Blog
/

Inside the SOC

/
November 13, 2024

From Royal to BlackSuit: Understanding the Tactics and Impact of a Sophisticated Ransomware Strain

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
13
Nov 2024
Since late 2023, Darktrace has tracked BlackSuit ransomware, a sophisticated spinoff of Royal ransomware, targeting various industries. Using double extortion tactics, BlackSuit demands substantial ransoms, causing significant disruption. Darktrace’s proactive measures highlight the need for robust cybersecurity to counteract these evolving threats and protect critical assets.

What is BlackSuit Ransomware?

Since late 2023, Darktrace has detected BlackSuit ransomware infiltrating multiple customer networks in the US. This ransomware has targeted a wide range of industries, including arts, entertainment, real estate, public administration, defense, and social security.

Emerging in May 2023, BlackSuit is believed to be a spinoff of Royal ransomware due to similarities in code and Conti, and most likely consists of Russian and Eastern European hackers [1]. Recorded Future reported that the ransomware had affected 95 organizations worldwide, though the actual number is likely much higher [2]. While BlackSuit does not appear to focus on any particular sector, it has targeted multiple organizations in the healthcare, education, IT, government, retail and manufacturing industries [3]. Employing double extortion tactics, BlackSuit not only encrypts files but also steals sensitive data to leverage ransom payments.

BlackSuit has demanded over USD 500 million in ransoms, with the highest individual demand reaching USD 60 million [4]. Notable targets include CDK Global, Japanese media conglomerate Kadokawa, multiple educational institutions, Octapharma Plasma, and the government of Brazil [5][6][7][8].

Darktrace’s Coverage of BlackSuit Ransomware Attack

Case 1, November 2023

The earliest attack on a Darktrace customer by BlackSuit was detected at the start of November 2023. The unusual network activity began on a weekend—a time commonly chosen by ransomware groups to increase their chances of success, as many security teams operate with reduced staff. Darktrace identified indicators of the attackers’ presence on the network for almost two weeks, during which a total of 15 devices exhibited suspicious behavior.

The attack commenced with unusual internal SMB (Server Message Block) connections using a compromised service account. An internal device uploaded an executable (zzza.exe) to a domain controller (DC) and shortly after, wrote a script (socks5.ps1) to another device. According to a Cybersecurity Advisory from the CISA (Cybersecurity and Infrastructure Security Agency, US), the script file was a PowerShell reverse proxy [9].

Approximately an hour and a half later, the device to which the script was written exhibited uncommon WMI (Windows Management Instrumentation) activity. Two hours after receiving the executable file, the DC was observed making an outgoing NTLM request, using PowerShell to remotely execute commands, distributing differently named executable files (<PART OF THE CUSTOMER’S NAME>.exe), and controlling services on other devices.

Eighteen hours after the start of the unusual activity, Darktrace detected another device making repeated connections to “mystuff.bublup[.]com”, which the aforementioned CISA Advisory identifies as a domain used by BlackSuit for data exfiltration [9].

About ten minutes after the suspicious executables were distributed across the network, and less than 24 hours after the start of the unusual activity, file encryption began. A total of ten devices were seen appending the “.blacksuit” extension to files saved on other devices using SMB, as well as writing ransom notes (readme.blacksuit.txt). The file encryption lasted less than 20 minutes.

An example of the contents of a BlackSuit ransom note being written over SMB.
Figure 1: An example of the contents of a BlackSuit ransom note being written over SMB.

During this compromise, external connections to endpoints related to ConnectWise’s ScreenConnect remote management tool were also seen from multiple servers, suggesting that the tool was likely being abused for command-and-control (C2) activity. Darktrace identified anomalous connectivity associated with ScreenConnect was seen up to 11 days after the start of the attack.

