Detecting Attacks Across Email, SaaS, and Network Environments with Darktrace’s ActiveAI Security Platform
30
Apr 2024
This blog explores how Darktrace’s combined AI approach enabled it to identify and connect an attack that took place over three critical areas of a customer’s digital environment, namely email, SaaS and network.
The State of AI in Cybersecurity
In a recent survey outlined in Darktrace’s State of AI Cyber Security whitepaper, 95% of cyber security professionals agree that AI-powered security solutions will improve their organization’s detection of cyber-threats [1]. Crucially, a combination of multiple AI methods is the most effective to improve cybersecurity; improving threat detection, accelerating threat investigation and response, and providing visibility across an organization’s digital environment.
In March 2024, Darktrace’s AI-led security platform was able to detect suspicious activity affecting a customer’s email, Software-as-a-Service (SaaS), and network environments, whilst its applied supervised learning capability, Cyber AI Analyst, autonomously correlated and connected all of these events together in one single incident, explained concisely using natural language processing.
Attack Overview
Following an initial email attack vector, an attacker logged into a compromised SaaS user account from the Netherlands, changed inbox rules, and leveraged the account to send thousands of phishing emails to internal and external users. Internal users fell victim to the emails by clicking on contained suspicious links that redirected them to newly registered suspicious domains hosted on same IP address as the hijacked SaaS account login. This activity triggered multiple alerts in Darktrace DETECT™ on both the network and SaaS side, all of which were correlated into one Cyber AI Analyst incident.
In this instance, Darktrace RESPOND™ was not active on any of the customer’s environments, meaning the compromise was able to escalate until their security team acted on the alerts raised by DETECT. Had RESPOND been enabled at the time of the attack, it would have been able to apply swift actions to contain the attack by blocking connections to suspicious endpoints on the network side and disabling users deviating from their normal behavior on the customer’s SaaS environment.
Nevertheless, thanks to DETECT and Cyber AI Analyst, Darktrace was able to provide comprehensive visibility across the customer’s three digital estate environments, decreasing both investigation and response time which enabled them to quickly enact remediation during the attack. This highlights the crucial role that Darktrace’s combined AI approach can play in anomaly detection cyber defense
Attack Details & Darktrace Coverage
1. Email: the initial attack vector
The initial attack vector was likely email, as on March 18, 2024, Darktrace observed a user device making several connections to the email provider “zixmail[.]net”, shortly before it connected to the first suspicious domain. Darktrace/Email identified multiple unusual inbound emails from an unknown sender that contained a suspicious link. Darktrace recognized these emails as potentially malicious and locked the link, ensuring that recipients could not directly click it.
Figure 1: Suspected initial compromise email from an unknown sender, containing a suspicious link, which was locked by Darktrace/Email.
2. Escalation to Network
Later that day, despite Darktrace/Email having locked the link in the suspicious email, the user proceeded to click on it and was directed to a suspicious external location, namely “rz8js7sjbef[.]latovafineart[.]life”, which triggered the Darktrace/Network DETECT model “Suspicious Domain”. Darktrace/Email was able to identify that this domain had only been registered 4 days before this activity and was hosted on an IP address based in the Netherlands, 193.222.96[.]9.
3. SaaS Account Hijack
Just one minute later, Darktrace/Apps observed the user’s Microsoft 365 account logging into the network from the same IP address. Darktrace understood that this represented unusual SaaS activity for this user, who had only previously logged into the customer’s SaaS environment from the US, triggering the “Unusual External Source for SaaS Credential Use” model.
4. SaaS Account Updates
A day later, Darktrace identified an unusual administrative change on the user’s Microsoft 365 account. After logging into the account, the threat actor was observed setting up a new multi-factor authentication (MFA) method on Microsoft Authenticator, namely requiring a 6-digit code to authenticate. Darktrace understood that this authentication method was different to the methods previously used on this account; this, coupled with the unusual login location, triggered the “Unusual Login and Account Update” DETECT model.
5. Obfuscation Email Rule
On March 20, Darktrace detected the threat actor creating a new email rule, named “…”, on the affected account. Attackers are typically known to use ambiguous or obscure names when creating new email rules in order to evade the detection of security teams and endpoints users.
