Blog
/

Inside the SOC

/
March 14, 2023

Defending Against Crypto Thieves with DETECT + RESPOND

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
14
Mar 2023
Cyber criminals steal from crypto-currency platforms. Learn how Darktrace uncovered Lapalas Clipper activity & defended against cryptocurrency thieves.

Between June 2021 and June 2022, crypto-currency platforms around the world lost an estimated 44 billion USD to cyber criminals, whose modus operandi range from stealing passwords and account recovery phrases, to cryptojacking and directly targeting crypto-currency transactions. 

There has been a recent rise in cases of cyber criminals’ using information stealer malware to gather and exfiltrate sensitive crypto-currency wallet details, ultimately leading to the theft of significant sums of digital currency. Having an autonomous decision maker able to detect and respond to potential compromises is crucial to safeguard crypto wallets and transactions against would-be attackers.

In late 2022, Darktrace observed several threat actors employing a novel attack method to target crypto-currency users across its customer base, specifically the latest version of the Laplas Clipper malware. Using Self-Learning AI, Darktrace DETECT/Network™ and Darktrace RESPOND/Network™ were able to uncover and mitigate Laplas Clipper activity and intervene to prevent the theft of large sums of digital currency.

Laplas Clipper Background

Laplas Clipper is a variant of information stealing malware which operates by diverting crypto-currency transactions from victims’ crypto wallets into the wallets of threat actors [1]. Laplas Clipper is a Malware-as-a-Service (MaaS) offering available for purchase and use by a variety of threat actors. It has been observed in the wild since October 2022, when 180 samples were identified and linked with another malware strain, namely SmokeLoader [2]. This loader has itself been observed since at least 2011 and acts as a delivery mechanism for popular malware strains [3]. 

SmokeLoader is typically distributed via malicious attachments sent in spam emails or targeted phishing campaigns but can also be downloaded directly by users from file hosting pages or spoofed websites. SmokeLoader is known to specifically deliver Laplas Clipper onto compromised devices via a BatLoader script downloaded as a Microsoft Word document or a PDF file attached to a phishing email. These examples of social engineering are relatively low effort methods intended to convince users to download the malware, which subsequently injects malicious code into the explorer.exe process and downloads Laplas Clipper.

Laplas Clipper activity observed across Darktrace’s customer base generally began with SmokeLoader making HTTP GET requests to Laplas Clipper command and control (C2) infrastructure. Once downloaded, the clipper loads a ‘build[.]exe’ module and begins monitoring the victim’s clipboard for crypto-currency wallet addresses. If a wallet address is identified, the infected device connects to a server associated with Laplas Clipper and downloads wallet addresses belonging to the threat actor. The actor’s addresses are typically spoofed to appear similar to those they replace in order to evade detection. The malware continues to update clipboard activity and replaces the user’s wallet addresses with a spoofed address each time one is copied for a for crypto-currency transactions.

Darktrace Coverage of Laplas Clipper and its Delivery Methods 

In October and November 2022, Darktrace observed a significant increase in suspicious activity associated with Laplas Clipper across several customer networks. The activity consisted largely of:  

  1. User devices connecting to a suspicious endpoint.  
  2. User devices making HTTP GET requests to an endpoint associated with the SmokeLoader loader malware, which was installed on the user’s device.
  3. User devices making HTTP connections to the Laplas Clipper download server “clipper[.]guru”, from which it downloads spoofed wallet addresses to divert crypto-currency payments. 

In one particular instance, a compromised device was observed connecting to endpoints associated with SmokeLoader shortly before connecting to a Laplas Clipper download server. In other instances, devices were detected connecting to other anomalous endpoints including the domains shonalanital[.]com, transfer[.]sh, and pc-world[.]uk, which appears to be mimicking the legitimate endpoint thepcworld[.]com. 

Additionally, some compromised devices were observed attempting to connect malicious IP addresses including 193.169.255[.]78 and 185.215.113[.]23, which are associated with the RedLine stealer malware. Additionally, Darktrace observed connections to the IP addresses 195.178.120[.]154 and 195.178.120[.]154, which are associated with SmokeLoader, and 5.61.62[.]241, which open-source intelligence has associated with Cobalt Strike. 

Figure 1: Beacon to Young Endpoint model breach demonstrating Darktrace’s ability to detect external connections that are considered extremely rare for the network.
Figure 2: The event log of an infected device attempting to connect to IP addresses associated with the RedLine stealer malware, and the actions RESPOND took to block these attempts.

The following DETECT/Network models breached in response to these connections:

  • Compromise / Beacon to Young Endpoint 
  • Compromise / Slow Beaconing Activity to External Rare 
  • Compromise / Beacon for 4 Days
  • Compromise / Beaconing Activity to External Rare
  • Compromise / Sustained TCP Beaconing Activity to Rare Endpoint 
  • Anomalous Connection / Multiple Failed Connections to Rare Endpoints 
  • Compromise / Large Number of Suspicious Failed Connections 
  • Compromise / HTTP Beaconing to Rare Destination 
  • Compromise / Post and Beacon to Rare External 
  • Anomalous Connection / Callback on Web Facing Device 

DETECT/Network is able to identify such activity as its models operate based on a device’s usual pattern of behavior, rather than a static list of indicators of compromise (IOCs). As such, Darktrace can quickly identify compromised devices that deviate for their expected pattern of behavior by connecting to newly created malicious endpoints or C2 infrastructure, thereby triggering an alert.

In one example, RESPOND/Network autonomously intercepted a compromised device attempting to connect to the Laplas Clipper C2 server, preventing it from downloading SmokeLoader and subsequently, Laplas Clipper itself.

Figure 3: The event log of an infected device attempting to connect to the Laplas Clipper download server, and the actions RESPOND/Network took to block these attempts.

In another example, DETECT/Network observed an infected device attempting to perform numerous DNS Requests to a crypto-currency mining pool associated with the Monero digital currency.  

This activity caused the following DETECT/Network models to breach:

  • Compromise / Monero Mining
  • Compromise / High Priority Crypto Currency Mining 

RESPOND/Network quickly intervened, enforcing a previously established pattern of life on the device, ensuring it could not perform any unexpected activity, and blocking the connections to the endpoint in question for an hour. These actions carried out by Darktrace’s autonomous response technology prevented the infected device from carrying out crypto-mining activity, and ensured the threat actor could not perform any additional malicious activity.

Figure 4. The event log of an infected devices showing DNS requests to the Monero crypto-mining pool, and the actions taken to block them by RESPOND/Network.

Finally, in instances when RESPOND/Network was not activated, external connections to the Laplas Clipper C2 server were nevertheless monitored by DETECT/Network, and the customer’s security team were notified of the incident.

Conclusion 

The rise of information stealing malware variants such as Laplas Clipper highlights the importance of crypto-currency and crypto-mining in the malware ecosystem and more broadly as a significant cyber security concern. Crypto-mining is often discounted as background noise for security teams or compliance issues that can be left untriaged; however, malware strains like Laplas Clipper demonstrate the real security risks posed to digital estates from threat actors focused on crypto-currency. 

Leveraging its Self-Learning AI, DETECT/Network and RESPOND/Network are able to work in tandem to quickly identify connections to suspicious endpoints and block them before any malicious software can be downloaded, safeguarding customers.

Appendices

List of IOCs 

a720efe2b3ef7735efd77de698a5576b36068d07 - SHA1 Filehash - Laplas Malware Download

conhost.exe - URI - Laplas Malware Download

185.223.93.133 - IP Address - Laplas C2 Endpoint

185.223.93.251 - IP Address - Laplas C2 Endpoint

45.159.189.115 - IP Address - Laplas C2 Endpoint

79.137.204.208 - IP Address - Laplas C2 Endpoint

5.61.62.241 - IP Address - Laplas C2 Endpoint

clipper.guru - URI - Laplas C2 URI

/bot/online?guid= - URI - Laplas C2 URI

/bot/regex?key= - URI - Laplas C2 URI

/bot/get?address - URI - Laplas C2 URI

Mitre Attack and Mapping 

Initial Access:

T1189 – Drive By Compromise 

T1566/002 - Spearphishing

Resource Development:

T1588 / 001 - Malware

Ingress Tool Transfer:

T1105 – Ingress Tool Transfer

Command and Control:

T1071/001 – Web Protocols 

T1071 – Application Layer Protocol

T1008 – Fallback Channels

T1104 – Multi-Stage Channels

T1571 – Non-Standard Port

T1102/003 – One-Way Communication

T1573 – Encrypted Channel

Persistence:

T1176 – Browser Extensions

Collection:

T1185 – Man in the Browser

Exfiltration:

T1041 – Exfiltration over C2 Channel

References

[1] https://blog.cyble.com/2022/11/02/new-laplas-clipper-distributed-by-smokeloader/ 

[2] https://thehackernews.com/2022/11/new-laplas-clipper-malware-targeting.html

[3] https://attack.mitre.org/software/S0226/

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Anna Gilbertson
Cyber Security Analyst
Hanah Darley
Director of Threat Research
Watch the NIS2 Webinar
Book a 1-1 meeting with one of our experts
Get in touch
Share this article
Trending blogs
1
Darktrace is Positioned as a Leader in the IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment
Dec 9, 2024
2
Cloud Security: Addressing Common CISO Challenges with Advanced Solutions
Nov 28, 2024
3
Preparing for 2025: Darktrace's Top 10 AI and Cybersecurity Predictions
Nov 3, 2024
4
Navigating Buying and Adoption Journeys for AI Cybersecurity Tools
Oct 15, 2024
5
How Darktrace won an email security trial by learning the business, not the breach
Oct 9, 2024

More in this series

No items found.

Blog

/

January 2, 2025

/

Inside the SOC

A Snake in the Net: Defending Against AiTM Phishing Threats and Mamba 2FA

Default blog imageDefault blog image

What are Adversary-in-the-Middle (AiTM) phishing kits?

Phishing-as-a-Service (PhaaS) platforms have significantly lowered the barriers to entry for cybercriminals, enabling a new wave of sophisticated phishing attacks. Among the most concerning developments in this landscape is the emergence of Adversary-in-the-Middle (AiTM) phishing kits, which enhance traditional phishing tactics by allowing attackers to intercept and manipulate communications in real-time. The PhaaS marketplace offers a wide variety of innovative capabilities, with basic services starting around USD 120 and more advanced services costing around USD 250 monthly [1].

These AiTM kits are designed to create convincing decoy pages that mimic legitimate login interfaces, often pre-filling user information to increase credibility. By acting as a man-in-the-middle, attackers can harvest sensitive data such as usernames, passwords, and even multi-factor authentication (MFA) tokens without raising immediate suspicion. This capability not only makes AiTM attacks more effective but also poses a significant challenge for cybersecurity defenses [2].

Mamba 2FA is one such example of a PhaaS strain with AiTM capabilities that has emerged as a significant threat to users of Microsoft 365 and other enterprise systems. Discovered in May 2024, Mamba 2FA employs advanced AiTM tactics to bypass MFA, making it particularly dangerous for organizations relying on these security measures.

What is Mamba 2FA?

Phishing Mechanism

Mamba 2FA employs highly convincing phishing pages that closely mimic legitimate Microsoft services like OneDrive and SharePoint. These phishing URLs are crafted with a specific structure, incorporating Base64-encoded parameters. This technique allows attackers to tailor the phishing experience to the targeted organization, making the deception more effective. If an invalid parameter is detected, users are redirected to a benign error page, which helps evade automated detection systems [5].

‍

Figure 1: Phishing page mimicking the Microsoft OneDrive service.

Real-Time Communication

A standout feature of Mamba 2FA is its use of the Socket.IO JavaScript library. This library facilitates real-time communication between the phishing page and the attackers' backend servers. As users input sensitive information, such as usernames, passwords, and MFA tokens on the phishing site, this data is immediately relayed to the attackers, enabling swift unauthorized access [5].

Multi-Factor Authentication Bypass

Mamba 2FA specifically targets MFA methods that are not resistant to phishing, such as one-time passwords (OTPs) and push notifications. When a user enters their MFA token, it is captured in real-time by the attackers, who can then use it to access the victim's account immediately. This capability significantly undermines traditional security measures that rely on MFA for account protection.

Infrastructure and Distribution

The platform's infrastructure consists of two main components: link domains and relay servers. Link domains handle initial phishing attempts, while relay servers are responsible for stealing credentials and completing login processes on behalf of the attacker. The relay servers are designed to mask their IP addresses by using proxy services, making it more difficult for security systems to block them [3].

Evasion Techniques

To evade detection by security tools, Mamba 2FA employs several strategies:

  • ‍Sandbox Detection: The platform can detect if it is being analyzed in a sandbox environment and will redirect users to harmless pages like Google’s 404 error page.‍
  • Dynamic URL Generation: The URLs used in phishing attempts are frequently rotated and often short-lived to avoid being blacklisted by security solutions.‍
  • HTML Attachments: Phishing emails often include HTML attachments that appear benign but contain hidden JavaScript that redirects users to the phishing page [5].

Darktrace’s Coverage of Mamba 2FA

Starting in July 2024, the Darktrace Threat Research team detected a sudden rise in Microsoft 365 customer accounts logging in from unusual external sources. These accounts were accessed from an anomalous endpoint, 2607:5500:3000:fea[::]2, and exhibited unusual behaviors upon logging into Software-as-a-Service (SaaS) accounts. This activity strongly correlates with a phishing campaign using Mamba 2FA, first documented in late June 2024 and tracked as Mamba 2FA by Sekoia [2][3].

Darktrace / IDENTITY  was able to identify the initial stages of the Mamba 2FA campaign by correlating subtle anomalies, such as unusual SaaS login locations. Using AI based on peer group analysis, it detected unusual behavior associated with these attacks. By leveraging Autonomous Response actions, Darktrace was able to neutralize these threats in every instance of the campaign detected.

On July 23, a SaaS user was observed logging in from a rare ASN and IP address, 2607:5500:3000:fea::2, originating from the US and successfully passed through MFA authentication.

Figure 2: Model Alert Event Log showing Darktrace’s detection of a SaaS user mailbox logging in from an unusual source it correlates with Mamba 2FA relay server.

Almost an hour later, the SaaS user was observed logging in from another suspicious IP address, 45.133.172[.]86, linked to ASN AS174 COGENT-174. This IP, originating from the UK, successfully passed through MFA validation.

Following this unusual access, the SaaS user was notably observed reading emails and files that could contain sensitive payment and contract information. This behavior suggests that the attacker may have been leveraging contextual information about the target to craft further malicious phishing emails or fraudulent invoices. Subsequently, the user was detected creating a new mailbox rule titled 'fdsdf'. This rule was configured to redirect emails from a specific domain to the 'Deleted Items' folder and automatically mark them as read.

Implications of Unusual Email Rules

Such unusual email rule configurations are a common tactic employed by attackers. They often use these rules to automatically forward emails containing sensitive keywords—such as "invoice”, "payment", or "confidential"—to an external address. Additionally, these rules help conceal malicious activities, keeping them hidden from the target and allowing the attacker to operate undetected.

Figure 3: The model alert “SaaS / Compliance / Anomalous New Email Rule,” pertaining to the unusual email rule created by the SaaS user named ‘fdsdf’.

Blocking the action

A few minutes later, the SaaS user from the unusual IP address 45.133.172[.]86 was observed attempting to send an email with the subject “RE: Payments.” Subsequently, Darktrace detected the user engaging in activities that could potentially establish persistence in the compromised account, such as registering a new authenticator app. Recognizing this sequence of anomalous behaviors, Darktrace implemented an Autonomous Response inhibitor, disabling the SaaS user for two hours. This action effectively contained potential malicious activities, such as the distribution of phishing emails and fraudulent invoices, and gave the customer’s security team the necessary time to conduct a thorough investigation and implement appropriate security measures.

Figure 4: Device Event Log displaying Darktrace’s Autonomous Response taking action by blocking the SaaS account.
Figure 5: Darktrace / IDENTITY highlighting the 16 model alerts that triggered during the observed compromise.

In another example from mid-July, similar activities related to the campaign were observed on another customer network. A SaaS user was initially detected logging in from the unusual external endpoint 2607:5500:3000:fea[::]2.

Figure 6: The SaaS / Compromise / SaaS Anomaly Following Anomalous Login model alert was triggered by an unusual login from a suspicious IP address linked to Mamba 2FA.

A few minutes later, in the same manner as demonstrated in the previous case, the actor was observed logging in from another rare endpoint, 102.68.111[.]240. However, this time it was from a source IP located in Lagos, Nigeria, which no other user on the network had been observed connecting from. Once logged in, the SaaS user updated the settings to "User registered Authenticator App with Notification and Code," a possible attempt to maintain persistence in the SaaS account.

Figure 7: Darktrace / IDENTITY highlighted the regular locations for the SaaS user. The rarity scores associated with the Mamba 2FA IP location and another IP located in Nigeria were classified as having very low regularity scores for this user.

Based on unusual patterns of user behavior, a Cyber AI Analyst Incident was also generated, detailing all potential account hijacking activities. Darktrace also applied an Autonomous Response action, disabling the user for over five hours. This swift action was crucial in preventing further unauthorized access, potential data breaches and further implications.

Figure 8: Cyber AI Analyst Incident detailing the unusual activities related to the SaaS account hijacking.

Since the customer had subscribed to Darktrace Security Operations Centre (SOC) services, Darktrace analysts conducted an additional human investigation confirming the account compromise.

How Darktrace Combats Phishing Threats

The initial entry point for Mamba 2FA account compromises primarily involves phishing campaigns using HTML attachments and deceptive links. These phishing attempts are designed to mimic legitimate Microsoft services, such as OneDrive and SharePoint, making them appear authentic to unsuspecting users. Darktrace / EMAIL leverages multiple capabilities to analyze email content for known indicators of phishing. This includes looking for suspicious URLs, unusual attachments (like HTML files with embedded JavaScript), and signs of social engineering tactics commonly used in phishing campaigns like Mamba 2FA. With these capabilities, Darktrace successfully detected Mamba 2FA phishing emails in networks where this tool is integrated into the security layers, consequently preventing further implications and account hijacks of their users.

Mamba 2FA URL Structure and Domain Names

The URL structure used in Mamba 2FA phishing attempts is specifically designed to facilitate the capture of user credentials and MFA tokens while evading detection. These phishing URLs typically follow a pattern that incorporates Base64-encoded parameters, which play a crucial role in the operation of the phishing kit.

The URLs associated with Mamba 2FA phishing pages generally follow this structure [6]:

https://{domain}/{m,n,o}/?{Base64 string}

Below are some potential Mamba 2FA phishing emails, with the Base64 strings already decoded, that were classified as certain threats by Darktrace / EMAIL. This classification was based on identifying multiple suspicious characteristics, such as HTML attachments containing JavaScript code, emails from senders with no previous association with the recipients, analysis of redirect links, among others. These emails were autonomously blocked from being delivered to users' inboxes.

Figure 9: Darktrace / EMAIL highlighted a possible phishing email from Mamba 2FA, which was classified as a 100% anomaly.
Figure 10: Darktrace / EMAIL highlighted a URL that resembles the characteristics associated with Mamba 2FA.

Conclusion

The rise of PhaaS platforms and the advent of AiTM phishing kits represent a concerning evolution in cyber threats, pushing the boundaries of traditional phishing tactics and exposing significant vulnerabilities in current cybersecurity defenses. The ability of these attacks to effortlessly bypass traditional security measures like MFA underscores the need for more sophisticated, adaptive strategies to combat these evolving threats.

By identifying and responding to anomalous activities within Microsoft 365 accounts, Darktrace not only highlights the importance of comprehensive monitoring but also sets a new standard for proactive threat detection. Furthermore, the autonomous threat response capabilities and the exceptional proficiency of Darktrace / EMAIL in intercepting and neutralizing sophisticated phishing attacks illustrate a robust defense mechanism that can effectively safeguard users and maintain the integrity of digital ecosystems.

Credit to Patrick Anjos (Senior Cyber Analyst) and Nahisha Nobregas (Senior Cyber Analyst)

Appendices

Darktrace Model Detections

  • SaaS / Access / M365 High Risk Level Login
  • SaaS / Access / Unusual External Source for SaaS Credential Use
  • SaaS / Compromise / Login From Rare Endpoint While User Is Active
  • SaaS / Compliance / M365 Security Information Modified
  • SaaS / Compromise / Unusual Login and New Email Rule
  • SaaS / Email Nexus / Suspicious Internal Exchange Activity
  • SaaS / Compliance / Anomalous New Email Rule
  • SaaS / Email Nexus / Possible Outbound Email Spam
  • SaaS / Compromise / Unusual Login and Account Update
  • SaaS / Compromise / SaaS Anomaly Following Anomalous Login
  • SaaS / Compliance / M365 Security Information Modified
  • SaaS / Compromise / Login From Rare Endpoint While User Is Active
  • SaaS / Compromise / Unusual Login, Sent Mail, Deleted Sent
  • SaaS / Unusual Activity / Multiple Unusual SaaS Activities
  • SaaS / Email Nexus / Unusual Login Location Following Link to File Storage
  • SaaS / Unusual Activity / Multiple Unusual External Sources For SaaS Credential
  • IaaS / Compliance / Uncommon Azure External User Invite
  • SaaS / Compliance / M365 External User Added to Group
  • SaaS / Access / M365 High Risk Level Login
  • SaaS / Compliance / M365 Security Information Modified
  • SaaS/ Unusual Activity / Unusual MFA Auth and SaaS Activity
  • SaaS / Compromise / Unusual Login and Account Update

Cyber AI Analyst Incidents:

  • Possible Hijack of Office365 Account
  • Possible Hijack of AzureActiveDirectory Account
  • Possible Unsecured Office365 Resource

List of Indicators of Compromise (IoCs)

IoC       Type    Description + Confidence

2607:5500:3000:fea[::]2 - IPv6 - Possible Mamba 2FA relay server

2607:5500:3000:1cab:[:]2 - IPv6 - Possible Mamba 2FA relay server

References

1.     https://securityaffairs.com/136953/cyber-crime/caffeine-phishing-platform.html

2.     https://any.run/cybersecurity-blog/analysis-of-the-phishing-campaign/

3.     https://www.bleepingcomputer.com/news/security/new-mamba-2fa-bypass-service-targets-microsoft-365-accounts/

4.     https://cyberinsider.com/microsoft-365-accounts-targeted-by-new-mamba-2fa-aitm-phishing-threat/

5.     https://blog.sekoia.io/mamba-2fa-a-new-contender-in-the-aitm-phishing-ecosystem/

MITRE ATT&CK Mapping

Tactic – Technique

DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - Cloud Accounts

DISCOVERY - Cloud Service Dashboard

RESOURCE DEVELOPMENT - Compromise Accounts

CREDENTIAL ACCESS - Steal Web Session Cookie

PERSISTENCE - Account Manipulation

PERSISTENCE - Outlook Rules

RESOURCE DEVELOPMENT - Email Accounts

INITIAL ACCESS - Phishing

Continue reading
About the author
Patrick Anjos
Senior Cyber Analyst

Blog

/

December 19, 2024

/
No items found.

Darktrace Recognized in the Gartner® Magic Quadrant™ for Email Security Platforms

Default blog imageDefault blog image

Darktrace has been recognized in the first ever Gartner Magic Quadrant for Email Security Platforms (ESP).  As a Challenger, we have been recognized based on our Ability to Execute and Completeness of Vision.

The Gartner Magic Quadrant for Email Security is designed to help organizations evaluate which email security solutions might be the best fit for their needs by providing a visual representation of the market vendors and the strengths and cautions of different vendors. We encourage our customers to read the full report to get the complete picture.

Darktrace / EMAIL has a unique AI approach to identifying threats, including NLP and behavioral analysis, instead of traditional security measures like signatures and sandboxing – providing protection against advanced attacks like Business Email Compromise (BEC) and spear phishing. We believe our AI-first approach delivers high-quality solutions that our customers trust, allowing them to stay ahead of sophisticated threats that other tools miss.  

We’re proud of Darktrace’s rapid growth, geographic scale, and ability to execute effectively in the email security market, which reflect our commitment to delivering high-quality, reliable solutions that meet the evolving needs of our customers.

What do we believe makes Darktrace the fastest growing email security solution on the market?

An AI-first approach to innovation: Catching the threats others miss

As one of the founders of the ICES category, Darktrace has a long history of innovation, backed by over 200 patents. While other email security solutions are only just starting to apply machine learning (ML) techniques to outdated methods like signature analysis, reputation lists, and sandboxing, Darktrace has redefined the approach to email threat detection with its pioneering AI-driven anomaly detection engine.

Traditional ESPs often miss advanced threats because they rely on rules and signatures that focus on payloads and blindly trust known sources. This approach requires constant updates and frequently fails to detect threats like Business Email Compromise and Spear Phishing. In contrast, Darktrace / EMAIL uses advanced anomaly detection to identify the most sophisticated threats by focusing on unusual patterns and behaviors. This innovative approach has consistently delivered superior detection, stopping on average 58% of the threats that other solutions in the security stack miss.1

But our AI-first approach doesn’t stop at the inbox. At Darktrace, we transcend the limitations of traditional email security by leveraging a platform that unifies insights across multiple domains, providing robust protection against multi-domain threats. Our award-winning solutions defend the most popular attack vectors, including email, messaging, network, and identity protection. By combining signals from all domains, we establish unique behavioral profiles for each device and user, significantly enhancing detection precision.  

This pioneering approach has led to introducing industry-first advancements like QR code analysis and automated incident investigations, alongside game-changing functionality including:

  • Microsoft Teams security with advanced messaging analysis: The ability to identify critical early phishing and insider threats across both email and Microsoft Teams messaging.  
  • AI analyst narratives for improved end user reporting: that reduces phishing investigations by 60% by exposing unique narratives that provide the context of each received email and give feedback to each employee as they interact with their mail.2
  • Mailbox Security Assistant: to perform advanced behavioral browser analysis and stop malicious links within webpages, detecting and remediating 70% more malicious phishing links than traditional tools.3  
  • AI based, autonomous data loss prevention: to immediately secure your organization from misdirected emails, insider threats, and data loss—both classified and unclassified- without any administrative overhead.

Customer trust that fuels exponential growth

With almost 5,000 customers in under 5 years, we've doubled the growth rate of other vendors in the email security market. Our rapid market penetration, fueled by customer satisfaction and pioneering technology, showcases our revolutionary approach and sets new industry standards. 

Darktrace’s exceptional customer retention is fueled by an unparalleled customer experience, extensive regional support, dedicated account teams, and cutting-edge scalable technology. We pride ourselves on having a global network with local expertise, consisting of 110 worldwide offices which provide local language and technical support to offer multilingual, in-house assistance to our customer base.

Check it out – Darktrace / EMAIL has the highest percentage of 5-star ratings with a 4.8 rating on Gartner® Peer Insights™.4

Supporting every stage of your email security journey

Darktrace / EMAIL supports your security maturity journey, from first time security buyers to mature security stacks looking to augment their existing ESPs – by handling advanced threats without extensive tuning. And unlike other solutions that create a siloed and parallel solution, it works harmoniously with native email providers to create a modern email security stack. That’s why Darktrace performs well with first-time email security buyers and has strong renewal rates.

Integrating with Microsoft and Google via API, we replace traditional Secure Email Gateways (SEGs) with a modern, comprehensive email security stack. By combining approaches, our solution merges attack-centric analysis, which learns attack patterns and threat intelligence, with a business-centric approach that understands user behavior and inbox activity to deliver a unified stack that defends the entire threat spectrum – leading Darktrace to be recognized as Microsoft Partner of the year UK 2024.  

Our user-friendly, self-learning AI solution requires minimal tuning and deployment, making it perfect for customers looking for a highly usable but lightly configurable solution that will accompany them throughout their lifetime as they mature their email security stack in line with the evolving threat landscape.

Learn more

Get complimentary access to the full Gartner® Magic Quadrant™ for Email Security Platforms here.

To learn more about Darktrace / EMAIL or to get a free demo, check out the product hub.

References

1 From September 1 – December 31 2023, 58% of the phishing emails analyzed by Darktrace / EMAIL had already passed through native spam filtering and email security controls. (Darktrace End of Year Threat Report 2023)

2 When customers deployed the Darktrace / EMAIL Outlook Add-in there was a 60% decrease in incorrectly reported phishing emails. Darktrace Internal Research, 2024

3 Once a user reports phishing that contains a link, an automated second level triage engages our link analysis infrastructure expanding the signals analyzed. Darktrace Internal Research, 2024

4 Based on 252 reviews as of 19th December 2024

Continue reading
About the author
Carlos Gray
Product Manager
Your data. Our AI.
Elevate your network security with Darktrace AI