10 days after the start of the compromise, an account belonging to a manager was detected adding “.blacksuit” extensions to the customer’s Software-a-Service (SaaS) resources while connecting from 173.251.109[.]106. Six minutes after file encryption began, Darktrace flagged the unusual activity and recommended a block. However, since Autonomous Response mode was not enabled, the customer’s security team needed to manually confirm the action. Consequently, suspicious activity continued for about a week after the initial encryption. This included disabling authentication on the account and an unusual Teams session initiated from the suspicious external endpoint 216.151.180[.]147.

Case 2, February 2024

Another BlackSuit compromise occurred at the start of February 2024, when Darktrace identified approximately 50 devices exhibiting ransomware-related activity in another US customer’s environment. Further investigation revealed that a significant number of additional devices had also been compromised. These devices were outside Darktrace’s purview to the customer’s specific deployment configuration. The threat actors managed to exfiltrate around 4 TB of data.

Initial access to the network was gained via a virtual private network (VPN) compromise in January 2024, when suspicious connections from a Romanian IP address were detected. According to CISA, the BlackSuit group often utilizes the services of initial access brokers (IAB)—actors who specialize in infiltrating networks, such as through VPNs, and then selling that unauthorized access to other threat actors [9]. Other initial access vectors include phishing emails, RDP (Remote Desktop Protocol) compromise, and exploitation of vulnerable public-facing applications.

Similar to the first case, the file encryption began at the end of the working week. During this phase of the attack, affected devices were observed encrypting files on other internal devices using two compromised administrator accounts. The encryption activity lasted for approximately six and a half hours. Multiple alerts were sent to the customer from Darktrace’s Security Operations Centre (SOC) team, who began reviewing the activity within four minutes of the start of the file encryption.

Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 2: Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 3: A spike in model alerts on the day when file encryption by BlackSuit was observed in the network.

In this case, the threat actor utilized SystemBC proxy malware for command and control (C2). A domain controller (DC) was seen connecting to 137.220.61[.]94 on the same day the file encryption took place. The DC was also observed connecting to a ProxyScrape domain around the same time, which is related to the SOCKS5 protocol used by SystemBC. During this compromise, RDP, SSH, and SMB were used for lateral movement within the network.

Figure 4: A Cyber AI Analyst investigation alerting to a device on the VPN subnet making suspicious internal SSH connections due to malicious actors moving laterally within the network.

Signs of threat actors potentially being on the network were observed as early as two days prior to the file encryption. This included unusual internal network scanning via multiple protocols (ICMP, SMB, RDP, etc.), credential brute-forcing, SMB access failures, and anonymous SMBv1 sessions. These activities were traced to IP addresses belonging to two desktop devices in the VPN subnet associated with two regular employee user accounts. Threat actors were seemingly able to exploit at least one of these accounts due to LDAP legacy policies being in place on the customer’s environment.

A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Figure 5: A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.
Figure 6: Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.

Case 3, August 2024

The most recently observed BlackSuit compromise occurred in August 2024, when a device was observed attempting to brute-force the credentials of an IT administrator. This activity continued for 11 days.

Once the admin’s account was successfully compromised, network scanning, unusual WMI, and SAMR (Security Account Manager Remote protocol) activity followed. A spike in the use of this account was detected on a Sunday—once again, the attackers seemingly targeting the weekend—when the account was used by nearly 50 different devices.

The compromised admin’s account was exploited for data gathering via SMB, resulting in the movement of 200 GB of data between internal devices in preparation for exfiltration. The files were then archived using the naming convention “*.part<number>.rar”.

Around the same time, Darktrace observed data transfers from 19 internal devices to “bublup-media-production.s3.amazonaws[.]com,” totaling just over 200 GB—the same volume of data gathered internally. Connections to other Bublup domains were also detected. The internal data download and external data transfer activity took approximately 8-9 hours.

Unfortunately, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning any mitigative actions to stop the data gathering or exfiltration required human confirmation.  

One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.
Figure 7: One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.

Once the information was stolen, the threat actor moved on to the final stage of the attack—file encryption. Five internal devices, using either the compromised admin account or connecting via anonymous SMBv1 sessions, were seen encrypting files and writing ransom notes to five other devices on the network. The attempts at file encryption continued for around two hours, but Darktrace’s Autonomous Response capability was able to block the activity and prevent the attack from escalating.

