Behavioral Detection Traced a Three-Day Ransomware Intrusion from VPN Access to Encryption
Summary
Darktrace details a customer intrusion involving compromised VPN credentials, reconnaissance, privilege escalation, Sliver C2, potential data exfiltration, and ransomware encryption. Incomplete response coverage allowed the attack to reach deployment.
Key points
- The intrusion began with compromised VPN credentials; how the attackers obtained them is unknown, and no specific ransomware group was identified.
- Over several days, attackers performed network reconnaissance, abused Active Directory replication to obtain credentials, and moved laterally using tools including PSExec, WMI, and RDP.
- Darktrace observed Sliver-consistent C2 communications and more than 200 MB uploaded to Wasabi cloud storage, suggesting possible exfiltration before encryption.
- The attackers used SMB, including legacy SMBv1, to encrypt thousands of files across multiple systems, disrupting normal operations.
- Darktrace detected anomalous activity early, but Autonomous Response was not fully configured across affected devices; the article says earlier containment could have disrupted the intrusion.
- The investigation highlights risks from valid credentials and legitimate tools that can evade defenses relying mainly on known malware signatures.
Article Details
- Attack Vectors
- Compromised VPN credentials were used for initial access; how the credentials were obtained is unclear.
- The intruder performed internal reconnaissance, including network and SMB authentication scanning, and used Active Directory replication abuse through drsuapi::DRSGetNCChanges.
- Lateral movement involved PSExec, WMI, RDP, DCE-RPC, SMB sessions, and deployment of PSEXESVC.exe through ADMIN$ shares.
- Sliver was used for C2-style communications. The intrusion also involved outbound data transfers to Wasabi cloud storage, followed by SMB-based ransomware propagation and file encryption.
- Defensive Notes
- Investigate unusual scanning, Active Directory replication anomalies consistent with DCSync, and anomalous use of native tools and reconnaissance software.
- Disable and reset compromised VPN credentials, and isolate devices exhibiting anomalous scanning or lateral movement.
- Use anomaly-based detection to identify and block repeated outbound connections to rare external infrastructure, and prevent unauthorized transfers to cloud storage such as Wasabi.
- The article states that Autonomous Response was enabled but not fully configured across impacted devices; it recommends deploying response across affected systems to enable targeted intervention.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | safedata[.]s3[.]wasabisys[.]com | Endpoint associated with potential data exfiltration to Wasabi cloud storage. |
| HOSTNAME | delete[.]me | File observed during reconnaissance and described as commonly associated with NetScan. |
| IPV4 | 137[.]220[.]59[.]55 | Potential C2 infrastructure; communications were likely routed through a Vultr-hosted VPS. |
| IPV4 | 38[.]27[.]106[.]117 | Wasabi cloud storage endpoint associated with potential data exfiltration. |
| IPV4 | 38[.]27[.]106[.]123 | Wasabi cloud storage endpoint associated with potential data exfiltration. |
| IPV4 | 38[.]27[.]106[.]128 | Wasabi cloud storage endpoint associated with potential data exfiltration. |
| MD5 | d6828e30ab66774a91a96ae93be4ae4c | JA3 fingerprint associated with the Sliver framework and observed C2-style communications. |
MITRE ATT&CK
T1018 · Remote System DiscoveryInternal network enumeration and reverse DNS scanning were observed.T1021 · Remote ServicesLateral movement included prolonged RDP sessions and SMB activity through ADMIN$ shares.T1041 · Exfiltration Over C2 ChannelThe article maps exfiltration over a C2 channel to the intrusion; it does not specify that the observed Wasabi transfer used that channel.T1046 · Network Service DiscoveryThe intruder conducted extensive network and port scanning during reconnaissance.T1070 · Indicator RemovalFile Deletion is listed in the article's ATT&CK mapping, but no corresponding behavior is described.T1071.001 · Web ProtocolsThe article maps Web Protocols to the intrusion's C2 activity.T1078 · Valid AccountsCompromised VPN credentials and administrative credentials were used for access and privileged activity.T1080 · Taint Shared ContentTaint Shared Content is listed in the article's ATT&CK mapping, but no corresponding behavior is described.T1083 · File and Directory DiscoveryFile and Directory Discovery is included in the article's ATT&CK mapping; no specific behavior is detailed.T1110 · Brute ForceRepeated NTLM authentication attempts used multiple variations of Administrator credentials.T1112 · Modify RegistryModify Registry is listed in the article's ATT&CK mapping, but no corresponding behavior is described.T1135 · Network Share DiscoveryThe intrusion included SMB authentication scanning and network share activity.T1190 · Exploit Public-Facing ApplicationPublic-Facing Application is listed in the article's ATT&CK mapping, but the described initial access was through compromised VPN credentials.T1210 · Exploitation of Remote ServicesExploitation of Remote Services is listed in the article's ATT&CK mapping; the described lateral movement used administrative tools and services.T1486 · Data Encrypted for ImpactRansomware encrypted thousands of files across multiple systems.T1489 · Service StopService Stop is listed in the article's ATT&CK mapping, but no corresponding behavior is described.T1567 · Exfiltration Over Web ServiceMore than 200 MB was uploaded externally to endpoints associated with Wasabi cloud storage.T1572 · Protocol TunnelingC2-style SSL communications exhibited repeated connection patterns resembling beaconing; the article lists Protocol Tunneling in its mapping.T1588 · Obtain CapabilitiesMalware is listed under Resource Development in the article's mapping, but no specific resource-development behavior is described.T1595 · Active ScanningThe article maps scanning IP blocks and vulnerability scanning to the observed reconnaissance; it describes extensive network scanning.
People
Vendors
DarktraceIn early 2026, Darktrace detected activity within a customer’s environment related to a multi-stage ransomware intrusion from the initial compromise. This activity does not appear to be attributable to a specificVultrConnections to 137[.]220[.]59[.]55 (ASN AS20473 AS-VULTR) indicated that the communications were likely routed via a virtual private server (VPS) hosted by Vultr.Wasabia device initiating SSL connections to safedata.s3[.]wasabisys[.]com, an endpoint associated with Wasabi cloud storage.
Products
Autonomous ResponseWhile Darktrace’s Autonomous Response capability was enabled within the customer’s environment, it was not fully configured across the impacted devices, allowing the attack to progress to ransomware deployment. HadCyber AI AnalystFigure 5: Darktrace’s Cyber AI Analyst detection of two linked unusual connections to Vultr infrastructure.Darktrace also observed a device initiating SSL connections to safedata.s3[.]wasabisys[.]com, an endpoint
Tools
Cobalt Strikeamong threat actors as a stealthier alternative to more heavily signatured frameworks such as Cobalt Strike. As a legitimate framework, its use further complicates detection for security tools that rely onnetscanUnusual use of common reconnaissance tools such as Nmap and NetScanNmapwith TCP connections targeting ports 21, 80, 445, 4899 and 8080. Associated URIs suggested the use of Nmap, a widely used penetration testing tool. This highlights how attackers often leverage legitimatePsExecescalated privileges and expanded their foothold using living-off-the-land (LOTL) techniques such as PSExec, WMI, and RDP. Concurrently, Darktrace identified command-and-control (C2)-style communicationsRDPand expanded their foothold using living-off-the-land (LOTL) techniques such as PSExec, WMI, and RDP. Concurrently, Darktrace identified command-and-control (C2)-style communications consistent with theSliverThe intrusion also involved the use of Sliver, an open-source adversary emulation framework, which is increasingly observed in real-world attacks. Originally designed for penetration testing and red teaming, Sliver hasWMIprivileges and expanded their foothold using living-off-the-land (LOTL) techniques such as PSExec, WMI, and RDP. Concurrently, Darktrace identified command-and-control (C2)-style communications consistent with