Blog
/
Network
/
February 19, 2025

Darktrace Releases Annual 2024 Threat Insights

Explore Darktrace's Annual Threat Report 2024 for insights on the latest cyber threats and trends observed throughout the year.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
The Darktrace Threat Research Team
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
19
Feb 2025

Defenders must understand the threat landscape in order to protect against it. They can do that with threat intelligence.

Darktrace approaches threat intelligence with a unique perspective. Unlike traditional security vendors that rely on established patterns from past incidents, it uses a strategy that is rooted in the belief that identifying behavioral anomalies is crucial for identifying both known and novel threats.

For Darktrace analysts and researchers, the incidents detected by the AI solution mark the beginning of a deeper investigation, aiming to connect mitigated threats to wider trends from across the threat landscape. Through hindsight analysis, the Darktrace Threat Research team has highlighted numerous threats, including zero-day, n-day, and other novel attacks, showcasing their evolving nature and Darktrace’s ability to identify them.

Read Darktrace's Annual Threat Report to discover major trends around vulnerabilities in internet-facing systems, new and re-emerging ransomware strains, and sophisticated email attacks.

Multiple campaigns target vulnerabilities in internet-facing systems

It is increasingly common for threat actors to identify and exploit newly discovered vulnerabilities in widely used services and applications, and in some cases, these vulnerability exploitations occur within hours of disclosure.

In 2024, the most significant campaigns observed involved the ongoing exploitation of zero-day and n-day vulnerabilities in edge and perimeter network technologies. In fact, in the first half of the year, 40% of all identified campaign activity came from the exploitation of internet-facing devices. Some of the most common exploitations involved Ivanti Connect Secure (CS) and Ivanti Policy Secure (PS) appliances, Palo Alto Network (PAN-OS) firewall devices, and Fortinet appliances.

Darktrace helps security teams identify suspicious behavior quickly, as demonstrated with the critical vulnerability in PAN-OS firewall devices. The vulnerability was publicly disclosed on April 11, 2024, yet with anomaly-based detection, Darktrace’s Threat Research team was able to identify a range of suspicious behavior related to exploitation of this vulnerability, including command-and-control (C2) connectivity, data exfiltration, and brute-forcing activity, as early as March 26.

That means that Darktrace and our Threat Research team detected this Common Vulnerabilities and Exposure (CVE) exploitation 16 days before the vulnerability was disclosed. Addressing critical vulnerabilities quickly massively benefits security, as teams can reduce their effectiveness by slowing malicious operations and forcing attackers to pursue more costly and time-consuming methods.

Persistent ransomware threats continue to evolve

The continued adoption of the Ransomware-as-a-Service (RaaS) model provides even less experienced threat actors with the tools needed to carry out disruptive attacks, significantly lowering the barrier to entry.

The Threat Research team tracked both novel and re-emerging strains of ransomware across the customer fleet, including Akira, LockBit, and Lynx. Within these ransomware attempts and incidents, there were notable trends in attackers’ techniques: using phishing emails as an attack vector, exploiting legitimate tools to mask C2 communication, and exfiltrating data to cloud storage services.

Read the Annual 2024 Threat Report for the complete list of prominent ransomware actors and their commonly used techniques.

Onslaught of email threats continues

With a majority of attacks originating from email, it is crucial that organizations secure the inboxes and beyond.

Between December 21, 2023, and December 18, 2024, Darktrace / EMAIL detected over 30.4 million phishing emails across the fleet. Of these, 70% successfully bypassed Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification checks and 55% passed through all other existing layers of customer email security.

The abuse of legitimate services and senders continued to be a significant method for threat actors throughout 2024. By leveraging trusted platforms and domains, malicious actors can bypass traditional security measures and increase the likelihood of their phishing attempts being successful.

This past year, there was a substantial use of legitimately authenticated senders and previously established domains, with 96% of phishing emails detected by Darktrace / EMAIL utilizing existing domains rather than registering new ones.

These are not the only types of email attacks we observed. Darktrace detected over 2.7 million emails with multistage payloads.

While most traditional cybersecurity solutions struggle to cover multiple vectors and recognize each stage of complex attacks as part of wider malicious activity, Darktrace can detect and respond across email, identities, network, and cloud.

Conclusion

The Darktrace Threat Research team continues to monitor the ever-evolving threat landscape. Major patterns over the last year have revealed the importance of fast-acting, anomaly-based detection like Darktrace provides.