Conclusion

The persistent and evolving threat posed by ransomware like BlackSuit underscores the critical importance of robust cybersecurity measures across all sectors. Since its emergence in 2023, BlackSuit has demonstrated a sophisticated approach to infiltrating networks, leveraging double extortion tactics, and demanding substantial ransoms. The cases highlighted above illustrate the varied methods and persistence of BlackSuit attackers, from exploiting VPN vulnerabilities to abusing remote management tools and targeting off-hours to maximize impact.

Although many similar connection patterns, such as the abuse of Bublup services for data exfiltration or the use of SOCKS5 proxies for C2, were observed during cases investigated by Darktrace, BlackSuit actors are highly sophisticated and tailors their attacks to each target organization. The consequences of a successful attack can be highly disruptive, and remediation efforts can be time-consuming and costly. This includes taking the entire network offline while responding to the incident, restoring encrypted files from backups (if available), dealing with damage to the organization’s reputation, and potential lawsuits.

These BlackSuit ransomware incidents emphasize the need for continuous vigilance, timely updates to security protocols, and the adoption of autonomous response technologies to swiftly counteract such attacks. As ransomware tactics continue to evolve, organizations must remain agile and informed to protect their critical assets and data. By learning from these incidents and enhancing their cybersecurity frameworks, organizations can better defend against the relentless threat of ransomware and ensure the resilience of their operations in an increasingly digital world.

Credit to Signe Zaharka (Principal Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

Insights from Darktrace’s First 6: Half-year threat report for 2024

First 6: half year threat report darktrace screenshot

Darktrace’s First 6: Half-Year Threat Report 2024 highlights the latest attack trends and key threats observed by the Darktrace Threat Research team in the first six months of 2024.

  • Focuses on anomaly detection and behavioral analysis to identify threats
  • Maps mitigated cases to known, publicly attributed threats for deeper context
  • Offers guidance on improving security posture to defend against persistent threats

‍

‍

Appendices

Darktrace Model Detections

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / High Volume of New or Uncommon Service Control

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / Rare WinRM Outgoing

Anomalous Connection / SMB Enumeration

Anomalous Connection / Suspicious Activity On High Risk Device

Anomalous Connection / Suspicious Read Write Ratio

Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB

Anomalous Connection / Sustained MIME Type Conversion

Anomalous Connection / Uncommon 1 GiB Outbound

Anomalous Connection / Unusual Admin SMB Session

Anomalous File / Internal / Additional Extension Appended to SMB File

Anomalous File / Internal / Executable Uploaded to DC

Anomalous File / Internal / Unusual SMB Script Write

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous Server Activity / Outgoing from Server

Anomalous Server Activity / Rare External from Server

Anomalous Server Activity / Write to Network Accessible WebRoot

Compliance / Outgoing NTLM Request from DC

Compliance / Remote Management Tool On Server

Compliance / SMB Drive Write

Compromise / Beacon to Young Endpoint

Compromise / Beaconing Activity To External Rare

Compromise / Ransomware / Possible Ransom Note Read

Compromise / Ransomware / Possible Ransom Note Write

Compromise / Ransomware / SMB Reads then Writes with Additional Extensions

Compromise / Ransomware / Suspicious SMB Activity

Device / Anomalous RDP Followed By Multiple Model Breaches

Device / EXE Files Distributed to Multiple Devices

Device / Internet Facing Device with High Priority Alert

Device / Large Number of Model Breaches

Device / Large Number of Model Breaches from Critical Network Device

Device / Multiple Lateral Movement Model Breaches

Device / Network Scan

Device / New or Uncommon WMI Activity

Device / New or Unusual Remote Command Execution

Device / New User Agent To Internal Server

Device / SMB Lateral Movement

Device / SMB Session Brute Force (Admin)

Device / Suspicious SMB Scanning Activity

Device / Unusual LDAP Query For Domain Admins

SaaS / Access / Teams Activity from Rare Endpoint

SaaS / Resource / SaaS Resources With Additional Extensions

SaaS / Unusual Activity / Disabled Strong Authentication

SaaS / Unusual Activity / Multiple Unusual SaaS Activity Scores

SaaS / Unusual Activity / Unusual SaaS Activity Score

SaaS / Unusual Activity / Unusual Volume of SaaS Modifications

Unusual Activity / Anomalous SMB Delete Volume

Unusual Activity / Anomalous SMB Move & Write

Unusual Activity / High Volume Client Data Transfer

Unusual Activity / High Volume Server Data Transfer

Unusual Activity / Internal Data Transfer

Unusual Activity / SMB Access Failures

Unusual Activity / Sustained Anomalous SMB Activity

Unusual Activity / Unusual External Data to New Endpoint

User / New Admin Credentials on Client

User / New Admin Credentials on Server

User/ Kerberos Password Bruteforce

Autonomous Response Models

Antigena / Network / External Threat / Antigena File then New Outbound Block

Antigena / Network / External Threat / Antigena Ransomware Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

Antigena / Network / External Threat / SMB Ratio Antigena Block

Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity

Antigena / Network / Insider Threat / Antigena Internal Data Transfer Block

Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block

Antigena / Network / Insider Threat / Antigena Network Scan Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Pattern of Life Block

Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block

Antigena / Network / Significant Anomaly / Repeated Antigena Breaches

Antigena / SaaS / Antigena Unusual Activity Block

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

.blacksuit - File extension – When encrypting the files, this extension is appended to the filename – High

readme.blacksuit.txt – ransom note - A file demanding cryptocurrency payment in exchange for decrypting the victim's files and not leaking the stolen data – High

mystuff.bublup[.]com, bublup-media-production.s3.amazonaws[.]com – data exfiltration domains related to an organization and project management app that has document sharing functionality – High

137.220.61[.]94:4001 – SystemBC C2 related IP address (this tool is often used by other ransomware groups as well) - Medium

173.251.109[.]106 – IP address seen during a SaaS BlackSuit compromise (during file encryption) – Medium

216.151.180[.]147 – IP address seen during a SaaS BlackSuit compromise (during an unusual Teams session) - Medium

MITRE ATT&CK Mapping

Tactic - Technqiue

Account Manipulation - PERSISTENCE - T1098

Alarm Suppression - INHIBIT RESPONSE FUNCTION - T0878

Application Layer Protocol - COMMAND AND CONTROL - T1071

Automated Collection - COLLECTION - T1119

Block Command Message - INHIBIT RESPONSE FUNCTION - T0803

Block Reporting Message - INHIBIT RESPONSE FUNCTION - T0804

Browser Extensions - PERSISTENCE - T1176

Brute Force I/O - IMPAIR PROCESS CONTROL - T0806

Brute Force - CREDENTIAL ACCESS - T1110

Client Configurations - RECONNAISSANCE - T1592.004 - T1592

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Data Destruction - IMPACT - T1485

Data Destruction - INHIBIT RESPONSE FUNCTION - T0809

Data Encrypted for Impact - IMPACT - T1486

Data from Cloud Storage Object - COLLECTION - T1530

Data Staged - COLLECTION - T1074

Domain Groups - DISCOVERY - T1069.002 - T1069

Email Collection - COLLECTION - T1114

Exfiltration Over C2 Channel - EXFILTRATION - T1041

Exfiltration to Cloud Storage - EXFILTRATION - T1567.002 - T1567

Exploit Public - Facing Application - INITIAL ACCESS - T1190

Exploitation for Privilege Escalation - PRIVILEGE ESCALATION - T0890

Exploitation of Remote Services - LATERAL MOVEMENT - T1210

File and Directory Discovery - DISCOVERY - T1083

File Deletion - DEFENSE EVASION - T1070.004 - T1070

IP Addresses - RECONNAISSANCE - T1590.005 - T1590

Lateral Tool Transfer - LATERAL MOVEMENT - T1570

LLMNR/NBT - NS Poisoning and SMB Relay - CREDENTIAL ACCESS, COLLECTION - T1557.001 - T1557

Modify Alarm Settings - INHIBIT RESPONSE FUNCTION - T0838

Modify Control Logic - IMPAIR PROCESS CONTROL, INHIBIT RESPONSE FUNCTION - T0833

Modify Parameter - IMPAIR PROCESS CONTROL - T0836

Network Service Scanning - DISCOVERY - T1046

Network Share Discovery - DISCOVERY - T1135

Pass the Hash - DEFENSE EVASION, LATERAL MOVEMENT - T1550.002 - T1550

RDP Hijacking - LATERAL MOVEMENT - T1563.002 - T1563

Remote Access Software - COMMAND AND CONTROL - T1219

Remote Desktop Protocol - LATERAL MOVEMENT - T1021.001 - T1021

Remote System Discovery - DISCOVERY - T1018

Rename System Utilities - DEFENSE EVASION - T1036.003 - T1036

Scanning IP Blocks - RECONNAISSANCE - T1595.001 - T1595

Scheduled Transfer - EXFILTRATION - T1029

Service Execution - EXECUTION - T1569.002 - T1569

Service Stop - IMPACT - T1489

SMB/Windows Admin Shares - LATERAL MOVEMENT - T1021.002 - T1021

Stored Data Manipulation - IMPACT - T1565.001 - T1565

Taint Shared Content - LATERAL MOVEMENT - T1080

Valid Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078

Vulnerability Scanning - RECONNAISSANCE - T1595.002 - T1595

Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071

Web Services - RESOURCE DEVELOPMENT - T1583.006 - T1583

Web Shell - PERSISTENCE - T1505.003 - T1505

Windows Management Instrumentation - EXECUTION - T1047

Windows Remote Management - LATERAL MOVEMENT - T1021.006 - T1021

References

1.     https://www.trendmicro.com/en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal.html

2.     https://www.reuters.com/technology/cybersecurity/blacksuit-hacker-behind-cdk-global-attack-hitting-us-car-dealers-2024-06-27/

3.     https://www.sentinelone.com/anthology/blacksuit/

4.     https://thehackernews.com/2024/08/fbi-and-cisa-warn-of-blacksuit.html

5.     https://www.techtarget.com/whatis/feature/The-CDK-Global-outage-Explaining-how-it-happened

6.     https://therecord.media/japanese-media-kadokawa-investigating-cyber

7.     https://therecord.media/plasma-donation-company-cyberattack-blacksuit

8.     https://thecyberexpress.com/government-of-brazil-cyberattack-by-blacksuit/

9.     https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Signe Zaharka
Senior Cyber Security Analyst
Watch the NIS2 Webinar
Book a 1-1 meeting with one of our experts
Get in touch
Share this article
Trending blogs
1
Darktrace Releases 2024 Half-Year Threat Insights
Aug 6, 2024
2
Introducing ‘Defend Beyond’: Our promise to customers in the face of evolving threats
Aug 27, 2024
3
Darktrace: Microsoft UK Partner of the Year 2024
Jun 27, 2024
4
Navigating buying and adoption journeys for AI cybersecurity tools
Oct 15, 2024
5
How Darktrace won an email security trial by learning the business, not the breach
Oct 9, 2024

More in this series

No items found.

Blog

/

November 19, 2024

/
No items found.

Darktrace Leading the Future of Network Detection and Response with Recognition from KuppingerCole

Default blog imageDefault blog image

KuppingerCole has recognized Darktrace as an overall Leader, Product Leader, Market Leader and Innovation Leader in the KuppingerCole Leadership Compass: Network Detection and Response (2024).

With the perimeter all but dissolved, Network Detection and Response (NDR) tools are quickly becoming a critical component of the security stack, as the main tool to span the modern network. NDRs connect on-premises infrastructure to cloud, remote workers, identities, SaaS applications, and IoT/OT – something not available to EDR that requires agents and isolates visibility to individual devices.

