Blog
/
/
July 14, 2021

Darktrace Detects Egregor Ransomware in Customer Environment

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
14
Jul 2021
See how Darktrace managed to detect and eliminate an Egregor ransomware extortion attack in a customer environment without the use of any signatures.

Ransomware groups are coming and going faster than ever. In June alone we saw Avaddon release its decryption keys unprompted and disappear from sight, while members of CLOP were arrested in Ukraine. The move follows increasing pressure from the US intelligence community and Ukrainian authorities, who took down Egregor ransomware back in February. Egregor had only been around since September 2020. It survived less than six months.

But these gangs aren’t going away – they are simply going underground. Despite ‘closures’, cases of ransomware continue to rise and new threat actors and independent hackers pop up on the Dark Web every day.

As malware actors lay low and resurface with new variants, keeping up with the stream of signatures and new strains has become untenable. This blog studies the techniques, tools and procedures (TTPs) observed from a real-life Egregor intrusion last autumn, which showcases how Self-Learning AI detected the attack without relying on signatures.

Egregor: Maze reloaded

150 companies
worldwide have fallen victim to Egregor.

Law enforcement authorities have been busy this year. Aside from Egregor and CLOP, actions were taken against Netwalker in Bulgaria and the US, while Europol announced that an international operation had disrupted the core infrastructure of Emotet, one of the most prominent botnets of the past decade.

All parties – from governments down to individual businesses – are taking the threat of ransomware more seriously. In response to this added pressure, cyber-criminals often prefer to shut up shop rather than hang around long enough to be arrested.

DarkSide famously closed down after the Colonial Pipeline attacks, only nine months after it had been created. An admin from the Ziggy gang announced that it would issue refunds and was looking for a job as a threat hunter.

“Hi. I am Ziggy ransomware administrator. We decided to publish all decryption keys.

We are very sad about what we did. As soon as possible, all the keys will be published in this channel.”

Take this apology with a pinch of salt. The players which have ‘closed down’ have not had a change of heart, they’ve just changed tack. Different names and new infrastructure can help keep the heat off and circumvent US sanctions or federal scrutiny. PayloadBIN (a new ransomware which cropped up last month), WastedLocker, Dridex, Hades, Phoenix, Indrik Spider… all just aliases for one single group: Evil Corp.

The FBI are becoming more aggressive in their methods of infiltration and disruption, so it is likely we will see more of these U-turns and guerrilla-style tactics. Temporary pop-up gangs are an emerging trend in place of large, established enterprises like REvil, whose websites also vanished following the attack against Kaseya. And there is no doubt we will continue to witness these ‘exit scams’, where groups retire and re-brand, like Maze did last September, when it came back as Egregor.

Darktrace detects malware regardless of the name or strain. It stopped Maze last year, and, as we shall see below, it stopped its successor Egregor, even though the code and C2 endpoints used in the intrusion had never been seen before.

30%
of ransom profits are taken by Egregor developers.

Egregor ransomware attack

Back in November 2020, Egregor was in full bloom, targeting major organizations and exfiltrating data in ‘double extortion’ attacks. At a logistics company in Europe with around 20,000 active devices, during a Darktrace Proof of Value (POV) trial, Egregor struck.

Figure 1: Timeline of the attack. The overall dwell time — from first C2 connection to encryption — was five days.

As a Ransomware-as-a-Service (RaaS) gang, it appears Egregor had partnered with botnet providers to facilitate initial access. In this case, the compromised device carried signs of prior infection. It was seen connecting to an apparent Webex endpoint, before connecting to the Akamai doppelganger, amajai-technologies[.]network. This activity was followed by a number of command and control (C2) and exfiltration-related breaches.

Three days later, Darktrace observed lateral movement over HTTPS. Another device – a server – was seen connecting to the amajai host. This server wrote unusual numeric exectuables to shared SMB drives and took new service control. A third host then made a ~50GB upload to a rare IP.

Figure 2: Cyber AI Analyst summarizes the initial C2 and unusual SMB writes in a similar incident, followed later by a large upload to a rare external endpoint.

After two days, encryption began. This triggered multiple hosts breaches. On the final day, the attacker made large uploads to various endpoints, all from ostensibly compromised hosts.

Retrospective analysis

$4m
is the highest recorded cost of an Egregor ransom.

If the attack had not been neutralized at this point, it could have resulted in significant financial loss and reputational damage for the company. The two-pronged attack enabled Egregor both to encrypt critical resources and to exfiltrate them, with a view to publicizing sensitive data if the victims refused to pay up.

The affiliates who deployed the ransomware in this case were highly skilled. They leveraged a number of sophisticated techniques including the use of a large number of C2 endpoints, with doppelgangers and off-the-shelf tools.

The adoption of HTTPS for lateral movement and reconnaissance reduced lateral noise for scans and enumeration. The complex C2 had numerous endpoints, some of which were doppelgangers of legitimate sites. Furthermore, some malware was downloaded as masqueraded files: the mimetype Octet Streams were downloaded as ‘g.pixel’. These three tactics helped obfuscate the attacker’s movements and trick traditional security tools.

Ransomware attacks are occurring at a speed that even five years ago was unimaginable. In this case, the overall dwell time was less than a week, and part of the attack happened out of office hours. This highlights the need for Autonomous Response, which can keep up with novel threats and does not rely on humans being in the loop to contain cyber-attacks.

Gone today, here tomorrow

Egregor was busted in February, but we may well see it resurface under a different name and with modified code. If and when this happens, signatures will be of no use. Catching never-before-seen ransomware, which employs novel methods of intrusion and extortion, requires a different approach.

The endpoint in the case study above is now associated via open-source intelligence (OSINT) with Cobalt Strike. But at the time of the investigation, the C2 was unlisted. Similarly, the malware was unknown to OSINT and thus evaded signature-based tools.

Despite this, Self-Learning AI detected every single stage of the in-progress attack. No action was taken as it was only a trial POV so Darktrace had no remote access in the environment. However, after seeing the power of the technology, the organization decided to implement Darktrace across its digital estate.

Thanks to Darktrace analyst Roberto Romeu for his insights on the above threat find.

Learn how Darktrace stops Egregor and all forms of ransomware

Darktrace model detections:

  • Agent Beacon to New Endpoint
  • Agent Beacon (Long Period)
  • Agent Beacon (Medium Period)
  • Agent Beacon (Short Period)
  • Anomalous Octet Stream
  • Anomalous Server Activity / Outgoing from Server
  • Anomalous SMB Followed By Multiple Model Breaches
  • Anomalous SSL without SNI to New External
  • Beaconing Activity To External Rare
  • Beacon to Young Endpoint
  • Data Sent To New External Device
  • Data Sent to Rare Domain
  • DGA Beacon
  • Empire Python Activity Pattern
  • EXE from Rare External Location
  • High Volume of Connections with Beacon Score
  • High Volume of New or Uncommon Service Control
  • HTTP Beaconing to Rare Destination
  • Large Number of Model Breaches
  • Long Agent Connection to New Endpoint
  • Low and Slow Exfiltration
  • Multiple C2 Model Breaches
  • Multiple Connections to New External TCP Port
  • Multiple Failed Connections to Rare Endpoint
  • Multiple Lateral Movement Model Breaches
  • Network Scan
  • New Failed External Connections
  • New or Uncommon Service Control
  • Numeric Exe in SMB Write
  • Rare External SSL Self-Signed
  • Slow Beaconing Activity To External Rare
  • SMB Drive Write
  • SMB Enumeration
  • SSL Beaconing to Rare Destination
  • SSL or HTTP Beacon
  • Suspicious Beaconing Behaviour
  • Suspicious Self-Signed SSL
  • Sustained SSL or HTTP Increase
  • Quick and Regular Windows HTTP Beaconing
  • Uncommon 1 GiB Outbound
  • Unusual BITS Activity
  • Unusual Internal Connections
  • Unusual SMB Version 1 Connectivity
  • Zip or Gzip from Rare External Location

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Justin Fier
SVP, Red Team Operations

Justin is one of the US’s leading cyber intelligence experts, and holds the position of SVP, Red Team Operations at Darktrace. His insights on cyber security and artificial intelligence have been widely reported in leading media outlets, including the Wall Street Journal, CNN, The Washington Post, and VICELAND. With over 10 years’ experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

OT

/

April 4, 2025

Darktrace Named as Market Leader in the 2025 Omdia Market Radar for OT Cybersecurity Platforms

Default blog imageDefault blog image

We are pleased to announce that Darktrace / OT has been named a Market Leader in Omdia’s  2025 Market Radar for OT Cybersecurity Platforms. We believe this highlights our unique capabilities in the OT security market and follows similar recognition from Gartner who recently named Darktrace / OT as the sole Visionary in in the Magic Quadrant for Cyber Physical Systems (CPS) Protection Platforms market.

Historically, IT and OT systems have been managed separately, creating challenges due to the differences of priorities between the two domains. While both value availability, IT emphasizes confidentiality and integrity whereas OT focuses on safety and reliability. Organizations are increasingly converging these systems to reap the benefits of automation, efficiency, and productivity (1).

Omdia’s research highlights that decision makers are increasingly prioritizing comprehensive security coverage, centralized management, and advanced cybersecurity capabilities when selecting OT security solutions (1).

Rising productivity demands have driven the convergence of OT, IT, and cloud-connected systems, expanding attack surfaces and exposing vulnerabilities. Darktrace / OT provides a comprehensive OT security solution, purpose-built for critical infrastructure, offering visibility across OT, IoT, and IT assets, bespoke risk management, and industry-leading threat detection and response powered by Self-Learning AITM.

Figure 1: Omdia vendor overview for OT cybersecurity platforms
Figure 1: Omdia vendor overview for OT cybersecurity platforms

An AI-first approach to OT security  

Many OT security vendors have integrated AI into their offerings, often leveraging machine learning for anomaly detection and threat response. However, only a few have a deep-rooted history in AI, with longstanding expertise shaping their approach beyond surface-level adoption.

The Omdia Market Radar recognizes that Darktrace has extensive background in the AI space:

“Darktrace has invested extensively in AI research to fuel its capabilities since 2013 with 200-plus patent applications, providing anomaly detection with a significant level of customization, helping with SOC productivity and efficiency, streamlining to show what matters for OT.” (1)

Unlike other security approaches that rely on existing threat data, Darktrace / OT achieves this through Self-Learning AI that understands normal business operations, detecting and containing known and unknown threats autonomously, thereby reducing Sec Ops workload and ensuring minimal downtime

This approach extends to incident investigations where an industry-first Cyber AI AnalystTM automatically investigates all relevant threats across IT and OT, prioritizes critical incidents, and then summarizes findings in an easily understandable view—bringing production engineers and security analysts together to communicate and quickly take appropriate action.

Balancing autonomous response with human oversight

In OT environments where uptime is essential, autonomous response technology can be approached with apprehension. However, Darktrace offers customizable response actions that can be set to “human confirmation mode.”

Omdia recognizes that our approach provides customizable options for autonomous response:

“Darktrace’s autonomous response functionality enforces normal, expected behavior. This can be automated but does not need to be from the beginning, and it can be fine-tuned. Alternative step-by-step mitigations are clearly laid out step-by-step and updated based on organizational risk posture and current level of progress.” (1)

This approach allows security and production to keep humans-in-the-loop with pre-defined actions for potential attacks, enforcing normal to contain a threat, and allowing production to continue without disruption.  

Bespoke vulnerability and risk management

In the realm of OT security, asset management takes precedent as one of the key focus points for organizations. With a large quantity of assets to manage, practitioners are overwhelmed with information with no real way to prioritize or apply them to their unique environment.

Darktrace / OT is recognized by Omdia as having:

“Advanced risk management capabilities that showcase metrics on impact, exploit difficulty, and estimated cost of an attack […] Given the nascency of this capability (April 2024), it is remarkably granular in depth and insight.” (1)

Enabling this is Darktrace’s unique approach to AI extends to risk management capabilities for OT. Darktrace / OT understands customers’ unique risks by building a comprehensive and contextualized picture that goes beyond isolated CVE scoring. It combines attack path modeling with MITRE ATT&CK  techniques to provide hardening recommendations regardless of patching availability and gives you a clearer view of the potential impact of an attack from APT groups.

Modular, scalable security for industrial environments

Organizations need flexibility when it comes to OT security, some want a fully integrated IT-OT security stack, while others prefer a segregated approach due to compliance or operational concerns. The Darktrace ActiveAI Security Platform offers integrated security across multiple domains, allowing flexibility and unification across IT and OT security. The platform combines telemetry from all areas of your digital estate to detect and respond to threats, including OT, network, cloud, email, and user identities.

Omdia recognizes Darktrace’s expansive coverage across multiple domains as a key reason why organizations should consider Darktrace / OT:

“Darktrace’s modular and platform, approach offer’s integrated security across multiple domains. It offers the option of Darktrace / OT as a separate platform product for those that want to segregate IT and OT cybersecurity or are not yet in a position to secure both domains in tandem. The deployment of Darktrace’s platform is flexible—with nine different deployment options, including physical on-premises, virtual, cloud, and hybrid.” (1)

With flexible deployment options, Darktrace offers security teams the ability to choose a model that works best for their organization, ensuring that security doesn’t have to be a “one-size-fits-all” approach.

Conclusion: Why Darktrace / OT stands out in Omdia’s evaluation

Omdia’s 2025 Market Radar for OT Cybersecurity Platforms provides a technical-first, vendor-agnostic evaluation, offering critical insights for organizations looking to strengthen their OT security posture. Darktrace’s recognition as a Market Leader reinforces its unique AI-driven approach, flexible deployment options, and advanced risk management capabilities as key differentiators in an evolving threat landscape.

By leveraging Self-Learning AI, autonomous response, and real-world risk analysis, Darktrace / OT enables organizations to detect, investigate, and mitigate threats before they escalate, without compromising operational uptime.

Read the full report here!

References

  1. www.darktrace.com/resources/darktrace-named-a-market-leader-in-the-2025-omdia-market-radar-for-ot-cybersecurity-platforms
Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance

Blog

/

Cloud

/

April 2, 2025

Fusing Vulnerability and Threat Data: Enhancing the Depth of Attack Analysis

Default blog imageDefault blog image

Cado Security, recently acquired by Darktrace, is excited to announce a significant enhancement to its data collection capabilities, with the addition of a vulnerability discovery feature for Linux-based cloud resources. According to Darktrace’s Annual Threat Report 2024, the most significant campaigns observed in 2024 involved the ongoing exploitation of significant vulnerabilities in internet-facing systems. Cado’s new vulnerability discovery capability further deepens its ability to provide extensive context to security teams, enabling them to make informed decisions about threats, faster than ever.

Deep context to accelerate understanding and remediation

Context is critical when understanding the circumstances surrounding a threat. It can also take many forms – alert data, telemetry, file content, business context (for example asset criticality, core function of the resource), and risk context, such as open vulnerabilities.

When performing an investigation, it is common practice to understand the risk profile of the resource impacted, specifically determining open vulnerabilities and how they may relate to the threat. For example, if an analyst is triaging an alert related to an internet-facing Webserver running Apache, it would greatly benefit the analyst to understand open vulnerabilities in the Apache version that is running, if any of them are exploitable, whether a fix is available, etc. This dataset also serves as an invaluable source when developing a remediation plan, identifying specific vulnerabilities to be prioritised for patching.

Data acquisition in Cado

Cado is the only platform with the ability to perform full forensic captures as well as utilize instant triage collection methods, which is why fusing host-based artifact data with vulnerability data is such an exciting and compelling development.

The vulnerability discovery feature can be run as part of an acquisition – full or triage – as well as independently using a fast ‘Scan only’ mode.

Figure 1: A fast vulnerability scan being performed on the acquired evidence

Once the acquisition has completed, the user will have access to a ‘Vulnerabilities’ table within their investigation, where they are able to view and filter open vulnerabilities (by Severity, CVE ID, Resource, and other properties), as well as pivot to the full Event Timeline. In the Event Timeline, the user will be able to identify whether there is any malicious, suspicious or other interesting activity surrounding the vulnerable package, given the unified timeline presents a complete chronological dataset of all evidence and context collected.

Figure 2: Vulnerabilities discovered on the acquired evidence
Figure 3: Pivot from the Vulnerabilities table to the Event Timeline provides an in-depth view of file and process data associated with the vulnerable package selected. In this example, Apache2.

Future work

In the coming months, we’ll be releasing initial versions of highly anticipated integrations between Cado and Darktrace, including the ability to ingest Darktrace / CLOUD alerts which will automatically trigger a forensic capture (as well as a vulnerability discovery) of the impacted assets.

To learn more about how Cado and Darktrace will combine forces, request a demo today.

Continue reading
About the author
Paul Bottomley
Director of Product Management, Cado
Your data. Our AI.
Elevate your network security with Darktrace AI