December 9, 2024

Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Darktrace’s Threat Research team investigated a major campaign exploiting vulnerabilities in Palo Alto firewall devices (CVE 2024-0012 and 2024-9474). Learn about the spike in post-exploitation activities and understand the need for anomaly-based detection to stay ahead of evolving threats.

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Adam Potter

Senior Cyber Analyst

Dec 2024

Introduction: Spike in exploitation and post-exploitation activity affecting Palo Alto firewall devices

As the first line of defense for many organizations, perimeter devices such as firewalls are frequently targeted by threat actors. If compromised, these devices can serve as the initial point of entry to the network, providing access to vulnerable internal resources. This pattern of malicious behavior has become readily apparent within the Darktrace customer base. In 2024, Darktrace Threat Research analysts identified and investigated at least two major campaigns targeting internet-exposed perimeter devices. These included the exploitation of PAN-OS firewall exploitation via CVE 2024-3400 and FortiManager appliances via CVE 2024-47575.

More recently, at the end of November, Darktrace analysts observed a spike in exploitation and post-exploitation activity affecting, once again, Palo Alto firewall devices in the days following the disclosure of the CVE 2024-0012 and CVE-2024-9474 vulnerabilities.

Threat Research analysts had already been investigating potential exploitation of the firewalls’ management interface after Palo Alto published a security advisory (PAN-SA-2024-0015) on November 8. Subsequent analysis of data from Darktrace’s Security Operations Center (SOC) and external research uncovered multiple cases of Palo Alto firewalls being targeted via the likely exploitation of these vulnerabilities since November 13, through the end of the month. Although this spike in anomalous behavior may not be attributable to a single malicious actor, Darktrace Threat Research identified a clear increase in PAN-OS exploitation across the customer base by threat actors likely utilizing the recently disclosed vulnerabilities, resulting in broad patterns of post-exploitation activity.

How did exploitation occur?

CVE 2024-0012 is an authentication bypass vulnerability affecting unpatched versions of Palo Alto Networks Next-Generation Firewalls. The vulnerability resides in the management interface application on the firewalls specifically, which is written in PHP. When attempting to access highly privileged scripts, users are typically redirected to a login page. However, this can be bypassed by supplying an HTTP request where a Palo Alto related authentication header can be set to “off”. Users can supply this header value to the Nginx reverse proxy server fronting the application which will then send it without any prior processing [1].

CVE-2024-9474 is a privilege escalation vulnerability that allows a PAN-OS administrator with access to the management web interface to execute root-level commands, granting full control over the affected device [2]. When combined, these vulnerabilities enable unauthenticated adversaries to execute arbitrary commands on the firewall with root privileges.

Post-Exploitation Patterns of Activity

Darktrace Threat Research analysts examined potential indicators of PAN-OS software exploitation via CVE 2024-0012 and CVE-2024-9474 during November 2024. The investigation identified three main groupings of post-exploitation activity:

Exploit validation and initial payload retrieval
Command and control (C2) connectivity, potentially featuring further binary downloads
Potential reconnaissance and cryptomining activity

Exploit Validation

Across multiple investigated customers, Darktrace analysts identified likely vulnerable PAN-OS devices conducting external network connectivity to bin services. Specifically, several hosts performed DNS queries for, and HTTP requests to Out-of-Band Application Security Testing (OAST) domains, such as csv2im6eq58ujueonqs0iyq7dqpak311i.oast[.]pro. These endpoints are commonly used by network administrators to harden defenses, but they are increasingly used by threat actors to verify successful exploitation of targeted devices and assess their potential for further compromise. Although connectivity involving OAST domains were prevalent across investigated incidents, this activity was not necessarily the first indicator observed. In some cases, device behavior involving OAST domains also occurred shortly after an initial payload was downloaded.

Figure 1: Darktrace model alert logs detailing the HTTP request to an OAST domain immediately following PAN-OS device compromise.

Initial Payload Retrieval

Following successful exploitation, affected devices commonly performed behaviors indicative of initial payload download, likely in response to incoming remote command execution. Typically, the affected PAN-OS host would utilize the command line utilities curl and Wget, seen via use of user agents curl/7.61.1 and Wget/1.19.5 (linux-gnu), respectively.

In some cases, the use of these command line utilities by the infected devices was considered new behavior. Given the nature of the user agents, interaction with the host shell suggests remote command execution to achieve the outgoing payload requests.