For example, response speed is essential when campaigns target vulnerabilities in internet-facing systems, and these vulnerabilities can be exploited by attackers within hours of their disclosure if not even before that.

Similarly, anomaly-based detection can identify hard to find threats like ransomware attacks that increasingly use living-off-the-land techniques and legitimate tools to hide malicious activity. A similar pattern can be found in the realm of email security, where attacks are also getting harder to spot, especially as they frequently exploit trusted senders, use redirects via legitimate services, and craft attacks that bypass DMARC and other layers of email security.

As attacks appear with greater complexity, speed, and camouflage, defenders must have timely detection and containment capabilities to handle all emerging threats. These hard-to-spot attacks can be identified and stopped by Darktrace.

[related-resource]

Download the full report

Discover the latest threat landscape trends and recommendations from the Darktrace Threat Research team

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
The Darktrace Threat Research Team

More in this series

No items found.

Blog

/

Identity

/

May 23, 2025

From Rockstar2FA to FlowerStorm: Investigating a Blooming Phishing-as-a-Service Platform

man on computerDefault blog imageDefault blog image

What is FlowerStorm?

FlowerStorm is a Phishing-as-a-Service (PhaaS) platform believed to have gained traction following the decline of the former PhaaS platform Rockstar2FA. It employs Adversary-in-the-Middle (AitM) attacks to target Microsoft 365 credentials. After Rockstar2FA appeared to go dormant, similar PhaaS portals began to emerge under the name FlowerStorm. This naming is likely linked to the plant-themed terminology found in the HTML titles of its phishing pages, such as 'Sprout' and 'Blossom'. Given the abrupt disappearance of Rockstar2FA and the near-immediate rise of FlowerStorm, it is possible that the operators rebranded to reduce exposure [1].

External researchers identified several similarities between Rockstar2FA and FlowerStorm, suggesting a shared operational overlap. Both use fake login pages, typically spoofing Microsoft, to steal credentials and multi-factor authentication (MFA) tokens, with backend infrastructure hosted on .ru and .com domains. Their phishing kits use very similar HTML structures, including randomized comments, Cloudflare turnstile elements, and fake security prompts. Despite Rockstar2FA typically being known for using automotive themes in their HTML titles, while FlowerStorm shifted to a more botanical theme, the overall design remained consistent [1].

Despite these stylistic differences, both platforms use similar credential capture methods and support MFA bypass. Their domain registration patterns and synchronized activity spikes through late 2024 suggest shared tooling or coordination [1].

FlowerStorm, like Rockstar2FA, also uses their phishing portal to mimic legitimate login pages such as Microsoft 365 for the purpose of stealing credentials and MFA tokens while the portals are relying heavily on backend servers using top-level domains (TLDs) such as .ru, .moscow, and .com. Starting in June 2024, some of the phishing pages began utilizing Cloudflare services with domains such as pages[.]dev. Additionally, usage of the file “next.php” is used to communicate with their backend servers for exfiltration and data communication. FlowerStorm’s platform focuses on credential harvesting using fields such as email, pass, and session tracking tokens in addition to supporting email validation and MFA authentications via their backend systems [1].

Darktrace’s coverage of FlowerStorm Microsoft phishing

While multiple suspected instances of the FlowerStorm PhaaS platform were identified during Darktrace’s investigation, this blog will focus on a specific case from March 2025. Darktrace’s Threat Research team analyzed the affected customer environment and discovered that threat actors were accessing a Software-as-a-Service (SaaS) account from several rare external IP addresses and ASNs.

Around a week before the first indicators of FlowerStorm were observed, Darktrace detected anomalous logins via Microsoft Office 365 products, including Office365 Shell WCSS-Client and Microsoft PowerApps.  Although not confirmed in this instance, Microsoft PowerApps could potentially be leveraged by attackers to create phishing applications or exploit vulnerabilities in data connections [2].

Darktrace’s detection of the unusual SaaS credential use.
Figure 1: Darktrace’s detection of the unusual SaaS credential use.

Following this initial login, Darktrace observed subsequent login activity from the rare source IP, 69.49.230[.]198. Multiple open-source intelligence (OSINT) sources have since associated this IP with the FlowerStorm PhaaS operation [3][4].  Darktrace then observed the SaaS user resetting the password on the Core Directory of the Azure Active Directory using the user agent, O365AdminPortal.

Given FlowerStorm’s known use of AitM attacks targeting Microsoft 365 credentials, it seems highly likely that this activity represents an attacker who previously harvested credentials and is now attempting to escalate their privileges within the target network.

