Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Roberto Romeu
Senior SOC Analyst
Share
10
Feb 2023
In the latter half of 2022, Darktrace observed a rise in Vidar Stealer infections across its client base. These infections consisted in a predictable series of network behaviors, including usage of certain social media platforms for the retrieval of Command and Control (C2) information and usage of certain URI patterns in C2 communications. In the blog post, we will provide details of the pattern of network activity observed in these Vidar Stealer infections, along with details of Darktrace’s coverage of the activity.
Background on Vidar Stealer
Vidar Stealer, first identified in 2018, is an info-stealer capable of obtaining and then exfiltrating sensitive data from users’ devices. This data includes banking details, saved passwords, IP addresses, browser history, login credentials, and crypto-wallet data [1]. The info-stealer, which is typically delivered via malicious spam emails, cracked software websites, malicious ads, and websites impersonating legitimate brands, is known to access profiles on social media platforms once it is running on a user’s device. The info-stealer does this to retrieve the IP address of its Command and Control (C2) server. After retrieving its main C2 address, the info-stealer, like many other info-stealers, is known to download several third-party Dynamic Link Libraries (DLLs) which it uses to gain access to sensitive data saved on the infected device. The info-stealer then bundles the sensitive data which it obtains and sends it back to the C2 server.
Details of Attack Chain
In the second half of 2022, Darktrace observed the following pattern of activity within many client networks:
1. User’s device makes an HTTPS connection to Telegram and/or to a Mastodon server
2. User’s device makes an HTTP GET request with an empty User-Agent header, an empty Host header and a target URI consisting of 4 digits to an unusual, external endpoint
3. User’s device makes an HTTP GET request with an empty User-Agent header, an empty Host header and a target URI consisting of 10 digits followed by ‘.zip’ to the unusual, external endpoint
4. User’s device makes an HTTP POST request with an empty User-Agent header, an empty Host header, and the target URI ‘/’ to the unusual, external endpoint
Figure 1: The above network logs, taken from Darktrace’s Advanced Search interface, show an infected device contacting Telegram and then making a series of HTTP requests to 168.119.167[.]188
Figure 2: The above network logs, taken from Darktrace’s Advanced Search interface, show an infected device contacting a Mastadon server and then making a series of HTTP requests to 107.189.31[.]171
Each of these activity chains occurred as the result of a user running Vidar Stealer on their device. No common method was used to trick users into running Vidar Stealer on their devices. Rather, a variety of methods, ranging from malspam to cracked software downloads appear to have been used.
Once running on a user’s device, Vidar Stealer went on to make an HTTPS connection to either Telegram (https://t[.]me/) or a Mastodon server (https://nerdculture[.]de/ or https://ioc[.]exchange/). Telegram and Mastodon are social media platforms on which users can create profiles. Malicious actors are known to create profiles on these platforms and then to embed C2 information within the profiles’ descriptions [2]. In the Vidar cases observed across Darktrace’s client base, it seems that Vidar contacted Telegram and/or Mastodon servers in order to retrieve the IP address of its C2 server from a profile description. Since social media platforms are typically trusted, this ‘Dead Drop’ method of sharing C2 details with malware samples makes it possible for threat actors to regularly update C2 details without the communication of these changes being blocked.
Figure 3: A screenshot a profile on the Mastodon server, nerdculture[.]de. The profile’s description contains a C2 address
After retrieving its C2 address from the description of a Telegram or Mastodon profile, Vidar went on to make an HTTP GET request with an empty User-Agent header, an empty Host header and a target URI consisting of 4 digits to its C2 server. The sequences of digits appearing in these URIs are campaign IDs. The C2 server responded to Vidar’s GET request with configuration details that likely informed Vidar’s subsequent data stealing activities.
After receiving its configuration details, Vidar went on to make a GET request with an empty User-Agent header, an empty Host header and a target URI consisting of 10 digits followed by ‘.zip’ to the C2 server. This request was responded to with a ZIP file containing legitimate, third-party Dynamic Link Libraries such as ‘vcruntime140.dll’. Vidar used these libraries to gain access to sensitive data saved on the infected host.
Figure 4: The above PCAP provides an example of the configuration details provided by a C2 server in response to Vidar’s first GET request
Figure 5: Examples of DLLs included within ZIP files downloaded by Vidar samples
After downloading a ZIP file containing third-party DLLs, Vidar made a POST request containing hundreds of kilobytes of data to the C2 endpoint. This POST request likely represented exfiltration of stolen information.
Darktrace Coverage
After infecting users’ devices, Vidar contacted either Telegram or Mastodon, and then made a series of HTTP requests to its C2 server. The info-stealer’s usage of social media platforms, along with its usage of ZIP files for tool transfer, complicate the detection of its activities. The info-stealer’s HTTP requests to its C2 server, however, caused the following Darktrace DETECT/Network models to breach:
Anomalous File / Zip or Gzip from Rare External Location
Anomalous File / Numeric File Download
Anomalous Connection / Posting HTTP to IP Without Hostname
These model breaches did not occur due to users’ devices contacting IP addresses known to be associated with Vidar. In fact, at the time that the reported activities occurred, many of the contacted IP addresses had no OSINT associating them with Vidar activity. The cause of these model breaches was in fact the unusualness of the devices’ HTTP activities. When a Vidar-infected device was observed making HTTP requests to a C2 server, Darktrace recognised that this behavior was highly unusual both for the device and for other devices in the network. Darktrace’s recognition of this unusualness caused the model breaches to occur.
Vidar Stealer infections move incredibly fast, with the time between initial infection and data theft sometimes being less than a minute. In cases where Darktrace’s Autonomous Response technology was active, Darktrace RESPOND/Network was able to autonomously block Vidar’s connections to its C2 server immediately after the first connection was made.
Figure 6: The Event Log for an infected device, shows that Darktrace RESPOND/Network autonomously intervened 1 second after the device first contacted the C2 server 95.217.245[.]254
Conclusion
In the latter half of 2022, a particular pattern of activity was prolific across Darktrace’s client base, with the pattern being seen in the networks of customers across a broad range of industry verticals and sizes. Further investigation revealed that this pattern of network activity was the result of Vidar Stealer infection. These infections moved fast and were effective at evading detection due to their usage of social media platforms for information retrieval and their usage of ZIP files for tool transfer. Since the impact of info-stealer activity typically occurs off-network, long after initial infection, insufficient detection of info-stealer activity leaves victims at risk of attackers operating unbeknownst to them and of powerful attack vectors being available to launch broad compromises.
Despite the evasion attempts made by the operators of Vidar, Darktrace DETECT/Network was able to detect the unusual HTTP activities which inevitably resulted from Vidar infections. When active, Darktrace RESPOND/Network was able to quickly take inhibitive actions against these unusual activities. Given the prevalence of Vidar Stealer [3] and the speed at which Vidar Stealer infections progress, Autonomous Response technology proves to be vital for protecting organizations from info-stealer activity.
Thanks to the Threat Research Team for its contributions to this blog.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Hiding in Plain Sight: Uncovering a Multi-Stage Ransomware Attack Through Behavioral Detection
Darktrace detected a multi-stage ransomware intrusion from its earliest stages, identifying reconnaissance, privilege escalation, lateral movement, command-and-control communications, and data exfiltration before encryption occurred. This analysis highlights how behavioral detection exposed attacker activity using legitimate tools and infrastructure, providing multiple opportunities for early intervention and containment.
From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions
Darktrace researchers analyze a recurring macOS intrusion pattern leveraging ClickFix-style social engineering and AppleScript post-compromise activity. By correlating weak behavioral signals such as HTTP POST beaconing, rare destinations, and SSL anomalies, defenders can detect and disrupt command-and-control activity before sustained attacker control is established.
Hola VPN Abuse: From Proxy Traffic to Malware and Cryptomining
Darktrace’s analysis of Hola VPN-related activity across multiple environments reveals how peer-to-peer proxy functionality can enable malware delivery, command-and-control traffic, and cryptomining. Darktrace data highlights consistent patterns, suspicious downloads from rare endpoints, and post-compromise behavior, demonstrating how seemingly benign software can obscure threats and facilitate further malicious activity.
Hiding in Plain Sight: Uncovering a Multi-Stage Ransomware Attack Through Behavioral Detection
Why ransomware has changed
Ransomware attacks have continued to increase globally, with 698 incidents reported in May 2026, representing a 48% rise compared to 472 incidents in May 2025 [1]. At the same time, the ransomware landscape is evolving. Several major ransomware groups, including LockBit [2], have been disrupted by successful joint law enforcement operations, resulting in a shift away from a small number of dominant actors towards a more fragmented and distributed ecosystem. This is increasingly composed of smaller groups who play a specialized role in the attack, such as initial access brokers, affiliates or developers.
As a result, ransomware tactics, techniques, and procedures (TTPs) are becoming more diverse and less predictable. On top of this, adversaries are leveraging native tools and legitimate penetration testing frameworks to evade detection. Anomaly-based detection is therefore critical to identify pre-ransomware activity, rather than relying on signatures associated with a handful of well-known ransomware groups.
As these attacks often unfold over several days, there is a critical window for defenders to act. In this context, behavioral-based detection plays a vital role in identifying suspicious pre-ransomware activity, and enabling early intervention before encryption or exfiltration occurs.
Inside a modern ransomware intrusion
In early 2026, Darktrace detected activity within a customer’s environment related to a multi-stage ransomware intrusion from the initial compromise. This activity does not appear to be attributable to a specific ransomware group, and no known ransomware payload was observed until the final stage.
The attack aligns with a broader industry trend in which compromised virtual private network (VPN) credentials are used as an entry point, followed by rapid internal reconnaissance and lateral movement using legitimate administrative tools. This growing preference for native tools and legitimate frameworks in cyber-attacks illustrates that it is increasingly unreliable to depend solely on traditional indicators of compromise such as known malware signatures or exploit detection.
The intrusion also involved the use of Sliver, an open-source adversary emulation framework, which is increasingly observed in real-world attacks. Originally designed for penetration testing and red teaming, Sliver has gained traction among threat actors as a stealthier alternative to more heavily signatured frameworks such as Cobalt Strike. As a legitimate framework, its use further complicates detection for security tools that rely on known malicious signatures.
Darktrace’s detection of a ransomware event in a customer’s environment
The initial compromise appears to have occurred via compromised credentials used over the VPN shortly before, or at the onset of the first indicators of suspicious activity. While it remains unclear as to how or when the threat actors gained access to these credentials, the use of initial access brokers (IABs) is a common feature of modern ransomware operations. This suggests that access to the environment may have been established several days or weeks beforehand.
The intrusion unfolded over three days, presenting multiple opportunities for early detection and intervention before ransomware deployment. The attack progressed through a compressed but structured sequence: initial access and reconnaissance were completed within hours, followed by privilege escalation and lateral movement the next day, and culminating in data exfiltration and encryption shortly thereafter. Throughout each stage, distinct behavioral anomalies emerged across the network providing clear indicators of malicious activity well before the ransomware was deployed.
While Darktrace’s Autonomous Response capability was enabled within the customer’s environment, it was not fully configured across the impacted devices, allowing the attack to progress to ransomware deployment. Had Autonomous Response been fully deployed across the affected systems, it could have taken targeted action against the earliest stages of malicious activity, potentially disrupting the intrusion before it escalated.
Figure 1: Timeline of the attack progression.
Day 1: Reconnaissance and privilege escalation
The threat actor gained access via compromised VPN credentials and initiated internal reconnaissance. Darktrace detected anomalous scanning behavior, including unusual port scanning activity and widespread network enumeration.
Specifically, Darktrace detected a high volume of east-west scanning activity across a broad range of ports, with TCP connections targeting ports 21, 80, 445, 4899 and 8080. Associated URIs suggested the use of Nmap, a widely used penetration testing tool. This highlights how attackers often leverage legitimate penetration testing tools for malicious reconnaissance, enabling them to blend into normal network activity and evade traditional signature-based detection methods.
Figure 2: Darktrace's detection of a sharp increase in anomalous internal connections, triggering multiple high-severity model alerts associated with reconnaissance activity.
Several devices were observed using administrative credentials to carry out privileged actions in a manner that was highly anomalous for the environment. This activity was accompanied by behavior consistent with SMB authentication scanning, suggesting efforts to identify and access additional systems. As the activity intensified, an increasing number of devices became involved, signalling lateral movement and further spread across the network.
Darktrace also identified privilege escalation through active directory (AD) replication abuse, specifically via the drsuapi::DRSGetNCChanges function. This technique allows an attacker with sufficient privileges to request directory replication data from a domain controller (DC), enabling them to extract credentials, including password hashes, without directly interacting with user accounts. Commonly associated with ‘DCSync’ attacks, this technique is frequently used to obtain highly privileged credentials and enable further escalation within an environment.
Figure 3: Darktrace’s detection of anomalous AD replication activity indicative of privilege escalation.
This activity was seen alongside the use of the now obsolete SMBv1, repeated NTLM authentication attempts using multiple variations of ‘Administrator’ credentials, reverse DNS scanning, and large-scale network scanning. Darktrace observed widespread use of SMBv1 across the customer’s environment, exposing a significant security weakness. As a legacy protocol with well-documented weaknesses, SMBv1 can be exploited to facilitate lateral movement, allowing the attackers to expand their access following initial compromise.
Day 3: Lateral Movement, Command & Control, and Exfiltration
Two days later, the attacker escalated privileges and expanded their foothold using living-off-the-land (LOTL) techniques such as PSExec, WMI, and RDP. Concurrently, Darktrace identified command-and-control (C2)-style communications consistent with the Sliver framework, alongside rare outbound connections to cloud infrastructure indicating potential data exfiltration. The volume and severity of observed activity increased as attack behavior intensified.
The device was observed conducting extensive lateral movement, leveraging LOTL techniques to evade detection. Activity included WMI execution (e.g. ExecQuery), DCE-RPC activity, SMB sessions and file writes, most of which were successful, as well as the deployment of PSEXESVC.exe via ADMIN$ shares and prolonged RDP sessions. Darktrace identified this behavior as highly anomalous for the environment. Such activity is commonly associated with the transfer of attacker tooling, remote command execution, and the establishment of persistent access across compromised systems.
Figure 4: Darktrace’s detection of a spike in RPC binding events indicative of potential lateral movement.
On the same day, Darktrace detected C2-style SSL communications originating from multiple internal devices to rare external endpoints. These connections exhibited anomalous characteristics, including invalid SSL certificates and repeated connection patterns resembling beaconing. Analysis of the observed JA3 fingerprint further linked the activity to Sliver, the adversary simulation framework referenced earlier, as the hash has previously been associated with Sliver-related infrastructure [3]. The use of this framework reflects a broader trend of attackers repurposing legitimate offensive security tools for stealthy C2 communications. Connections to 137[.]220[.]59[.]55 (ASN AS20473 AS-VULTR) indicated that the communications were likely routed via a virtual private server (VPS) hosted by Vultr. Attackers often utilize VPS infrastructure from legitimate cloud providers like Vultr to obscure their true origin, blend into benign traffic, and evade IP-based detection mechanisms [4].
Figure 5: Darktrace’s Cyber AI Analyst detection of two linked unusual connections to Vultr infrastructure.
Darktrace also observed a device initiating SSL connections to safedata.s3[.]wasabisys[.]com, an endpoint associated with Wasabi cloud storage. Darktrace recognized that neither the destination nor the associated IP address had previously been observed within the environment. More than 200 MB of data was subsequently uploaded externally to endpoints sharing the same JA3 client hash, indicating a sustained transfer session and potential data exfiltration to third-party storage. The apparent exfiltration prior to encryption is consistent with a double-extortion ransomware strategy.
Figure 6: Darktrace’s Cyber AI Analyst detection of more than 30 rare outbound connections to a Wasabi cloud storage endpoint, indicative of potential data exfiltration
Day 4: Encryption
The attack culminated in ransomware deployment, marking the transition from suspicious network activity to a business-impacting incident. Using SMB-based propagation, the threat actor encrypted thousands of files across the network, affecting multiple systems and disrupting normal operations. Throughout the encryption event, the legacy SMBv1 protocol was used extensively across multiple internal systems, resulting in a significant increase in newly encrypted files.
Figure 7: Darktrace’s detection of abnormal spikes in SMB activity and associated model alerts, indicative of ransomware encryption and propagation.
Darktrace’s Cyber AI Analyst automatically investigated and correlated the encryption activity and related events into a single incident narrative, providing the customer with real-time visibility into the attack while significantly reducing investigation time.
Figure 8: Darktrace’s Cyber AI Analyst’s investigation into the encryption activity. AI Analyst incident detailing example encryption activity in real time. Related events are automatically correlated and summarized into a clear narrative, reducing investigation time.
Defender action recommendations
What Could Have Stopped the Attack Earlier?
Although the attack ultimately resulted in ransomware deployment, there were multiple opportunities to detect, contain, and disrupt the intrusion before encryption occurred. The following actions could have significantly reduced the overall impact:
Detect and investigate indicators of reconnaissance and lateral movement
Unusual scanning
Active Directory replication anomalies consistent with DCSync activity
Anomalous use of native tools and processes indicative of LOTL attacks
Unusual use of common reconnaissance tools such as Nmap and NetScan
Contain compromised credentials and affected devices
Disable and reset compromised VPN credentials
Isolate devices performing anomalous scanning and lateral movement activity
Block suspicious external communications and data exfiltration
Use anomaly-based detection to detect and block repeated outbound connections to rare external infrastructure
Prevent data exfiltration to unauthorized cloud storage services such as Wasabi
Conclusion
The incident highlights the importance of anomaly-based detection, particularly against attacks that primarily use native or legitimate tools to evade traditional security measures. Darktrace identified suspicious activity from the first day of the compromise, providing multiple opportunities to disrupt the intrusion before it progressed to lateral movement and data exfiltration.
In this instance, detection was not the limiting factor; response time was. Prompt investigation and containment of devices exhibiting anomalous behavior could have prevented lateral movement, data exfiltration, and ultimately ransomware deployment.
As adversaries increasingly prioritize stealth over custom malware, relying instead on legitimate tools, valid credentials, and trusted infrastructure, traditional signature-based detection becomes less effective. Identifying subtle behavioral deviations early remains critical to disrupting attacks before they escalate into full-scale ransomware incidents.
Credit to Alexandra Evzona (Cyber Analyst), Priya Thapa (Senior Cyber Analyst) Edited by Ryan Traill (Content Manager)
Darktrace / EMAIL Expands Behavioral Defense Across Email and Collaboration Workflows
Email and collaboration tools do more than carry messages. They are where organizations approve payments, share sensitive data, reset credentials, and make thousands of everyday decisions. Increasingly, they are interfaces through which humans direct AI agents in their daily activity. Email, Slack and Teams are high volume, rich with sensitive data, and an easy place to hide malicious activity.
The opportunity isn’t lost on bad actors. Darktrace / EMAIL detected more than 32 million high-confidence phishing emails globally in 2025, and 70% of those messages passed DMARC authentication. Phishing is increasingly difficult to detect and familiar trust signals alone are not enough. People and security teams need to understand how a message fits the normal behavior of the sender, recipient, and organization. They also need to correlate activity across platforms to spot threats that span multiple channels.
To effectively secure against today’s evolved threats, security teams need to act at two levels: they need to help each employee make a safer decision ‘in the moment’, and they need to understand the wider patterns that may expose the business to risk.
Darktrace is introducing four new capabilities in Darktrace / EMAIL to address both challenges. The new features explain suspicious content more clearly to end users, strengthen the capabilities of Darktrace / Adaptive Human Defense with richer guidance, let organizations define their own patterns for detecting sensitive data in messages, and give security teams a process-level view of risk across email and collaboration workflows.
Darktrace / EMAIL Inbox Analysis highlights risky content within your emails
A warning is more useful when it explains what the user should look at. To help do that, we’ve expanded Darktrace / EMAIL’s Inbox Analysis Add-In to highlight potentially dangerous content within the body of emails that Darktrace / EMAIL flags as potentially suspicious or high risk.
The add-in can highlight language designed to create urgency, financial references, requests for payment, suspicious links, and content that is unusual for the sender. Each highlighted element includes a pop up that explains why it may be suspicious. Instead of asking an employee to accept a verdict without context, the analysis helps them examine the message and make a more informed decision.
Enhanced Just-In-Time Training Banners in Darktrace / Adaptive Human Defense
Enhanced Just-In-Time Training Banners build on the same principle. The banners now include a contextual header, actionable advice, and specific detection context. This gives employees more useful guidance at the point of risk without adding unnecessary information or cognitive load.
Together, the capabilities help turn a warning into a short learning moment. Employees can see what looks unusual, understand what action to take, and build their judgment.
Custom Sensitive Data Detection in Darktrace / EMAIL - Data Loss Prevention
Sensitive data is different for every business. Standard categories such as payment card details or government identifiers matter, but organizations also have their own customer codes, project names, research formats, account structures, and internal identifiers.
Custom Sensitive Data Detection in Darktrace / EMAIL - Data Loss Prevention allows administrators to write custom expressions for the data their organization needs to protect. Matched content can trigger existing model actions and data loss prevention (DLP) workflows, extending Darktrace's DLP capabilities.
This extends data loss detection beyond a fixed library of common data types. Security teams can apply controls to information that is sensitive in the context of their own organization and adapt those controls as the business changes.
Introducing Email and Collaboration Workflow Risk Posture Dashboards
Some of the most important risks are not isolated events. They are repeated ways of working that create an opening for error, misuse, or attack. For example, a payment request may be one suspicious message, but a recurring approval workflow that relies on weak verification is a business process risk.
The new Email and Collaboration Workflow Risk Posture Dashboard analyzes email and collaboration data across Email, Microsoft Teams, Slack and Zoom to provide a process-level view of risk in the organization. These may include financial authorization workflows, sensitive data sharing patterns, and activity that could expose credentials.
The dashboard brings these patterns into a view and provides actionable recommendations. This helps security teams determine where to investigate or strengthen controls, where ownership needs to be clarified, and where the business may need to change a risky process. It gives CISOs a clearer view of how human and communication risk is embedded in everyday operations, not only where individual alerts occur.
Behavior connects the individual decision to the wider risk
These capabilities build on Darktrace’s unique behavioral approach to security. We use Adaptive AI to learn how people and AI normally behave within an organization, creating the context needed to recognize when activity changes.
Within the Darktrace Behavioral Defense Platform, Darktrace / EMAIL helps protect people against phishing, account takeover, data exfiltration, and human risk across email and collaboration tools. The new capabilities extend that protection in both directions. They give employees clearer context for the decision in front of them, while giving security leaders a broader view of the workflows and behavior that create risk across the organization.
The result is not simply more alerts. It is a better understanding of why something is risky, what action to take, and where the organization can reduce risk before a familiar process becomes an easy route for an attacker.
.jpg)
