Blog
/
Network
/
February 11, 2025

Defending Against Living-off-the-Land Attacks: Anomaly Detection in Action

Discover how Darktrace detected and responded to cyberattacks using Living-off-the-Land (LOTL) tactics to exploit trusted services and tools on customer networks.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Alexandra Sentenac
Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
11
Feb 2025

What is living-off-the-land?

Threat actors employ a variety of techniques to compromise target networks, including exploiting unpatched vulnerabilities, abusing misconfigurations, deploying backdoors, and creating custom malware. However, these methods generate a lot of noise and are relatively easy for network and host-based monitoring tools to detect, especially once indicators of compromise (IoCs) and tactics, techniques, and procedures (TTPs) are published by the cybersecurity community.

Living-off-the-Land (LOTL) techniques, however, allow attacks to remain nearly invisible to Endpoint Detection and Response (EDR) tools – leveraging trusted protocols, applications and native systems to carry out malicious activity. While mitigations exist, they are often poorly implemented. The Cybersecurity and Infrastructure Security Agency (CISA) found that some organizations “lacked security baselines, allowing [Living-off-the-Land binaries (LOLBins)] to execute and leaving analysts unable to identify anomalous activity” and “organizations did not appropriately tune their detection tools to reduce alert noise, leading to an unmanageable level of alerts to sift through and action" [1].

Darktrace / NETWORK addresses this challenge across Information Technology (IT), Operational Technology (OT), and cloud environments by continuously analyzing network traffic and identifying deviations from normal behavior with its multi-layered AI – helping organizations detect and respond to LOTL attacks in real time.

Darktrace’s detection of LOTL attacks

This blog will review two separate attacks detected by Darktrace that leveraged LOTL techniques at several stages of the intrusion.

Case A

Reconnaissance

In September 2024, a malicious actor gained access to a customer network via their Virtual Private Network (VPN) from two desktop devices that had no prior connection history. Over two days, the attacker conducted multiple network scans, targeting ports associated with Remote Desktop Protocol (RDP) and NTLM authentication. Darktrace detected this unusual activity, triggering multiple alerts for scanning and enumeration activity.

Unusual NTLM authentication attempts using default accounts like “Guest” and “Administrator” were detected. Two days after the initial intrusion, suspicious DRSGetNCChanges requests were observed on multiple domain controllers (DCs), targeting the Directory Replication Service RPC interface (i.e., drsuapi) – a technique used to extract account hashes from DCs. This process can be automated using tools like Mimikatz's DcSync and DCShadow

Around the same time, attacker-controlled devices were seen presenting an admin credential and another credential potentially granting access to Cisco Firewall systems, suggesting successful privilege escalation. Due to the severity of this activity, Darktrace’s Autonomous Response was triggered to prevent the device from further deviation from its normal behavior. However, because Autonomous Response was configured in Human Confirmation mode, the response actions had to be manually applied by the customer.

Cyber AI Analyst Critical Incident showing the unusual DRSGetNCChanges requests following unusual scanning activity.
Figure 1: Cyber AI Analyst Critical Incident showing the unusual DRSGetNCChanges requests following unusual scanning activity.

Lateral movement

Darktrace also detected anomalous RDP connections to domain controllers, originating from an attacker-controlled device using admin and service credentials. The attacker then successfully pivoted to a likely RDP server, leveraging the RDP protocol – one of the most commonly used for lateral movement in network compromises observed by Darktrace.

Cyber Analyst Incident displaying unusual RDP lateral movement connections
Figure 2: Cyber Analyst Incident displaying unusual RDP lateral movement connections.

Tooling

Following an incoming RDP connection, one of the DCs made a successful GET request to the URI '/download/122.dll' on the 100% rare IP, 146.70.145[.]189. The request returned an executable file, which open-source intelligence (OSINT) suggests is likely a CobaltStrike C2 sever payload [2] [3]. Had Autonomous Response been enabled here, it would have blocked all outgoing traffic from the DC allowing the customer to investigate and remediate.

Additionally, Darktrace detected a suspicious CreateServiceW request to the Service Control (SVCCTL) RPC interface on a server. The request executed commands using ‘cmd.exe’ to perform the following actions

  1. Used ‘tasklist’ to filter processes named ”lsass.exe” (Local Security Authority Subsystem Service) to find its specific process ID.
  2. Used “rundll32.exe” to execute the MiniDump function from the “comsvcs.dll” library, creating a memory dump of the “lsass.exe” process.
  3. Saved the output to a PNG file in a temporary folder,

Notably, “cmd.exe” was referenced as “CMd.EXE” within the script, likely an attempt to evade detection by security tools monitoring for specific keywords and patterns.

Model Alert Log showing the unusual SVCCTL create request.
Figure 3: Model Alert Log showing the unusual SVCCTL create request.

Over the course of three days, this activity triggered around 125 Darktrace / NETWORK alerts across 11 internal devices. In addition, Cyber AI Analyst launched an autonomous investigation into the activity, analyzing and connecting 16 separate events spanning multiple stages of the cyber kill chain - from initial reconnaissance to payload retrieval and lateral movement.

Darktrace’s comprehensive detection enabled the customer’s security team to remediate the compromise before any further escalation was observed.

Case B

Between late 2023 and early 2024, Darktrace identified a widespread attack that combined insider and external threats, leveraging multiple LOTL tools for reconnaissance and lateral movement within a customer's network.

Reconnaissance

Initially, Darktrace detected the use of a new administrative credential by a device, which then made unusual RDP connections to multiple internal systems, including a 30-minute connection to a DC. Throughout the attack, multiple unusual RDP connections using the new administrative credential “%admin!!!” were observed, indicating that this protocol was leveraged for lateral movement.

The next day, a Microsoft Defender Security Integration alert was triggered on the device due to suspicious Windows Local Security Authority Subsystem Service (LSASS) credential dump behavior. Since the LSASS process memory can store operating system and domain admin credentials, obtaining this sensitive information can greatly facilitate lateral movement within a network using legitimate tools such as PsExec or Windows Management Instrumentation (WMI) [4]. Security integrations with other security vendors like this one can provide insights into host-based processes, which are typically outside of Darktrace’s coverage. Darktrace’s anomaly detection and network activity monitoring help prioritize the investigation of these alerts.

Three days later, the attacker was observed logging into the DC and querying tickets for the Lightweight Directory Access Protocol (LDAP) service using the default credential “Administrator.” This activity, considered new by Darktrace, triggered an Autonomous Response action that blocked further connections on Kerberos port 88 to the DC. LDAP provides a central location to access and manage data about computers, servers, users, groups, and policies within a network. LDAP enumeration can provide valuable Active Directory (AD) object information to an attacker, which can be used to identify critical attack paths or accounts with high privileges.

Lateral movement

Following the incoming RDP connection, the DC began scanning activities, including RDP and Server Block Message (SMB) services, suggesting the attacker was using remote access for additional reconnaissance. Outgoing RDP connection attempts to over 100 internal devices were observed, with around 5% being successful, highlighting the importance of this protocol for the threat actor’s lateral movement.

Around the same time, the DC made WMI, PsExec, and service control connections to two other DCs, indicating further lateral movement using native administrative protocols and tools. These functions can be leveraged by attackers to query system information, run malicious code, and maintain persistent access to compromised devices while avoiding traditional security tool alarms. In this case, requested services included the IWbemServices (used to access WMI services) and IWbemFetchSmartEnum (used to retrieve a network-optimized enumerator interface) interfaces, with ExecQuery operations detected for the former. This method returns an enumerable collection of IWbemClassObject interface objects based on a query.

Additionally, unusual Windows Remote Management (WinRM) connections to another domain controller were observed. WinRM is a Microsoft protocol that allows systems to exchange and access management information over HTTP(S) across a network, such as running executables or modifying the registry and services.

Cyber AI Analyst Incident showing unusual WMI activity between the two DCs.
Figure 4: Cyber AI Analyst Incident showing unusual WMI activity between the two DCs.

The DC was also detected writing the file “PSEXESVC.exe” to the “ADMIN$” share of another internal device over the SMB file transfer network protocol. This activity was flagged as highly unusual by Darktrace, as these two devices had not previously engaged in this type of SMB connectivity.

It is rare for an attacker to immediately find the information or systems they are after, making it likely they will need to move around the network before achieving their objectives. Tools such as PsExec enable attackers to do this while largely remaining under the radar. With PsExec, attackers who gain access to a single system can connect to and execute commands remotely on other internal systems, access sensitive information, and spread their attack further into the environment.

Model Alert Event Log showing the new write of the file “PSEXESVC.exe” by one of the compromised devices over an SMB connection initiated at an unusual time.
Figure 5. Model Alert Event Log showing the new write of the file “PSEXESVC.exe” by one of the compromised devices over an SMB connection initiated at an unusual time.

Darktrace further observed the DC connecting to the SVCCTL endpoint on a remote device and performing the CreateServiceW operation, which was flagged as highly unusual based on previous behavior patterns between the two devices. Additionally, new ChangeServiceConfigW operations were observed from another device.

Aside from IWbemServices requests seen on multiple devices, Darktrace also detected multiple internal devices connecting to the ITaskSchedulerService interface over DCE-RPC and performing new SchRpcRegisterTask operations, which register a task on the destination system. Attackers can exploit the task scheduler to facilitate the initial or recurring execution of malicious code by a trusted system process, often with elevated permissions. The creation of these tasks was considered new or highly unusual and triggered several anomalous ITaskScheduler activity alerts.

Conclusion

As pointed out by CISA, threat actors frequently exploit the lack of implemented controls on their target networks, as demonstrated in the incidents discussed here. In the first case, VPN access was granted to all domain users, providing the attacker with a point of entry. In the second case, there were no restrictions on the use of RDP within the targeted network segment, allowing the attackers to pivot from device to device.

Darktrace assists security teams in monitoring for unusual use of LOTL tools and protocols that can be leveraged by threat actors to achieve a wide range of objectives. Darktrace’s Self-Learning AI sifts through the network traffic noise generated by these trusted tools, which are essential to administrators and developers in their daily tasks, and highlights any anomalous and potentially unexpected use.

Credit to Alexandra Sentenac (Senior Cyber Analyst) and Ryan Traill (Analyst Content Lead)

References

[1] https://www.cisa.gov/sites/default/files/2024-02/Joint-Guidance-Identifying-and-Mitigating-LOTL_V3508c.pdf

[2] https://www.virustotal.com/gui/ip-address/146.70.145.189/community

[3] https://www.virustotal.com/gui/file/cc9a670b549d84084618267fdeea13f196e43ae5df0d88e2e18bf5aa91b97318

[4]https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks

MITRE Mapping

INITIAL ACCESS - External Remote Services

DISCOVERY - Remote System Discovery

DISCOVERY - Network Service Discovery

DISCOVERY - File and Directory Discovery

CREDENTIAL ACCESS – OS Credential Dumping: LSASS Memory

LATERAL MOVEMENT - Remote Services: Remote Desktop Protocol

LATERAL MOVEMENT - Remote Services: SMB/Windows Admin Shares

EXECUTION - System Services: Service Execution

PERSISTENCE - Scheduled Task

COMMAND AND CONTROL - Ingress Tool Transfer

Darktrace Model Detections

Case A

Device / Suspicious Network Scan Activity

Device / Network Scan

Device / ICMP Address Scan

Device / Reverse DNS Sweep

Device / Suspicious SMB Scanning Activity

Device / Possible SMB/NTLM Reconnaissance

Anomalous Connection / Unusual Admin SMB Session

Device / SMB Session Brute Force (Admin)

Device / Possible SMB/NTLM Brute Force

Device / SMB Lateral Movement

Device / Anomalous NTLM Brute Force

Anomalous Connection / SMB Enumeration

Device / SMB Session Brute Force (Non-Admin)

Device / Anomalous SMB Followed By Multiple Model Breaches

Anomalous Connection / Possible Share Enumeration Activity

Device / RDP Scan

Device / Anomalous RDP Followed By Multiple Model Breaches

Anomalous Connection / Unusual Admin RDP Session

Anomalous Connection / Active Remote Desktop Tunnel

Anomalous Connection / Anomalous DRSGetNCChanges Operation

Anomalous Connection / High Priority DRSGetNCChanges

Compliance / Default Credential Usage

User / New Admin Credentials on Client

User / New Admin Credentials on Server

Device / Large Number of Model Breaches from Critical Network Device

User / New Admin Credential Ticket Request

Compromise / Unusual SVCCTL Activity

Anomalous Connection / New or Uncommon Service Control

Anomalous File / Script from Rare External Location

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous File / EXE from Rare External Location

Anomalous File / Numeric File Download

Device / Initial Breach Chain Compromise

Device / Multiple Lateral Movement Model Breaches

Device / Large Number of Model Breaches

Compromise / Multiple Kill Chain Indicators

Case B

User / New Admin Credentials on Client

Compliance / Default Credential Usage

Anomalous Connection / SMB Enumeration

Device / Suspicious SMB Scanning Activity

Device / RDP Scan

Device / New or Uncommon WMI Activity

Device / Anomaly Indicators / New or Uncommon WMI Activity Indicator

Device / New or Unusual Remote Command Execution

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / Active Remote Desktop Tunnel

Compliance / SMB Drive Write

Anomalous Connection / Anomalous DRSGetNCChanges Operation

Device / Multiple Lateral Movement Model Breaches

Device / Anomalous ITaskScheduler Activity

Anomalous Connection / Unusual Admin RDP Session

Device / Large Number of Model Breaches from Critical Network Device

Compliance / Default Credential Usage

IOC - Type - Description/Probability

146.70.145[.]189 - IP Address - Likely C2 Infrastructure

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Alexandra Sentenac
Cyber Analyst

More in this series

No items found.

Blog

/

/

May 2, 2025

SocGholish: From loader and C2 activity to RansomHub deployment

laptop and hand typingDefault blog imageDefault blog image

Over the past year, a clear pattern has emerged across the threat landscape: ransomware operations are increasingly relying on compartmentalized affiliate models. In these models, initial access brokers (IABs) [6], malware loaders, and post-exploitation operators work together.

Due to those specialization roles, a new generation of loader campaigns has risen. Threat actors increasingly employ loader operators to quietly establish footholds on the target network. These entities then hand off access to ransomware affiliates. One loader that continues to feature prominently in such campaigns is SocGholish.

What is SocGholish?

SocGholish is a loader malware that has been utilized since at least 2017 [7].  It has long been associated with fake browser updates and JavaScript-based delivery methods on infected websites.

Threat actors often target outdated or poorly secured CMS-based websites like WordPress. Through unpatched plugins, or even remote code execution flaws, they inject malicious JavaScript into the site’s HTML, templates or external JS resources [8].  Historically, SocGholish has functioned as a first-stage malware loader, ultimately leading to deployment of Cobalt Strike beacons [9], and further facilitating access persistence to corporate environments. More recently, multiple security vendors have reported that infections involving SocGholish frequently lead to the deployment of RansomHub ransomware [3] [5].

This blog explores multiple instances within Darktrace's customer base where SocGholish deployment led to subsequent network compromises. Investigations revealed indicators of compromise (IoCs) similar to those identified by external security researchers, along with variations in attacker behavior post-deployment. Key innovations in post-compromise activities include credential access tactics targeting authentication mechanisms, particularly through the abuse of legacy protocols like WebDAV and SCF file interactions over SMB.

Initial access and execution

Since January 2025, Darktrace’s Threat Research team observed multiple cases in which threat actors leveraged the SocGholish loader for initial access. Malicious actors commonly deliver SocGholish by compromising legitimate websites by injecting malicious scripts into the HTML of the affected site. When the visitor lands on an infected site, they are typically redirected to a fake browser update page, tricking them into downloading a ZIP file containing a JavaScript-based loader [1] [2]. In one case, a targeted user appears to have visited the compromised website garagebevents[.]com (IP: 35.203.175[.]30), from which around 10 MB of data was downloaded.

Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.
Figure 1: Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.

Within milliseconds of the connection establishment, the user’s device initiated several HTTPS sessions over the destination port 443 to the external endpoint 176.53.147[.]97, linked to the following Keitaro TDS domains:

  • packedbrick[.]com
  • rednosehorse[.]com
  • blackshelter[.]org
  • blacksaltys[.]com

To evade detection, SocGholish uses highly obfuscated code and relies on traffic distribution systems (TDS) [3].  TDS is a tool used in digital and affiliate marketing to manage and distribute incoming web traffic based on predefined rules. More specifically, Keitaro is a premium self-hosted TDS frequently utilized by attackers as a payload repository for malicious scripts following redirects from compromised sites. In the previously noted example, it appears that the device connected to the compromised website, which then retrieved JavaScript code from the aforementioned Keitaro TDS domains. The script served by those instances led to connections to the endpoint virtual.urban-orthodontics[.]com (IP: 185.76.79[.]50), successfully completing SocGholish’s distribution.

Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.
Figure 2: Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.

Persistence

During some investigations, Darktrace researchers observed compromised devices initiating HTTPS connections to the endpoint files.pythonhosted[.]org (IP: 151.101.1[.]223), suggesting Python package downloads. External researchers have previously noted how attackers use Python-based backdoors to maintain access on compromised endpoints following initial access via SocGholish [5].

Credential access and lateral movement

Credential access – external

Darktrace researchers identified observed some variation in kill chain activities following initial access and foothold establishment. For example, Darktrace detected interesting variations in credential access techniques. In one such case, an affected device attempted to contact the rare external endpoint 161.35.56[.]33 using the Web Distributed Authoring and Versioning (WebDAV) protocol. WebDAV is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. WebDAV enables remote shares to be mounted over HTTP or HTTPS, similar to how SMB operates, but using web-based protocols. Windows supports WebDAV natively, which means a UNC path pointing to an HTTP or HTTPS resource can trigger system-level behavior such as authentication.

In this specific case, the system initiated outbound connections using the ‘Microsoft-WebDAV-MiniRedir/10.0.19045’ user-agent, targeting the URI path of /s on the external endpoint 161.35.56[.]33. During these requests, the host attempted to initiate NTML authentication and even SMB sessions over the web, both of which failed. Despite the session failures, these attempts also indicate a form of forced authentication. Forced authentication exploits a default behavior in Windows where, upon encountering a UNC path, the system will automatically try to authenticate to the resource using NTML – often without any user interaction. Although no files were directly retrieved, the WebDAV server was still likely able to retrieve the user’s NTLM hash during the session establishment requests, which can later be used by the adversary to crack the password offline.

Credential access – internal

In another investigated incident, Darktrace observed a related technique utilized for credential access and lateral movement. This time, the infected host uploaded a file named ‘Thumbs.scf’ to multiple internal SMB network shares. Shell Command File ( SCF) is a legacy Windows file format used primarily for Windows Explorer shortcuts. These files contain instructions for rendering icons or triggering shell commands, and they can be executed implicitly when a user simply opens a folder containing the file – no clicks required.

The ‘Thumbs.scf’ file dropped by the attacker was crafted to exploit this behavior. Its contents included a [Shell] section with the Command=2 directive and an IconFile path pointing to a remote UNC resource on the same external endpoint, 161.35.56[.]33, seen in the previously described case – specifically, ‘\\161.35.56[.]33\share\icon.ico’. When a user on the internal network navigates to the folder containing the SCF file, their system will automatically attempt to load the icon. In doing so, the system issues a request to the specified UNC path, which again prompts Windows to initiate NTML authentication.

This pattern of activity implies that the attacker leveraged passive internal exposure; users who simply browsed a compromised share would unknowingly send their NTML hashes to an external attacker-controlled host. Unlike the WebDAV approach, which required initiating outbound communication from the infected host, this SCF method relies on internal users to interact with poisoned folders.

Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.
Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.

Command-and-control

Following initial compromise, affected devices would then attempt outbound connections using the TLS/SSL protocol over port 443 to different sets of command-and-control (C2) infrastructure associated with SocGholish. The malware frequently uses obfuscated JavaScript loaders to initiate its infection chain, and once dropped, the malware communicates back to its infrastructure over standard web protocols, typically using HTTPS over port 443. However, this set of connections would precede a second set of outbound connections, this time to infrastructure linked to RansomHub affiliates, possibly facilitating the deployed Python-based backdoor.

Connectivity to RansomHub infrastructure relied on defense evasion tactics, such as port-hopping. The idea behind port-hopping is to disguise C2 traffic by avoiding consistent patterns that might be caught by firewalls, and intrusion detection systems. By cycling through ephemeral ports, the malware increases its chances of slipping past basic egress filtering or network monitoring rules that only scrutinize common web traffic ports like 443 or 80. Darktrace analysts identified systems connecting to destination ports such as 2308, 2311, 2313 and more – all on the same destination IP address associated with the RansomHub C2 environment.

Figure 4: Advanced Search connection logs showing connections over destination ports that change rapidly.

Conclusion

Since the beginning of 2025, Darktrace analysts identified a campaign whereby ransomware affiliates leveraged SocGholish to establish network access in victim environments. This activity enabled multiple sets of different post exploitation activity. Credential access played a key role, with affiliates abusing WebDAV and NTML over SMB to trigger authentication attempts. The attackers were also able to plant SCF files internally to expose NTML hashes from users browsing shared folders. These techniques evidently point to deliberate efforts at early lateral movement and foothold expansion before deploying ransomware. As ransomware groups continue to refine their playbooks and work more closely with sophisticated loaders, it becomes critical to track not just who is involved, but how access is being established, expanded, and weaponized.

Credit to Chrisina Kreza (Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

Appendices

Darktrace / NETWORK model alerts

·       Anomalous Connection / SMB Enumeration

·       Anomalous Connection / Multiple Connections to New External TCP Port

·       Anomalous Connection / Multiple Failed Connections to Rare Endpoint

·       Anomalous Connection / New User Agent to IP Without Hostname

·       Compliance / External Windows Communication

·       Compliance / SMB Drive Write

·       Compromise / Large DNS Volume for Suspicious Domain

·       Compromise / Large Number of Suspicious Failed Connections

·       Device / Anonymous NTML Logins

·       Device / External Network Scan

·       Device / New or Uncommon SMB Named Pipe

·       Device / SMB Lateral Movement

·       Device / Suspicious SMB Activity

·       Unusual Activity / Unusual External Activity

·       User / Kerberos Username Brute Force

MITRE ATT&CK mapping

·       Credential Access – T1187 Forced Authentication

·       Credential Access – T1110 Brute Force

·       Command and Control – T1071.001 Web Protocols

·       Command and Control – T1571 Non-Standard Port

·       Discovery – T1083 File and Directory Discovery

·       Discovery – T1018 Remote System Discovery

·       Discovery – T1046 Network Service Discovery

·       Discovery – T1135 Network Share Discovery

·       Execution – T1059.007 JavaScript

·       Lateral Movement – T1021.002 SMB/Windows Admin Shares

·       Resource Deployment – T1608.004 Drive-By Target

List of indicators of compromise (IoCs)

·       garagebevents[.]com – 35.203.175[.]30 – Possibly compromised website

·       packedbrick[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       rednosehorse[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       blackshelter[.]org – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       blacksaltys[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       virtual.urban-orthodontics[.]com – 185.76.79[.]50

·       msbdz.crm.bestintownpro[.]com – 166.88.182[.]126 – SocGholish C2

·       185.174.101[.]240 – RansomHub Python C2

·       185.174.101[.]69 – RansomHub Python C2

·       108.181.182[.]143 – RansomHub Python C2

References

[1] https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/socgholish-malware/

[2] https://intel471.com/blog/threat-hunting-case-study-socgholish

[3] https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html

[4] https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware

[5] https://www.guidepointsecurity.com/blog/ransomhub-affiliate-leverage-python-based-backdoor/

[6] https://www.cybereason.com/blog/how-do-initial-access-brokers-enable-ransomware-attacks

[7] https://attack.mitre.org/software/S1124/

[8] https://expel.com/blog/incident-report-spotting-socgholish-wordpress-injection/

[9] https://www.esentire.com/blog/socgholish-to-cobalt-strike-in-10-minutes

Continue reading
About the author
Christina Kreza
Cyber Analyst

Blog

/

/

May 1, 2025

Your Vendors, Your Risk: Rethinking Third-Party Security in the Age of Supply Chain Attacks

man on cellphoneDefault blog imageDefault blog image

When most people hear the term supply chain attack, they often imagine a simple scenario: one organization is compromised, and that compromise is used as a springboard to attack another. This kind of lateral movement is common, and often the entry vector is as mundane and as dangerous as email.

Take, for instance, a situation where a trusted third-party vendor is breached. An attacker who gains access to their systems can then send malicious emails to your organization, emails that appear to come from a known and reputable source. Because the relationship is trusted, traditional phishing defenses may not be triggered, and recipients may be more inclined to engage with malicious content. From there, the attacker can establish a foothold, move laterally, escalate privileges, and launch a broader campaign.

This is one dimension of a supply chain cyber-attack, and it’s well understood in many security circles. But the risk doesn’t end there. In fact, it goes deeper, and it often hits the most important asset of all: your customers' data.

The risk beyond the inbox

What happens when customer data is shared with a third party for legitimate processing purposes for example billing, analytics, or customer service and that third party is then compromised?

In that case, your customer data is breached, even if your own systems were never touched. That’s the uncomfortable truth about modern cybersecurity: your risk is no longer confined to your own infrastructure. Every entity you share data with becomes an extension of your attack surface. Thus, we should rethink how we perceive responsibility.

It’s tempting to think that securing our environment is our job, and securing their environment is theirs. But if a breach of their environment results in the exposure of our customers, the accountability and reputational damage fall squarely on our shoulders.

The illusion of boundaries

In an era where digital operations are inherently interconnected, the lines of responsibility can blur quickly. Legally and ethically, organizations are still responsible for the data they collect even if that data is processed, stored, or analyzed by a third party. A customer whose data is leaked because of a vendor breach will almost certainly hold the original brand responsible, not the third-party processor they never heard of.

This is particularly important for industries that rely on extensive outsourcing and platform integrations (SaaS platforms, marketing tools, CRMs, analytics platforms, payment processors). The list of third-party vendors with access to customer data grows year over year. Each integration adds convenience, but also risk.

Encryption isn’t a silver bullet

One of the most common safeguards used in these data flows is encryption. Encrypting customer data in transit is a smart and necessary step, but it’s far from enough. Once data reaches the destination system, it typically needs to be decrypted for use. And the moment it is decrypted, it becomes vulnerable to a variety of attacks like ransomware, data exfiltration, privilege escalation, and more.

In other words, the question isn’t just is the data secure in transit? The more important question is how is it protected once it arrives?

A checklist for organizations evaluating third-parties

Given these risks, what should responsible organizations do when they need to share customer data with third parties?

Start by treating third-party security as an extension of your own security program. Here are some foundational controls that can make a difference:

Due diligence before engagement: Evaluate third-party vendors based on their security posture before signing any contracts. What certifications do they hold? What frameworks do they follow? What is their incident response capability?

Contractual security clauses: Build in specific security requirements into vendor contracts. These can include requirements for encryption standards, access control policies, and data handling protocols.

Third-party security assessments: Require vendors to provide evidence of their security controls. Independent audits, penetration test results, and SOC 2 reports can all provide useful insights.

Ongoing monitoring and attestations: Security isn’t static. Make sure vendors provide regular security attestations and reports. Where possible, schedule periodic reviews or audits, especially for vendors handling sensitive data.

Minimization and segmentation: Don’t send more data than necessary. Data minimization limits the exposure in the event of a breach. Segmentation, both within your environment and within vendor access levels, can further reduce risk.

Incident response planning: Ensure you have a playbook for handling third-party incidents, and that vendors do as well. Coordination in the event of a breach should be clear and rapid.

The human factor: Customers and communication

There’s another angle to supply chain cyber-attacks that’s easy to overlook: the post-breach exploitation of public knowledge. When a breach involving customer data hits the news, it doesn’t take long for cybercriminals to jump on the opportunity.

Attackers can craft phishing emails that appear to be follow-ups from the affected organization: “Click here to reset your password,” “Confirm your details due to the breach,” etc.

A breach doesn’t just put customer data at risk it also opens the door to further fraud, identity theft, and financial loss through social engineering. This is why post-breach communication and phishing mitigation strategies are valuable components of an incident response strategy.

Securing what matters most

Ultimately, protecting against supply chain cyber-attacks isn’t just about safeguarding your own perimeter. It’s about defending the integrity of your customers’ data, wherever it goes. When customer data is entrusted to you, the duty of care doesn’t end at your firewall.

Relying on vendors to “do their part” is not enough. True due diligence means verifying, validating, and continuously monitoring those extended attack surfaces. It means designing controls that assume failure is possible, and planning accordingly.

In today’s threat landscape, cybersecurity is no longer just a technical discipline. It’s a trust-building exercise. Your customers expect you to protect their information, and rightly so. And when a supply chain attack happens, whether the breach originated with you or your partner, the damage lands in the same place: your brand, your customers, your responsibility.

[related-resource]

Continue reading
About the author
Tony Jarvis
VP, Field CISO | Darktrace
Your data. Our AI.
Elevate your network security with Darktrace AI