Darktrace / IDENTITY’s detection of privilege escalation on a compromised SaaS account, highlighting unusual login activity and a password reset event.
Figure 2: Darktrace / IDENTITY’s detection of privilege escalation on a compromised SaaS account, highlighting unusual login activity and a password reset event.

Notably, Darktrace’s Cyber AI Analyst also detected anomalies during a number of these login attempts, which is significant given FlowerStorm’s known capability to bypass MFA and steal session tokens.

Cyber AI Analyst’s detection of new login behavior for the SaaS user, including abnormal MFA usage.
Figure 3: Cyber AI Analyst’s detection of new login behavior for the SaaS user, including abnormal MFA usage.
Multiple login and failed login events were observed from the anomalous source IP over the month prior, as seen in Darktrace’s Advanced Search.
Figure 4: Multiple login and failed login events were observed from the anomalous source IP over the month prior, as seen in Darktrace’s Advanced Search.

In response to the suspicious SaaS activity, Darktrace recommended several Autonomous Response actions to contain the threat. These included blocking the user from making further connections to the unusual IP address 69.49.230[.]198 and disabling the user account to prevent any additional malicious activity. In this instance, Darktrace’s Autonomous Response was configured in Human Confirmation mode, requiring manual approval from the customer’s security team before any mitigative actions could be applied. Had the system been configured for full autonomous response, it would have immediately blocked the suspicious connections and disabled any users deviating from their expected behavior—significantly reducing the window of opportunity for attackers.

Figure 5: Autonomous Response Actions recommended on this account behavior; This would result in disabling the user and blocking further sign-in activity from the source IP.

Conclusion

The FlowerStorm platform, along with its predecessor, RockStar2FA is a PhaaS platform known to leverage AitM attacks to steal user credentials and bypass MFA, with threat actors adopting increasingly sophisticated toolkits and techniques to carry out their attacks.

In this incident observed within a Darktrace customer's SaaS environment, Darktrace detected suspicious login activity involving abnormal VPN usage from a previously unseen IP address, which was subsequently linked to the FlowerStorm PhaaS platform. The subsequent activity, specifically a password reset, was deemed highly suspicious and likely indicative of an attacker having obtained SaaS credentials through a prior credential harvesting attack.

Darktrace’s prompt detection of these SaaS anomalies and timely notifications from its Security Operations Centre (SOC) enabled the customer to mitigate and remediate the threat before attackers could escalate privileges and advance the attack, effectively shutting it down in its early stages.

Credit to Justin Torres (Senior Cyber Analyst), Vivek Rajan (Cyber Analyst), Ryan Traill (Analyst Content Lead)

Appendices

Darktrace Model Alert Detections

·      SaaS / Access / M365 High Risk Level Login

·      SaaS / Access / Unusual External Source for SaaS Credential Use

·      SaaS / Compromise / Login from Rare High-Risk Endpoint

·      SaaS / Compromise / SaaS Anomaly Following Anomalous Login

·      SaaS / Compromise / Unusual Login and Account Update

·      SaaS / Unusual Activity / Unusual MFA Auth and SaaS Activity

Cyber AI Analyst Coverage

·      Suspicious Access of Azure Active Directory  

·      Suspicious Access of Azure Active Directory  

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

69.49.230[.]198 – Source IP – Malicious IP Associated with FlowerStorm, Observed in Login Activity

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique  

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Cloud Service Dashboard - DISCOVERY - T1538

Compromise Accounts - RESOURCE DEVELOPMENT - T1586

Steal Web Session Cookie - CREDENTIAL ACCESS - T1539

References:

[1] https://news.sophos.com/en-us/2024/12/19/phishing-platform-rockstar-2fa-trips-and-flowerstorm-picks-up-the-pieces/

[2] https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-compromised-malicious-app

[3] https://www.virustotal.com/gui/ip-address/69.49.230.198/community

[4] https://otx.alienvault.com/indicator/ip/69.49.230.198

Continue reading
About the author
Justin Torres
Cyber Analyst

Blog

/

Network

/

May 23, 2025

Defending the Frontlines: Proactive Cybersecurity in Local Government

Default blog imageDefault blog image

Serving a population of over 165,000 citizens, this county government delivers essential services that enhance the quality of life for all of its residents in Florida, United States. From public safety and works to law enforcement, economic development, health, and community services, the county’s cybersecurity strategy plays a foundational role in protecting its citizens.

