December 20, 2023

Ivanti Sentry Vulnerability | Analysis & Insights

Darktrace observed a critical vulnerability in Ivanti Sentry's cybersecurity. Learn how this almost become a huge threat and how we stopped it in its tracks.

Written by

Sam Lister

Specialist Security Researcher

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Sam Lister

Specialist Security Researcher

Dec 2023

In an increasingly interconnected digital landscape, the prevalence of critical vulnerabilities in internet-facing systems stands as an open invitation to malicious actors. These vulnerabilities serve as a near limitless resource, granting attackers a continually array of entry points into targeted networks.

In the final week of August 2023, Darktrace observed malicious actors validating exploits for one such critical vulnerability, likely the critical RCE vulnerability, CVE-2023-38035, on Ivanti Sentry servers within multiple customer networks. Shortly after these successful tests were carried out, malicious actors were seen delivering crypto-mining and reconnaissance tools onto vulnerable Ivanti Sentry servers.

Fortunately, Darktrace DETECT™ was able to identify this post-exploitation activity on the compromised servers at the earliest possible stage, allowing the customer security teams to take action against affected devices. In environments where Darktrace RESPOND™ was enabled in autonomous response mode, Darktrace was further able inhibit the identified post-exploitation activity and stop malicious actors from progressing towards their end goals.

Exploitation of Vulnerabilities in Ivanti Products

The software provider, Ivanti, offers a variety of widely used endpoint management, service management, and security solutions. In July and August 2023, the Norwegian cybersecurity company, Mnemonic, disclosed three vulnerabilities in Ivanti products [1]/[2]/[3]; two in Ivanti's endpoint management solution, Ivanti Endpoint Manager Mobile (EPMM) (formerly called 'MobileIron Core'), and one in Ivanti’s security gateway solution, Ivanti Sentry (formerly called 'MobileIron Sentry'):

CVE-2023-35078

CVSS Score: 10.0
Affected Product: Ivanti EPMM
Details from Ivanti: [4]/[5]/[6]
Vulnerability type: Authentication bypass

CVE-2023-35081

CVSS Score: 7.2
Affected Product: Ivanti EPMM
Details from Ivanti: [7]/[8]/[9]
Vulnerability type: Directory traversal

CVE-2023-38035

CVSS Score:
Affected Product: Ivanti Sentry
Details from Ivanti: [10]/[11]/[12]
Vulnerability type: Authentication bypass

At the beginning of August 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) provided details of advanced persistent threat (APT) activity targeting EPMM systems within Norwegian private sector and government networks via exploitation of CVE-2023-35078 combined with suspected exploitation of CVE-2023-35081.

In an article published in August 2023 [12], Ivanti disclosed that a very limited number of their customers had been subjected to exploitation of the Ivanti Sentry vulnerability, CVE-2023-38035, and on the August 22, 2023, CISA added the Ivanti Sentry vulnerability, CVE-2023-38035 to its ‘Known Exploited Vulnerabilities Catalogue’. CVE-2023-38035 is a critical authentication bypass vulnerability affecting the System Manager Portal of Ivanti Sentry systems. The System Manager Portal, which is accessible by default on port 8433, is used for administration of the Ivanti Sentry system. Through exploitation of CVE-2023-38035, an unauthenticated actor with access to the System Manager Portal can achieve Remote Code Execution (RCE) on the underlying Ivanti Sentry system.

Observed Exploitation of CVE-2023-38035

On August 24, Darktrace observed Ivanti Sentry servers within several customer networks receiving successful SSL connections over port 8433 from the external endpoint, 34.77.65[.]112. The usage of port 8433 indicates that the System Manager Portal was accessed over the connections. Immediately after receiving these successful connections, Ivanti Sentry servers made GET requests over port 4444 to 34.77.65[.]112. The unusual string ‘Wget/1.14 (linux-gnu)’ appeared in the User-Agent headers of these requests, indicating that the command-line utility, wget, was abused to initiate the requests.

Figure 1: Event Log data for an Ivanti Sentry system showing the device breaching a range of DETECT models after contacting 34.77.65[.]112.The suspicious behavior highlighted by DETECT was subsequently investigated by Darktrace’s Cyber AI Analyst™, which was able to weave together these separate behaviors into single incidents representing the whole attack chain.

