Darktrace Shows Cyber AI Analyst Investigating Four Advanced Threat Incidents
Summary
Darktrace presents four customer investigations involving ShadowPad, Blind Eagle, ransomware, and RansomHub to show how Cyber AI Analyst correlates activity across attack chains and supports faster threat triage and containment.
Key points
- In a ShadowPad investigation, the article describes VPN access likely involving CVE-2024-24919, compromised credentials, lateral movement, and data theft; Cyber AI Analyst linked activity across two intrusion threads.
- For a Blind Eagle incident at a South American transport provider, the system correlated suspicious downloads, likely Remcos command-and-control traffic, and data transfers.
- A ransomware investigation involved VPN access, credential theft using Zerologon and directory replication, lateral movement, data exfiltration, and an attempted ransomware deployment.
- In a RansomHub case, Cyber AI Analyst linked 38 incident events, including data exfiltration and file encryption.
- The examples illustrate the product’s automated investigation of anomalies, correlation of events across systems, and presentation of attack chains to support SOC triage and response.
Article Details
- Defense Focus
- Automate Level 1 and Level 2 SOC investigation by correlating anomaly alerts and telemetry into a unified incident view, helping teams detect, investigate, and contain threats faster.
- Detection Methods
- Evaluate multiple hypotheses about anomalous activity, analyze logs for involved assets, and correlate findings across domains.
- Link related detections and incident events to reconstruct attack chains, including network scanning, administrative connectivity, external data transfers, collection, exfiltration, and ransomware encryption.
- Use machine learning to understand the organization’s environment and filter noise from potential threats.
- Data Sources
- Logs and anomaly alerts
- Network and device activity, including VPN access, RDP, SMB, WMI, HTTP, HTTPS, and DNS traffic
- File downloads, data uploads, and external data transfers
- Incident events and asset-related findings
- Platforms
- Security Operations Centre (SOC)
- Defensive Actions
- Correlate related detections into a single incident view to understand the sequence of events and attack chain.
- Use investigation findings to prioritize response and, where appropriate, accelerate containment.
- Apply machine-learning-based environmental understanding to reduce alert noise and focus action on identified threats.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]194[.]10[.]170 | Likely attacker-used server identified as the destination for HTTP POST exfiltration. |
| IPV4 | 62[.]60[.]226[.]112 | Rare external IP to which a customer device was directed over HTTP; Darktrace assessed the activity with medium confidence as associated with Blind Eagle. |
CVE
CVE-2024-24919network (VPN) environment, likely via the exploitation of an information disclosure vulnerability (CVE-2024-24919) affecting Check Point Security Gateway devices.CVE-2024-43451to targeted recipients, similar to the way threat actors have previously been observed exploiting CVE-2024-43451, a vulnerability in Microsoft Windows that allows the disclosure of a user’s NTLMv2 password hash
People
Threat Actors
Malware
RansomHubCase 4: Cyber AI Analyst vs RansomhubRemcosFigure 3: Cyber AI Analyst investigation linking likely Remcos C2 traffic, a suspicious file download, and eventual data exfiltration.Type image caption here (optional)ShadowPadCase 1: Cyber AI Analyst vs. ShadowPad Malware: East Asian Advanced Persistent Threat (APT)
Vendors
Check Pointlikely via the exploitation of an information disclosure vulnerability (CVE-2024-24919) affecting Check Point Security Gateway devices.DarktraceAt Darktrace, we’ve learned that no single AI technique can solve cybersecurity on its own. We employ a multi-layered AI approach, strategically integrating a diverse set of techniques both sequentially and
Products
BackBlazeThe actor finally collected and exfiltrated several gigabytes of data to the cloud storage services, MEGA, Backblaze, and LimeWire, before returning to attempt ransomware detonation.Check Point Security Gatewayvia the exploitation of an information disclosure vulnerability (CVE-2024-24919) affecting Check Point Security Gateway devices.Cyber AI Analystand time-consuming tasks carried out during investigation workflows. We call this core capability Cyber AI Analyst.LimeWireThe actor finally collected and exfiltrated several gigabytes of data to the cloud storage services, MEGA, Backblaze, and LimeWire, before returning to attempt ransomware detonation.MEGAThe actor finally collected and exfiltrated several gigabytes of data to the cloud storage services, MEGA, Backblaze, and LimeWire, before returning to attempt ransomware detonation.Microsoft Windowsthe way threat actors have previously been observed exploiting CVE-2024-43451, a vulnerability in Microsoft Windows that allows the disclosure of a user’s NTLMv2 password hash upon minimal interaction with a
Tools
AnyDesksystems showed signs of using various tools, including the remote monitoring and management (RMM) tool AnyDesk, the proxy tool SystemBC, the data compression tool WinRAR, and the data transfer tool WinSCP.SystemBCusing various tools, including the remote monitoring and management (RMM) tool AnyDesk, the proxy tool SystemBC, the data compression tool WinRAR, and the data transfer tool WinSCP.WinRARremote monitoring and management (RMM) tool AnyDesk, the proxy tool SystemBC, the data compression tool WinRAR, and the data transfer tool WinSCP.WinSCP(RMM) tool AnyDesk, the proxy tool SystemBC, the data compression tool WinRAR, and the data transfer tool WinSCP.
Countries
ColombiaSince 2018, APT-C-36, also known as Blind Eagle, has been observed performing cyber-attacks targeting various sectors across multiple countries in Latin America, with a particular focus on Colombia.Germanywhich had never previously been seen in this customer’s environment and was geolocated in Germany.