Blog
/
Network
/
April 24, 2024

How Cactus Ransomware Was Detected and Stopped

Discover the tactics used to uncover a Cactus ransomware infection and the implications for cybersecurity defenses.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Tiana Kelly
Deputy Team Lead, London & Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
24
Apr 2024

What is CACTUS Ransomware?

In May 2023, Kroll Cyber Threat Intelligence Analysts identified CACTUS as a new ransomware strain that had been actively targeting large commercial organizations since March 2023 [1]. CACTUS ransomware gets its name from the filename of the ransom note, “cAcTuS.readme.txt”. Encrypted files are appended with the extension “.cts”, followed by a number which varies between attacks, e.g. “.cts1” and “.cts2”.

As the cyber threat landscape adapts to ever-present fast-paced technological change, ransomware affiliates are employing progressively sophisticated techniques to enter networks, evade detection and achieve their nefarious goals.

How does CACTUS Ransomware work?

In the case of CACTUS, threat actors have been seen gaining initial network access by exploiting Virtual Private Network (VPN) services. Once inside the network, they may conduct internal scanning using tools like SoftPerfect Network Scanner, and PowerShell commands to enumerate endpoints, identify user accounts, and ping remote endpoints. Persistence is maintained by the deployment of various remote access methods, including legitimate remote access tools like Splashtop, AnyDesk, and SuperOps RMM in order to evade detection, along with malicious tools like Cobalt Strike and Chisel. Such tools, as well as custom scripts like TotalExec, have been used to disable security software to distribute the ransomware binary. CACTUS ransomware is unique in that it adopts a double-extortion tactic, stealing data from target networks and then encrypting it on compromised systems [2].

At the end of November 2023, cybersecurity firm Arctic Wolf reported instances of CACTUS attacks exploiting vulnerabilities on the Windows version of the business analytics platform Qlik, specifically CVE-2023-41266, CVE-2023-41265, and CVE-2023-48365, to gain initial access to target networks [3]. The vulnerability tracked as CVE-2023-41266 can be exploited to generate anonymous sessions and perform HTTP requests to unauthorized endpoints, whilst CVE-2023-41265 does not require authentication and can be leveraged to elevate privileges and execute HTTP requests on the backend server that hosts the application [2].

Darktrace’s Coverage of CACTUS Ransomware

In November 2023, Darktrace observed malicious actors leveraging the aforementioned method of exploiting Qlik to gain access to the network of a customer in the US, more than a week before the vulnerability was reported by external researchers.

Here, Qlik vulnerabilities were successfully exploited, and a malicious executable (.exe) was detonated on the network, which was followed by network scanning and failed Kerberos login attempts. The attack culminated in the encryption of numerous files with extensions such as “.cts1”, and SMB writes of the ransom note “cAcTuS.readme.txt” to multiple internal devices, all of which was promptly identified by Darktrace DETECT™.

While traditional rules and signature-based detection tools may struggle to identify the malicious use of a legitimate business platform like Qlik, Darktrace’s Self-Learning AI was able to confidently identify anomalous use of the tool in a CACTUS ransomware attack by examining the rarity of the offending device’s surrounding activity and comparing it to the learned behavior of the device and its peers.

Unfortunately for the customer in this case, Darktrace RESPOND™ was not enabled in autonomous response mode during their encounter with CACTUS ransomware meaning that attackers were able to successfully escalate their attack to the point of ransomware detonation and file encryption. Had RESPOND been configured to autonomously act on any unusual activity, Darktrace could have prevented the attack from progressing, stopping the download of any harmful files, or the encryption of legitimate ones.

Cactus Ransomware Attack Overview

Holiday periods have increasingly become one of the favoured times for malicious actors to launch their attacks, as they can take advantage of the festive downtime of organizations and their security teams, and the typically more relaxed mindset of employees during this period [4].

Following this trend, in late November 2023, Darktrace began detecting anomalous connections on the network of a customer in the US, which presented multiple indicators of compromise (IoCs) and tactics, techniques and procedures (TTPs) associated with CACTUS ransomware. The threat actors in this case set their attack in motion by exploiting the Qlik vulnerabilities on one of the customer’s critical servers.

Darktrace observed the server device making beaconing connections to the endpoint “zohoservice[.]net” (IP address: 45.61.147.176) over the course of three days. This endpoint is known to host a malicious payload, namely a .zip file containing the command line connection tool PuttyLink [5].

Darktrace’s Cyber AI Analyst was able to autonomously identify over 1,000 beaconing connections taking place on the customer’s network and group them together, in this case joining the dots in an ongoing ransomware attack. AI Analyst recognized that these repeated connections to highly suspicious locations were indicative of malicious command-and-control (C2) activity.

Cyber AI Analyst Incident Log showing the offending device making over 1,000 connections to the suspicious hostname “zohoservice[.]net” over port 8383, within a specific period.
Figure 1: Cyber AI Analyst Incident Log showing the offending device making over 1,000 connections to the suspicious hostname “zohoservice[.]net” over port 8383, within a specific period.

The infected device was then observed downloading the file “putty.zip” over a HTTP connection using a PowerShell user agent. Despite being labelled as a .zip file, Darktrace’s detection capabilities were able to identify this as a masqueraded PuttyLink executable file. This activity resulted in multiple Darktrace DETECT models being triggered. These models are designed to look for suspicious file downloads from endpoints not usually visited by devices on the network, and files whose types are masqueraded, as well as the anomalous use of PowerShell. This behavior resembled previously observed activity with regards to the exploitation of Qlik Sense as an intrusion technique prior to the deployment of CACTUS ransomware [5].

The downloaded file’s URI highlighting that the file type (.exe) does not match the file's extension (.zip). Information about the observed PowerShell user agent is also featured.
Figure 2: The downloaded file’s URI highlighting that the file type (.exe) does not match the file's extension (.zip). Information about the observed PowerShell user agent is also featured.

Following the download of the masqueraded file, Darktrace observed the initial infected device engaging in unusual network scanning activity over the SMB, RDP and LDAP protocols. During this activity, the credential, “service_qlik” was observed, further indicating that Qlik was exploited by threat actors attempting to evade detection. Connections to other internal devices were made as part of this scanning activity as the attackers attempted to move laterally across the network.

Numerous failed connections from the affected server to multiple other internal devices over port 445, indicating SMB scanning activity.
Figure 3: Numerous failed connections from the affected server to multiple other internal devices over port 445, indicating SMB scanning activity.

The compromised server was then seen initiating multiple sessions over the RDP protocol to another device on the customer’s network, namely an internal DNS server. External researchers had previously observed this technique in CACTUS ransomware attacks where an RDP tunnel was established via Plink [5].

A few days later, on November 24, Darktrace identified over 20,000 failed Kerberos authentication attempts for the username “service_qlik” being made to the internal DNS server, clearly representing a brute-force login attack. There is currently a lack of open-source intelligence (OSINT) material definitively listing Kerberos login failures as part of a CACTUS ransomware attack that exploits the Qlik vulnerabilities. This highlights Darktrace’s ability to identify ongoing threats amongst unusual network activity without relying on existing threat intelligence, emphasizing its advantage over traditional security detection tools.

Kerberos login failures being carried out by the initial infected device. The destination device detected was an internal DNS server.
Figure 4: Kerberos login failures being carried out by the initial infected device. The destination device detected was an internal DNS server.

In the month following these failed Kerberos login attempts, between November 26 and December 22, Darktrace observed multiple internal devices encrypting files within the customer’s environment with the extensions “.cts1” and “.cts7”. Devices were also seen writing ransom notes with the file name “cAcTuS.readme.txt” to two additional internal devices, as well as files likely associated with Qlik, such as “QlikSense.pdf”. This activity detected by Darktrace confirmed the presence of a CACTUS ransomware infection that was spreading across the customer’s network.

The model, 'Ransom or Offensive Words Written to SMB', triggered in response to SMB file writes of the ransom note, ‘cAcTuS.readme.txt’, that was observed on the customer’s network.
Figure 5: The model, 'Ransom or Offensive Words Written to SMB', triggered in response to SMB file writes of the ransom note, ‘cAcTuS.readme.txt’, that was observed on the customer’s network.
CACTUS ransomware extensions, “.cts1” and “.cts7”, being appended to files on the customer’s network.
Figure 6: CACTUS ransomware extensions, “.cts1” and “.cts7”, being appended to files on the customer’s network.

Following this initial encryption activity, two affected devices were observed attempting to remove evidence of this activity by deleting the encrypted files.

Attackers attempting to remove evidence of their activity by deleting files with appendage “.cts1”.
Figure 7: Attackers attempting to remove evidence of their activity by deleting files with appendage “.cts1”.

Conclusion

In the face of this CACTUS ransomware attack, Darktrace’s anomaly-based approach to threat detection enabled it to quickly identify multiple stages of the cyber kill chain occurring in the customer’s environment. These stages ranged from ‘initial access’ by exploiting Qlik vulnerabilities, which Darktrace was able to detect before the method had been reported by external researchers, to ‘actions on objectives’ by encrypting files. Darktrace’s Self-Learning AI was also able to detect a previously unreported stage of the attack: multiple Kerberos brute force login attempts.

If Darktrace’s autonomous response capability, RESPOND, had been active and enabled in autonomous response mode at the time of this attack, it would have been able to take swift mitigative action to shut down such suspicious activity as soon as it was identified by DETECT, effectively containing the ransomware attack at the earliest possible stage.

Learning a network’s ‘normal’ to identify deviations from established patterns of behaviour enables Darktrace’s identify a potential compromise, even one that uses common and often legitimately used administrative tools. This allows Darktrace to stay one step ahead of the increasingly sophisticated TTPs used by ransomware actors.

Credit to Tiana Kelly, Cyber Analyst & Analyst Team Lead, Anna Gilbertson, Cyber Analyst

Appendices

References

[1] https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection

[2] https://www.bleepingcomputer.com/news/security/cactus-ransomware-exploiting-qlik-sense-flaws-to-breach-networks/

[3] https://explore.avertium.com/resource/new-ransomware-strains-cactus-and-3am

[4] https://www.soitron.com/cyber-attackers-abuse-holidays/

[5] https://arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/

Darktrace DETECT Models

Compromise / Agent Beacon (Long Period)

Anomalous Connection / PowerShell to Rare External

Device / New PowerShell User Agent

Device / Suspicious SMB Scanning Activity

Anomalous File / EXE from Rare External Location

Anomalous Connection / Unusual Internal Remote Desktop

User / Kerberos Password Brute Force

Compromise / Ransomware / Ransom or Offensive Words Written to SMB

Unusual Activity / Anomalous SMB Delete Volume

Anomalous Connection / Multiple Connections to New External TCP Port

Compromise / Slow Beaconing Activity To External Rare  

Compromise / SSL Beaconing to Rare Destination  

Anomalous Server Activity / Rare External from Server  

Compliance / Remote Management Tool On Server

Compromise / Agent Beacon (Long Period)  

Compromise / Suspicious File and C2  

Device / Internet Facing Device with High Priority Alert  

Device / Large Number of Model Breaches  

Anomalous File / Masqueraded File Transfer

Anomalous File / Internet facing System File Download  

Anomalous Server Activity / Outgoing from Server

Device / Initial Breach Chain Compromise  

Compromise / Agent Beacon (Medium Period)  

Compromise / Agent Beacon (Long Period)  

List of IoCs

IoC - Type - Description

zohoservice[.]net: 45.61.147[.]176 - Domain name: IP Address - Hosting payload over HTTP

Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17763.2183 - User agent -PowerShell user agent

.cts1 - File extension - Malicious appendage

.cts7- File extension - Malicious appendage

cAcTuS.readme.txt - Filename -Ransom note

putty.zip – Filename - Initial payload: ZIP containing PuTTY Link

MITRE ATT&CK Mapping

Tactic - Technique  - SubTechnique

Web Protocols: COMMAND AND CONTROL - T1071 -T1071.001

Powershell: EXECUTION - T1059 - T1059.001

Exploitation of Remote Services: LATERAL MOVEMENT - T1210 – N/A

Vulnerability Scanning: RECONAISSANCE     - T1595 - T1595.002

Network Service Scanning: DISCOVERY - T1046 - N/A

Malware: RESOURCE DEVELOPMENT - T1588 - T1588.001

Drive-by Compromise: INITIAL ACCESS - T1189 - N/A

Remote Desktop Protocol: LATERAL MOVEMENT – 1021 -T1021.001

Brute Force: CREDENTIAL ACCESS        T – 1110 - N/A

Data Encrypted for Impact: IMPACT - T1486 - N/A

Data Destruction: IMPACT - T1485 - N/A

File Deletion: DEFENSE EVASION - T1070 - T1070.004

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Tiana Kelly
Deputy Team Lead, London & Cyber Analyst

More in this series

No items found.

Blog

/

Identity

/

May 27, 2025

From Rockstar2FA to FlowerStorm: Investigating a Blooming Phishing-as-a-Service Platform

man on computerDefault blog imageDefault blog image

What is FlowerStorm?

FlowerStorm is a Phishing-as-a-Service (PhaaS) platform believed to have gained traction following the decline of the former PhaaS platform Rockstar2FA. It employs Adversary-in-the-Middle (AitM) attacks to target Microsoft 365 credentials. After Rockstar2FA appeared to go dormant, similar PhaaS portals began to emerge under the name FlowerStorm. This naming is likely linked to the plant-themed terminology found in the HTML titles of its phishing pages, such as 'Sprout' and 'Blossom'. Given the abrupt disappearance of Rockstar2FA and the near-immediate rise of FlowerStorm, it is possible that the operators rebranded to reduce exposure [1].

External researchers identified several similarities between Rockstar2FA and FlowerStorm, suggesting a shared operational overlap. Both use fake login pages, typically spoofing Microsoft, to steal credentials and multi-factor authentication (MFA) tokens, with backend infrastructure hosted on .ru and .com domains. Their phishing kits use very similar HTML structures, including randomized comments, Cloudflare turnstile elements, and fake security prompts. Despite Rockstar2FA typically being known for using automotive themes in their HTML titles, while FlowerStorm shifted to a more botanical theme, the overall design remained consistent [1].

Despite these stylistic differences, both platforms use similar credential capture methods and support MFA bypass. Their domain registration patterns and synchronized activity spikes through late 2024 suggest shared tooling or coordination [1].

FlowerStorm, like Rockstar2FA, also uses their phishing portal to mimic legitimate login pages such as Microsoft 365 for the purpose of stealing credentials and MFA tokens while the portals are relying heavily on backend servers using top-level domains (TLDs) such as .ru, .moscow, and .com. Starting in June 2024, some of the phishing pages began utilizing Cloudflare services with domains such as pages[.]dev. Additionally, usage of the file “next.php” is used to communicate with their backend servers for exfiltration and data communication. FlowerStorm’s platform focuses on credential harvesting using fields such as email, pass, and session tracking tokens in addition to supporting email validation and MFA authentications via their backend systems [1].

Darktrace’s coverage of FlowerStorm Microsoft phishing

While multiple suspected instances of the FlowerStorm PhaaS platform were identified during Darktrace’s investigation, this blog will focus on a specific case from March 2025. Darktrace’s Threat Research team analyzed the affected customer environment and discovered that threat actors were accessing a Software-as-a-Service (SaaS) account from several rare external IP addresses and ASNs.

Around a week before the first indicators of FlowerStorm were observed, Darktrace detected anomalous logins via Microsoft Office 365 products, including Office365 Shell WCSS-Client and Microsoft PowerApps.  Although not confirmed in this instance, Microsoft PowerApps could potentially be leveraged by attackers to create phishing applications or exploit vulnerabilities in data connections [2].

Darktrace’s detection of the unusual SaaS credential use.
Figure 1: Darktrace’s detection of the unusual SaaS credential use.

Following this initial login, Darktrace observed subsequent login activity from the rare source IP, 69.49.230[.]198. Multiple open-source intelligence (OSINT) sources have since associated this IP with the FlowerStorm PhaaS operation [3][4].  Darktrace then observed the SaaS user resetting the password on the Core Directory of the Azure Active Directory using the user agent, O365AdminPortal.

Given FlowerStorm’s known use of AitM attacks targeting Microsoft 365 credentials, it seems highly likely that this activity represents an attacker who previously harvested credentials and is now attempting to escalate their privileges within the target network.

Darktrace / IDENTITY’s detection of privilege escalation on a compromised SaaS account, highlighting unusual login activity and a password reset event.
Figure 2: Darktrace / IDENTITY’s detection of privilege escalation on a compromised SaaS account, highlighting unusual login activity and a password reset event.

Notably, Darktrace’s Cyber AI Analyst also detected anomalies during a number of these login attempts, which is significant given FlowerStorm’s known capability to bypass MFA and steal session tokens.