From flying blind to seeing the bigger picture

Safeguarding data from multiple systems, service providers, and citizens is a key aspect of the County’s Systems Management remit. Protecting sensitive information while enabling smooth engagement with multiple external partners poses a unique challenge; the types of data and potential threats are continuously evolving, but resources – both human and financial – remain consistently tight.

When the Chief Information Officer took on his role in 2024, building out a responsive defense-in-depth strategy was central to achieving these goals. However, with limited resources and complex needs, his small security team was struggling with high alert volumes, inefficient tools, and time-consuming investigations that frequently led nowhere.

Meanwhile, issues like insider threats, Denial of Service (DoS), and phishing attacks were growing; the inefficiencies were creating serious security vulnerabilities. As the CIO put it, he was flying blind. With so much data coming in, security analysts were in danger of missing the bigger picture.

“We would just see a single portion of data that could send us down a rabbit hole, thinking something’s going on – only to find out after spending days, weeks, or even months that it was nothing. If you’re only seeing one piece of the issue, it’s really difficult to identify whether something is a legitimate threat or a false positive.”

Local government’s unique cybersecurity challenges

According to the CIO, even with a bigger team, aligning and comparing all the data into a comprehensive, bigger picture would be a major challenge. “The thing about local government specifically is that it’s a complex security environment. We bring together a lot of different individuals and organizations, from construction workers to people who bring projects into our community to better the County. What we work with varies from day to day.”

The challenge wasn’t just about identifying threats, but also about doing so quickly enough to respond before damage was done. The CIO said this was particularly concerning when dealing with sophisticated threats: “We’re dealing with nation-state attackers nowadays, as opposed to ‘script kiddies.’ There’s no time to lose. We’ve got to have cybersecurity that can respond as quickly as they can attack.”

To achieve this, among the most critical challenges the CIO and his team needed to address were:

  • Contextual awareness and visibility across the network: The County team lacked the granular visibility needed to identify potentially harmful behaviors. The IT team needed a tool that uncovered hidden activities and provided actionable insights, with minimal manual intervention.
  • Augmenting human expertise and improving response times: Hiring additional analysts to monitor the environment is prohibitively expensive for many local governments. The IT team needed a cybersecurity solution that could augment existing skills while automating day-to-day tasks. More effective resource allocation would drive improved response times.
  • Preventing email-based threats: Phishing and malicious email links present a persistent threat. The County team needed a way to flag, identify, and hold suspicious messages automatically and efficiently. Given the team’s public service remit, contextual awareness is crucial to ensuring that no legitimate communications are accidentally blocked. Accuracy is extremely important.
  • Securing access and managing insider threats: Having already managed insider threats posed by former staff members, the IT team wanted to adopt a more proactive, deterrent-based approach towards employee IT resource use, preventing incidents before they could occur.

Proactive cybersecurity

Recognizing these challenges, the CIO and County sought AI-driven solutions capable of acting autonomously to support a lean IT team and give the big picture view needed, without getting lost in false positive alerts.

Ease of deployment was another key requirement: the CIO wanted to quickly establish a security baseline for County that would not require extensive pre-planning or disrupt existing systems. Having worked with Darktrace in previous roles, he knew the solution had the capacity to make the critical connections he was looking for, while delivering fast response times and reducing the burden on security teams.

When every second counts, we want to be as close to the same resources as our attackers are utilizing. We have got to have something that can respond as quickly as they can attack. For the County, that’s Darktrace.” – CIO, County Systems Management Department.

Closing network visibility gaps with Darktrace / NETWORK

The County chose Darktrace / NETWORK for unparalleled visibility into the County’s network. With the solution in place, the CIO and his team were able to identify and address previously hidden activities, uncovering insider threats in unexpected places. For example, one team member had installed an unauthorized anonymizer plug-in on their browser, posing a potentially serious security risk via traffic being sent out to the internet. “Darktrace immediately alerted on it,” said CIO. “We were able to deal with the threat proactively and quickly.”

Darktrace / NETWORK continuously monitored and updated its understanding of the County environment, intelligently establishing the different behaviors and network activity. The end result was a level of context awareness that enabled the team to focus on the alerts that mattered most, saving time and effort.

“Darktrace brings all the data we need together, into one picture. We’re able to see what’s going on at a glance, as opposed to spending time trying to identify real threats from false positives,” said the CIO. The ability to automate actions freed the team up to focus on more complex tasks, with 66% of network response actions being applied autonomously, taking the right action at the right time to stop the earliest signs of threatening activity. This reduced pressure on the County’s team members, while buying valuable containment time to perform deeper investigations.

