Darktrace’s Mid-Year Review Finds AI-Enabled Phishing, SaaS Ransomware and Ongoing Vulnerability Exploitation

Aug 5, 2025 · Original article ↗

Summary

Darktrace’s review of the first half of 2025 reports 12.6 million malicious emails, recurring ClickFix campaigns, ransomware and SaaS account abuse, and exploitation of internet-facing vulnerabilities, including Cityworks before public disclosure.

Key points

Darktrace detected more than 12.6 million malicious emails from January through May 2025; over 25% of phishing emails targeted VIP users, and 32% contained high volumes of text.
ClickFix campaigns seen in March and April tricked users with fake CAPTCHAs into running malicious PowerShell, delivering payloads such as information stealers.
Attackers used compromised credentials to access networks through exposed RDP and VPN services and compromised SaaS accounts; ransomware activity increasingly targeted SaaS environments.
Darktrace observed exploitation of SimpleHelp vulnerabilities CVE-2024-57727 and CVE-2024-57728 in March, despite patches being available since January.
The review reports signs of CVE-2025-0994 exploitation against Trimble Cityworks as early as January 19, before public disclosure on February 6.
Observed threats also included BlindEagle, a China-linked LapDogs campaign, Raspberry Robin, AsyncRAT, Gh0st RAT, Amadey and Stealc.
The review highlights the continuing risks of delayed patching and weak identity protections, and notes that the Lumma Stealer takedown in May did not eliminate the threat.

Article Details

Publisher: Darktrace
Report Period: 2025-01-01 to 2025-06-30
Scope: Threat activity observed across Darktrace customer deployments, including cloud-hosted Darktrace / EMAIL model data.
Key Statistics: Darktrace detected over 12.6 million malicious emails from January through May 2025.
Over 25% of phishing emails in the first five months of 2025 targeted VIP users.
More than 100,000 QR code-based phishing emails were detected in February 2025; the originally reported figure was corrected.
In the first five months of 2025, 32% of phishing emails contained a high volume of text.
Recommendations: Invest in anomaly-based detection to identify deviations in user and system behavior, including novel threats.
Strengthen identity management practices and continuously monitor SaaS accounts.
Improve patch management cycles for internet-facing and remote-management technologies.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`4j[.]pm`	Listed as a Raspberry Robin C2 server.
HOSTNAME	`4xq[.]nl`	Listed as a Raspberry Robin C2 server.
HOSTNAME	`8t[.]wf`	Listed as a Raspberry Robin C2 server.
HOSTNAME	`dynamic[.]serveftp[.]net`	Listed as a likely AsyncRAT C2 server.
HOSTNAME	`erp[.]ranasons[.]com`	Listed as a possible destination for exfiltration in the SimpleHelp RMM exploitation case.
HOSTNAME	`lu[.]dssiss[.]icu`	Listed as a likely Gh0stRAT C2 server.
HOSTNAME	`microsoft-download[.]ddnsfree[.]com`	Listed as a likely AsyncRAT C2 server.
HOSTNAME	`pruebas[.]pintacuario[.]mx`	Listed as a possible C2 server in the SimpleHelp RMM exploitation case.
HOSTNAME	`vpnl[.]net`	Listed as a likely AsyncRAT C2 server.
HOSTNAME	`windows-cam[.]casacam[.]net`	Listed as a likely AsyncRAT C2 server.
HOSTNAME	`www[.]northumbra[.]com`	Listed as a Command and Control (C2) server for the LapDogs ORB network.
IPV4	`103[.]106[.]230[.]31`	Listed as a C2 server for the LapDogs ORB network, observed in December 2024.
IPV4	`103[.]131[.]189[.]2`	Listed as a C2 server for the LapDogs ORB network, observed in December 2024 and June 2025.
IPV4	`143[.]110[.]243[.]154`	Listed as a likely destination for exfiltration in the SimpleHelp RMM exploitation case.
IPV4	`144[.]217[.]181[.]205`	Listed as a likely C2 server in the SimpleHelp RMM exploitation case.
IPV4	`154[.]223[.]20[.]56`	Listed as a possible C2 server for the LapDogs ORB network, observed in December 2024.
IPV4	`157[.]20[.]182[.]16`	Listed as a likely AsyncRAT C2 server.
IPV4	`158[.]220[.]96[.]15`	Listed as a likely AsyncRAT C2 server.
IPV4	`163[.]172[.]125[.]253`	Listed as a likely AsyncRAT C2 server.
IPV4	`185[.]81[.]157[.]19`	Listed as a likely AsyncRAT C2 server.
IPV4	`194[.]28[.]226[.]181`	Listed as a likely GhostSocks C2 server.
IPV4	`195[.]82[.]147[.]98`	Listed as an Amadey C2 server.
IPV4	`207[.]231[.]105[.]51`	Listed as a likely AsyncRAT C2 server.
IPV4	`213[.]183[.]63[.]41`	Listed as a C2 server in the SimpleHelp RMM exploitation case.
IPV4	`38[.]60[.]214[.]23`	Listed as a possible C2 server for the LapDogs ORB network, observed in January and February 2025.
IPV4	`88[.]209[.]248[.]141`	Listed as a likely AsyncRAT C2 server.
IPV4	`95[.]217[.]34[.]113`	Listed as a likely AsyncRAT C2 server.
MD5	`02aa02aee2a6bd93a4a8f4941a0e6310`	Listed as a possible additional Gh0stRAT payload.
MD5	`5ea622c630ef2fd677868cbe8523a3d5`	Listed as a possible additional Gh0stRAT payload.
MD5	`69549862b2d357e1de5bab899ec0c817`	Listed as a possible additional Gh0stRAT payload.
MD5	`9d33029eaeac1c2d05cf47eebb93a1d0`	Listed as a possible additional Gh0stRAT payload.
MD5	`f42aa5e68b28a3f335f5ea8b6c60cb57`	Listed as a possible additional Gh0stRAT payload.
MD5	`f891c920f81bab4efbaaa1f7a850d484`	Listed as a possible additional Gh0stRAT payload.
SHA1	`03287a15bfd67ff8c3340c0bae425ecaa37a929f`	Listed as a possible additional Gh0stRAT payload.
SHA1	`1473292e1405882b394de5a5857f0b6fa3858fd1`	Listed as a possible additional Gh0stRAT payload.
SHA1	`20189164c4cd5cac7eb76ba31d0bd8936761d7a7`	Listed as a possible additional Gh0stRAT payload.
SHA1	`8e9dec3b028f2406a8c546a9e9ea3d50609c36bb`	Listed as a possible additional Gh0stRAT payload.
SHA1	`aa5a5d2bd610ccf23e58bcb17d6856d7566d71b9`	Listed as a possible additional Gh0stRAT payload.
SHA1	`fea1e30dfafbe9fa9abbbdefbcbe245b6b0628ad`	Listed as a possible additional Gh0stRAT payload.