This rule was seemingly created with the intention of obfuscating the sending of malicious emails, as the rule would move sent emails to the "RSS Feeds” folder, a commonly used tactic by attackers as the folder is often left unchecked by endpoint users. Interestingly, Darktrace identified that, despite the initial unusual login coming from the Netherlands, the email rule was created from a different destination IP, indicating that the attacker was using a Virtual Private Network (VPN) after gaining a foothold in the network.
Figure 2: Hijacked SaaS account making an anomalous login from the unusual Netherlands-based IP, before creating a new email rule.
6. Outbound Phishing Emails Sent
Later that day, the attacker was observed using the compromised customer account to send out numerous phishing emails to both internal and external recipients. Darktrace/Email detected a significant spike in inbound emails on the compromised account, with the account receiving bounce back emails or replies in response to the phishing emails. Darktrace further identified that the phishing emails contained a malicious DocSend link hidden behind the text “Click Here”, falsely claiming to be a link to the presentation platform Prezi.
Figure 3: Darktrace/Email detected that the DocSend link displayed via text “Click Here”, was embedded in a Prezi link.
7. Suspicious Domains and Redirects
After the phishing emails were sent, multiple other internal users accessed the DocSend link, which directed them to another suspicious domain, “thecalebgroup[.]top”, which had been registered on the same day and was hosted on the aforementioned Netherlands-based IP, 193.222.96[.]91. At the time of the attack, this domain had not been reported by any open-source intelligence (OSINT), but it has since been flagged as malicious by multiple vendors [2].
Figure 4: External Sites Summary showing the suspicious domain that had never previously been seen on the network. A total of 11 “Suspicious Domain” models were triggered in response to this activity.
8. Cyber AI Analyst’s Investigation
As this attack was unfolding, Darktrace’s Cyber AI Analyst was able to autonomously investigate the events, correlating them into one wider incident and continually adding a total of 14 new events to the incident as more users fell victim to the phishing links.
Cyber AI Analyst successfully weaved together the initial suspicious domain accessed in the initial email attack vector (Figure 5), the hijack of the SaaS account from the Netherlands IP (Figure 6), and the connection to the suspicious redirect link (Figure 7). Cyber AI Analyst was also able to uncover other related activity that took place at the time, including a potential attempt to exfiltrate data out of the customer’s network.
By autonomously analyzing the thousands of connections taking place on a network at any given time, Darktrace’s Cyber AI Analyst is able to detect seemingly separate anomalous events and link them together in one incident. This not only provides organizations with full visibility over potential compromises on their networks, but also saves their security teams precious time ensuring they can quickly scope out the ongoing incident and begin remediation.
Figure 5: Cyber AI Analyst correlated the attack’s sequence, starting with the initial suspicious domain accessed in the initial email attack vector.
Figure 6: As the attack progressed, Cyber AI Analyst correlated and appended additional events to the same incident, including the SaaS account hijack from the Netherlands-based IP.
Figure 7: Cyber AI Analyst correlated and appended additional events to the same incident, including additional users connecting to the suspicious redirect link following the outbound phishing emails being sent.
Conclusion
In this scenario, Darktrace demonstrated its ability to detect and correlate suspicious activities across three critical areas of a customer’s digital environment: email, SaaS, and network.
It is essential that cyber defenders not only adopt AI but use a combination of AI technology capable of learning and understanding the context of an organization’s entire digital infrastructure. Darktrace’s anomaly-based approach to threat detection allows it to identify subtle deviations from the expected behavior in network devices and SaaS users, indicating potential compromise. Meanwhile, Cyber AI Analyst dynamically correlates related events during an ongoing attack, providing organizations and their security teams with the information needed to respond and remediate effectively.