Cyber AI Analyst’s detection of new login behavior for the SaaS user, including abnormal MFA usage.
Figure 3: Cyber AI Analyst’s detection of new login behavior for the SaaS user, including abnormal MFA usage.
Multiple login and failed login events were observed from the anomalous source IP over the month prior, as seen in Darktrace’s Advanced Search.
Figure 4: Multiple login and failed login events were observed from the anomalous source IP over the month prior, as seen in Darktrace’s Advanced Search.

In response to the suspicious SaaS activity, Darktrace recommended several Autonomous Response actions to contain the threat. These included blocking the user from making further connections to the unusual IP address 69.49.230[.]198 and disabling the user account to prevent any additional malicious activity. In this instance, Darktrace’s Autonomous Response was configured in Human Confirmation mode, requiring manual approval from the customer’s security team before any mitigative actions could be applied. Had the system been configured for full autonomous response, it would have immediately blocked the suspicious connections and disabled any users deviating from their expected behavior—significantly reducing the window of opportunity for attackers.

Figure 5: Autonomous Response Actions recommended on this account behavior; This would result in disabling the user and blocking further sign-in activity from the source IP.

Conclusion

The FlowerStorm platform, along with its predecessor, RockStar2FA is a PhaaS platform known to leverage AitM attacks to steal user credentials and bypass MFA, with threat actors adopting increasingly sophisticated toolkits and techniques to carry out their attacks.

In this incident observed within a Darktrace customer's SaaS environment, Darktrace detected suspicious login activity involving abnormal VPN usage from a previously unseen IP address, which was subsequently linked to the FlowerStorm PhaaS platform. The subsequent activity, specifically a password reset, was deemed highly suspicious and likely indicative of an attacker having obtained SaaS credentials through a prior credential harvesting attack.

Darktrace’s prompt detection of these SaaS anomalies and timely notifications from its Security Operations Centre (SOC) enabled the customer to mitigate and remediate the threat before attackers could escalate privileges and advance the attack, effectively shutting it down in its early stages.

Credit to Justin Torres (Senior Cyber Analyst), Vivek Rajan (Cyber Analyst), Ryan Traill (Analyst Content Lead)

Appendices

Darktrace Model Alert Detections

·      SaaS / Access / M365 High Risk Level Login

·      SaaS / Access / Unusual External Source for SaaS Credential Use

·      SaaS / Compromise / Login from Rare High-Risk Endpoint

·      SaaS / Compromise / SaaS Anomaly Following Anomalous Login

·      SaaS / Compromise / Unusual Login and Account Update

·      SaaS / Unusual Activity / Unusual MFA Auth and SaaS Activity

Cyber AI Analyst Coverage

·      Suspicious Access of Azure Active Directory  

·      Suspicious Access of Azure Active Directory  

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

69.49.230[.]198 – Source IP – Malicious IP Associated with FlowerStorm, Observed in Login Activity

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique  

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Cloud Service Dashboard - DISCOVERY - T1538

Compromise Accounts - RESOURCE DEVELOPMENT - T1586

Steal Web Session Cookie - CREDENTIAL ACCESS - T1539

References:

[1] https://news.sophos.com/en-us/2024/12/19/phishing-platform-rockstar-2fa-trips-and-flowerstorm-picks-up-the-pieces/

[2] https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-compromised-malicious-app

[3] https://www.virustotal.com/gui/ip-address/69.49.230.198/community

[4] https://otx.alienvault.com/indicator/ip/69.49.230.198

Continue reading
About the author
Justin Torres
Cyber Analyst

Blog

/

Network

/

May 23, 2025

Defending the Frontlines: Proactive Cybersecurity in Local Government

Default blog imageDefault blog image

Serving a population of over 165,000 citizens, this county government delivers essential services that enhance the quality of life for all of its residents in Florida, United States. From public safety and works to law enforcement, economic development, health, and community services, the county’s cybersecurity strategy plays a foundational role in protecting its citizens.

From flying blind to seeing the bigger picture

Safeguarding data from multiple systems, service providers, and citizens is a key aspect of the County’s Systems Management remit. Protecting sensitive information while enabling smooth engagement with multiple external partners poses a unique challenge; the types of data and potential threats are continuously evolving, but resources – both human and financial – remain consistently tight.

When the Chief Information Officer took on his role in 2024, building out a responsive defense-in-depth strategy was central to achieving these goals. However, with limited resources and complex needs, his small security team was struggling with high alert volumes, inefficient tools, and time-consuming investigations that frequently led nowhere.

Meanwhile, issues like insider threats, Denial of Service (DoS), and phishing attacks were growing; the inefficiencies were creating serious security vulnerabilities. As the CIO put it, he was flying blind. With so much data coming in, security analysts were in danger of missing the bigger picture.

“We would just see a single portion of data that could send us down a rabbit hole, thinking something’s going on – only to find out after spending days, weeks, or even months that it was nothing. If you’re only seeing one piece of the issue, it’s really difficult to identify whether something is a legitimate threat or a false positive.”

Local government’s unique cybersecurity challenges

According to the CIO, even with a bigger team, aligning and comparing all the data into a comprehensive, bigger picture would be a major challenge. “The thing about local government specifically is that it’s a complex security environment. We bring together a lot of different individuals and organizations, from construction workers to people who bring projects into our community to better the County. What we work with varies from day to day.”

The challenge wasn’t just about identifying threats, but also about doing so quickly enough to respond before damage was done. The CIO said this was particularly concerning when dealing with sophisticated threats: “We’re dealing with nation-state attackers nowadays, as opposed to ‘script kiddies.’ There’s no time to lose. We’ve got to have cybersecurity that can respond as quickly as they can attack.”

To achieve this, among the most critical challenges the CIO and his team needed to address were:

  • Contextual awareness and visibility across the network: The County team lacked the granular visibility needed to identify potentially harmful behaviors. The IT team needed a tool that uncovered hidden activities and provided actionable insights, with minimal manual intervention.
  • Augmenting human expertise and improving response times: Hiring additional analysts to monitor the environment is prohibitively expensive for many local governments. The IT team needed a cybersecurity solution that could augment existing skills while automating day-to-day tasks. More effective resource allocation would drive improved response times.
  • Preventing email-based threats: Phishing and malicious email links present a persistent threat. The County team needed a way to flag, identify, and hold suspicious messages automatically and efficiently. Given the team’s public service remit, contextual awareness is crucial to ensuring that no legitimate communications are accidentally blocked. Accuracy is extremely important.
  • Securing access and managing insider threats: Having already managed insider threats posed by former staff members, the IT team wanted to adopt a more proactive, deterrent-based approach towards employee IT resource use, preventing incidents before they could occur.

Proactive cybersecurity

Recognizing these challenges, the CIO and County sought AI-driven solutions capable of acting autonomously to support a lean IT team and give the big picture view needed, without getting lost in false positive alerts.

Ease of deployment was another key requirement: the CIO wanted to quickly establish a security baseline for County that would not require extensive pre-planning or disrupt existing systems. Having worked with Darktrace in previous roles, he knew the solution had the capacity to make the critical connections he was looking for, while delivering fast response times and reducing the burden on security teams.

When every second counts, we want to be as close to the same resources as our attackers are utilizing. We have got to have something that can respond as quickly as they can attack. For the County, that’s Darktrace.” – CIO, County Systems Management Department.

Closing network visibility gaps with Darktrace / NETWORK

The County chose Darktrace / NETWORK for unparalleled visibility into the County’s network. With the solution in place, the CIO and his team were able to identify and address previously hidden activities, uncovering insider threats in unexpected places. For example, one team member had installed an unauthorized anonymizer plug-in on their browser, posing a potentially serious security risk via traffic being sent out to the internet. “Darktrace immediately alerted on it,” said CIO. “We were able to deal with the threat proactively and quickly.”

Darktrace / NETWORK continuously monitored and updated its understanding of the County environment, intelligently establishing the different behaviors and network activity. The end result was a level of context awareness that enabled the team to focus on the alerts that mattered most, saving time and effort.

“Darktrace brings all the data we need together, into one picture. We’re able to see what’s going on at a glance, as opposed to spending time trying to identify real threats from false positives,” said the CIO. The ability to automate actions freed the team up to focus on more complex tasks, with 66% of network response actions being applied autonomously, taking the right action at the right time to stop the earliest signs of threatening activity. This reduced pressure on the County’s team members, while buying valuable containment time to perform deeper investigations.

The agentless deployment advantage

For the CIO, one of the major benefits of Darktrace / NETWORK is that it’s agentless. “Agents alert attackers to the presence of security in your environment, it helps them to understand that there’s something else they need to bring down your defenses,” he said. Using Darktrace to mirror network traffic, the County can maintain full visibility across all network entities without alerting attackers and respond to threatening activity at machine speed. “It allows me to sleep better at night, knowing that this tool can effectively unplug the network cable from that device and bring it offline,” said CIO.

Streamlining investigations with Darktrace Cyber AI Analyst

For lean security teams, contextual awareness is crucial in reducing the burden of alert fatigue. Using Cyber AI Analyst, the County team is able to take the pressure off, automatically investigating every relevant event, and reducing thousands of individual alerts to only a small number of incidents that require manual review.

For the County team, the benefits are clear: 520 investigation hours saved in one month, with an average of just 11 minutes investigation time per incident. For the CIO, Darktrace goes beyond reducing workloads, it actually drives security: “It identifies threats almost instantly, bringing together logs and behaviors into a single, clear view.”

The efficiency gain has been so significant that the CIO believes Darktrace augments capabilities beyond the size of a team of analysts. “You could have three analysts working around the clock, but it’s hard to bring all those logs and behaviors together in one place and communicate everything in a coordinated way. Nothing does that as quickly as Darktrace can.”

Catching the threats from within: Defense in depth with Darktrace / IDENTITY

One of the key benefits of Darktrace for the County was its breadth of capability and responsiveness. “We’re looking at everything from multi-factor authentication, insider threats, distributed denial of service attacks,” said the CIO. “I’ve worked with other products in the past, but I’ve never found a tool as good as Darktrace.”

Further insider threats uncovered by Darktrace / IDENTITY included insecure access practices. Some users had logins and passwords on shared network resources or in plain-text files. Darktrace alerted the security team and the threats were mitigated before serious damage was done.

Darktrace / IDENTITY gives organizations advanced visibility of application user behavior from unusual authentication, password sprays, account takeover, resource theft, and admin abuse. Security teams can take targeted actions including the forced log-off of a user or temporary disabling of an account to give the team time to verify legitimacy.

First line of defense against the number one attack vector: Enhancing email security with Darktrace / EMAIL

Email-based threats, such as phishing, are among the most common attack vectors in modern cybersecurity, and a key vector for ransomware attacks. Post implementation performance was so strong that the organization now plans to retire other tools, cutting costs without compromising on security.

Darktrace / EMAIL was one of the first tools that I implemented when I started here,” said CIO. “I really recognize the value of it in our environment.” In addition to detecting and flagging potentially malicious email, the CIO said an unexpected benefit has been the reinforcement of more security-aware behaviors among end users. “People are checking their junk folders now, alerting us and checking to see if something is legitimate or not.”

The CIO said that, unlike traditional email security tools that basically perform only one function, Darktrace has multiple additional capabilities that deliver extra layers of protection compared to one-dimensional alternatives. For example, AI-employee feedback loops leverage insights gained from individual users to not only improve detection rates, but also provide end users with contextual security awareness training, to enhance greater understanding of the risks.

Straightforward integration, ease of use

The County wanted a powerful, responsive solution – without demanding pre-installation or integration needs, and with maximum ease of use. “The integration is relatively painless,” said the CIO. “That’s another real benefit, you can bring Darktrace into your environment and have it up and running faster than you could ever hire additional analysts to look at the same data.”

The team found that, compared to competing products, where there was extensive setup, overhead, and resources, “Darktrace is almost plug-and-play.” According to the CIO, the solution started ingesting information and providing notifications immediately: “You can turn on defense or response mechanisms at a granular level, for email or network – or both at the same time.”

The County sees Darktrace as an integral part of its cybersecurity strategy into the future. “Having worked with Darktrace in the past, it was an easy decision for me to agree to a multi-year partnership,” said the CIO “As we continue to build out our defense-in-depth strategy, the ability to use Darktrace to manage other data sources and identify new, additional behavior will be crucial to our proactive, risk-based approach.”

Darktrace has the capacity to meet the organization’s need for exceptional responsiveness, without burning out teams. “If you’re not overburdening the teams that you do have with significant workloads, they have a lot more agility to deal with things on the fly,” said the CIO.

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI