Darktrace Details SaaS Account Hijacks Using VPS Infrastructure

Aug 21, 2025 · Original article ↗

Summary

Darktrace describes suspicious SaaS activity across two customer environments, including rare VPS logins, inbox-rule manipulation, email deletion, and phishing-related behavior. The investigation suggests attackers used hijacked sessions to maintain access and conceal

Key points

Darktrace reported suspicious activity in two customer environments, including logins from rare IP addresses associated with Hyonix and other VPS providers.
In one case, logins from rare endpoints occurred close to legitimate user activity from distant locations, suggesting possible session hijacking.
Attackers created new or obfuscated inbox rules and deleted emails, apparently to conceal phishing activity and maintain access.
In the second environment, MFA was satisfied via token claims during anomalous logins; account recovery settings were also changed on some accounts.
The investigation found outbound spam and suspicious DNS activity; a file associated with Splashtop was written to a domain controller, though its role was not confirmed.
Darktrace said Autonomous Response was not enabled in either environment, so automated containment did not occur.
The article includes IP indicators, detection-model names, and MITRE ATT&CK mappings for the observed techniques.

Article Details

Attack Vectors: Rare external logins from VPS-associated IP addresses were followed by anomalous mailbox activity, including inbox-rule creation and deletion of emails.
The article says initial access in Case 1 was not directly observed and was likely achieved through phishing or account hijacking.
In Case 2, multiple users logged in from rare endpoints, with MFA reported as satisfied via token claims.
Attackers attempted to modify account recovery settings and used compromised accounts for outbound spam.
Defensive Notes: Monitor for improbable travel, rare login sources, concurrent sessions, unusual inbox-rule changes, email deletion, and account-recovery setting changes.
The article says Darktrace Autonomous Response was not enabled in either customer environment; it states that enabling it could have blocked connections from unusual VPS endpoints.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]131[.]131[.]44`	Hyonix IP used in login and MFA activity.
IPV4	`103[.]211[.]53[.]84`	IP used in a security information update from a rare external source.
IPV4	`103[.]75[.]11[.]134`	IP associated with Host Universal / Proton VPN and listed as an indicator in the investigation.
IPV4	`104[.]168[.]194[.]248`	Rare login IP listed as an indicator in the investigation.
IPV4	`162[.]241[.]121[.]156`	Rare IP explicitly associated with phishing.
IPV4	`178[.]173[.]244[.]27`	Hyonix IP listed as an indicator in the investigation.
IPV4	`193[.]32[.]248[.]242`	IP used in suspicious login activity and associated with Mullvad VPN.
IPV4	`194[.]49[.]68[.]244`	IP associated with Hyonix ASN and listed as an indicator in the investigation.
IPV4	`38[.]240[.]42[.]160`	IP associated with Hyonix ASN AS931 and listed as an indicator in the investigation.
IPV4	`38[.]255[.]57[.]212`	Hyonix IP used during MFA activity.
IPV4	`50[.]229[.]155[.]2`	Rare login IP listed as an indicator in the investigation.
IPV4	`51[.]36[.]233[.]224`	IP used in suspicious login activity.
IPV4	`91[.]223[.]3[.]147`	Mevspace IP used in multiple logins.
IPV6	`2a02:748:4000:18:0:1:170b:2524`	Hivelocity VPS address used in multiple logins and MFA activity.