KuppingerCole Analysts AG designated Darktrace an ‘Overall Leader’ position because of our continual innovation around user-led security. Self-Learning AI together with automated triage through Cyber AI Analyst and real-time autonomous response actions have been instrumental to security teams in stopping potential threats before they become a breach. With this time saved, Darktrace is leading beyond reactive security to truly harden a network, allowing the team to spend more time in preventive security measures.

Network Detection and Response protects where others fail to reach

NDR solutions operate at the network level, deploying inside or parallel to your network to ingest raw traffic via virtual or physical sensors. This gives them unprecedented potential to identify anomalies and possible breaches in any network - far beyond simple on-prem, into dynamic virtual environments, cloud or hybrid networks, cloud applications, and even remote devices accessing the corporate network via ZTNA or VPN.

Rather than looking at processes level data, NDR can detect the lateral movement of an adversary across multiple assets by analyzing network traffic patterns which endpoint solutions may not be able to identify [1]. In the face of a growing, complex environment, organizations large and small, will benefit from using NDRs either in conjunction, or as the foundation for, their Extended Detection and Response (XDR) for a unified view that improves their overall threat detection, ease of investigation and faster response times.

Today's NDR solutions are expected to include advanced ML and artificial intelligence (AI) algorithms [1]

Traditional IDS & IPS systems are labor intensive, requiring continuous rule creation, outdated signature maintenance, and manual monitoring for false positives or incorrect actions. This is no longer viable against a higher volume and changing landscape, making NDR the natural network tool to level against these evolutions. The role of AI in NDRs is designed to meet this challenge, “to reduce both the labor need for analysis and false positives, as well as add value by improving anomaly detection and overall security posture” .

Celebrating success in leadership and innovation

Darktrace is proud to have been recognized as an NDR “Overall Leader” in KuppingerCole Analyst AG’s Leadership Compass. The report gave further recognition to Darktrace as a ‘Product Leader”, “Innovation Leader” and “Market Leader”.

Maximum scores were received for core product categories, in addition to market presence and financial strength. Particular attention was directed to our innovation. This year has seen several NDR updates via Darktrace’s ActiveAI Security Platform version 6.2 which has enhanced investigation workflows and provided new AI transparency within the toolset.

Positive scores were also received for Darktrace’s deployment ecosystem and surrounding support, minimizing the need for extraneous integrations through a unique platform architecture that connects with over 90 other vendors.

High Scores received in Darktrace’s KuppingerCole Spider Chart across Core NDR capability areas
Figure 1: High Scores received in Darktrace’s KuppingerCole Spider Chart across Core NDR capability areas

Darktrace’s pioneering AI approach sets it apart

Darktrace / NETWORK’s approach is fundamentally different to other NDRs. Continual anomaly-based detection (our Self-Learning AI), understands what is normal across each of your network entities, and then examines deviations from these behaviors rather than needing to apply static rules or ML to adversary techniques. As a result, Darktrace / NETWORK can focus on surfacing the novel threats that cannot be anticipated, whilst our proactive solutions expose gaps that can be exploited and reduce the risk of known threats.    

Across the millions of possible network events that may occur, Darktrace’s Cyber AI Analyst reduces that manual workload for SOC teams by presenting only what is most important in complete collated incidents. This accelerates SOC Level 2 analyses of incidents by 10x2, giving time back, first for any necessary response and then for preventive workflows.

Finally, when incidents begin to escalate, Darktrace can natively (or via third-party) autonomously respond and take precise actions based on a contextual understanding of both the affected assets and incident in question so that threats can be disarmed without impacting wider operations.

Within the KuppingerCole report, several standout strengths were listed:

  • Cyber AI Analyst was celebrated as a core differentiator, enhancing both visibility and investigation into critical network issues and allowing a faster response.
  • Darktrace / NETWORK was singled for its user benefits. Both a clear interface for analysts with advanced filtering and analytical tools, and efficient role-based access control (RBAC) and configuration options for administrators.
  • At the product level, Darktrace was recognized for complete network traffic analysis (NTA) capabilities allowing extensive analysis into components like application use/type, fingerprinting, source/destination communication, in addition to comprehensive protocol support across a range of network device types from IT, OT, IoT and mobiles and detailed MITRE ATT&CK mapping.
  • Finally, at the heart of it, Darktrace’s innovation was highlighted in relation to its intrinsic Self Learning AI, utilizing multiple layers of deep learning, neural networks, LLMs, NLP, Generative AI and more to understand network activity and filter it for what’s critical on an individual customer level.

Going beyond reactive security

Darktrace’s visibility and AI-enabled detection, investigation and response enable security teams to focus on hardening gaps in their network through contextual relevance & priority. Darktrace / NETWORK explicitly gives time back to security teams allowing them to focus on the bigger strategic and governance workflows that sometimes get overlooked. This is enabled through proactive solutions intrinsically connected to our NDR:

  • Darktrace / Proactive Exposure Management, which looks beyond just CVE risks to instead discover, prioritize and validate risks by business impact and how to mobilize against them early, to reduce the number of real threats security teams face.
  • Darktrace / Incident Readiness & Recovery, a solution rather than service-based approach to incident response (IR) that lets teams respond in the best way to each incident and proactively test their familiarity and effectiveness of IR workflows with sophisticated incident simulations involving their own analysts and assets.

Together, these solutions allow Darktrace / NETWORK to go beyond the traditional NDR and shift teams to a more hardened and proactive state.

Putting customers first

Customers continue to sit at the forefront of Darktrace R&D, with their emerging needs and pain points being the direct inspiration for our continued innovation.

This year Darktrace / NETWORK has protected thousands of customers against the latest attacks, from data exfil and destruction, to unapproved privilege escalation and ransomware including strains like Medusa, Qilin and AlphV BlackCat.

In each instance, Darktrace / NETWORK was able to provide a holistic lens of the anomalies present in their traffic, collated those that were important, and either responded or gave teams the ability to take targeted actions against their threats – even when adversaries pivoted. In one example of a Gootloader compromise, Darktrace ensured a SOC went from detection to recovery within 5 days, 92.8% faster than the average containment time of 69 days.

Results like these, focused on user-led security, have secured Darktrace’s position within the latest NDR Leadership Compass.

To find out more about what makes Darktrace / NETWORK special, read the full KuppingerCole report.

References

[1] Osman Celik, KuppingerCole Leadership Compass:Network Detection and Response (2024)

[2] Darktrace's AI Analyst customer fleet data

[3] https://www.ibm.com/reports/data-breach

Continue reading
About the author
Gabriel Few-Wiegratz
Product Marketing Manager

Blog

/

November 7, 2024

/

Inside the SOC

Onomastics Gymnastics: How Darktrace Detects Spoofing and Business Email Compromise in Multi-Name Users

Default blog imageDefault blog image

Note: For privacy reasons, actual surnames and email addresses observed in these incidents below have been replaced with fictitious placeholder names, using the common Spanish names “Fulano” and “Mengano”.

Naming conventions

Modeling names and their variants of members of an organization is a critical component to properly detect if those same names and variants are being spoofed by malicious actors. For many predominantly English-speaking organizations, these variants can largely be captured by variants of a person’s given name (e.g. James-Jimmy-Jim) and a consistent, singular surname or family name (e.g. Smith). Naming conventions, however, are far from universal. This piece will review how Darktrace / EMAIL manages the common naming conventions of much of the Spanish-speaking world, and can use its modeling to create high-fidelity detections of multiple types of spoofing attempts.

A brief summary of the common convention across Spain and much of Spanish-speaking America: most people are given one or two given names (e.g. Roberto, Juan, María, Natalia), and their surnames are the first surname of their father, followed by the first surname of their mother. While there are various exceptions to this norm, the below graphic Wikipedia [1][2] highlights the general rule.

Example Spanish naming convention for father “José García Torres” and mother “María Acosta Gómez” for child “Pablo García Acosta”. If shortened to one surname, the convention holds the child would be referred to as “Pablo García”
Figure 1: Example Spanish naming convention for father “José García Torres” and mother “María Acosta Gómez” for child “Pablo García Acosta”. If shortened to one surname, the convention holds the child would be referred to as “Pablo García” [1].

Detection of improper name usage

Implicit in the above comment that shortening to one surname follows the convention of using the first surname, shortening to the second surname is often a tell-tale sign of someone unfamiliar with the person or their broader culture. This can be a useful corroborating feature in detecting a spoof attempt – analogous to a spelling error.

In the case of a Spanish customer, this misuse of name shortening contributed to the detection of a spoof attempt trying to solicit a response by impersonating an internal user forwarding information about ‘Data Protection’.

Figure 2: The Cyber AI Analyst summary of the Darktrace / EMAIL detections shows the use of the Gmail sender impersonating Isabel Maria Fulano Mengano, but incorrectly uses the second surname Mengano.

While the limited communication history from the sender and the nature of the text content already marks the mail as suspicious, Darktrace / EMAIL notes the personal name used in the email is similar to a high-value user (‘whale’ to use the terminology of spearphishing). The additional context provided by the detection of the attempted spoof prompted more severe actioning of this email, leading to a ‘Hold’ action instead of a less-severe ‘Unspoof’ action via a banner on the email.

The content summary of the sender showing the ‘Personal’ field of the email being ‘Isabel Mengano’, breaking from the standard name-shortening convention. The additional metrics identify features that might be anomalous about the sender.
Figure 3: The content summary of the sender showing the ‘Personal’ field of the email being ‘Isabel Mengano’, breaking from the standard name-shortening convention. The additional metrics identify features that might be anomalous about the sender.

Malicious email properly using both surnames

Misusing the name-shortening convention is not the only way that Darktrace / EMAIL can detect spoofing attempts. In the case of another Spanish customer,  Darktrace observed a whale impersonation being sent to 230 users with solicitation content, but no links or attachments. Although the name was modeled internally in the “Surname, Given-name” format, Darktrace identified the spoofing attempt targeting a high-value user and took action, blocking the series of emails from reaching end-user inboxes to prevent unsuspecting users from responding.

Cyber AI Analyst summary of a suspicious email
Figure 4: Cyber AI Analyst summary of a suspicious email. The personal field is visible as ‘juan fulano mengano’, which is consistent with the reverse-order modelled user ‘fulano mengano, juan’. The subject line ‘Urgent Request’ sent to 230 users gives an intuitive indicator of the emails potentially being part of a malicious solicitation campaign.

In Summary: A case of onomastics gymnastics

The variety in valid usage of human language can be a barrier to evaluating when a given text is benign or malicious. Despite this, Darktrace / EMAIL is designed to manage this variety, as exemplified by the detections of two spoofing attempts seen against organizations using the distinct Spanish-speaking world’s common naming convention. The scope of this design as seen in this onomastic context, extends to a wide range of detections surrounding emails and their behavioral anomalies.

Credit to Roberto Romeu (Principal Cyber Analyst), Justin Torres (Senior Cyber Analyst) and Natalia Sánchez Rocafort (Senior Analyst Consultant).

Darktrace / Email solution brief screenshot

Secure Your Inbox with Cutting-Edge AI Email Protection

Discover the most advanced cloud-native AI email security solution to protect your domain and brand while preventing phishing, novel social engineering, business email compromise, account takeover, and data loss.

  • Gain up to 13 days of earlier threat detection and maximize ROI on your current email security
  • Experience 20-25% more threat blocking power with Darktrace / EMAIL
  • Stop the 58% of threats bypassing traditional email security

‍

References

[1] https://en.wikipedia.org/wiki/Naming_customs_of_Hispanic_America

[2] https://en.wikipedia.org/wiki/Spanish_naming_customs

Continue reading
About the author
Roberto Romeu
Senior SOC Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI