Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
The Darktrace Threat Research Team
Share
19
Feb 2025
Defenders must understand the threat landscape in order to protect against it. They can do that with threat intelligence.
Darktrace approaches threat intelligence with a unique perspective. Unlike traditional security vendors that rely on established patterns from past incidents, it uses a strategy that is rooted in the belief that identifying behavioral anomalies is crucial for identifying both known and novel threats.
For Darktrace analysts and researchers, the incidents detected by the AI solution mark the beginning of a deeper investigation, aiming to connect mitigated threats to wider trends from across the threat landscape. Through hindsight analysis, the Darktrace Threat Research team has highlighted numerous threats, including zero-day, n-day, and other novel attacks, showcasing their evolving nature and Darktrace’s ability to identify them.
Read Darktrace's Annual Threat Report to discover major trends around vulnerabilities in internet-facing systems, new and re-emerging ransomware strains, and sophisticated email attacks.
Multiple campaigns target vulnerabilities in internet-facing systems
It is increasingly common for threat actors to identify and exploit newly discovered vulnerabilities in widely used services and applications, and in some cases, these vulnerability exploitations occur within hours of disclosure.
Darktrace helps security teams identify suspicious behavior quickly, as demonstrated with the critical vulnerability in PAN-OS firewall devices. The vulnerability was publicly disclosed on April 11, 2024, yet with anomaly-based detection, Darktrace’s Threat Research team was able to identify a range of suspicious behavior related to exploitation of this vulnerability, including command-and-control (C2) connectivity, data exfiltration, and brute-forcing activity, as early as March 26.
That means that Darktrace and our Threat Research team detected this Common Vulnerabilities and Exposure (CVE) exploitation 16 days before the vulnerability was disclosed. Addressing critical vulnerabilities quickly massively benefits security, as teams can reduce their effectiveness by slowing malicious operations and forcing attackers to pursue more costly and time-consuming methods.
Persistent ransomware threats continue to evolve
The continued adoption of the Ransomware-as-a-Service (RaaS) model provides even less experienced threat actors with the tools needed to carry out disruptive attacks, significantly lowering the barrier to entry.
The Threat Research team tracked both novel and re-emerging strains of ransomware across the customer fleet, including Akira, LockBit, and Lynx. Within these ransomware attempts and incidents, there were notable trends in attackers’ techniques: using phishing emails as an attack vector, exploiting legitimate tools to mask C2 communication, and exfiltrating data to cloud storage services.
Read the Annual 2024 Threat Report for the complete list of prominent ransomware actors and their commonly used techniques.
Onslaught of email threats continues
With a majority of attacks originating from email, it is crucial that organizations secure the inboxes and beyond.
Between December 21, 2023, and December 18, 2024, Darktrace / EMAIL detected over 30.4 million phishing emails across the fleet. Of these, 70% successfully bypassed Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification checks and 55% passed through all other existing layers of customer email security.
The abuse of legitimate services and senders continued to be a significant method for threat actors throughout 2024. By leveraging trusted platforms and domains, malicious actors can bypass traditional security measures and increase the likelihood of their phishing attempts being successful.
This past year, there was a substantial use of legitimately authenticated senders and previously established domains, with 96% of phishing emails detected by Darktrace / EMAIL utilizing existing domains rather than registering new ones.
These are not the only types of email attacks we observed. Darktrace detected over 2.7 million emails with multistage payloads.
While most traditional cybersecurity solutions struggle to cover multiple vectors and recognize each stage of complex attacks as part of wider malicious activity, Darktrace can detect and respond across email, identities, network, and cloud.
Conclusion
The Darktrace Threat Research team continues to monitor the ever-evolving threat landscape. Major patterns over the last year have revealed the importance of fast-acting, anomaly-based detection like Darktrace provides.
For example, response speed is essential when campaigns target vulnerabilities in internet-facing systems, and these vulnerabilities can be exploited by attackers within hours of their disclosure if not even before that.
Similarly, anomaly-based detection can identify hard to find threats like ransomware attacks that increasingly use living-off-the-land techniques and legitimate tools to hide malicious activity. A similar pattern can be found in the realm of email security, where attacks are also getting harder to spot, especially as they frequently exploit trusted senders, use redirects via legitimate services, and craft attacks that bypass DMARC and other layers of email security.
As attacks appear with greater complexity, speed, and camouflage, defenders must have timely detection and containment capabilities to handle all emerging threats. These hard-to-spot attacks can be identified and stopped by Darktrace.
[related-resource]
Download the full report
Discover the latest threat landscape trends and recommendations from the Darktrace Threat Research team
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
SocGholish: From loader and C2 activity to RansomHub deployment
In early 2025, Darktrace uncovered SocGholish-to-RansomHub intrusion chains, including loader and C2 activity, alongside credential harvesting via WebDAV and SCF abuse. Learn more about SocGholish and its kill chain here!
Your Vendors, Your Risk: Rethinking Third-Party Security in the Age of Supply Chain Attacks
Protecting against supply chain cyber-attacks means safeguarding not just your network, but your customers’ trust. Learn why securing vendor relationships is essential in today’s threat landscape.
SocGholish: From loader and C2 activity to RansomHub deployment
Over the past year, a clear pattern has emerged across the threat landscape: ransomware operations are increasingly relying on compartmentalized affiliate models. In these models, initial access brokers (IABs) [6], malware loaders, and post-exploitation operators work together.
Due to those specialization roles, a new generation of loader campaigns has risen. Threat actors increasingly employ loader operators to quietly establish footholds on the target network. These entities then hand off access to ransomware affiliates. One loader that continues to feature prominently in such campaigns is SocGholish.
What is SocGholish?
SocGholish is a loader malware that has been utilized since at least 2017 [7]. It has long been associated with fake browser updates and JavaScript-based delivery methods on infected websites.
Threat actors often target outdated or poorly secured CMS-based websites like WordPress. Through unpatched plugins, or even remote code execution flaws, they inject malicious JavaScript into the site’s HTML, templates or external JS resources [8]. Historically, SocGholish has functioned as a first-stage malware loader, ultimately leading to deployment of Cobalt Strike beacons [9], and further facilitating access persistence to corporate environments. More recently, multiple security vendors have reported that infections involving SocGholish frequently lead to the deployment of RansomHub ransomware [3] [5].
This blog explores multiple instances within Darktrace's customer base where SocGholish deployment led to subsequent network compromises. Investigations revealed indicators of compromise (IoCs) similar to those identified by external security researchers, along with variations in attacker behavior post-deployment. Key innovations in post-compromise activities include credential access tactics targeting authentication mechanisms, particularly through the abuse of legacy protocols like WebDAV and SCF file interactions over SMB.
Initial access and execution
Since January 2025, Darktrace’s Threat Research team observed multiple cases in which threat actors leveraged the SocGholish loader for initial access. Malicious actors commonly deliver SocGholish by compromising legitimate websites by injecting malicious scripts into the HTML of the affected site. When the visitor lands on an infected site, they are typically redirected to a fake browser update page, tricking them into downloading a ZIP file containing a JavaScript-based loader [1] [2]. In one case, a targeted user appears to have visited the compromised website garagebevents[.]com (IP: 35.203.175[.]30), from which around 10 MB of data was downloaded.
Figure 1: Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.
Within milliseconds of the connection establishment, the user’s device initiated several HTTPS sessions over the destination port 443 to the external endpoint 176.53.147[.]97, linked to the following Keitaro TDS domains:
packedbrick[.]com
rednosehorse[.]com
blackshelter[.]org
blacksaltys[.]com
To evade detection, SocGholish uses highly obfuscated code and relies on traffic distribution systems (TDS) [3]. TDS is a tool used in digital and affiliate marketing to manage and distribute incoming web traffic based on predefined rules. More specifically, Keitaro is a premium self-hosted TDS frequently utilized by attackers as a payload repository for malicious scripts following redirects from compromised sites. In the previously noted example, it appears that the device connected to the compromised website, which then retrieved JavaScript code from the aforementioned Keitaro TDS domains. The script served by those instances led to connections to the endpoint virtual.urban-orthodontics[.]com (IP: 185.76.79[.]50), successfully completing SocGholish’s distribution.
Figure 2: Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.
Persistence
During some investigations, Darktrace researchers observed compromised devices initiating HTTPS connections to the endpoint files.pythonhosted[.]org (IP: 151.101.1[.]223), suggesting Python package downloads. External researchers have previously noted how attackers use Python-based backdoors to maintain access on compromised endpoints following initial access via SocGholish [5].
Credential access and lateral movement
Credential access – external
Darktrace researchers identified observed some variation in kill chain activities following initial access and foothold establishment. For example, Darktrace detected interesting variations in credential access techniques. In one such case, an affected device attempted to contact the rare external endpoint 161.35.56[.]33 using the Web Distributed Authoring and Versioning (WebDAV) protocol. WebDAV is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. WebDAV enables remote shares to be mounted over HTTP or HTTPS, similar to how SMB operates, but using web-based protocols. Windows supports WebDAV natively, which means a UNC path pointing to an HTTP or HTTPS resource can trigger system-level behavior such as authentication.
In this specific case, the system initiated outbound connections using the ‘Microsoft-WebDAV-MiniRedir/10.0.19045’ user-agent, targeting the URI path of /s on the external endpoint 161.35.56[.]33. During these requests, the host attempted to initiate NTML authentication and even SMB sessions over the web, both of which failed. Despite the session failures, these attempts also indicate a form of forced authentication. Forced authentication exploits a default behavior in Windows where, upon encountering a UNC path, the system will automatically try to authenticate to the resource using NTML – often without any user interaction. Although no files were directly retrieved, the WebDAV server was still likely able to retrieve the user’s NTLM hash during the session establishment requests, which can later be used by the adversary to crack the password offline.
Credential access – internal
In another investigated incident, Darktrace observed a related technique utilized for credential access and lateral movement. This time, the infected host uploaded a file named ‘Thumbs.scf’ to multiple internal SMB network shares. Shell Command File ( SCF) is a legacy Windows file format used primarily for Windows Explorer shortcuts. These files contain instructions for rendering icons or triggering shell commands, and they can be executed implicitly when a user simply opens a folder containing the file – no clicks required.
The ‘Thumbs.scf’ file dropped by the attacker was crafted to exploit this behavior. Its contents included a [Shell] section with the Command=2 directive and an IconFile path pointing to a remote UNC resource on the same external endpoint, 161.35.56[.]33, seen in the previously described case – specifically, ‘\\161.35.56[.]33\share\icon.ico’. When a user on the internal network navigates to the folder containing the SCF file, their system will automatically attempt to load the icon. In doing so, the system issues a request to the specified UNC path, which again prompts Windows to initiate NTML authentication.
This pattern of activity implies that the attacker leveraged passive internal exposure; users who simply browsed a compromised share would unknowingly send their NTML hashes to an external attacker-controlled host. Unlike the WebDAV approach, which required initiating outbound communication from the infected host, this SCF method relies on internal users to interact with poisoned folders.
Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.
Command-and-control
Following initial compromise, affected devices would then attempt outbound connections using the TLS/SSL protocol over port 443 to different sets of command-and-control (C2) infrastructure associated with SocGholish. The malware frequently uses obfuscated JavaScript loaders to initiate its infection chain, and once dropped, the malware communicates back to its infrastructure over standard web protocols, typically using HTTPS over port 443. However, this set of connections would precede a second set of outbound connections, this time to infrastructure linked to RansomHub affiliates, possibly facilitating the deployed Python-based backdoor.
Connectivity to RansomHub infrastructure relied on defense evasion tactics, such as port-hopping. The idea behind port-hopping is to disguise C2 traffic by avoiding consistent patterns that might be caught by firewalls, and intrusion detection systems. By cycling through ephemeral ports, the malware increases its chances of slipping past basic egress filtering or network monitoring rules that only scrutinize common web traffic ports like 443 or 80. Darktrace analysts identified systems connecting to destination ports such as 2308, 2311, 2313 and more – all on the same destination IP address associated with the RansomHub C2 environment.
Figure 4: Advanced Search connection logs showing connections over destination ports that change rapidly.
Conclusion
Since the beginning of 2025, Darktrace analysts identified a campaign whereby ransomware affiliates leveraged SocGholish to establish network access in victim environments. This activity enabled multiple sets of different post exploitation activity. Credential access played a key role, with affiliates abusing WebDAV and NTML over SMB to trigger authentication attempts. The attackers were also able to plant SCF files internally to expose NTML hashes from users browsing shared folders. These techniques evidently point to deliberate efforts at early lateral movement and foothold expansion before deploying ransomware. As ransomware groups continue to refine their playbooks and work more closely with sophisticated loaders, it becomes critical to track not just who is involved, but how access is being established, expanded, and weaponized.
Credit to Chrisina Kreza (Cyber Analyst) and Adam Potter (Senior Cyber Analyst)
Appendices
Darktrace / NETWORK model alerts
· Anomalous Connection / SMB Enumeration
· Anomalous Connection / Multiple Connections to New External TCP Port
· Anomalous Connection / Multiple Failed Connections to Rare Endpoint
· Anomalous Connection / New User Agent to IP Without Hostname
· Compliance / External Windows Communication
· Compliance / SMB Drive Write
· Compromise / Large DNS Volume for Suspicious Domain
· Compromise / Large Number of Suspicious Failed Connections
· Device / Anonymous NTML Logins
· Device / External Network Scan
· Device / New or Uncommon SMB Named Pipe
· Device / SMB Lateral Movement
· Device / Suspicious SMB Activity
· Unusual Activity / Unusual External Activity
· User / Kerberos Username Brute Force
MITRE ATT&CK mapping
· Credential Access – T1187 Forced Authentication
· Credential Access – T1110 Brute Force
· Command and Control – T1071.001 Web Protocols
· Command and Control – T1571 Non-Standard Port
· Discovery – T1083 File and Directory Discovery
· Discovery – T1018 Remote System Discovery
· Discovery – T1046 Network Service Discovery
· Discovery – T1135 Network Share Discovery
· Execution – T1059.007 JavaScript
· Lateral Movement – T1021.002 SMB/Windows Admin Shares
Your Vendors, Your Risk: Rethinking Third-Party Security in the Age of Supply Chain Attacks
When most people hear the term supply chain attack, they often imagine a simple scenario: one organization is compromised, and that compromise is used as a springboard to attack another. This kind of lateral movement is common, and often the entry vector is as mundane and as dangerous as email.
Take, for instance, a situation where a trusted third-party vendor is breached. An attacker who gains access to their systems can then send malicious emails to your organization, emails that appear to come from a known and reputable source. Because the relationship is trusted, traditional phishing defenses may not be triggered, and recipients may be more inclined to engage with malicious content. From there, the attacker can establish a foothold, move laterally, escalate privileges, and launch a broader campaign.
This is one dimension of a supply chain cyber-attack, and it’s well understood in many security circles. But the risk doesn’t end there. In fact, it goes deeper, and it often hits the most important asset of all: your customers' data.
The risk beyond the inbox
What happens when customer data is shared with a third party for legitimate processing purposes for example billing, analytics, or customer service and that third party is then compromised?
In that case, your customer data is breached, even if your own systems were never touched. That’s the uncomfortable truth about modern cybersecurity: your risk is no longer confined to your own infrastructure. Every entity you share data with becomes an extension of your attack surface. Thus, we should rethink how we perceive responsibility.
It’s tempting to think that securing our environment is our job, and securing their environment is theirs. But if a breach of their environment results in the exposure of our customers, the accountability and reputational damage fall squarely on our shoulders.
The illusion of boundaries
In an era where digital operations are inherently interconnected, the lines of responsibility can blur quickly. Legally and ethically, organizations are still responsible for the data they collect even if that data is processed, stored, or analyzed by a third party. A customer whose data is leaked because of a vendor breach will almost certainly hold the original brand responsible, not the third-party processor they never heard of.
This is particularly important for industries that rely on extensive outsourcing and platform integrations (SaaS platforms, marketing tools, CRMs, analytics platforms, payment processors). The list of third-party vendors with access to customer data grows year over year. Each integration adds convenience, but also risk.
Encryption isn’t a silver bullet
One of the most common safeguards used in these data flows is encryption. Encrypting customer data in transit is a smart and necessary step, but it’s far from enough. Once data reaches the destination system, it typically needs to be decrypted for use. And the moment it is decrypted, it becomes vulnerable to a variety of attacks like ransomware, data exfiltration, privilege escalation, and more.
In other words, the question isn’t just is the data secure in transit? The more important question is how is it protected once it arrives?
A checklist for organizations evaluating third-parties
Given these risks, what should responsible organizations do when they need to share customer data with third parties?
Start by treating third-party security as an extension of your own security program. Here are some foundational controls that can make a difference:
Due diligence before engagement: Evaluate third-party vendors based on their security posture before signing any contracts. What certifications do they hold? What frameworks do they follow? What is their incident response capability?
Contractual security clauses: Build in specific security requirements into vendor contracts. These can include requirements for encryption standards, access control policies, and data handling protocols.
Third-party security assessments: Require vendors to provide evidence of their security controls. Independent audits, penetration test results, and SOC 2 reports can all provide useful insights.
Ongoing monitoring and attestations: Security isn’t static. Make sure vendors provide regular security attestations and reports. Where possible, schedule periodic reviews or audits, especially for vendors handling sensitive data.
Minimization and segmentation: Don’t send more data than necessary. Data minimization limits the exposure in the event of a breach. Segmentation, both within your environment and within vendor access levels, can further reduce risk.
Incident response planning: Ensure you have a playbook for handling third-party incidents, and that vendors do as well. Coordination in the event of a breach should be clear and rapid.
The human factor: Customers and communication
There’s another angle to supply chain cyber-attacks that’s easy to overlook: the post-breach exploitation of public knowledge. When a breach involving customer data hits the news, it doesn’t take long for cybercriminals to jump on the opportunity.
Attackers can craft phishing emails that appear to be follow-ups from the affected organization: “Click here to reset your password,” “Confirm your details due to the breach,” etc.
A breach doesn’t just put customer data at risk it also opens the door to further fraud, identity theft, and financial loss through social engineering. This is why post-breach communication and phishing mitigation strategies are valuable components of an incident response strategy.
Securing what matters most
Ultimately, protecting against supply chain cyber-attacks isn’t just about safeguarding your own perimeter. It’s about defending the integrity of your customers’ data, wherever it goes. When customer data is entrusted to you, the duty of care doesn’t end at your firewall.
Relying on vendors to “do their part” is not enough. True due diligence means verifying, validating, and continuously monitoring those extended attack surfaces. It means designing controls that assume failure is possible, and planning accordingly.
In today’s threat landscape, cybersecurity is no longer just a technical discipline. It’s a trust-building exercise. Your customers expect you to protect their information, and rightly so. And when a supply chain attack happens, whether the breach originated with you or your partner, the damage lands in the same place: your brand, your customers, your responsibility.
.png)
.jpg)