The agentless deployment advantage

For the CIO, one of the major benefits of Darktrace / NETWORK is that it’s agentless. “Agents alert attackers to the presence of security in your environment, it helps them to understand that there’s something else they need to bring down your defenses,” he said. Using Darktrace to mirror network traffic, the County can maintain full visibility across all network entities without alerting attackers and respond to threatening activity at machine speed. “It allows me to sleep better at night, knowing that this tool can effectively unplug the network cable from that device and bring it offline,” said CIO.

Streamlining investigations with Darktrace Cyber AI Analyst

For lean security teams, contextual awareness is crucial in reducing the burden of alert fatigue. Using Cyber AI Analyst, the County team is able to take the pressure off, automatically investigating every relevant event, and reducing thousands of individual alerts to only a small number of incidents that require manual review.

For the County team, the benefits are clear: 520 investigation hours saved in one month, with an average of just 11 minutes investigation time per incident. For the CIO, Darktrace goes beyond reducing workloads, it actually drives security: “It identifies threats almost instantly, bringing together logs and behaviors into a single, clear view.”

The efficiency gain has been so significant that the CIO believes Darktrace augments capabilities beyond the size of a team of analysts. “You could have three analysts working around the clock, but it’s hard to bring all those logs and behaviors together in one place and communicate everything in a coordinated way. Nothing does that as quickly as Darktrace can.”

Catching the threats from within: Defense in depth with Darktrace / IDENTITY

One of the key benefits of Darktrace for the County was its breadth of capability and responsiveness. “We’re looking at everything from multi-factor authentication, insider threats, distributed denial of service attacks,” said the CIO. “I’ve worked with other products in the past, but I’ve never found a tool as good as Darktrace.”

Further insider threats uncovered by Darktrace / IDENTITY included insecure access practices. Some users had logins and passwords on shared network resources or in plain-text files. Darktrace alerted the security team and the threats were mitigated before serious damage was done.

Darktrace / IDENTITY gives organizations advanced visibility of application user behavior from unusual authentication, password sprays, account takeover, resource theft, and admin abuse. Security teams can take targeted actions including the forced log-off of a user or temporary disabling of an account to give the team time to verify legitimacy.

First line of defense against the number one attack vector: Enhancing email security with Darktrace / EMAIL

Email-based threats, such as phishing, are among the most common attack vectors in modern cybersecurity, and a key vector for ransomware attacks. Post implementation performance was so strong that the organization now plans to retire other tools, cutting costs without compromising on security.

Darktrace / EMAIL was one of the first tools that I implemented when I started here,” said CIO. “I really recognize the value of it in our environment.” In addition to detecting and flagging potentially malicious email, the CIO said an unexpected benefit has been the reinforcement of more security-aware behaviors among end users. “People are checking their junk folders now, alerting us and checking to see if something is legitimate or not.”

The CIO said that, unlike traditional email security tools that basically perform only one function, Darktrace has multiple additional capabilities that deliver extra layers of protection compared to one-dimensional alternatives. For example, AI-employee feedback loops leverage insights gained from individual users to not only improve detection rates, but also provide end users with contextual security awareness training, to enhance greater understanding of the risks.

Straightforward integration, ease of use

The County wanted a powerful, responsive solution – without demanding pre-installation or integration needs, and with maximum ease of use. “The integration is relatively painless,” said the CIO. “That’s another real benefit, you can bring Darktrace into your environment and have it up and running faster than you could ever hire additional analysts to look at the same data.”

The team found that, compared to competing products, where there was extensive setup, overhead, and resources, “Darktrace is almost plug-and-play.” According to the CIO, the solution started ingesting information and providing notifications immediately: “You can turn on defense or response mechanisms at a granular level, for email or network – or both at the same time.”

The County sees Darktrace as an integral part of its cybersecurity strategy into the future. “Having worked with Darktrace in the past, it was an easy decision for me to agree to a multi-year partnership,” said the CIO “As we continue to build out our defense-in-depth strategy, the ability to use Darktrace to manage other data sources and identify new, additional behavior will be crucial to our proactive, risk-based approach.”

Darktrace has the capacity to meet the organization’s need for exceptional responsiveness, without burning out teams. “If you’re not overburdening the teams that you do have with significant workloads, they have a lot more agility to deal with things on the fly,” said the CIO.

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI