Darktrace / Network blog

Across the network

Darktrace / Network is in action all over the globe. Learn more about what’s behind it from Darktrace experts.

Latest Blog Posts

Darktrace is Positioned as a Leader in the IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment

Darktrace is recognized as a Leader in the IDC MarketScape. Read this blog to find out more about Darktrace's leadership in the market and our pioneering leadership in AI over the past decade, alongside a variety of other unique differentiators and innovations in the NDR industry.

Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Darktrace’s Threat Research team investigated a major campaign exploiting vulnerabilities in Palo Alto firewall devices (CVE 2024-0012 and 2024-9474). Learn about the spike in post-exploitation activities and understand the need for anomaly-based detection to stay ahead of evolving threats.

Darktrace Leading the Future of Network Detection and Response With Recognition from KuppingerCole

Darktrace just picked up the title of "Overall Leader" in KuppingerCole's 2024 Leadership Compass for Network Detection and Response (NDR). Why? Our Self-Learning AI and smart automation make tackling threats faster and easier, helping security teams stay ahead of the game.

Tactics Behind the Royal and Blacksuit Ransomware

Delve into the complexities of the Royal and Blacksuit ransomware strains and their implications for cybersecurity in today’s digital landscape.

Post-Exploitation Activities on Fortinet Devices: A Network-Based Analysis

This blog explores recent findings from Darktrace's Threat Research team on active exploitation campaigns targeting Fortinet appliances. This analysis focuses on the September 2024 exploitation of FortiManager via CVE-2024-47575, alongside related malicious activity observed in June 2024.

How Triada Affects Banking and Communication Apps

Explore the intricacies of the Triada Trojan and its targeting of communication and banking apps. Learn how to safeguard against this threat.

From Call to Compromise: Darktrace’s Response to a Vishing-Induced Network Attack

When a remote user fell victim to a vishing attack, allowing a malicious actor to gain access to a customer network, Darktrace swiftly detected the intrusion and responded effectively. This prompt action prevented any data loss and reinforced trust in Darktrace’s robust security measures.

FortiClient EMS Exploited: Attack Chain & Post Exploitation Tactics

Read about the methods used to exploit FortiClient EMS and the critical post-exploitation tactics that affect cybersecurity defenses.

Decrypting the Matrix: How Darktrace Uncovered a KOK08 Ransomware Attack

In May 2024, a Darktrace customer was affected by KOK08, a ransomware strain commonly used by the Matrix ransomware family. Learn more about the tactics used by this ransomware case, including double extortion, and how Darktrace is able to detect and respond to such threats.

How Darktrace Detects TeamCity Exploitation Activity

Darktrace observed the rapid exploitation of a critical vulnerability in JetBrains TeamCity (CVE-2024-27198) shortly following its public disclosure. Learn how the need for speedy detection serves to protect against supply chain attacks.

Investigating the Adaptive Jupyter Information Stealer

Find out how to safeguard your organization from the Jupyter information stealer with strategies revealed by Darktrace's in-depth investigation.

Qilin Ransomware: Detection and Analysis

Get insights into the detection of Qilin ransomware operations and how organizations can protect themselves from this threat.

Elevating Network Security: Confronting Trust, Ransomware, & Novel Attacks

Ensuring trust, battling ransomware, and detecting novel attacks pose critical challenges in network security. This blog explores these challenges and shows how leveraging AI-driven security solutions helps security teams stay informed and effectively safeguard their network.

Post-Exploitation Activities on PAN-OS Devices: A Network-Based Analysis

This blog investigates the network-based activity detected by Darktrace in compromises stemming from the exploitation of a vulnerability in Palo Alto Networks firewall devices, namely CVE-2024-3400.

Darktrace Investigation Into Medusa Ransomware

See how Darktrace empowers organizations to fight back against Medusa ransomware, enhancing their cybersecurity posture with advanced technology.

The Price of Admission: Countering Stolen Credentials with Darktrace

This blog examines a network compromise that stemmed from the purchase of leaked credentials from the dark web. Credentials purchased from dark web marketplaces allow unauthorized access to internal systems. Such access can be used to exfiltrate data, disrupt operations, or deploy malware.

Exploitation of ConnectWise ScreenConnect Vulnerabilities

Uncover the tactics used to exploit ConnectWise vulnerabilities and strategies to protect your systems.

How Cactus Ransomware Was Detected and Stopped

Discover the tactics used to uncover a Cactus ransomware infection and the implications for cybersecurity defenses.

Sliver C2: How Darktrace Provided a Sliver of Hope

Learn how Darktrace is tackling the challenges posed by the Sliver C2 framework and what it means for modern cybersecurity defenses.

Balada Injector: Darktrace’s Investigation into the Malware Exploiting WordPress Vulnerabilities

This blog explores Darktrace’s detection of Balada Injector, a malware known to exploit vulnerabilities in WordPress to gain unauthorized access to networks. Darktrace was able to define numerous use-cases within customer environments which followed previously identified patterns of activity spikes across multiple weeks.

Customer stories