Darktrace acquires Cybersprint, a best-in-class Attack Surface Management company. Learn more about the integration and its benefits.
Today Darktrace announced the acquisition of best-in-class Attack Surface Management (ASM) company Cybersprint. This is hugely exciting for both our companies, our customers and the wider security industry.
After months of meeting with the Cybersprint teams, diving into their technology and shared opportunities, we are truly excited for the way ahead. Cybersprint is a fantastic fit for Darktrace because of their technology, their people and their data. I want to go into those three reasons in a little more detail.
The Technology
We have tested Cybersprint’s technology intensely ourselves and have seen first-hand great benefits in the short, medium and long-term for our customers.
There are three technical requirements to ensure it met Darktrace’s architectural needs:
Unique to each customer; delivering a bespoke perspective of the attack surface of a given organisation by starting just with a brand or domain. No access to sensitive customer data is required. No installation or integration is required to get started.
The analysis of data had to be real-time and continuous. This is critically important for Darktrace’s Continuous Cyber AI Loop. We always operate on real-time data that is continuously updated as things change; so does Cybersprint.
Built-in automation and integration. Cybersprint automates everything possible in Attack Surface Management and integrates with every external data source.
We have already identified several high-impact integration opportunities where Cybersprint and its external data can be additive to Darktrace’s self-learning, internal data; applying this to each area of the Loop.
The People
Thinking about people, Cybersprint has a well-functioning technical team that we welcome with open arms here at Darktrace, to help accelerate our Prevent vision and create something better together.
When we first started meeting with the Cybersprint teams, we immediately noticed that this is a meeting of minds. We both share a vision for cyber security – using smart tech to move the needle in favour of defenders. We both believe that cyber security is not a human-scale problem – this won’t be solved by throwing more humans in the mix.
Their world-class teams of researchers, ethical hackers and developers are a great addition to our own R&D capabilities in Cambridge, who have a heavy focus on AI. We share many common values across both organizations – such as friends & family first. It is great to have another European research hub that is only a short train-ride or flight away from our Cambridge R&D HQ. It’s important to note that the vast majority of Cybersprint employees are deep technologists.
The Data
Lastly, touching on data, Cybersprint has unparalleled access to attack surface data – basically an up-to-date, continuous copy of the internet. Having access to this data and being able to intelligently analyse it is a huge benefit in itself.
At Darktrace, we already have complete visibility over the internal data of our customers – their email environment, SaaS data, operational technology, IoT, network, zero-trust and other coverage areas – but being able to combine those data sets and deriving insights from them will further drive breakthrough innovations.
Delivering on a shared vision
To understand why we are so excited about Cybersprint and see it as a great fit, one has to be aware of our technology vision of a closed loop system:
Darktrace is already well-known for its offering in the Detect (Enterprise Immune System), Investigate (Cyber AI Analyst) and Respond (Antigena) areas. As we work towards further augmenting security teams in other areas, we are starting to productize technology that makes it more costly and harder for attackers to succeed – we refer to this area broadly as ‘Prevent’.
Prevent is all about being proactive, hardening your environment and reducing risk. The core technology for Prevent is Attack Path Modeling – feeding Attack Path Modeling with various telemetry and working out the most critical attack paths and chokepoints to remediate.
Darktrace already has complete coverage of an organization’s digital estate from an internal perspective, thanks to our various coverage areas. Our Attack Path Modeling is currently producing powerful results based on an organization’s internal data only – but by adding Cybersprint’s attack surface data and external asset information, we will have complete visibility, internal and external, and bespoke to each individual organization.
While the ASM data in itself is valuable to harden the external attack surface, feeding it into our Attack Path Modeling engine will unlock further capabilities. It allows us to model bespoke, multi-domain, end-to-end attack paths in real time.
Stay tuned
This is the beginning of an exciting journey for both Cybersprint and Darktrace. We look forward to updating you again on the evolution of our upcoming Prevent offering.
In the meantime, feel free to send any questions relating to Cybersprint to cybersprint@darktrace.com
Like this and want more?
Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newsletter
Enjoying the blog?
Sign up to receive the latest news and insights from the Darktrace newsletter – delivered directly to your inbox
Thanks for signing up!
Look out for your first newsletter, coming soon.
Oops! Something went wrong while submitting the form.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Max Heinemeyer
Global Field CISO
Max is a cyber security expert with over a decade of experience in the field, specializing in a wide range of areas such as Penetration Testing, Red-Teaming, SIEM and SOC consulting and hunting Advanced Persistent Threat (APT) groups. At Darktrace, Max is closely involved with Darktrace’s strategic customers & prospects. He works with the R&D team at Darktrace, shaping research into new AI innovations and their various defensive and offensive applications. Max’s insights are regularly featured in international media outlets such as the BBC, Forbes and WIRED. Max holds an MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.
RansomHub revisited: New front-runner in the ransomware-as-a-service marketplace
In a previous Inside the SOC blog, Darktrace investigated RansomHub and its growing impact on the threat landscape due to its use by the ShadowSyndicate threat group. Here, RansomHub is revisited with new insights on this ransomware-as-a-service (RaaS) platform that has rapidly gained traction among threat actors of late.
In recent months, Darktrace’s Threat Research team has noted a significant uptick in potential compromises affecting the fleet, indicating that RansomHub is becoming a preferred tool for cybercriminals. This article delves into the increasing adoption of RansomHub, the tactics, techniques, and procedures (TTPs) employed by its affiliates, and the broader implications for organizations striving to protect their systems.
RansomHub overview & background
One notable threat group to have transitioned from ALPHV (BlackCat)-aligned operations to RansomHub-aligned operations is ScatteredSpider [1]. The adoption of RansomHub by ScatteredSpider and other threat actors suggests a possible power shift among threat groups, given the increasing number of cybercriminals adopting it, including those who previously relied on ALPHV’s malware code [2].
ALPHV was a RaaS strain used by cybercriminals to breach Change Healthcare in February 2024 [2]. However, there are claims that the ransom payment never reached the affiliate using ALPHV, leading to a loss of trust in the RaaS. Around the same time, Operation Cronos resulted in the shutdown of LockBit and the abandonment of its affiliates [2]. Consequently, RansomHub emerged as a prominent RaaS successor.
RansomHub targets
The RansomHub ransomware group has been observed targeting various sectors, including critical infrastructure, financial and government services, and the healthcare sector [4]. They use ransomware variants rewritten in GoLang to target both Windows and Linux systems [5]. RansomHub is known for employing double extortion attacks, encrypting data using “Curve25519” encryption [6].
RansomHub tactics and techniques
The attackers leverage phishing attacks and social engineering techniques to lure their victims. Once access is gained, they use sophisticated tools to maintain control over compromised networks and exploit vulnerabilities in systems like Windows, Linux, ESXI, and NAS.
In more recent RansomHub attacks, tools such as Atera and Splashtop have been used to facilitate remote access, while NetScan has been employed to discover and retrieve information about network devices [7].
External researchers have observed that RansomHub uses several legitimate tools, or a tactic known as Living-off-the-Land (LOTL), to carry out their attacks. These tools include:
SecretServerSecretStealer: A PowerShell script that allows for the decryption of passwords [1].
Ngrok: A legitimate reverse proxy tool that creates a secure tunnel to servers located behind firewalls, used by the group for lateral movement and data exfiltration.
Remmina: An open-source remote desktop client for POSIX-based operating systems, enabling threat actors to access remote services [1].
By using these legitimate tools instead of traditional malware, RansomHub can avoid detection and maintain a lower profile during their operations.
Darktrace’s Coverage of RansomHub
Darktrace’s Security Operations Center (SOC) detected several notable cases of likely RansomHub activity across the customer base in recent months. In all instances, threat actors performed network scanning and brute force activities.
During the investigation of a confirmed RansomHub attack in January 2025, the Darktrace Threat Research team identified multiple authentication attempts as attackers tried to retrieve valid credentials. It is plausible that the attackers gained entry to customer environments through their Remote Desktop (RD) web server. Following this, various RDP connections were made to pivot to other devices within the network.
The common element among the cases investigated was that, in most instances, devices were seen performing outgoing connections to splashtop[.]com, a remote access and support software service, after the scanning activity had occurred. On one customer network, following this activity, the same device was seen connecting to the domain agent-api[.]atera[.]com and IP 20.37.139[.]187, which are seemingly linked to Atera, a Remote Monitoring and Management (RMM) tool.
Figure 1: Model Alert Log of an affected device making connections to *atera[.]com.
In a separate case, a Darktrace observed a device attempting to perform SMB scanning activity, trying to connect to multiple internal devices over port 445. Cyber AI Analyst was able to detect and correlate these individual connections into a single reconnaissance incident.
Similar connections to Remote Monitoring and Management (RMM) tools were also detected in a different customer environment, as alerted by Darktrace’s SOC. Unusual connections to Splashtop and Atera were made from the alerted device. Following this, the same device was observed sending a large volume of data over SSH Rclone to a rare external endpoint on the unusual port 448, triggered multiple models in Darktrace / NETWORK.
Figure 2: Advanced Search graph demonstrating the rarity of the external IP 38.244.145[.]85 used for data exfiltration.
Figure 3: Model Alert Log displaying information related to the suspicious IP, including the port used and its rarity for the network.
In the cases observed, data exfiltration occurred alongside the encryption of files likely indicating double extortion tactics. In September 2024, the Darktrace’s Threat Research team identified a 6-digit alphanumeric additional extension similar to “.293ac3”. This case was closely linked to a RansomHub attack, which was also analyzed in a different blog post by Darktrace [8].
Figure 4: Event Log displaying the extension “.293ac3” being appended to encrypted files on an affected customer network.
Conclusion
RansomHub exemplifies the evolving RaaS ecosystem, where threat actors capitalize on ready-made platforms to launch sophisticated attacks with ease. The activities observed highlight its growing popularity among cybercriminals. The analysis showed that the different attacks investigated followed a similar pattern of activity.
First, attackers perform reconnaissance activities, including widespread scanning from multiple devices and reverse DNS sweeps. They then use high-privileged credentials to pivot among devices and establish remote connections using RMM tools such as Atera. A common element among most attacks that reached the data encryption stage is the use of a 6-digit alphanumeric extension.
In all cases, Darktrace alerted on the unusual activities observed, creating not only model alerts but also Cyber AI Analyst incidents. Both Darktrace Security Operations Support and Darktrace Managed Threat Detection services provided 24/7 assistance to clients affected by RansomHub. The analyst team continued investigating these incidents, gathering data and IoCs seen in the RansomHub incidents, providing valuable insight and guidance throughout the process.
As RansomHub continues to gain traction, it serves as a stark reminder of the need for robust cybersecurity measures, proactive threat intelligence, and continued vigilance.
Credit to Maria Geronikolou (Cyber Analyst) and Nahisha Nobregas (Senior Cyber Analyst)
Appendices
Darktrace Model Detections
Network Reconnaissance
o Device / Network Scan
o Device / ICMP Address Scan
o Device / RDP Scan
o Device / Anomalous LDAP Root Searches
o Anomalous Connection / SMB Enumeration
o Device / Spike in LDAP Activity
o Device / Suspicious Network Scan Activity
Lateral Movement
o Device / Multiple Lateral Movement Model Alerts
o Device / Increase in New RPC Services
o Device / New or Uncommon WMI Activity
o Device / Possible SMB/NTLM Brute Force
o Device / SMB Session Brute Force (Non-Admin)
o Device / Anomalous NTLM Brute Force
o Compliance / Default Credential Usage
o Compliance / Outgoing NTLM Request from DC
C2 Activity
o Anomalous Server Activity / Outgoing from Server
o Anomalous Connection / Multiple Connections to New External TCP Port
o Unusual Activity / Unusual External Activity
o Compliance / Remote Management Tool On Server
Data Exfiltration
o Unusual Activity / Enhanced Unusual External Data Transfer
o Anomalous Connection / Outbound SSH to Unusual Port
o Compliance / SSH to Rare External Destination
o Unusual Activity / Unusual External Data to New Endpoint
o Unusual Activity / Unusual External Data Transfer
o Attack Path Modelling / Unusual Data Transfer on Critical Attack Path
o Compliance / Possible Unencrypted Password File On Server
While the success of a SOC team is often measured through incident management effectiveness (E.g MTTD, MTTR), a true measure of maturity is the reduction of annual security incidents.
Organizations face an increasing number of alerts each year, yet the best SOC teams place focus on proactive operations which don’t reduce the threshold for what becomes an incident but targets the source risks that prevent them entirely.
Freeing up time to focus on cyber risk management is a challenge in and of itself, we cover this in the previous two blogs in this series (see above). However, when the time comes to manage risk, there are several challenges that are unique when compared to detection & response functions within cybersecurity.
Why do cyber risks matter?
While the volume of reported CVEs is increasing at an alarming rate[1], determining the criticality of each vulnerability is becoming increasingly challenging, especially when the likelihood and impact may be different for each organization. Yet vulnerabilities have stood as an important signpost in traditional security and mitigation strategies. Now, without clear prioritization, potentially severe risks may go unreported, leaving organizations exposed to significant threats.
Vulnerabilities also represent just one area of potential risks. Cyberattacks are no longer confined to a single technology type. They now traverse various platforms, including cloud services, email systems, and networks. As technology infrastructure continues to expand, so does the attack surface, making comprehensive visibility across all technology types essential for reducing risk and preventing multi-vector attacks.
However, achieving this visibility is increasingly difficult as infrastructure grows and the cyber risk market remains oversaturated. This visibility challenge extends beyond technology to include personnel and individual cyber hygiene which can still exacerbate broader cyberattacks whether malicious or not.
Organizations must adopt a holistic approach to preventative security. This includes improving visibility across all technology types, addressing human risks, and mobilizing swiftly against emerging security gaps.
“By 2026, 60% of cybersecurity functions will implement business-impact-focused risk assessment methods, aligning cybersecurity strategies with organizational objectives.” [2]
The costs of a fragmented approach
Figure 1: Organizations may have a combination of siloed preventative security measures or technologies in place
Unlike other security tools (like SIEM, NDR or SOAR) which contain an established set of capabilities, cyber risk reduction has not traditionally been defined by a single market, rather a variety of products and practices that each provide their own value and are overwhelming if too many are adopted. Just some examples include:
Threat and Vulnerability management: Leverages threat intelligence, CVEs and asset management; however, leaves teams with significant patching workflows, ignores business & human factors and is reliant on the speed of teams to keep up with each passing update.
Continuous Controls Monitoring (CCM): Automatically audits the effectiveness of security controls based on industry frameworks but requires careful prioritization and human calculations to set-up effectively. Focuses solely on mobilization.
Breach and Attack Simulation (BAS): Automates security posture testing through mock scenarios but require previous prioritization and might not tell you how your specific technologies can be mitigated to reduce that risk.
Posture Management technologies: Siloed approaches across Cloud, SaaS, Data Security and even Gen AI that reactively assess misconfigurations and suggest improvements but with only industry frameworks to validate the importance of the risks.
Red teaming & Penetration testing: Required by several regulations including (GDPR, HIPPA, PCI, DSS), many organizations hire 'red teams' to perform real breaches in trusted conditions. Penetration tests reveal many flaws, but are not continuous, requiring third-party input and producing long to-do lists with input of broader business risk dependent on the cost of the service.
Third-party auditors: Organizations also use third-party auditors to identify assets with vulnerabilities, grade compliance, and recommend improvements. At best, these exercises become tick-box exercises for companies to stay in compliance with the responsibility still on the client to perform further discovery and actioning.
Many of these individual solutions on the market offer simple enhancement, or an automated version of an existing human security task. Ultimately, they lack an understanding of the most critical assets at your organization and are limited in scope, only working in a specific technology area or with the data you provide.
Even when these strategies are complete, implementation of the results require resources, coordination, and buy-in from IT, cybersecurity, and compliance departments. Given the nature of modern business structures, this can be labor and time intensive as responsibilities are shared by organizational segmentation spread across IT, governance, risk and compliance (GRC), and security teams.
Prioritize your true cyber risk with a CTEM approach
Organizations with robust security programs benefit from well-defined policies, standards, key risk indicators (KRIs), and operational metrics, making it easier to measure and report cyber risk accurately.
Implementing a framework like Gartner’s CTEM (Continuous Threat Exposure Management) can help governance by defining the most relevant risks to each organization and which specific solutions meet your improvement needs.
This five-step approach—scoping, discovery, prioritization, validation, and mobilization—encourages focused management cycles, better delegation of responsibilities and a firm emphasis on validating potential risks through technological methods like attack path modeling or breach and attack simulation to add credibility.
Implementing CTEM requires expertise and structure. This begins with an exposure management solution developed uniquely alongside a core threat detection and response offering, to provide visibility of an organization’s most critical risks, whilst linking directly to their incident-based workflows.
“By 2026, organizations prioritizing their security investments, based on a continuous threat exposure management program, will realize a two-third reduction in breaches.” [3]
Achieving a proactive security posture across the whole estate
Unlike conventional tools that focus on isolated risks, Darktrace / Proactive Exposure Management breaks down traditional barriers. Teams can define risk scopes with full, prioritized visibility of the critical risks between: IT/OT networks, email, Active Directory, cloud resources, operational groups, (or even the external attack surface by integrating with Darktrace / Attack Surface Management).
Our innovative, AI-led risk discovery provides a view that mirrors actual attacker methodologies. It does this through advanced algorithms that determine risk based on business importance, rather than traditional device-type prioritization. By implementing a sophisticated damage assessment methodology, security teams don’t just prioritize via severity but instead, the inherent impact, damage, weakness and external exposure of an asset or user.
These calculations also revolutionize vulnerability management by combining industry standard CVE measurements with that organization-specific context to ensure patch management efforts are efficient, rather than an endless list.
Darktrace also integrates MITRE ATT&CK framework mappings to connect all risks through attack path modeling. This offers validation to our AI’s scoring by presenting real world incident scenarios that could occur across your technologies, and the actionable mitigations to mobilize against them.
For those human choke points, security may also deploy targeted phishing engagements. These send real but harmless email ‘attacks’ to test employee susceptibility, strengthening your ability to identify weak points in your security posture, while informing broader governance strategies.
Combining risk with live detection and response
Together, each of these capabilities let teams take the best steps towards reducing risk and the volume of incidents they face. However, getting proactive also sharpens your ability to handle live threats if they occur.
During real incidents Darktrace users can quickly evaluate the potential impact of affected assets, create their own risk detections based on internal policies, strengthen their autonomous response along critical attack paths, or even see the possible stage of the next attack.
By continually ingesting risk information into live triage workflows, security teams will develop a proactive-first mindset, prioritizing the assets and alerts that have the most impact to the business. This lets them utilize their resource in the most efficient way, freeing up even more time for risk management, mitigation and ensuring continuity for the business.
Whether your organization is laying the foundation for a cybersecurity program or enhancing an advanced one, Darktrace’s self-learning AI adapts to your needs:
Foundational stage: For organizations establishing visibility and automating detection and response.
Integrated stage: For teams expanding coverage across domains and consolidating tools for simplicity.
Proactive stage: For mature security programs enhancing posture with vulnerability management and risk prioritization.
The Darktrace ActiveAI Security Platform empowers security teams to adopt a preventative defense strategy by using Cyber AI Analyst and autonomous response to fuel quicker triage, incident handling and give time back for proactive efforts designed around business impact. The platform encapsulates the critical capabilities that help organizations be proactive and stay ahead of evolving threats.
![Model Alert Log of an affected device making connections to *atera[.]com.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/67a4f4c351229b3135812411_Screenshot%202025-02-06%20at%209.43.19%E2%80%AFAM.png)
![Advanced Search graph demonstrating the rarity of the external IP 38.244.145[.]85 used for data exfiltration.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/67a4f4ef3ae41e42fd9511e5_Screenshot%202025-02-06%20at%209.44.06%E2%80%AFAM.png)