‍

Figure 2: AI Analyst Incident representing a chain of suspicious activities from an Ivanti Sentry server.

In cases where Darktrace RESPOND was enabled in autonomous response mode, RESPOND was able to automatically enforce the Ivanti Sentry server’s normal pattern of life, thus blocking further exploit testing.

Figure 3: Event Log for an Ivanti Sentry server showing the device receiving a RESPOND action immediately after trying to 34.77.65[.]112.

The GET requests to 34.77.65[.]112 were responded to with the following HTML document:

Figure 4: Snapshot of the HTML document returned by 34.77.65[.]112.

None of the links within this HTML document were functional. Furthermore, the devices’ downloads of these HTML documents do not appear to have elicited further malicious activities. These facts suggest that the observed 34.77.65[.]112 activities were representative of a malicious actor validating exploits (likely for CVE-2023-38035) on Ivanti Sentry systems.

Over the next 24 hours, these Ivanti Sentry systems received successful SSL connections over port 8433 from a variety of suspicious external endpoints, such as 122.161.66[.]161. These connections resulted in Ivanti Sentry systems making HTTP GET requests to subdomains of ‘oast[.]site’ and ‘oast[.]live’. Strings containing ‘curl’ appeared in the User-Agent headers of these requests, indicating that the command-line utility, cURL, was abused to initiate the requests.

These ‘oast[.]site’ and ‘oast[.]live’ domains are used by the out-of-band application security testing (OAST) service, Interactsh. Malicious actors are known to abuse this service to carry out out-of-band (OOB) exploit testing. It, therefore, seems likely that these activities were also representative of a malicious actor validating exploits for CVE-2023-38035 on Ivanti Sentry systems.

Figure 5: Event Log for Ivanti Sentry system showing the device contacting an 'oast[.]site' endpoint after receiving connections from the suspicious, external endpoint 122.161.66[.]161.

The actors seen validating exploits for CVE-2023-38035 may have been conducting such activities in preparation for their own subsequent malicious activities. However, given the variety of attack chains which ensued from these exploit validation activities, it is also possible that they were carried out by Initial Access Brokers (IABs) The activities which ensued from exploit validation activities identified by Darktrace fell into two categories: internal network reconnaissance and cryptocurrency mining.

Reconnaissance Activities

In one of the reconnaissance cases, immediately after receiving successful SSL connections over port 8443 from the external endpoints 190.2.131[.]204 and 45.159.248[.]179, an Ivanti Sentry system was seen making a long SSL connection over port 443 to 23.92.29[.]148, and making wget GET requests over port 4444 with the Target URIs '/ncat' and ‘/TxPortMap’ to the external endpoints, 45.86.162[.]147 and 195.123.240[.]183.

Figure 6: Event Log data for an Ivanti Sentry system showing the device making connections to the external endpoints, 45.86.162[.]147, 23.92.29[.]148, and 195.123.240[.]183, immediately after receiving connections from rare external endpoints.

The Ivanti Sentry system then went on to scan for open SMB ports on systems within the internal network. This activity likely resulted from an attacker dropping a port scanning utility on the vulnerable Ivanti Sentry system.

Figure 7: Event Log data for an Ivanti Sentry server showing the device breaching several DETECT models after downloading a port scanning tool from 195.123.240[.]183.

In another reconnaissance case, Darktrace observed multiple wget HTTP requests with Target URIs such as ‘/awp.tar.gz’ and ‘/resp.tar.gz’ to a suspicious, external server (78.128.113[.]130). Shortly after making these requests, the Ivanti Sentry system started to scan for open SMB ports and to respond to LLMNR queries from other internal devices. These behaviors indicate that the server may have installed an LLMNR poisoning tool, such as Responder. The Ivanti Sentry server also went on to conduct further information-gathering activities, such as LDAP reconnaissance, HTTP-based vulnerability scanning, HTTP-based password searching, and RDP port scanning.

Figure 8: Event Log data for an Ivanti Sentry system showing the device making connections to 78.128.113[.]130, scanning for an open SMB port on internal endpoints, and responding to LLMNR queries from internal endpoints.

In cases where Darktrace RESPOND was active, reconnaissance activities resulted in RESPOND enforcing the Ivanti Sentry server’s pattern of life.

Figure 9: Event Log data for an Ivanti Sentry system receiving a RESPOND action as a result of its SMB port scanning activity.

Figure 10: Event Log data for an Ivanti Sentry system receiving a RESPOND action as a result of its LDAP reconnaissance activity.

Crypto-Mining Activities

In one of the cryptomining cases, Darktrace detected an Ivanti Sentry server making SSL connections to aelix[.]xyz and mining pool endpoints after receiving successful SSL connections over port 8443 from the external endpoint, 140.228.24[.]160.

Figure 11: Event Log data for an Ivanti Sentry system showing the device contacting aelix[.]xyz and mining pool endpoints immediately after receiving connections from the external endpoint, 140.228.24[.]160.

In a cryptomining case on another customer’s network, an Ivanti Sentry server was seen making GET requests indicative of Kinsing malware infection. These requests included wget GET requests to 185.122.204[.]197 with the Target URIs ‘/unk.sh’ and ‘/se.sh’ and a combination of GET and POST requests to 185.221.154[.]208 with the User-Agent header ‘Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36’ and the Target URIs, ‘/mg’, ‘/ki’, ‘/get’, ‘/h2’, ‘/ms’, and ‘/mu’. These network-based artefacts have been observed in previous Kinsing infections [13].

Figure 12: Event Log data for an Ivanti Sentry system showing the device displaying likely Kinsing C2 activity.

On customer environments where RESPOND was active, Darktrace was able to take swift autonomous action by blocking cryptomining connection attempts to malicious command-and-control (C2) infrastructure, in this case Kinsing servers.

Figure 13: Event Log data for an Ivanti Sentry server showing the device receiving a RESPOND action after attempting to contact Kinsing C2 infrastructure.

Fortunately, due to Darktrace DETECT+RESPOND prompt identification and targeted actions against these emerging threats, coupled with remediating steps taken by affected customers’ security teams, neither the cryptocurrency mining activities nor the network reconnaissance activities led to significant disruption.

Figure 14: Timeline of observed malicious activities.

Conclusion The inevitable presence of critical vulnerabilities in internet-facing systems underscores the perpetual challenge of defending against malicious intrusions. The near inexhaustible supply of entry routes into organizations’ networks available to malicious actors necessitates a more proactive and vigilant approach to network security.

While it is, of course, essential for organizations to secure their digital environments through the regular patching of software and keeping abreast of developing vulnerabilities that could impact their network, it is equally important to have a safeguard in place to mitigate against attackers who do manage to exploit newly discovered vulnerabilities.

In the case of Ivanti Sentry, Darktrace observed malicious actors validating exploits against affected servers on customer networks just a few days after the public disclosure of the critical vulnerability. This activity was followed up by a variety of malicious and disruptive, activities including cryptocurrency mining and internal network reconnaissance.

Darktrace DETECT immediately detected post-exploitation activities on compromised Ivanti Sentry servers, enabling security teams to intervene at the earliest possible stage. Darktrace RESPOND, when active, autonomously inhibited detected post-exploitation activities. These DETECT detections, along with their accompanying RESPOND interventions, prevented malicious actors from being able to progress further towards their likely harmful objectives.

Credit to Sam Lister, Senior Cyber Analyst, and Trent Kessler, SOC Analyst

‍

Appendices

MITRE ATT&CK Mapping

Initial Access techniques:

Exploit Public-Facing Application (T1190)

Credential Access techniques:

Unsecured Credentials: Credentials In Files (T1552.001)
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)

Discovery

Network Service Discovery (T1046)
Remote System Discovery (T1018)
Account Discovery: Domain Account (T1087.002)

Command and Control techniques:

Application Layer Protocol: Web Protocols (T1071.001)
Ingress Tool Transfer (T1105)
Non-Standard Port (T1571)
Encrypted Channel: Asymmetric Cryptography (T1573.002)

Impact techniques

Resource Hijacking (T1496)

List of IoCs

Exploit testing IoCs:

· 34.77.65[.]112

· Wget/1.14 (linux-gnu)

· cjjovo7mhpt7geo8aqlgxp7ypod6dqaiz.oast[.]site • 178.128.16[.]97

· curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2

· cjk45q1chpqflh938kughtrfzgwiofns3.oast[.]site • 178.128.16[.]97

· curl/7.29.0

Kinsing-related IoCs:

· 185.122.204[.]197

· /unk.sh

· /se.sh

· 185.221.154[.]208

· 45.15.158[.]124

· Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

· /mg

· /ki

· /get

· /h2

· /ms

· /mu

· vocaltube[.]ru • 185.154.53[.]140

· 92.255.110[.]4

· 194.87.254[.]160

Responder-related IoCs:

· 78.128.113[.]130

· 78.128.113[.]34

· /awp.tar.gz

· /ivanty

· /resp.tar.gz

Crypto-miner related IoCs:

· 140.228.24[.]160

· aelix[.]xyz • 104.21.60[.]147 / 172.67.197[.]200

· c8446f59cca2149cb5f56ced4b448c8d (JA3 client fingerprint)

· b5eefe582e146aed29a21747a572e11c (JA3 client fingerprint)

· pool.supportxmr[.]com

· xmr.2miners[.]com

· monerooceans[.]stream

· xmr-eu2.nanopool[.]org

Port scanner-related IoCs:

· 122.161.66[.]161

· 192.241.235[.]32

· 45.86.162[.]147

· /ncat

· Wget/1.14 (linux-gnu)

· 45.159.248[.]179

· 142.93.115[.]146

· 23.92.29[.]148

· /TxPortMap

· 195.123.240.183

· 6935a8d379e086ea1aed159b8abcb0bc8acf220bd1cbc0a84fd806f14014bca7 (SHA256 hash of downloaded file)

Darktrace DETECT Model Breaches

· Anomalous Server Activity / New User Agent from Internet Facing System

· Device / New User Agent

· Anomalous Connection / New User Agent to IP Without Hostname

· Device / New User Agent and New IP

· Anomalous Connection / Application Protocol on Uncommon Port

· Anomalous Connection / Callback on Web Facing Device

· Compromise / High Volume of Connections with Beacon Score

· Compromise / Large Number of Suspicious Failed Connections

· Compromise / High Volume of Connections with Beacon Score

· Compromise / Beacon for 4 Days

· Compromise / Agent Beacon (Short Period)

· Device / Large Number of Model Breaches

· Anomalous Server Activity / Rare External from Server

· Compromise / Large Number of Suspicious Successful Connections

· Compromise / Monero Mining

· Compromise / High Priority Crypto Currency Mining

· Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

· Device / Internet Facing Device with High Priority Alert

· Device / Suspicious SMB Scanning Activity

· Device / Internet Facing Device with High Priority Alert

· Device / Network Scan

· Device / Unusual LDAP Bind and Search Activity

· Compliance / Vulnerable Name Resolution

· Device / Anomalous SMB Followed By Multiple Model Breaches

· Device / New User Agent To Internal Server

· Anomalous Connection / Suspicious HTTP Activity

· Anomalous Connection / Unusual Internal Connections

· Anomalous Connection / Suspicious HTTP Activity

· Device / RDP Scan

· Device / Large Number of Model Breaches

· Compromise / Beaconing Activity To External Rare

· Compromise / Beacon to Young Endpoint

· Anomalous Connection / Suspicious HTTP Activity

· Compromise / Suspicious Internal Use Of Web Protocol

· Anomalous File / EXE from Rare External Location

· Anomalous File / Internet Facing System File Download

· Device / Suspicious SMB Scanning Activity

· Device / Internet Facing Device with High Priority Alert

· Device / Network Scan

· Device / Initial Breach Chain Compromise

References

[1] https://www.mnemonic.io/resources/blog/ivanti-endpoint-manager-mobile-epmm-authentication-bypass-vulnerability/
‍[2] https://www.mnemonic.io/resources/blog/threat-advisory-remote-file-write-vulnerability-in-ivanti-epmm/
‍[3] https://www.mnemonic.io/resources/blog/threat-advisory-remote-code-execution-vulnerability-in-ivanti-sentry/
‍[4] https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
‍[5] https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US
‍[6] https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078?language=en_US
‍[7] https://www.ivanti.com/blog/cve-2023-35081-new-ivanti-epmm-vulnerability
‍[8] https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US
‍[9] https://forums.ivanti.com/s/article/KB-Arbitrary-File-Write-CVE-2023-35081?language=en_US
‍[10] https://www.ivanti.com/blog/cve-2023-38035-vulnerability-affecting-ivanti-sentry
‍[11] https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US
‍[12] https://forums.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035?language=en_US
‍[13] https://isc.sans.edu/diary/Your+Business+Data+and+Machine+Learning+at+Risk+Attacks+Against+Apache+NiFi/29900

Written by

Sam Lister

Specialist Security Researcher

Inside the SOC

Written by

Sam Lister

Specialist Security Researcher

VP, Security & AI Strategy, Field CISO

Watch the NIS2 Webinar

Blog

Network

April 2, 2026

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

Cybersecurity has traditionally organized risk around incidents, breaches, campaigns, and threat groups. Those elements still matter—but if we fixate on individual incidents, we risk missing the shaping of the entire ecosystem. Nation‑state–aligned operators are increasingly using cyber operations to establish long-term strategic leverage, not just to execute isolated attacks or short‑term objectives.

Our latest research, Crimson Echo, shifts the lens accordingly. Instead of dissecting campaigns, malware families, or actor labels as discrete events, the threat research team analyzed Chinese‑nexus activity as a continuum of behaviors over time. That broader view reveals how these operators position themselves within environments: quietly, patiently, and persistently—often preparing the ground long before any recognizable “incident” occurs.

How Chinese-nexus cyber threats have changed over time

Chinese-nexus cyber activity has evolved in four phases over the past two decades. This ranges from early, high-volume operations in the 1990s and early 2000s to more structured, strategically-aligned activity in the 2010s, and now toward highly adaptive, identity-centric intrusions.

Today’s phase is defined by scale, operational restraint, and persistence. Attackers are establishing access, evaluating its strategic value, and maintaining it over time. This reflects a broader shift: cyber operations are increasingly integrated into long-term economic and geopolitical strategies. Access to digital environments, specifically those tied to critical national infrastructure, supply chains, and advanced technology, has become a form of strategic leverage for the long-term.

How Darktrace analysts took a behavioral approach to a complex problem

One of the challenges in analyzing nation-state cyber activity is attribution. Traditional approaches often rely on tracking specific threat groups, malware families, or infrastructure. But these change constantly, and in the case of Chinese-nexus operations, they often overlap.

Crimson Echo is the result of a retrospective analysis of three years of anomalous activity observed across the Darktrace fleet between July 2022 and September 2025. Using behavioral detection, threat hunting, open-source intelligence, and a structured attribution framework (the Darktrace Cybersecurity Attribution Framework), the team identified dozens of medium- to high-confidence cases and analyzed them for recurring operational patterns.

This long-horizon, behavior-centric approach allows Darktrace to identify consistent patterns in how intrusions unfold, reinforcing that behavioral patterns that matter.

What the data shows

Several clear trends emerged from the analysis:

Targeting is concentrated in strategically important sectors. Across the dataset, 88% of intrusions occurred in organizations classified as critical infrastructure, including transportation, critical manufacturing, telecommunications, government, healthcare, and Information Technology (IT) services.
Strategically important Western economies are a primary focus. The US alone accounted for 22.5% of observed cases, and when combined with major European economies including Germany, Italy, Spain and the UK, over half of all intrusions (55%) were concentrated in these regions.
Nearly 63% of intrusions of intrusions began with the exploitation of internet-facing systems, reinforcing the continued risk posed by externally exposed infrastructure.

Two models of cyber operations

Across the dataset, Chinese-nexus activity followed two operational models.

The first is best described as “smash and grab.” These are short-horizon intrusions optimized for speed. Attackers move quickly – often exfiltrating data within 48 hours – and prioritize scale over stealth. The median duration of these compromises is around 10 days. It’s clear they are willing to risk detection for short-term gain.

The second is “low and slow.” These operations were less prevalent in the dataset, but potentially more consequential. Here, attackers prioritize persistence, establishing durable access through identity systems and legitimate administrative tools, so they can maintain access undetected for months or even years. In one notable case, the actor had fully compromised the environment and established persistence, only to resurface in the environment more than 600 days after. The operational pause underscores both the depth of the intrusion and the actor’s long‑term strategic intent. This suggests that cyber access is a strategic asset to preserve and leverage over time, and we observed these attacks most often inin sectors of the high strategic importance.

