Darktrace Cyber AI Analyst

Reported Context (20)

The Darktrace model detections and Cyber AI Analyst detections that triggered in response to these activities are also highlighted. Model detections whose name include “Antigena” are a unique class of detections which Darktrace Tests Show AI Agents Hacking Simulated Corporate Networks to Cheat
toward additional AI services; when that failed, the attacker pivoted to cryptomining. Darktrace’s Cyber AI Analyst pieced the intrusion together and Darktrace’s Managed Threat Detection service alerted the customer, Darktrace’s Mid-Year 2026 Report Finds Attackers Exploiting Trusted Identities, Services and AI
Figure 5: Darktrace’s Cyber AI Analyst detection of two linked unusual connections to Vultr infrastructure.Darktrace also observed a device initiating SSL connections to safedata.s3[.]wasabisys[.]com, an endpoint Behavioral Detection Traced a Three-Day Ransomware Intrusion from VPN Access to Encryption
was escalated to the customer by Darktrace’s SOC. The activity was also summarized by Darktrace’s Cyber AI Analyst, which grouped the relevant events into a single investigation narrative, helping to identify the Compromised AWS AI Gateway Used for Cryptomining, Darktrace Reports
Once an alert does fire, speed and context matter. The Darktrace Cyber AI Analyst can automatically investigate across both environments, piecing together network and email evidence into a single, cohesive incident. Darktrace Explains Benefits of Integrating Email and Network Security

CVE (2)

Malware (12)

People (14)

Threat Actors (2)

MITRE ATT&CK (37)

Vendors (9)

Products (45)

Tools (18)

Industries (10)

Countries (13)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.