Darktrace / Network blog

Across the network

Darktrace / Network is in action all over the globe. Learn more about what’s behind it from Darktrace experts.

Latest Blog Posts

Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic

ClickFix is a social engineering technique that exploits human error through fake prompts, leading users to unknowingly run malicious commands. Learn how Darktrace detects and responds to such threats!

Darktrace Recognized as a Leader in the 2025 Gartner® Magic Quadrant™ for Network Detection and Response

Darktrace announces its Leader position in the inaugural Gartner® Magic Quadrant™ for Network Detection and Response (NDR).

PumaBot: Novel Botnet Targeting IoT Surveillance Devices

Darktrace investigated “PumaBot,” a Go-based Linux botnet targeting IoT devices. It avoids internet-wide scanning, instead using a C2 server to get targets and brute-force SSH credentials. Once inside, it executes remote commands and ensures persistence.

Defending the Frontlines: Proactive Cybersecurity in Local Government

To quickly identify and respond to threats before damage occurs, this local government relies on Darktrace to improve network visibility, stop insider threats, protect its email systems, and accelerate incident investigations.

Catching a RAT: How Darktrace Neutralized AsyncRAT

Darktrace's AI-driven tools identified and disrupted AsyncRAT activity, detecting suspicious connections and blocking them autonomously. This proactive response prevented the compromise from escalating and safeguarded sensitive data from exfiltration.

Anomaly-Based Threat Hunting: Darktrace's Approach in Action

This blog outlines Darktrace's model-based anomaly detection and how security teams can leverage custom models for targeted threat hunts. Recently, Darktrace's Threat Research team applied this method in their report, "AI & Cybersecurity: The State of Cyber in UK and US Energy Sectors."

SocGholish: From loader and C2 activity to RansomHub deployment

In early 2025, Darktrace uncovered SocGholish-to-RansomHub intrusion chains, including loader and C2 activity, alongside credential harvesting via WebDAV and SCF abuse. Learn more about SocGholish and its kill chain here!

Your Vendors, Your Risk: Rethinking Third-Party Security in the Age of Supply Chain Attacks

Protecting against supply chain cyber-attacks means safeguarding not just your network, but your customers’ trust. Learn why securing vendor relationships is essential in today’s threat landscape.

Boosting Security with Azure Virtual Network TAP Traffic Mirroring

Discover why Darktrace is a launch partner for the Public Preview of Microsoft Azure Virtual Network Terminal Access Point (TAP).

The Importance of NDR in Resilient XDR

Learn why EDR alone is not enough and how NDR uncovers and stops threats that disable or bypass endpoint security.

Obfuscation Overdrive: Next-Gen Cryptojacking with Layers

Docker is a prime target for malware, with new strains emerging daily. This blog explores a novel campaign showcasing advanced obfuscation and cryptojacking techniques.

How NDR and Secure Access Service Edge (SASE) Work Together to Achieve Network Security Outcomes

Learn how NDR and SASE solutions complement and interact with each other to create a robust network security strategy.

Cyberhaven Supply Chain Attack: Exploiting Browser Extensions

In late 2024, Darktrace detected unusual activity linked to Cyberhaven's Chrome browser extension. Read more about Darktrace’s investigation here.

Darktrace's Detection of State-Linked ShadowPad Malware

In 2024, Darktrace identified a cluster of intrusions involving the state-linked malware, ShadowPad. This blog will detail ShadowPad and the associated activities detected by Darktrace.

Darktrace Releases Annual 2024 Threat Insights

Explore Darktrace's Annual Threat Report 2024 for insights on the latest cyber threats and trends observed throughout the year.

Defending Against Living-off-the-Land Attacks: Anomaly Detection in Action

Discover how Darktrace detected and responded to cyberattacks using Living-off-the-Land (LOTL) tactics to exploit trusted services and tools on customer networks.

RansomHub Revisited: New Front-Runner in the Ransomware-as-a-Service Marketplace

Discover how RansomHub is rising in the ransomware landscape, using tools like Atera and Splashtop, reconnaissance tactics, and double extortion techniques.

Reimagining Your SOC: Unlocking a Proactive State of Security

Reimagining your SOC Part 3/3: This blog explores the challenges security professionals face in managing cyber risk, evaluates current market solutions, and outlines strategies for building a proactive security posture.

Reimagining Your SOC: How to Shift Away From Reactive Network Security

Reimagining your SOC Part 1/3: This blog shows how security teams can move to autonomous detection and investigation of novel threats, reducing alert fatigue, and enabling tailored, real-time threat response.

RansomHub Ransomware: Darktrace’s Investigation of the Newest Tool in ShadowSyndicate's Arsenal

Between September and October 2024, Darktrace investigated several customer networks compromised by RansomHub attacks. Further analysis revealed a connection to the ShadowSyndicate threat group. Read on to discover how these entities are linked and the tactics, techniques, and procedures employed in these attacks.

Customer stories