It’s important to note that the same operational ecosystem can employ both models concurrently, selecting the appropriate model based on target value, urgency, intended access. The observation of a “smash and grab” model should not be solely interpreted as a failure of tradecraft, but instead an operational choice likely aligned with objectives. Where “low and slow” operations are optimized for patience, smash and grab is optimized for speed; both seemingly are deliberate operational choices, not necessarily indicators of capability.

Rethinking cyber risk

For many organizations, cyber risk is still framed as a series of discrete events. Something happens, it is detected and contained, and the organization moves on. But persistent access, particularly in deeply interconnected environments that span cloud, identity-based SaaS and agentic systems, and complex supply chain networks, creates a major ongoing exposure risk. Even in the absence of disruption or data theft, that access can provide insight into operations, dependencies, and strategic decision-making. Cyber risk increasingly resembles long-term competitive intelligence.

This has impact beyond the Security Operations Center. Organizations need to shift how they think about governance, visibility, and resilience, and treat cyber exposure as a structural business risk instead of an incident response challenge.

What comes next

The goal of this research is to provide a clearer understanding of how these operations work, so defenders can recognize them earlier and respond more effectively. That includes shifting from tracking indicators to understanding behaviors, treating identity providers as critical infrastructure risks, expanding supplier oversight, investing in rapid containment capabilities, and more.

Learn more about the findings of Darktrace’s latest research, Crimson Echo: Understanding Chinese-nexus Cyber Operations Through Behavioral Analysis, by downloading the full report and summaries for business leaders, CISOs, and SOC analysts here.

About the author

Nathaniel Jones

VP, Security & AI Strategy, Field CISO

Blog

Proactive Security

April 1, 2026

AI-powered security for a rapidly growing grocery enterprise

Protecting a complex, fast-growing retail organization

For this multi-banner grocery holding organization, cybersecurity is considered an essential business enabler, protecting operations, growth, and customer trust. The organization’s lean IT team manages a highly distributed environment spanning corporate offices, 100+ stores, distribution centers and thousands of endpoints, users, and third-party connections.

Mergers and acquisitions fueled rapid growth, but they also introduced escalating complexity that constrained visibility into users, endpoints, and security risks inherited across acquired environments.

Closing critical visibility gaps with limited resources

Enterprise-wide visibility is a top priority for the organization, says the Vice President of Information Technology. “We needed insights beyond the perimeter into how users and devices were behaving across the organization.”

A security breach that occurred before the current IT leadership joined the company reinforced the urgency and elevated cybersecurity to an executive-level priority with a focus on protecting customer trust. The goal was to build a multi-layered security model that could deliver autonomous, enterprise-wide protection without adding headcount.

Managing cyber risk in M&A

Mergers and acquisitions are central to the grocery holding company’s growth strategy. But each transaction introduces new cyber risk, including inherited network architectures, inconsistent tooling, excessive privileges, and remnants of prior security incidents that were never fully remediated.

“Our M&A targets range from small chains with a single IT person and limited cyber tools to large chains with more developed IT teams, toolsets and instrumentation,” explains the VP of IT. “We needed a fast, repeatable, and reliable way to assess cyber risk before transactions closed.”

AI-driven security built for scale, speed, and resilience

Rather than layering additional point tools onto an already complex environment, the retailer adopted the Darktrace ActiveAI Security Platform™ in 2020 as part of a broader modernization effort to improve resilience, close visibility gaps, and establish a security foundation that could scale with growth.

“Darktrace’s AI-driven approach provided the ideal solution to these challenges,” shares the VP of IT. “It has empowered our organization to maintain a robust security strategy, ensuring the protection of our network and the smooth operation of our business.”

Enterprise-wide visibility into traffic

By monitoring both north-south and east-west traffic and applying Self-Learning AI, Darktrace develops a dynamic understanding of how users and devices normally behave across locations, roles, and systems.

“Modeling normal behavior across the environment enables us to quickly spot behavior that doesn’t fit. Even subtle changes that could signal a threat but appear legitimate at first glance,” explains the VP of IT.

Real-time threat containment, 24/7

Adopting autonomous response has created operational breathing room for the security team, says the company’s Cybersecurity Engineer.

“Early on, we enabled full Darktrace autonomous mode and we continue to do so today,” shares the IT Security Architect. “Allowing the technology to act first gives us the time we need to investigate incidents during business hours without putting the business at risk.”

Unified, actionable view of security ecosystem

The grocery retailer integrated Darktrace with its existing security ecosystem of firewalls, vulnerability management tools, and endpoint detection and response, and the VP of IT described the adoption process as “exceptionally smooth.”

The team can correlate enterprise-wide security data for a unified and actionable picture of all activity and risk. Using this “single pane of glass” approach, the retailer trains Level 1 and Level 2 operations staff to assist with investigations and user follow-ups, effectively extending the reach of the security function without expanding headcount.

From reactive defense to security at scale

With Darktrace delivering continuous visibility, autonomous containment, and integrated security workflows, the organization has strengthened its cybersecurity posture while improving operational efficiency. The result is a security model that not only reduces risk, but also supports growth, resilience, and informed decision-making at the business level.

Faster detection, faster resolution

With autonomous detection and response, the retailer can immediately contain risk while analysts investigate and validate activity. With this approach, the company can maintain continuous protection even outside business hours and reduce the chance of lateral spread across systems or locations.

Enterprise-grade protection with a lean team

From cloud environments to clients to SaaS collaboration tools, Darktrace provides holistic autonomous AI defense, processing petabytes of the organization’s network traffic and investigating millions of individual events that could be indicative of a wider incident.

Today, Darktrace autonomously conducts the majority of all investigations on behalf of the IT team, escalating only a tiny fraction for analyst review. The impact has been profound, freeing analysts from endless alerts and hours of triage so they can focus on more valuable, proactive, and gratifying work.

“From an operational perspective, Darktrace gives us time back,” says the Cybersecurity Engineer. More importantly, says the VP of IT, “it gives us peace of mind that we’re protected even if we’re not actively monitoring every alert.”

A strategic input for M&A decision-making

One of the most strategic outcomes has been the role of cybersecurity on M&A. 90 days prior to closing a transaction, the security team uses Darktrace alongside other tools to perform a cyber risk assessment of the potential acquisition. “Our approach with Darktrace has consistently identified gaps and exposed risks,” says the VP of IT, including:

Remnants of previous incidents that were never fully remediated
Network configurations with direct internet exposure
Excessive administrative privileges in Active Directory or on critical hosts

While security findings may not alter deal timelines, the VP of IT says they can have enormous business implications. “With early visibility into these risks, we can reduce exposure to inherited cyber threats, strengthen our position during negotiations, and establish clear remediation requirements.”

A security strategy built to evolve with the business

As the holding group expands its cloud footprint, it will extend Darktrace protections into Azure, applying the same AI-driven visibility and autonomous response to cloud workloads. The VP of IT says Darktrace's evolving capabilities will be instrumental in addressing the organization’s future cybersecurity needs and ability to adapt to the dynamic nature of cloud security.

“With Darktrace’s AI-driven approach, we have moved beyond reactive defense, establishing a resilient security foundation for confident expansion and modernization.”

‍

About the author

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Ivanti Sentry Vulnerability | Analysis & Insights

Ivanti Sentry Vulnerability | Analysis & Insights

Exploitation of Vulnerabilities in Ivanti Products

Observed Exploitation of CVE-2023-38035

Reconnaissance Activities

Crypto-Mining Activities

Appendices

MITRE ATT&CK Mapping

List of IoCs

References

Phantom Footprints: Tracking GhostSocks Malware

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

Enjoying the blog?

More in this series

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

Phantom Footprints: Tracking GhostSocks Malware

When Reality Diverges from the Playbook: Darktrace Identifies Encryption in a World Leaks Ransomware Attack

Blog

Network

April 2, 2026

How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience

How Chinese-nexus cyber threats have changed over time

How Darktrace analysts took a behavioral approach to a complex problem

What the data shows

Two models of cyber operations

Rethinking cyber risk

What comes next

Blog

Proactive Security

April 1, 2026

AI-powered security for a rapidly growing grocery enterprise

Protecting a complex, fast-growing retail organization

Closing critical visibility gaps with limited resources

Managing cyber risk in M&A

AI-driven security built for scale, speed, and resilience

Enterprise-wide visibility into traffic

Real-time threat containment, 24/7

Unified, actionable view of security ecosystem

From reactive defense to security at scale

Faster detection, faster resolution

Enterprise-grade protection with a lean team

A strategic input for M&A decision-making

A security strategy built to evolve with the business