Credit to Zoe Tilsiter, Analyst Consulting Lead (EMEA), Brianna Leddy, Director of Analysis
- SaaS / Access / Unusual External Source for SaaS Credential Use
- SaaS / Compromise / Unusual Login and Account Update
- SaaS / Compliance / Anomalous New Email Rule
- SaaS / Compromise / Unusual Login and New Email Rule
Network Models
- Device / Suspicious Domain
- Multiple Device Correlations / Multiple Devices Breaching Same Model
Cyber AI Analyst Incidents
- Possible Hijack of Office365 Account
- Possible SSL Command and Control
Indicators of Compromise (IoCs)
IoC – Type – Description
193.222.96[.]91 – IP – Unusual Login Source
thecalebgroup[.]top – Domain – Possible C2 Endpoint
rz8js7sjbef[.]latovafineart[.]life – Domain – Possible C2 Endpoint
https://docsend[.]com/view/vcdmsmjcskw69jh9 - Domain - Phishing Link
Like this and want more?
Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newsletter
Stay ahead of threats with the Darktrace blog newsletter
Get the latest insights from the cybersecurity landscape, including threat trends, incident analysis, and the latest Darktrace product developments – delivered directly to your inbox, monthly.
Thanks, your request has been received
A member of our team will be in touch with you shortly.
Oops! Something went wrong while submitting the form.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
From Royal to BlackSuit: Understanding the Tactics and Impact of a Sophisticated Ransomware Strain
What is BlackSuit Ransomware?
Since late 2023, Darktrace has detected BlackSuit ransomware infiltrating multiple customer networks in the US. This ransomware has targeted a wide range of industries, including arts, entertainment, real estate, public administration, defense, and social security.
Emerging in May 2023, BlackSuit is believed to be a spinoff of Royal ransomware due to similarities in code and Conti, and most likely consists of Russian and Eastern European hackers [1]. Recorded Future reported that the ransomware had affected 95 organizations worldwide, though the actual number is likely much higher [2]. While BlackSuit does not appear to focus on any particular sector, it has targeted multiple organizations in the healthcare, eduction, IT, government, retail and manufacturing industries [3]. Employing double extortion tactics, BlackSuit not only encrypts files but also steals sensitive data to leverage ransom payments.
BlackSuit has demanded over USD 500 million in ransoms, with the highest individual demand reaching USD 60 million [4]. Notable targets include CDK Global, Japanese media conglomerate Kadokawa, multiple educational institutions, Octapharma Plasma, and the government of Brazil [5][6][7][8].
Darktrace’s Coverage of BlackSuit Ransomware Attack
Case 1, November 2023
The earliest attack on a Darktrace customer by BlackSuit was detected at the start of November 2023. The unusual network activity began on a weekend—a time commonly chosen by ransomware groups to increase their chances of success, as many security teams operate with reduced staff. Darktrace identified indicators of the attackers’ presence on the network for almost two weeks, during which a total of 15 devices exhibited suspicious behavior.
The attack commenced with unusual internal SMB (Server Message Block) connections using a compromised service account. An internal device uploaded an executable (zzza.exe) to a domain controller (DC) and shortly after, wrote a script (socks5.ps1) to another device. According to a Cybersecurity Advisory from the CISA (Cybersecurity and Infrastructure Security Agency, US), the script file was a PowerShell reverse proxy [9].
Approximately an hour and a half later, the device to which the script was written exhibited uncommon WMI (Windows Management Instrumentation) activity. Two hours after receiving the executable file, the DC was observed making an outgoing NTLM request, using PowerShell to remotely execute commands, distributing differently named executable files (<PART OF THE CUSTOMER’S NAME>.exe), and controlling services on other devices.
Eighteen hours after the start of the unusual activity, Darktrace detected another device making repeated connections to “mystuff.bublup[.]com”, which the aforementioned CISA Advisory identifies as a domain used by BlackSuit for data exfiltration [9].
About ten minutes after the suspicious executables were distributed across the network, and less than 24 hours after the start of the unusual activity, file encryption began. A total of ten devices were seen appending the “.blacksuit” extension to files saved on other devices using SMB, as well as writing ransom notes (readme.blacksuit.txt). The file encryption lasted less than 20 minutes.
Figure 1: An example of the contents of a BlackSuit ransom note being written over SMB.
During this compromise, external connections to endpoints related to ConnectWise’s ScreenConnect remote management tool were also seen from multiple servers, suggesting that the tool was likely being abused for command-and-control (C2) activity. Darktrace identified anomalous connectivity associated with ScreenConnect was seen up to 11 days after the start of the attack.
10 days after the start of the compromise, an account belonging to a manager was detected adding “.blacksuit” extensions to the customer’s Software-a-Service (SaaS) resources while connecting from 173.251.109[.]106. Six minutes after file encryption began, Darktrace flagged the unusual activity and recommended a block. However, since Autonomous Response mode was not enabled, the customer’s security team needed to manually confirm the action. Consequently, suspicious activity continued for about a week after the initial encryption. This included disabling authentication on the account and an unusual Teams session initiated from the suspicious external endpoint 216.151.180[.]147.
Case 2, February 2024
Another BlackSuit compromise occurred at the start of February 2024, when Darktrace identified approximately 50 devices exhibiting ransomware-related activity in another US customer’s environment. Further investigation revealed that a significant number of additional devices had also been compromised. These devices were outside Darktrace’s purview to the customer’s specific deployment configuration. The threat actors managed to exfiltrate around 4 TB of data.
Initial access to the network was gained via a virtual private network (VPN) compromise in January 2024, when suspicious connections from a Romanian IP address were detected. According to CISA, the BlackSuit group often utilizes the services of initial access brokers (IAB)—actors who specialize in infiltrating networks, such as through VPNs, and then selling that unauthorized access to other threat actors [9]. Other initial access vectors include phishing emails, RDP (Remote Desktop Protocol) compromise, and exploitation of vulnerable public-facing applications.
Similar to the first case, the file encryption began at the end of the working week. During this phase of the attack, affected devices were observed encrypting files on other internal devices using two compromised administrator accounts. The encryption activity lasted for approximately six and a half hours. Multiple alerts were sent to the customer from Darktrace’s Security Operations Centre (SOC) team, who began reviewing the activity within four minutes of the start of the file encryption.
Figure 2: Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 3: A spike in model alerts on the day when file encryption by BlackSuit was observed in the network.
In this case, the threat actor utilized SystemBC proxy malware for command and control (C2). A domain controller (DC) was seen connecting to 137.220.61[.]94 on the same day the file encryption took place. The DC was also observed connecting to a ProxyScrape domain around the same time, which is related to the SOCKS5 protocol used by SystemBC. During this compromise, RDP, SSH, and SMB were used for lateral movement within the network.
Figure 4: A Cyber AI Analyst investigation alerting to a device on the VPN subnet making suspicious internal SSH connections due to malicious actors moving laterally within the network.
Signs of threat actors potentially being on the network were observed as early as two days prior to the file encryption. This included unusual internal network scanning via multiple protocols (ICMP, SMB, RDP, etc.), credential brute-forcing, SMB access failures, and anonymous SMBv1 sessions. These activities were traced to IP addresses belonging to two desktop devices in the VPN subnet associated with two regular employee user accounts. Threat actors were seemingly able to exploit at least one of these accounts due to LDAP legacy policies being in place on the customer’s environment.
Figure 5: A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Figure 6: Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.
Case 3, August 2024
The most recently observed BlackSuit compromise occurred in August 2024, when a device was observed attempting to brute-force the credentials of an IT administrator. This activity continued for 11 days.
Once the admin’s account was successfully compromised, network scanning, unusual WMI, and SAMR (Security Account Manager Remote protocol) activity followed. A spike in the use of this account was detected on a Sunday—once again, the attackers seemingly targeting the weekend—when the account was used by nearly 50 different devices.
The compromised admin’s account was exploited for data gathering via SMB, resulting in the movement of 200 GB of data between internal devices in preparation for exfiltration. The files were then archived using the naming convention “*.part<number>.rar”.
Around the same time, Darktrace observed data transfers from 19 internal devices to “bublup-media-production.s3.amazonaws[.]com,” totaling just over 200 GB—the same volume of data gathered internally. Connections to other Bublup domains were also detected. The internal data download and external data transfer activity took approximately 8-9 hours.
Unfortunately, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning any mitigative actions to stop the data gathering or exfiltration required human confirmation.
Figure 7: One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.
Once the information was stolen, the threat actor moved on to the final stage of the attack—file encryption. Five internal devices, using either the compromised admin account or connecting via anonymous SMBv1 sessions, were seen encrypting files and writing ransom notes to five other devices on the network. The attempts at file encryption continued for around two hours, but Darktrace’s Autonomous Response capability was able to block the activity and prevent the attack from escalating.
Conclusion
The persistent and evolving threat posed by ransomware like BlackSuit underscores the critical importance of robust cybersecurity measures across all sectors. Since its emergence in 2023, BlackSuit has demonstrated a sophisticated approach to infiltrating networks, leveraging double extortion tactics, and demanding substantial ransoms. The cases highlighted above illustrate the varied methods and persistence of BlackSuit attackers, from exploiting VPN vulnerabilities to abusing remote management tools and targeting off-hours to maximize impact.
Although many similar connection patterns, such as the abuse of Bublup services for data exfiltration or the use of SOCKS5 proxies for C2, were observed during cases investigated by Darktrace, BlackSuit actors are highly sophisticated and tailors their attacks to each target organization. The consequences of a successful attack can be highly disruptive, and remediation efforts can be time-consuming and costly. This includes taking the entire network offline while responding to the incident, restoring encrypted files from backups (if available), dealing with damage to the organization’s reputation, and potential lawsuits.
These BlackSuit ransomware incidents emphasize the need for continuous vigilance, timely updates to security protocols, and the adoption of autonomous response technologies to swiftly counteract such attacks. As ransomware tactics continue to evolve, organizations must remain agile and informed to protect their critical assets and data. By learning from these incidents and enhancing their cybersecurity frameworks, organizations can better defend against the relentless threat of ransomware and ensure the resilience of their operations in an increasingly digital world.
Credit to Signe Zaharka (Principal Cyber Analyst) and Adam Potter (Senior Cyber Analyst)
Darktrace’s First 6: Half-Year Threat Report 2024 highlights the latest attack trends and key threats observed by the Darktrace Threat Research team in the first six months of 2024.
Focuses on anomaly detection and behavioral analysis to identify threats
Maps mitigated cases to known, publicly attributed threats for deeper context
Offers guidance on improving security posture to defend against persistent threats
Appendices
Darktrace Model Detections
Anomalous Connection / Data Sent to Rare Domain
Anomalous Connection / High Volume of New or Uncommon Service Control
Anomalous Connection / New or Uncommon Service Control
Anomalous Connection / Rare WinRM Outgoing
Anomalous Connection / SMB Enumeration
Anomalous Connection / Suspicious Activity On High Risk Device
Anomalous Connection / Suspicious Read Write Ratio
Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB
Anomalous Connection / Sustained MIME Type Conversion
.blacksuit - File extension – When encrypting the files, this extension is appended to the filename – High
readme.blacksuit.txt – ransom note - A file demanding cryptocurrency payment in exchange for decrypting the victim's files and not leaking the stolen data – High
mystuff.bublup[.]com, bublup-media-production.s3.amazonaws[.]com – data exfiltration domains related to an organization and project management app that has document sharing functionality – High
137.220.61[.]94:4001 – SystemBC C2 related IP address (this tool is often used by other ransomware groups as well) - Medium
173.251.109[.]106 – IP address seen during a SaaS BlackSuit compromise (during file encryption) – Medium
216.151.180[.]147 – IP address seen during a SaaS BlackSuit compromise (during an unusual Teams session) - Medium
MITRE ATT&CK Mapping
Tactic - Technqiue
Account Manipulation - PERSISTENCE - T1098
Alarm Suppression - INHIBIT RESPONSE FUNCTION - T0878
Application Layer Protocol - COMMAND AND CONTROL - T1071
Automated Collection - COLLECTION - T1119
Block Command Message - INHIBIT RESPONSE FUNCTION - T0803
Block Reporting Message - INHIBIT RESPONSE FUNCTION - T0804
Onomastics Gymnastics: How Darktrace Detects Spoofing and Business Email Compromise in Multi-Name Users
Note: For privacy reasons, actual surnames and email addresses observed in these incidents below have been replaced with fictitious placeholder names, using the common Spanish names “Fulano” and “Mengano”.
Naming conventions
Modeling names and their variants of members of an organization is a critical component to properly detect if those same names and variants are being spoofed by malicious actors. For many predominantly English-speaking organizations, these variants can largely be captured by variants of a person’s given name (e.g. James-Jimmy-Jim) and a consistent, singular surname or family name (e.g. Smith). Naming conventions, however, are far from universal. This piece will review how Darktrace / EMAIL manages the common naming conventions of much of the Spanish-speaking world, and can use its modeling to create high-fidelity detections of multiple types of spoofing attempts.
A brief summary of the common convention across Spain and much of Spanish-speaking America: most people are given one or two given names (e.g. Roberto, Juan, María, Natalia), and their surnames are the first surname of their father, followed by the first surname of their mother. While there are various exceptions to this norm, the below graphic Wikipedia [1][2] highlights the general rule.
Figure 1: Example Spanish naming convention for father “José García Torres” and mother “María Acosta Gómez” for child “Pablo García Acosta”. If shortened to one surname, the convention holds the child would be referred to as “Pablo García” [1].
Detection of improper name usage
Implicit in the above comment that shortening to one surname follows the convention of using the first surname, shortening to the second surname is often a tell-tale sign of someone unfamiliar with the person or their broader culture. This can be a useful corroborating feature in detecting a spoof attempt – analogous to a spelling error.
In the case of a Spanish customer, this misuse of name shortening contributed to the detection of a spoof attempt trying to solicit a response by impersonating an internal user forwarding information about ‘Data Protection’.
Figure 2: The Cyber AI Analyst summary of the Darktrace / EMAIL detections shows the use of the Gmail sender impersonating Isabel Maria Fulano Mengano, but incorrectly uses the second surname Mengano.
While the limited communication history from the sender and the nature of the text content already marks the mail as suspicious, Darktrace / EMAIL notes the personal name used in the email is similar to a high-value user (‘whale’ to use the terminology of spearphishing). The additional context provided by the detection of the attempted spoof prompted more severe actioning of this email, leading to a ‘Hold’ action instead of a less-severe ‘Unspoof’ action via a banner on the email.
Figure 3: The content summary of the sender showing the ‘Personal’ field of the email being ‘Isabel Mengano’, breaking from the standard name-shortening convention. The additional metrics identify features that might be anomalous about the sender.
Malicious email properly using both surnames
Misusing the name-shortening convention is not the only way that Darktrace / EMAIL can detect spoofing attempts. In the case of another Spanish customer, Darktrace observed a whale impersonation being sent to 230 users with solicitation content, but no links or attachments. Although the name was modeled internally in the “Surname, Given-name” format, Darktrace identified the spoofing attempt targeting a high-value user and took action, blocking the series of emails from reaching end-user inboxes to prevent unsuspecting users from responding.
Figure 4: Cyber AI Analyst summary of a suspicious email. The personal field is visible as ‘juan fulano mengano’, which is consistent with the reverse-order modelled user ‘fulano mengano, juan’. The subject line ‘Urgent Request’ sent to 230 users gives an intuitive indicator of the emails potentially being part of a malicious solicitation campaign.
In Summary: A case of onomastics gymnastics
The variety in valid usage of human language can be a barrier to evaluating when a given text is benign or malicious. Despite this, Darktrace / EMAIL is designed to manage this variety, as exemplified by the detections of two spoofing attempts seen against organizations using the distinct Spanish-speaking world’s common naming convention. The scope of this design as seen in this onomastic context, extends to a wide range of detections surrounding emails and their behavioral anomalies.
Credit to Roberto Romeu (Principal Cyber Analyst), Justin Torres (Senior Cyber Analyst) and Natalia Sánchez Rocafort (Senior Analyst Consultant).
Discover the most advanced cloud-native AI email security solution to protect your domain and brand while preventing phishing, novel social engineering, business email compromise, account takeover, and data loss.
Gain up to 13 days of earlier threat detection and maximize ROI on your current email security
Experience 20-25% more threat blocking power with Darktrace / EMAIL
Stop the 58% of threats bypassing traditional email security
![One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/673513f1135d0e009caf256f_6735136a725738f4afe4de2b_Fig%25207.png)
