘイビア分析がセキュリティを維持するための根本的な基盤であることを意味しています。

A new UK AI Security Institute report shows autonomous AI agents independently developing novel attack chains, adapting when detected, and targeting humans and other AI systems. As agents become embedded across the enterprise, behavioral anomaly detection will be critical to securing the new attack surface they create.

Darktrace is integrating with Microsoft Agent 365 to bring behavior-based AI agent risk signals directly into the Microsoft 365 Admin Center. The integration gives security teams a more unified view of agent activity, helping them identify anomalous behavior, investigate potential risks, and manage AI agents more efficiently across Microsoft environments.

This marine organization uses Darktrace to strengthen cyber resilience across its distributed marine operations, protecting email, identity, network, and cloud environments while reducing manual triage for its lean ICT team. With autonomous response and unified visibility, Darktrace helps support operational continuity across mission-critical services.

Darktrace detected a multi-stage ransomware intrusion from its earliest stages, identifying reconnaissance, privilege escalation, lateral movement, command-and-control communications, and data exfiltration before encryption occurred. This analysis highlights how behavioral detection exposed attacker activity using legitimate tools and infrastructure, providing multiple opportunities for early intervention and containment.

New capabilities help employees understand suspicious content, give administrators more control over sensitive data, and show security teams where risky workflows sit across the organization.