Darktrace Describes Email Defenses Against APT-Linked Attacks

Summary

Darktrace describes how its email and identity tools detected or disrupted three customer threats: an adversary-in-the-middle phishing attack, TA577 activity seeking NTLM hashes, and phishing that deployed the WarmCookie backdoor.

Key points

In October 2024, a phishing email using a Dropbox-associated link led to an adversary-in-the-middle attack; Darktrace says its email and identity tools flagged abnormal redirects and login patterns and blocked credential exfiltration attempts.
In early 2024, TA577 used phishing emails with ZIP files and malicious infrastructure in an attempt to steal NTLM hashes; Darktrace says it detected lateral movement and blocked the theft attempts.
In mid-2024, phishing emails impersonating recruitment firms carried links that deployed the WarmCookie backdoor; Darktrace says it detected and blocked suspicious behavior in several customer environments.
The article presents behavioral analysis and correlating activity across domains as ways to detect threats that may evade static rules, signatures, or reputation checks.
Darktrace cautions that no email security solution can guarantee complete effectiveness and advocates a defense-in-depth approach.