While additional binaries and scripts were retrieved in later stages of the post-exploitation activity in some cases, this set of behaviors and payloads likely represent initial persistence and execution mechanisms that will enable additional functionality later in the kill chain. During the investigation, Darktrace analysts noted the prevalence of shell script payload requests. Devices analyzed would frequently make HTTP requests over the usual destination port 80 using the command line URL utility (curl), as seen in the user-agent field.

The observed URIs often featured requests for text files, such as “1.txt”, or shell scripts such as “y.sh”. Although packet capture (PCAP) samples were unavailable for review, external researchers have noted that the IP address hosting such “1.txt” files (46.8.226[.]75) serves malicious PHP payloads. When examining the contents of the “y.sh” shell script, Darktrace analysts noticed the execution of bash commands to upload a PHP-written web shell on the affected server.

Figure 2: PCAP showing the client request and server response associated with the download of the y.sh script from 45.76.141[.]166. The body content of the HTTP response highlights a shebang command to run subsequent code as bash script. The content is base64 encoded and details PHP script for what appears to be a webshell that will likely be written to the firewall device.

While not all investigated cases saw initial shell script retrieval, affected systems would commonly make an external HTTP connection, almost always via Wget, for the Executable and Linkable Format (ELF) file “/palofd” from the rare external IP 38.180.147[.]18.

Such requests were frequently made without prior hostname lookups, suggesting that the process or script initiating the requests already contained the external IP address. Analysts noticed a consistent SHA1 hash present for all identified instances of “/palofd” downloads (90f6890fa94b25fbf4d5c49f1ea354a023e06510). Multiple open-source intelligence (OSINT) vendors have associated this hash sample with Spectre RAT, a remote access trojan with capabilities including remote command execution, payload delivery, process manipulation, file transfers, and data theft [3][4].

Figure 3: Advanced Search log metrics highlighting details of the “/palofd” file download over HTTP.

Several targeted customer devices were observed initiating TLS/SSL connections to rare external IPs with self-signed TLS certificates following exploitation. Model data from across the Darktrace fleet indicated some overlap in JA3 fingerprints utilized by affected PAN-OS devices engaging in the suspicious TLS activity. Although JA3 hashes alone cannot be used for process attribution, this evidence suggests some correlation of source process across instances of PAN-OS exploitation.

These TLS/SSL sessions were typically established without the specification of a Server Name Indication (SNI) within the TLS extensions. The SNI extension prevents servers from supplying an incorrect certificate to the requesting client when multiple sites are hosted on the same IP. SSL connectivity without SNI specification suggests a potentially malicious running process as most software establishing TLS sessions typically supply this information during the handshake. Although the encrypted nature of the connection prevented further analysis of the payload packets, external sources note that JavaScript content is transmitted during these sessions, serving as initial payloads for the Sliver C2 platform using Wget [5].

C2 Communication and Additional Payloads

Following validation and preliminary post-compromise actions, examined hosts would commonly initiate varying forms of C2 connectivity. During this time, devices were frequently detected making further payload downloads, likely in response to directives set within C2 communications.

Palo Alto firewalls likely exploited via the newly disclosed CVEs would commonly utilize the Sliver C2 platform for external communication. Sliver’s functionality allows for different styles and formatting for communication. An open-source alternative to Cobalt Strike, this framework has been increasingly popular among threat actors, enabling the generation of dynamic payloads (“slivers”) for multiple platforms, including Windows, MacOS, Linux.

These payloads allow operators to establish persistence, spawn new shells, and exfiltrate data. URI patterns and PCAPs analysis yielded evidence of both English word type encoding within Sliverand Gzip formatting.

For example, multiple devices contacted the Sliver-linked IP address 77.221.158[.]154 using HTTP to retrieve Gzip files. The URIs present for these requests follow known Sliver Gzip formatted communication patterns [6]. Investigations yielded evidence of both English word encoding within Sliver, identified through PCAP analysis, and Gzip formatting.

Figure 4: Sample of URIs observed in Advanced Searchhighlighting HTTP requests to 77.221.158[.]154 for Gzip content suggest of Sliver communication.

Figure 5: PCAP showing English word encoding for Sliver communication observed during post-exploitation C2 activity.

External connectivity during this phase also featured TCP connection attempts over uncommon ports for common application protocols. For both Sliver and non-Sliver related IP addresses, devices utilized destination ports such as 8089, 3939, 8880, 8084, and 9999 for the HTTP protocol. The use of uncommon destination ports may represent attempts to avoid detection of connectivity to rare external endpoints. Moreover, some external beaconing within included URIs referencing the likely IP of the affected device. Such behavior can suggest the registration of compromised devices with command servers.

Targeted devices also proceeded to download additional payloads from rare external endpoints as beaconing/C2 activity was ongoing. For example, the newly registered domain repositorylinux[.]org (IP: 103.217.145[.]112) received numerous HTTP GET requests from investigated devices throughout the investigation period for script files including “linux.sh” and “cron.sh”. Young domains, especially those that present as similar to known code repositories, tend to host harmful content. Packet captures of the cron.sh file reveal commands within the HTTP body content involving crontab operations, likely to schedule future downloads. Some hosts that engaged in connectivity to the fake repository domain were later seen conducting crypto-mining connections, potentially highlighting the download of miner applications from the domain.

Additional payloads observed during this time largely featured variations of shell scripts, PHP content, and/or executables. Typically, shell scripts direct the device to retrieve additional content from external servers or repositories or contain potential configuration details for subsequent binaries to run on the device. For example, the “service.sh” retrieves a tar-compressed archive, a configuration JSON file as well as a file with the name “solr” from GitHub, potentially associated with the Apache Solr tool used for enterprise search. These could be used for further enumeration of the host and/or the network environment. PHP scripts observed may involve similar web shell functionality and were retrieved from both rare external IPs identified as well by external researchers [7]. Darktrace also detected the download of octet-stream data occurring mid-compromise from an Amazon Web Services (AWS) S3 bucket. Although no outside research confirmed the functionality, additional executable downloads for files such as “/initd”(IP: 178.215.224[.]246) and “/x6” (IP: 223.165.4[.]175) may relate to tool ingress, further Trojan/backdoor functionality, or cryptocurrency mining.

Figure 7: PCAP specifying the HTTP response headers and body content for the service.sh file request. The body content shown includes variable declarations for URLs that will eventually be called by the device shell via bash command.

Reconnaissance and Cryptomining

Darktrace analysts also noticed additional elements of kill chain operations from affected devices after periods of initial exploit activity. Several devices initiated TCP connections to endpoints affiliated with cryptomining pools such as us[.]zephyr[.]herominers[.]com and xmrig[.]com. Connectivity to these domains indicates likely successful installation of mining software during earlier stages of post-compromise activity. In a small number of instances, Darktrace observed reconnaissance and lateral movement within the time range of PAN-OS exploitation. Firewalls conducted large numbers of internal connectivity attempts across several critical ports related to privileged protocols, including SMB and SSH. Darktrace detected anonymous NTLM login attempts and new usage of potential PAN-related credentials. These behaviors likely constitute attempts at lateral movement to adjacent devices to further extend network compromise impact.

Figure 8: Model alert connection logs detailing the uncommon failed NTLM logins using an anonymous user account following PAN-OS exploitation.

Conclusion

Darktrace Threat Research and SOC analysts increasingly detect spikes in malicious activity on internet-facing devices in the days following the publication of new vulnerabilities. The latest iteration of this trend highlighted how threat actors quickly exploited Palo Alto firewall using authentication bypass and remote command execution vulnerabilities to enable device compromise. A review of the post-exploitation activity during these events reveals consistent patterns of perimeter device exploitation, but also some distinct variations.

Prior campaigns targeting perimeter devices featured activity largely confined to the exfiltration of configuration data and some initial payload retrieval. Within the current campaign, analysts identified a broader scope post-compromise activity consisting not only of payloads downloads but also extensive C2 activity, reconnaissance, and coin mining operations. While the use of command line tools like curl featured prominently in prior investigations, devices were seen retrieving a generally wider array of payloads during the latest round of activity. The use of the Sliver C2 platform further differentiates the latest round of PAN-OS compromises, with evidence of Sliver activity in about half of the investigated cases.

Several of the endpoints contacted by the infected firewall devices did not have any OSINT associated with them at the time of the attack. However, these indicators were noted as unusual for the devices according to Darktrace based on normal network traffic patterns. This reality further highlights the need for anomaly-based detection that does not rely necessarily on known indicators of compromise (IoCs) associated with CVE exploitation for detection. Darktrace’s experience in 2024 of multiple rounds of perimeter device exploitation may foreshadow future increases in these types of comprise operations.

Credit to Adam Potter (Senior Cyber Analyst), Alexandra Sentenac (Senior Cyber Analyst), Emma Foulger (Principal Cyber Analyst) and the Darktrace Threat Research team.

Get the latest insights on emerging cyber threats

Attackers are adapting, are you ready? This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.

Identity-based attacks: How attackers are bypassing traditional defenses
Zero-day exploitation: The rise of previously unknown vulnerabilities
AI-driven threats: How adversaries are leveraging AI to outmaneuver security controls

Stay ahead of evolving threats with expert analysis from Darktrace. Download the report here.

References

[1]: https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

[2]: https://security.paloaltonetworks.com/CVE-2024-9474

[3]: https://threatfox.abuse[.]ch/ioc/1346254/

[4]:https://www.virustotal.com/gui/file/4911396d80baff80826b96d6ea7e54758847c93fdbcd3b86b00946cfd7d1145b/detection

[5]: https://arcticwolf.com/resources/blog/arctic-wolf-observes-threat-campaign-targeting-palo-alto-networks-firewall-devices/

[6] https://www.immersivelabs.com/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide

[7] https://arcticwolf.com/resources/blog/arctic-wolf-observes-threat-campaign-targeting-palo-alto-networks-firewall-devices/

Appendices

Darktrace Model Alerts

Anomalous Connection / Anomalous SSL without SNI to New External

Anomalous Connection / Application Protocol on Uncommon Port

Anomalous Connection / Multiple Failed Connections to Rare Endpoint

Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

Anomalous Connection / New User Agent to IP Without Hostname

Anomalous Connection / Posting HTTP to IP Without Hostname

Anomalous Connection / Rare External SSL Self-Signed

Anomalous File / EXE from Rare External Location

Anomalous File / Incoming ELF File

Anomalous File / Mismatched MIME Type From Rare Endpoint

Anomalous File / Multiple EXE from Rare External Locations

Anomalous File / New User Agent Followed By Numeric File Download

Anomalous File / Script from Rare External Location

Anomalous File / Zip or Gzip from Rare External Location

Anomalous Server Activity / Rare External from Server

Compromise / Agent Beacon (Long Period)

Compromise / Agent Beacon (Medium Period)

Compromise / Agent Beacon to New Endpoint

Compromise / Beacon for 4 Days

Compromise / Beacon to Young Endpoint

Compromise / Beaconing Activity To External Rare

Compromise / High Priority Tunnelling to Bin Services

Compromise / High Volume of Connections with Beacon Score

Compromise / HTTP Beaconing to New IP

Compromise / HTTP Beaconing to Rare Destination

Compromise / Large Number of Suspicious Failed Connections

Compromise / Large Number of Suspicious Successful Connections

Compromise / Slow Beaconing Activity To External Rare

Compromise / SSL Beaconing to Rare Destination

Compromise / Suspicious Beaconing Behavior

Compromise / Suspicious File and C2

Compromise / Suspicious HTTP and Anomalous Activity

Compromise / Suspicious TLS Beaconing To Rare External

Compromise / Sustained SSL or HTTP Increase

Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

Device / Initial Attack Chain Activity

Device / New User Agent

MITRE ATT&CK Mapping

Tactic – Technique

INITIAL ACCESS – Exploit Public-Facing Application

RESOURCE DEVELOPMENT – Malware

EXECUTION – Scheduled Task/Job (Cron)

EXECUTION – Unix Shell

PERSISTENCE – Web Shell

DEFENSE EVASION – Masquerading (Masquerade File Type)

DEFENSE EVASION - Deobfuscate/Decode Files or Information

CREDENTIAL ACCESS – Brute Force

DISCOVERY – Remote System Discovery

COMMAND AND CONTROL – Ingress Tool Transfer

COMMAND AND CONTROL – Application Layer Protocol (Web Protocols)

COMMAND AND CONTROL – Encrypted Channel

COMMAND AND CONTROL – Non-Standard Port

COMMAND AND CONTROL – Data Obfuscation

IMPACT – Resource Hijacking (Compute)

List of IoCs

IoC – Type – Description

sys.traceroute[.]vip – Hostname - C2 Endpoint
77.221.158[.]154 – IP - C2 Endpoint
185.174.137[.]26 – IP - C2 Endpoint
93.113.25[.]46 – IP - C2 Endpoint
104.131.69[.]106 – IP - C2 Endpoint
95.164.5[.]41 – IP - C2 Endpoint
bristol-beacon-assets.s3.amazonaws[.]com – Hostname - Payload Server
img.dxyjg[.]com – Hostname - Payload Server
38.180.147[.]18 – IP - Payload Server
143.198.1[.]178 – IP - Payload Server
185.208.156[.]46 – IP - Payload Server
185.196.9[.]154 – IP - Payload Server
46.8.226[.]75 – IP - Payload Server
223.165.4[.]175 – IP - Payload Server
188.166.244[.]81 – IP - Payload Server
bristol-beaconassets.s3[.]amazonaws[.]com/Y5bHaYxvd84sw – URL - Payload
img[.]dxyjg[.]com/KjQfcPNzMrgV – URL - Payload
38.180.147[.]18/palofd – URL - Payload
90f6890fa94b25fbf4d5c49f1ea354a023e06510 – SHA1 - Associated to file /palofd
143.198.1[.]178/7Z0THCJ – URL - Payload
8d82ccdb21425cf27b5feb47d9b7fb0c0454a9ca – SHA1 - Associated to file /7Z0THCJ
fefd0f93dcd6215d9b8c80606327f5d3a8c89712 – SHA1 - Associated to file /7Z0THCJ
e5464f14556f6e1dd88b11d6b212999dd9aee1b1 – SHA1 - Associated to file /7Z0THCJ
143.198.1[.]178/o4VWvQ5pxICPm – URL - Payload
185.208.156[.]46/lUuL095knXd62DdR6umDig – URL - Payload
185.196.9[.]154/ykKDzZ5o0AUSfkrzU5BY4w – URL - Payload
46.8.226[.]75/1.txt – URL - Payload
223.165.4[.]175/x6 – URL - Payload
45.76.141[.]166/y.sh – URL - Payload
repositorylinux[.]org/linux.sh – URL - Payload
repositorylinux[.]org/cron.sh – URL - Payload

‍

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Written by

Adam Potter

Senior Cyber Analyst

Margaret Cunningham, PhD

VP, Security & AI Strategy, Field CISO

Watch the NIS2 Webinar

Blog

AI

August 21, 2026

AI Agents: Securing the Path from Intent to Action

The UK’s National Cyber Security Centre (NCSC) recently published guidance on managing the cyber risk of agentic AI. While the document is framed as interim advice as more formal guidance is developed, the framing reflects the current state of the industry: organizations are already deploying agents into production environments while standards, controls, and operating models for autonomous systems remain unsettled. Governance is evolving alongside adoption rather than preceding it, a reality which underscores the importance of robust controls.

The NCSC’s guidance recommends aligning controls to an agent's level of autonomy, assigning distinct identities, limiting permissions, constraining access to systems and data, monitoring activity, maintaining human oversight, and preserving the ability to intervene when necessary. Most of these recommendations will sound familiar to security teams. The challenge is not the novelty of the controls. It is the type of system those controls now need to govern.

The shift from model security to agent security

For several years, AI security discussions have focused heavily on models. Can a model be manipulated? Jailbroken? Trusted? Can it expose information it should not? Those questions remain important, but they capture only part of the problem. A model generating text is one thing. A system connected to identities, applications, tools, workflows, and business data is another.

The difference becomes clearer when comparing a chatbot that answers questions with an agent that can retrieve customer records, update tickets, invoke tools, trigger workflows, and interact with external systems. The underlying model may be identical. Its access is not. The security question begins to shift from what the model knows to what the system can do.

The same theme appears in the Five Eyes statement released earlier this year, describing AI as a force multiplier that is accelerating both offensive and defensive cyber operations. The NCSC guidance explores what that reality looks like when autonomous systems begin operating inside enterprise environments.

Securing AI agents in operation

The NCSC spends relatively little time debating model behavior and considerably more time discussing identity, permissions, monitoring, oversight, containment, and response. Agents are treated as participants within an environment rather than isolated pieces of technology.

That's broadly consistent with how we think about the problem at Darktrace.

An agent should not be treated as an extension of a user account. It develops its own behavioral patterns. It accesses systems, interacts with data, invokes tools, and moves across workflows in ways that can be observed independently. Understanding what an agent is permitted to do matters. Understanding how it actually behaves once deployed, and whether that behavior aligns with business intent, matters just as much.

Identity provides an obvious example. The NCSC recommends assigning distinct identities to agents rather than allowing them to disappear into surrounding human or service accounts. Most importantly, assigning agents distinct identities enables independent behavioral monitoring.

Development assumptions vs. real-world behavior

The same principle extends to monitoring. NCSC guidance places agent activity within normal security operations rather than treating it as a separate AI governance function. Many of the controls described are put in place before an agent begins operating. Sandboxing, credential design, approval workflows and human oversight all reflect judgments about how the system is expected to behave and what risks it is likely to create.

Actual use may challenge those assumptions. Access patterns change. Workflows expand. Systems begin interacting with resources they have never touched before. Processes that appeared reasonable during design behave differently in production. Human oversight requirements may turn out to be either excessive or inadequate once the system is operating at scale and operating within the context of unique business processes.

The Five Eyes statement points to a similar issue: organizations need confidence that controls continue to work as intended once systems are exposed to real users, data, tools and operational pressures. Often, the question is not whether an agent is technically allowed to perform an action, but whether its behavior remains consistent with the role it was intended to play.

Monitoring and governance of AI agents go hand-in-hand

This problem is exactly why monitoring and governance should be treated as part of the same process. Governance sets the initial parameters for deployment, while monitoring provides evidence about whether those parameters remain appropriate. That evidence should, in turn, inform changes to permissions, controls and oversight.

This matters increasingly as autonomous systems are integrated into business processes. The relevant risk is shaped not only by the model or agent itself, but by what it can access, what actions it can take, and how its behavior changes in practice.

Developing continuous oversight of AI agent behavior

The implication is clear: governance cannot end at deployment. Organizations need a way to understand how agents behave after deployment, test whether controls remain appropriate, and adjust them as conditions change. That requires visibility not just into technical activity, but into whether that activity makes sense in the context of the business process the agent is intended to support.

This is where business-centric behavioral security can become critical. Risk does not emerge from the model itself: it emerges from the actions an autonomous system takes within the enterprise and the downstream consequences of those actions.

An agent can operate exactly as intended and still create risk if it accesses sensitive information in an unexpected context, exercises permissions in ways that create unintended exposure, or influences business processes in ways that were not anticipated during design and review.

Traditional governance vs. behavioral analytics

Traditional governance frameworks provide assurance at a point in time. Behavioral security can provide ongoing visibility into how autonomous systems interact with the organization they are meant to serve. Rather than focusing exclusively on model performance or policy compliance, organizations need to understand whether an agent's behavior aligns with business intent, operational expectations, and acceptable risk tolerances as conditions change.

As enterprises move from isolated AI deployments to interconnected ecosystems of agents, visibility into behavior becomes as important as visibility into code. Governance determines what an autonomous system is permitted to do. Behavioral analytics helps determine what it is doing, what business outcomes it is producing, and whether those outcomes remain aligned with the organization's objectives.

‍

[related-resource]

About the author

Margaret Cunningham, PhD

VP, Security & AI Strategy, Field CISO

Blog

AI

August 19, 2026

When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar

Key takeaways

‍

Darktrace observed a customer download a fake Google Gemini installer hosted on Google Colab, resulting in the execution of the Vidar information stealer.
Darktrace identified the compromise through behavioral indicators, including suspicious process activity, anomalous network communications, and indicators of credential theft, before autonomously containing the threat.
The incident highlights how threat actors are increasingly exploiting trusted platforms and a growing interest in AI tools to distribute malware through seemingly legitimate software acquisition workflows.

‍

The Growing Abuse of Generative AI

As organizations are increasingly adopting generative AI tools into their daily workflows, attackers are adapting their distribution methods accordingly too. As part of their day-to-day work, users are now searching for AI assistants, programming tools, browser extensions, desktop applications, and productivity integrations.

Recent reports have highlighted campaigns that use fake AI software and AI-related installers to distribute malware and steal credentials [1]. Researchers have documented campaigns that exploit fake AI-themed websites and services to distribute information stealers and backdoors [2]. Security researchers have also observed attackers disguising malware as legitimate installers for AI software to increase the likelihood of victim interaction and execution [3].

In July 2026, Darktrace observed one such case within a customer environment in the Europe, Middle East and Africa (EMEA) region, where attackers used a fake generative AI installer to deliver the prolific information stealer Vidar. This incident highlights how threat actors are exploiting interest in AI services to distribute established malware using increasingly convincing social engineering techniques.

How a Fake Gemini Installer Delivered Vidar

Initial Access: From Search Result to Malware Download

Unlike many malware campaigns that begin with a phishing email, this activity appears to have originated from a user searching for and downloading software.

Darktrace first observed unusual activity on the customer network after a suspicious executable file was launched from a user’s Download folder. Further investigation revealed that the file purported to be a Google Gemini installer and was named “Download_Google_Gemini_For_Windows.exe”.

During the initial analysis, it was noted that the top search result for the suspicious filename associated pointed to a file hosted on Google Colab, a cloud-based Jupyter notebook platform, commonly used by developers, researchers, and data scientists to run code and machine learning workloads through a web browser. By leveraging another trusted Google platform, the attacker increased the likelihood that users would perceive the download as legitimate, making the lure more convincing to those searching for Gemini-related software.

‍

Figure 1: The Google Colab page containing a download prompt for the fake Google Gemini installer.

Further investigation of the Google Colab page revealed that the download prompt redirected users to a secondary site, hxxps://micronsoftwares[.]com, which posed as a "Windows Software Hub" download page and offered the fake Gemini installer for download.

‍

Figure 2: The secondary website posing as a "Windows Software Hub" download page, which likely hosted the fake Gemini installer.

While the investigation did not uncover any HTTP or file-download telemetry data that conclusively identified the download source, SSL communication sessions with Google Colab were detected immediately before the suspicious file was executed. The timing of these connections suggests that the user interacted with the Colab resource before being redirected to the secondary site from which the executable was downloaded.

‍

The user was not simply tricked into opening an email attachment; instead, the attacker embedded malicious content into a process many users would consider entirely legitimate: searching for and downloading software associated with a trusted platform.

‍

Weaponizing Trusted Platforms

At the time of review (July 15, 2026), Darktrace's Threat Research team confirmed that the Google Colab page was still active and prompting users to download a ZIP archive containing the binary file.

‍

The archive also appeared to contain a README file instructing users to run the binary file with administrator privileges and add it to their antivirus software’s exception lists. These instructions suggest that the campaign relied heavily on social engineering, convincing users to take actions that would facilitate malware execution and potentially bypass security checks.

The use of a legitimate platform also complicates the user’s decision-making. Downloads associated with a trusted service are often perceived as less suspicious than those hosted on unfamiliar domains. When combined with the branding of a widely used AI tool, the lure becomes even more convincing.

Malware Analysis

Darktrace’s Threat Research team identified the executable file as the information-stealing malware Vidar. Analysis revealed that the binary file was a newer Go-compiled variant that communicated with Telegram-based infrastructure. Darktrace’s researchers also identified dtm[.]kijangturbo88[.]top as a command-and-control (C2) endpoint associated with the activity. While the malware itself was not novel, the lure and delivery mechanism was.

For a deeper look at the information stealer, see Darktrace’s 2023 analysis of Vidar.

‍

**Figure 3:** Darktrace’s detection of the unusual outbound connection associated with the fake Gemini installer.

Shortly after execution, the process established communications with the external IP address 91.98.98[.]86 via port 443, directly linking the executable to suspicious network activity observed on the device. Subsequent open-source intelligence (OSINT) analysis of the revealed multiple malicious associations [5].

Additional Darktrace detections included unusual SSL activity from the affected device. Analysis of related SSL telemetry identified 91.98.111[.]49 as additional infrastructure associated with the activity [6].

Subsequent alerts from the customer's Microsoft Defender for Endpoint integration later confirmed activity consistent with the theft of browser credentials and other sensitive data from the affected endpoint.

Taken together, these detections provided a clear picture of the attack, from the execution of a suspicious file and unusual network connections to indicators of C2 activity and credential theft.

‍

**Figure 4:** Darktrace’s detection of anomalous activity following the execution of the fake Gemini installer, seen in the Model Alert Event Log.

Darktrace's Autonomous Response

Following the detection, Darktrace’s Autonomous Response took immediate containment action, including blocking communication with suspicious external infrastructure, including 91.98.98[.]86, and quarantining the compromised device.

Despite the apparent legitimacy of the activity, with the installer hosted on a trusted platform and resembling a routine software download, Darktrace was able to detect and contain the attack because the device's behavior deviated from its normal pattern.

‍

**Figure 5:** Automated containment actions implemented by Darktrace's Autonomous Response following the detection of activity associated with the fake Gemini installer.

Conclusion

This investigation highlights how threat actors continue to adapt established malware delivery techniques to emerging technology trends. While the malware itself was not new, the distribution method was. By disguising Vidar as a Google Gemini installer and hosting the malicious content on a trusted platform, the attack aligned its lure with a growing behavioral trend: users actively searching for AI tools and services as part of their day-to-day work.

Although fake installers are not a new phenomenon, the rapid rise of generative AI has created new opportunities for threat actors. Rather than relying solely on traditional delivery methods, attackers can now target users who are actively searching for AI applications. As AI adoption continues to accelerate across enterprise environments, organizations should remain alert to campaigns that exploit this interest through fake applications, malicious websites, manipulated search results, the misuse of trusted platforms, and AI-themed social engineering.

Credit to Rushanth Ramanathan (Cyber Analyst) Joanna Ng (Detection Engineer)

Edited by Ryan Traill (Content Manager)

Appendices

Darktrace Model Detections

Security Integration / C2 Activity and Integration Detection
Endpoint / New Suspicious Executable Launched
Endpoint / Process Connection / Unusual Connection from New Process
Anomalous Connection / Rare External SSL Self-Signed
Security Integration / High Severity Integration Detection
Antigena / Network / Significant Anomaly / Antigena Significant Security Integration and Network Activity Block

•Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

‍

List of Indicators of Compromise (IoCs)

‍

IoC	Type	Description
`Download_Google_Gemini_For_Windows.exe`	File	Fake Gemini-themed installer observed during the investigation.
`GoogleAppInstaller.exe`	File	Related executable identified through endpoint telemetry.
`91.98.98[.]86`	IP Address	External destination contacted by the malicious executable.
`91.98.111[.]49`	IP Address	Related infrastructure identified through SSL certificate pivoting.
`dtm[.]kijangturbo88[.]top`	Domain	Command-and-control endpoint identified during malware analysis.
`1e13c2c9eac72daf63fd00a9946878949e159ae6ec51b54ec64f942d79d61913`	SHA256	Malware sample associated with the fake Gemini installer.

MITRE ATT@CK Mapping

‍

MITRE ATT&CK Mapping	Tactic	Technique
Initial Access	`T1204`	User Execution
Execution	`T1204.002`	User Execution: Malicious File
Defence Evasion	`T1036`	Masquerading
Credential Access	`T1555`	Credentials from Password Stores
Credential Access	`T1555.003`	Credentials from Web Browsers
Command and Control	`T1071`	Application Layer Protocol
Exfiltration	`T1041`	Exfiltration Over C2 Channel

About the author

Rushanth Ramanathan

Cyber Analyst

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Introduction: Spike in exploitation and post-exploitation activity affecting Palo Alto firewall devices

How did exploitation occur?

Post-Exploitation Patterns of Activity

Exploit Validation

Initial Payload Retrieval

C2 Communication and Additional Payloads

Reconnaissance and Cryptomining

Conclusion

Get the latest insights on emerging cyber threats

References

Appendices

MITRE ATT&CK Mapping

List of IoCs

When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar

AI Agents: Securing the Path from Intent to Action

Enjoying the blog?

More in this series

When AI Agents Attack: The Case for Behavioral Anomaly Detection

Hiding in Plain Sight: Uncovering a Multi-Stage Ransomware Attack Through Behavioral Detection

9 Stages of Ransomware & How AI Responds

Blog

AI

August 21, 2026

AI Agents: Securing the Path from Intent to Action

The shift from model security to agent security

Securing AI agents in operation

Development assumptions vs. real-world behavior

Monitoring and governance of AI agents go hand-in-hand

Developing continuous oversight of AI agent behavior

Traditional governance vs. behavioral analytics

Blog

AI

August 19, 2026

When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar

Key takeaways

The Growing Abuse of Generative AI

How a Fake Gemini Installer Delivered Vidar

Initial Access: From Search Result to Malware Download

Weaponizing Trusted Platforms

Malware Analysis

Conclusion

Appendices

Darktrace Model Detections

List of Indicators of Compromise (IoCs)

MITRE ATT@CK Mapping