November 13, 2024

Tactics Behind the Royal and Blacksuit Ransomware

Delve into the complexities of the Royal and Blacksuit ransomware strains and their implications for cybersecurity in today’s digital landscape.

Written by

Signe Zaharka

Principal Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Signe Zaharka

Principal Cyber Analyst

Nov 2024

What is BlackSuit Ransomware?

Since late 2023, Darktrace has detected BlackSuit ransomware infiltrating multiple customer networks in the US. This ransomware has targeted a wide range of industries, including arts, entertainment, real estate, public administration, defense, and social security.

Emerging in May 2023, BlackSuit is believed to be a spinoff of Royal ransomware due to similarities in code and Conti, and most likely consists of Russian and Eastern European hackers [1]. Recorded Future reported that the ransomware had affected 95 organizations worldwide, though the actual number is likely much higher [2]. While BlackSuit does not appear to focus on any particular sector, it has targeted multiple organizations in the healthcare, education, IT, government, retail and manufacturing industries [3]. Employing double extortion tactics, BlackSuit not only encrypts files but also steals sensitive data to leverage ransom payments.

BlackSuit has demanded over USD 500 million in ransoms, with the highest individual demand reaching USD 60 million [4]. Notable targets include CDK Global, Japanese media conglomerate Kadokawa, multiple educational institutions, Octapharma Plasma, and the government of Brazil [5][6][7][8].

Darktrace’s Coverage of BlackSuit Ransomware Attack

Case 1, November 2023

The earliest attack on a Darktrace customer by BlackSuit was detected at the start of November 2023. The unusual network activity began on a weekend—a time commonly chosen by ransomware groups to increase their chances of success, as many security teams operate with reduced staff. Darktrace identified indicators of the attackers’ presence on the network for almost two weeks, during which a total of 15 devices exhibited suspicious behavior.

The attack commenced with unusual internal SMB (Server Message Block) connections using a compromised service account. An internal device uploaded an executable (zzza.exe) to a domain controller (DC) and shortly after, wrote a script (socks5.ps1) to another device. According to a Cybersecurity Advisory from the CISA (Cybersecurity and Infrastructure Security Agency, US), the script file was a PowerShell reverse proxy [9].

Approximately an hour and a half later, the device to which the script was written exhibited uncommon WMI (Windows Management Instrumentation) activity. Two hours after receiving the executable file, the DC was observed making an outgoing NTLM request, using PowerShell to remotely execute commands, distributing differently named executable files (<PART OF THE CUSTOMER’S NAME>.exe), and controlling services on other devices.

Eighteen hours after the start of the unusual activity, Darktrace detected another device making repeated connections to “mystuff.bublup[.]com”, which the aforementioned CISA Advisory identifies as a domain used by BlackSuit for data exfiltration [9].

About ten minutes after the suspicious executables were distributed across the network, and less than 24 hours after the start of the unusual activity, file encryption began. A total of ten devices were seen appending the “.blacksuit” extension to files saved on other devices using SMB, as well as writing ransom notes (readme.blacksuit.txt). The file encryption lasted less than 20 minutes.

Figure 1: An example of the contents of a BlackSuit ransom note being written over SMB.

During this compromise, external connections to endpoints related to ConnectWise’s ScreenConnect remote management tool were also seen from multiple servers, suggesting that the tool was likely being abused for command-and-control (C2) activity. Darktrace identified anomalous connectivity associated with ScreenConnect was seen up to 11 days after the start of the attack.

10 days after the start of the compromise, an account belonging to a manager was detected adding “.blacksuit” extensions to the customer’s Software-a-Service (SaaS) resources while connecting from 173.251.109[.]106. Six minutes after file encryption began, Darktrace flagged the unusual activity and recommended a block. However, since Autonomous Response mode was not enabled, the customer’s security team needed to manually confirm the action. Consequently, suspicious activity continued for about a week after the initial encryption. This included disabling authentication on the account and an unusual Teams session initiated from the suspicious external endpoint 216.151.180[.]147.

Case 2, February 2024

Another BlackSuit compromise occurred at the start of February 2024, when Darktrace identified approximately 50 devices exhibiting ransomware-related activity in another US customer’s environment. Further investigation revealed that a significant number of additional devices had also been compromised. These devices were outside Darktrace’s purview to the customer’s specific deployment configuration. The threat actors managed to exfiltrate around 4 TB of data.

Initial access to the network was gained via a virtual private network (VPN) compromise in January 2024, when suspicious connections from a Romanian IP address were detected. According to CISA, the BlackSuit group often utilizes the services of initial access brokers (IAB)—actors who specialize in infiltrating networks, such as through VPNs, and then selling that unauthorized access to other threat actors [9]. Other initial access vectors include phishing emails, RDP (Remote Desktop Protocol) compromise, and exploitation of vulnerable public-facing applications.

Similar to the first case, the file encryption began at the end of the working week. During this phase of the attack, affected devices were observed encrypting files on other internal devices using two compromised administrator accounts. The encryption activity lasted for approximately six and a half hours. Multiple alerts were sent to the customer from Darktrace’s Security Operations Centre (SOC) team, who began reviewing the activity within four minutes of the start of the file encryption.

Figure 2: Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.

Figure 3: A spike in model alerts on the day when file encryption by BlackSuit was observed in the network.

In this case, the threat actor utilized SystemBC proxy malware for command and control (C2). A domain controller (DC) was seen connecting to 137.220.61[.]94 on the same day the file encryption took place. The DC was also observed connecting to a ProxyScrape domain around the same time, which is related to the SOCKS5 protocol used by SystemBC. During this compromise, RDP, SSH, and SMB were used for lateral movement within the network.

Figure 4: A Cyber AI Analyst investigation alerting to a device on the VPN subnet making suspicious internal SSH connections due to malicious actors moving laterally within the network.

Signs of threat actors potentially being on the network were observed as early as two days prior to the file encryption. This included unusual internal network scanning via multiple protocols (ICMP, SMB, RDP, etc.), credential brute-forcing, SMB access failures, and anonymous SMBv1 sessions. These activities were traced to IP addresses belonging to two desktop devices in the VPN subnet associated with two regular employee user accounts. Threat actors were seemingly able to exploit at least one of these accounts due to LDAP legacy policies being in place on the customer’s environment.

Figure 5: A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.

Figure 6: Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.

Case 3, August 2024

The most recently observed BlackSuit compromise occurred in August 2024, when a device was observed attempting to brute-force the credentials of an IT administrator. This activity continued for 11 days.

Once the admin’s account was successfully compromised, network scanning, unusual WMI, and SAMR (Security Account Manager Remote protocol) activity followed. A spike in the use of this account was detected on a Sunday—once again, the attackers seemingly targeting the weekend—when the account was used by nearly 50 different devices.

The compromised admin’s account was exploited for data gathering via SMB, resulting in the movement of 200 GB of data between internal devices in preparation for exfiltration. The files were then archived using the naming convention “*.part<number>.rar”.

Around the same time, Darktrace observed data transfers from 19 internal devices to “bublup-media-production.s3.amazonaws[.]com,” totaling just over 200 GB—the same volume of data gathered internally. Connections to other Bublup domains were also detected. The internal data download and external data transfer activity took approximately 8-9 hours.

Unfortunately, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning any mitigative actions to stop the data gathering or exfiltration required human confirmation.

One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours. — Figure 7: One of the compromised devices was seen sending 80 GB of data to **bublup-media-production.s3.amazonaws[.]com** within a span of 4 hours.

Once the information was stolen, the threat actor moved on to the final stage of the attack—file encryption. Five internal devices, using either the compromised admin account or connecting via anonymous SMBv1 sessions, were seen encrypting files and writing ransom notes to five other devices on the network. The attempts at file encryption continued for around two hours, but Darktrace’s Autonomous Response capability was able to block the activity and prevent the attack from escalating.

Conclusion

The persistent and evolving threat posed by ransomware like BlackSuit underscores the critical importance of robust cybersecurity measures across all sectors. Since its emergence in 2023, BlackSuit has demonstrated a sophisticated approach to infiltrating networks, leveraging double extortion tactics, and demanding substantial ransoms. The cases highlighted above illustrate the varied methods and persistence of BlackSuit attackers, from exploiting VPN vulnerabilities to abusing remote management tools and targeting off-hours to maximize impact.

Although many similar connection patterns, such as the abuse of Bublup services for data exfiltration or the use of SOCKS5 proxies for C2, were observed during cases investigated by Darktrace, BlackSuit actors are highly sophisticated and tailors their attacks to each target organization. The consequences of a successful attack can be highly disruptive, and remediation efforts can be time-consuming and costly. This includes taking the entire network offline while responding to the incident, restoring encrypted files from backups (if available), dealing with damage to the organization’s reputation, and potential lawsuits.

These BlackSuit ransomware incidents emphasize the need for continuous vigilance, timely updates to security protocols, and the adoption of autonomous response technologies to swiftly counteract such attacks. As ransomware tactics continue to evolve, organizations must remain agile and informed to protect their critical assets and data. By learning from these incidents and enhancing their cybersecurity frameworks, organizations can better defend against the relentless threat of ransomware and ensure the resilience of their operations in an increasingly digital world.

Credit to Signe Zaharka (Principal Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

Insights from Darktrace’s First 6: Half-year threat report for 2024

First 6: half year threat report darktrace screenshot

Darktrace’s First 6: Half-Year Threat Report 2024 highlights the latest attack trends and key threats observed by the Darktrace Threat Research team in the first six months of 2024.

Focuses on anomaly detection and behavioral analysis to identify threats
Maps mitigated cases to known, publicly attributed threats for deeper context
Offers guidance on improving security posture to defend against persistent threats

‍

Appendices

Darktrace Model Detections

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / High Volume of New or Uncommon Service Control

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / Rare WinRM Outgoing

Anomalous Connection / SMB Enumeration

Anomalous Connection / Suspicious Activity On High Risk Device

Anomalous Connection / Suspicious Read Write Ratio

Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB

Anomalous Connection / Sustained MIME Type Conversion

Anomalous Connection / Uncommon 1 GiB Outbound

Anomalous Connection / Unusual Admin SMB Session

Anomalous File / Internal / Additional Extension Appended to SMB File

Anomalous File / Internal / Executable Uploaded to DC

Anomalous File / Internal / Unusual SMB Script Write

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous Server Activity / Outgoing from Server

Anomalous Server Activity / Rare External from Server

Anomalous Server Activity / Write to Network Accessible WebRoot

Compliance / Outgoing NTLM Request from DC

Compliance / Remote Management Tool On Server

Compliance / SMB Drive Write

Compromise / Beacon to Young Endpoint

Compromise / Beaconing Activity To External Rare

Compromise / Ransomware / Possible Ransom Note Read

Compromise / Ransomware / Possible Ransom Note Write

Compromise / Ransomware / SMB Reads then Writes with Additional Extensions

Compromise / Ransomware / Suspicious SMB Activity

Device / Anomalous RDP Followed By Multiple Model Breaches

Device / EXE Files Distributed to Multiple Devices

Device / Internet Facing Device with High Priority Alert

Device / Large Number of Model Breaches

Device / Large Number of Model Breaches from Critical Network Device

Device / Multiple Lateral Movement Model Breaches

Device / Network Scan

Device / New or Uncommon WMI Activity

Device / New or Unusual Remote Command Execution

Device / New User Agent To Internal Server

Device / SMB Lateral Movement

Device / SMB Session Brute Force (Admin)

Device / Suspicious SMB Scanning Activity

Device / Unusual LDAP Query For Domain Admins

SaaS / Access / Teams Activity from Rare Endpoint

SaaS / Resource / SaaS Resources With Additional Extensions

SaaS / Unusual Activity / Disabled Strong Authentication

SaaS / Unusual Activity / Multiple Unusual SaaS Activity Scores

SaaS / Unusual Activity / Unusual SaaS Activity Score

SaaS / Unusual Activity / Unusual Volume of SaaS Modifications

Unusual Activity / Anomalous SMB Delete Volume

Unusual Activity / Anomalous SMB Move & Write

Unusual Activity / High Volume Client Data Transfer

Unusual Activity / High Volume Server Data Transfer

Unusual Activity / Internal Data Transfer

Unusual Activity / SMB Access Failures

Unusual Activity / Sustained Anomalous SMB Activity

Unusual Activity / Unusual External Data to New Endpoint

User / New Admin Credentials on Client

User / New Admin Credentials on Server

User/ Kerberos Password Bruteforce

Autonomous Response Models

Antigena / Network / External Threat / Antigena File then New Outbound Block

Antigena / Network / External Threat / Antigena Ransomware Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

Antigena / Network / External Threat / SMB Ratio Antigena Block

Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity

Antigena / Network / Insider Threat / Antigena Internal Data Transfer Block

Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block

Antigena / Network / Insider Threat / Antigena Network Scan Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Pattern of Life Block

Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block

Antigena / Network / Significant Anomaly / Repeated Antigena Breaches

Antigena / SaaS / Antigena Unusual Activity Block

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

.blacksuit - File extension – When encrypting the files, this extension is appended to the filename – High

readme.blacksuit.txt – ransom note - A file demanding cryptocurrency payment in exchange for decrypting the victim's files and not leaking the stolen data – High

mystuff.bublup[.]com, bublup-media-production.s3.amazonaws[.]com – data exfiltration domains related to an organization and project management app that has document sharing functionality – High

137.220.61[.]94:4001 – SystemBC C2 related IP address (this tool is often used by other ransomware groups as well) - Medium

173.251.109[.]106 – IP address seen during a SaaS BlackSuit compromise (during file encryption) – Medium

216.151.180[.]147 – IP address seen during a SaaS BlackSuit compromise (during an unusual Teams session) - Medium

MITRE ATT&CK Mapping

Tactic - Technqiue

Account Manipulation - PERSISTENCE - T1098

Alarm Suppression - INHIBIT RESPONSE FUNCTION - T0878

Application Layer Protocol - COMMAND AND CONTROL - T1071

Automated Collection - COLLECTION - T1119

Block Command Message - INHIBIT RESPONSE FUNCTION - T0803

Block Reporting Message - INHIBIT RESPONSE FUNCTION - T0804

Browser Extensions - PERSISTENCE - T1176

Brute Force I/O - IMPAIR PROCESS CONTROL - T0806

Brute Force - CREDENTIAL ACCESS - T1110

Client Configurations - RECONNAISSANCE - T1592.004 - T1592

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Data Destruction - IMPACT - T1485

Data Destruction - INHIBIT RESPONSE FUNCTION - T0809

Data Encrypted for Impact - IMPACT - T1486

Data from Cloud Storage Object - COLLECTION - T1530

Data Staged - COLLECTION - T1074

Domain Groups - DISCOVERY - T1069.002 - T1069

Email Collection - COLLECTION - T1114

Exfiltration Over C2 Channel - EXFILTRATION - T1041

Exfiltration to Cloud Storage - EXFILTRATION - T1567.002 - T1567

Exploit Public - Facing Application - INITIAL ACCESS - T1190

Exploitation for Privilege Escalation - PRIVILEGE ESCALATION - T0890

Exploitation of Remote Services - LATERAL MOVEMENT - T1210

File and Directory Discovery - DISCOVERY - T1083

File Deletion - DEFENSE EVASION - T1070.004 - T1070

IP Addresses - RECONNAISSANCE - T1590.005 - T1590

Lateral Tool Transfer - LATERAL MOVEMENT - T1570

LLMNR/NBT - NS Poisoning and SMB Relay - CREDENTIAL ACCESS, COLLECTION - T1557.001 - T1557

Modify Alarm Settings - INHIBIT RESPONSE FUNCTION - T0838

Modify Control Logic - IMPAIR PROCESS CONTROL, INHIBIT RESPONSE FUNCTION - T0833

Modify Parameter - IMPAIR PROCESS CONTROL - T0836

Network Service Scanning - DISCOVERY - T1046

Network Share Discovery - DISCOVERY - T1135

Pass the Hash - DEFENSE EVASION, LATERAL MOVEMENT - T1550.002 - T1550

RDP Hijacking - LATERAL MOVEMENT - T1563.002 - T1563

Remote Access Software - COMMAND AND CONTROL - T1219

Remote Desktop Protocol - LATERAL MOVEMENT - T1021.001 - T1021

Remote System Discovery - DISCOVERY - T1018

Rename System Utilities - DEFENSE EVASION - T1036.003 - T1036

Scanning IP Blocks - RECONNAISSANCE - T1595.001 - T1595

Scheduled Transfer - EXFILTRATION - T1029

Service Execution - EXECUTION - T1569.002 - T1569

Service Stop - IMPACT - T1489

SMB/Windows Admin Shares - LATERAL MOVEMENT - T1021.002 - T1021

Stored Data Manipulation - IMPACT - T1565.001 - T1565

Taint Shared Content - LATERAL MOVEMENT - T1080

Valid Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078

Vulnerability Scanning - RECONNAISSANCE - T1595.002 - T1595

Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071

Web Services - RESOURCE DEVELOPMENT - T1583.006 - T1583

Web Shell - PERSISTENCE - T1505.003 - T1505

Windows Management Instrumentation - EXECUTION - T1047

Windows Remote Management - LATERAL MOVEMENT - T1021.006 - T1021

References

1. https://www.trendmicro.com/en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal.html

2. https://www.reuters.com/technology/cybersecurity/blacksuit-hacker-behind-cdk-global-attack-hitting-us-car-dealers-2024-06-27/

3. https://www.sentinelone.com/anthology/blacksuit/

4. https://thehackernews.com/2024/08/fbi-and-cisa-warn-of-blacksuit.html

5. https://www.techtarget.com/whatis/feature/The-CDK-Global-outage-Explaining-how-it-happened

6. https://therecord.media/japanese-media-kadokawa-investigating-cyber

7. https://therecord.media/plasma-donation-company-cyberattack-blacksuit

8. https://thecyberexpress.com/government-of-brazil-cyberattack-by-blacksuit/

9. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Written by

Signe Zaharka

Principal Cyber Analyst

Inside the SOC

Written by

Signe Zaharka

Principal Cyber Analyst

Product Marketing Manager, AI & Attack Surface

Watch the NIS2 Webinar

Blog

AI

December 23, 2025

How to Secure AI in the Enterprise: A Practical Framework for Models, Data, and Agents

Introduction: Why securing AI is now a security priority

AI adoption is at the forefront of the digital movement in businesses, outpacing the rate at which IT and security professionals can set up governance models and security parameters. Adopting Generative AI chatbots, autonomous agents, and AI-enabled SaaS tools promises efficiency and speed but also introduces new forms of risk that traditional security controls were never designed to manage. For many organizations, the first challenge is not whether AI should be secured, but what “securing AI” actually means in practice. Is it about protecting models? Governing data? Monitoring outputs? Or controlling how AI agents behave once deployed?

While demand for adoption increases, securing AI use in the enterprise is still an abstract concept to many and operationalizing its use goes far beyond just having visibility. Practitioners need to also consider how AI is sourced, built, deployed, used, and governed across the enterprise.

The goal for security teams: Implement a clear, lifecycle-based AI security framework. This blog will demonstrate the variety of AI use cases that should be considered when developing this framework and how to frame this conversation to non-technical audiences.

What does “securing AI” actually mean?

Securing AI is often framed as an extension of existing security disciplines. In practice, this assumption can cause confusion.

Traditional security functions are built around relatively stable boundaries. Application security focuses on code and logic. Cloud security governs infrastructure and identity. Data security protects sensitive information at rest and in motion. Identity security controls who can access systems and services. Each function has clear ownership, established tooling, and well-understood failure modes.

AI does not fit neatly into any of these categories. An AI system is simultaneously:

An application that executes logic
A data processor that ingests and generates sensitive information
A decision-making layer that influences or automates actions
A dynamic system that changes behavior over time

As a result, the security risks introduced by AI cuts across multiple domains at once. A single AI interaction can involve identity misuse, data exposure, application logic abuse, and supply chain risk all within the same workflow. This is where the traditional lines between security functions begin to blur.

For example, a malicious prompt submitted by an authorized user is not a classic identity breach, yet it can trigger data leakage or unauthorized actions. An AI agent calling an external service may appear as legitimate application behavior, even as it violates data sovereignty or compliance requirements. AI-generated code may pass standard development checks while introducing subtle vulnerabilities or compromised dependencies.

In each case, no single security team “owns” the risk outright.

This is why securing AI cannot be reduced to model safety, governance policies, or perimeter controls alone. It requires a shared security lens that spans development, operations, data handling, and user interaction. Securing AI means understanding not just whether systems are accessed securely, but whether they are being used, trained, and allowed to act in ways that align with business intent and risk tolerance.

At its core, securing AI is about restoring clarity in environments where accountability can quickly blur. It is about knowing where AI exists, how it behaves, what it is allowed to do, and how its decisions affect the wider enterprise. Without this clarity, AI becomes a force multiplier for both productivity and risk.

The five categories of AI risk in the enterprise

A practical way to approach AI security is to organize risk around how AI is used and where it operates. The framework below defines five categories of AI risk, each aligned to a distinct layer of the enterprise AI ecosystem

How to Secure AI in the Enterprise:

Defending against misuse and emergent behaviors
Monitoring and controlling AI in operation
Protecting AI development and infrastructure
Securing the AI supply chain
Strengthening readiness and oversight

Together, these categories provide a structured lens for understanding how AI risk manifests and where security teams should focus their efforts.

1. Defending against misuse and emergent AI behaviors

Generative AI systems and agents can be manipulated in ways that bypass traditional controls. Even when access is authorized, AI can be misused, repurposed, or influenced through carefully crafted prompts and interactions.

Key risks include:

Malicious prompt injection designed to coerce unwanted actions
Unauthorized or unintended use cases that bypass guardrails
Exposure of sensitive data through prompt histories
Hallucinated or malicious outputs that influence human behavior

Unlike traditional applications, AI systems can produce harmful outcomes without being explicitly compromised. Securing this layer requires monitoring intent, not just access. Security teams need visibility into how AI systems are being prompted, how outputs are consumed, and whether usage aligns with approved business purposes

2. Monitoring and controlling AI in operation

Once deployed, AI agents operate at machine speed and scale. They can initiate actions, exchange data, and interact with other systems with little human oversight. This makes runtime visibility critical.

Operational AI risks include:

Agents using permissions in unintended ways
Uncontrolled outbound connections to external services or agents
Loss of forensic visibility into ephemeral AI components
Non-compliant data transmission across jurisdictions

Securing AI in operation requires real-time monitoring of agent behavior, centralized control points such as AI gateways, and the ability to capture agent state for investigation. Without these capabilities, security teams may be blind to how AI systems behave once live, particularly in cloud-native or regulated environments.

3. Protecting AI development and infrastructure

Many AI risks are introduced long before deployment. Development pipelines, infrastructure configurations, and architectural decisions all influence the security posture of AI systems.

Common risks include:

Misconfigured permissions and guardrails
Insecure or overly complex agent architectures
Infrastructure-as-Code introducing silent misconfigurations
Vulnerabilities in AI-generated code and dependencies

AI-generated code adds a new dimension of risk, as hallucinated packages or insecure logic may be harder to detect and debug than human-written code. Securing AI development means applying security controls early, including static analysis, architectural review, and continuous configuration monitoring throughout the build process.

4. Securing the AI supply chain

AI supply chains are often opaque. Models, datasets, dependencies, and services may come from third parties with varying levels of transparency and assurance.

Key supply chain risks include:

Shadow AI tools used outside approved controls
External AI agents granted internal access
Suppliers applying AI to enterprise data without disclosure
Compromised models, training data, or dependencies

Securing the AI supply chain requires discovering where AI is used, validating the provenance and licensing of models and data, and assessing how suppliers process and protect enterprise information. Without this visibility, organizations risk data leakage, regulatory exposure, and downstream compromise through trusted integrations.

5. Strengthening readiness and oversight

Even with strong technical controls, AI security fails without governance, testing, and trained teams. AI introduces new incident scenarios that many security teams are not yet prepared to handle.

Oversight risks include:

Lack of meaningful AI risk reporting
Untested AI systems in production
Security teams untrained in AI-specific threats

Organizations need AI-aware reporting, red and purple team exercises that include AI systems, and ongoing training to build operational readiness. These capabilities ensure AI risks are understood, tested, and continuously improved, rather than discovered during a live incident.

Reframing AI security for the boardroom

AI security is not just a technical issue. It is a trust, accountability, and resilience issue. Boards want assurance that AI-driven decisions are reliable, explainable, and protected from tampering.

Effective communication with leadership focuses on:

Trust: confidence in data integrity, model behavior, and outputs
Accountability: clear ownership across teams and suppliers
Resilience: the ability to operate, audit, and adapt under attack or regulation

Mapping AI security efforts to recognized frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework helps demonstrate maturity and aligns AI security with broader governance objectives.

Conclusion: Securing AI is a lifecycle challenge

The same characteristics that make AI transformative also make it difficult to secure. AI systems blur traditional boundaries between software, users, and decision-making, expanding the attack surface in subtle but significant ways.

Securing AI requires restoring clarity. Knowing where AI exists, how it behaves, who controls it, and how it is governed. A framework-based approach allows organizations to innovate with AI while maintaining trust, accountability, and control.

The journey to secure AI is ongoing, but it begins with understanding the risks across the full AI lifecycle and building security practices that evolve alongside the technology.

About the author

Brittany Woodsmall

Product Marketing Manager, AI & Attack Surface

Blog

AI

December 22, 2025

The Year Ahead: AI Cybersecurity Trends to Watch in 2026

Introduction: 2026 cyber trends

Each year, we ask some of our experts to step back from the day-to-day pace of incidents, vulnerabilities, and headlines to reflect on the forces reshaping the threat landscape. The goal is simple: to identify and share the trends we believe will matter most in the year ahead, based on the real-world challenges our customers are facing, the technology and issues our R&D teams are exploring, and our observations of how both attackers and defenders are adapting.

In 2025, we saw generative AI and early agentic systems moving from limited pilots into more widespread adoption across enterprises. Generative AI tools became embedded in SaaS products and enterprise workflows we rely on every day, AI agents gained more access to data and systems, and we saw glimpses of how threat actors can manipulate commercial AI models for attacks. At the same time, expanding cloud and SaaS ecosystems and the increasing use of automation continued to stretch traditional security assumptions.

Looking ahead to 2026, we’re already seeing the security of AI models, agents, and the identities that power them becoming a key point of tension – and opportunity -- for both attackers and defenders. Long-standing challenges and risks such as identity, trust, data integrity, and human decision-making will not disappear, but AI and automation will increase the speed and scale of the cyber risk.

Here's what a few of our experts believe are the trends that will shape this next phase of cybersecurity, and the realities organizations should prepare for.

Agentic AI is the next big insider risk

‍In 2026, organizations may experience their first large-scale security incidents driven by agentic AI behaving in unintended ways—not necessarily due to malicious intent, but because of how easily agents can be influenced. AI agents are designed to be helpful, lack judgment, and operate without understanding context or consequence. This makes them highly efficient—and highly pliable. Unlike human insiders, agentic systems do not need to be socially engineered, coerced, or bribed. They only need to be prompted creatively, misinterpret legitimate prompts, or be vulnerable to indirect prompt injection. Without strong controls around access, scope, and behavior, agents may over-share data, misroute communications, or take actions that introduce real business risk. Securing AI adoption will increasingly depend on treating agents as first-class identities—monitored, constrained, and evaluated based on behavior, not intent.

-- Nicole Carignan, SVP of Security & AI Strategy ‍

Prompt Injection moves from theory to front-page breach

‍We’ll see the first major story of an indirect prompt injection attack against companies adopting AI either through an accessible chatbot or an agentic system ingesting a hidden prompt. In practice, this may result in unauthorized data exposure or unintended malicious behavior by AI systems, such as over-sharing information, misrouting communications, or acting outside their intended scope. Recent attention on this risk—particularly in the context of AI-powered browsers and additional safety layers being introduced to guide agent behavior—highlights a growing industry awareness of the challenge.

-- Collin Chapleau, Senior Director of Security & AI Strategy ‍

Humans are even more outpaced, but not broken

‍When it comes to cyber, people aren’t failing; the system is moving faster than they can. Attackers exploit the gap between human judgment and machine-speed operations. The rise of deepfakes and emotion-driven scams that we’ve seen in the last few years reduce our ability to spot the familiar human cues we’ve been taught to look out for. Fraud now spans social platforms, encrypted chat, and instant payments in minutes. Expecting humans to be the last line of defense is unrealistic.

Defense must assume human fallibility and design accordingly. Automated provenance checks, cryptographic signatures, and dual-channel verification should precede human judgment. Training still matters, but it cannot close the gap alone. In the year ahead, we need to see more of a focus on partnership: systems that absorb risk so humans make decisions in context, not under pressure.

-- Margaret Cunningham, VP of Security & AI Strategy

‍AI removes the attacker bottleneck—smaller organizations feel the impact

‍One factor that is currently preventing more companies from breaches is a bottleneck on the attacker side: there’s not enough human hacker capital. The number of human hands on a keyboard is a rate-determining factor in the threat landscape. Further advancements of AI and automation will continue to open that bottleneck. We are already seeing that. The ostrich approach of hoping that one’s own company is too obscure to be noticed by attackers will no longer work as attacker capacity increases.

-- Max Heinemeyer, Global Field CISO ‍

SaaS platforms become the preferred supply chain target

‍Attackers have learned a simple lesson: compromising SaaS platforms can have big payouts. As a result, we’ll see more targeting of commercial off-the-shelf SaaS providers, which are often highly trusted and deeply integrated into business environments. Some of these attacks may involve software with unfamiliar brand names, but their downstream impact will be significant. In 2026, expect more breaches where attackers leverage valid credentials, APIs, or misconfigurations to bypass traditional defenses entirely.

-- Nathaniel Jones, VP of Security & AI Strategy ‍

Increased commercialization of generative AI and AI assistants in cyber attacks

One trend we’re watching closely for 2026 is the commercialization of AI-assisted cybercrime. For example, cybercrime prompt playbooks sold on the dark web—essentially copy-and-paste frameworks that show attackers how to misuse or jailbreak AI models. It’s an evolution of what we saw in 2025, where AI lowered the barrier to entry. In 2026, those techniques become productized, scalable, and much easier to reuse.

-- Toby Lewis, Global Head of Threat Analysis

Conclusion

Taken together, these trends underscore that the core challenges of cybersecurity are not changing dramatically -- identity, trust, data, and human decision-making still sit at the core of most incidents. What is changing quickly is the environment in which these challenges play out. AI and automation are accelerating everything: how quickly attackers can scale, how widely risk is distributed, and how easily unintended behavior can create real impact. And as technology like cloud services and SaaS platforms become even more deeply integrated into businesses, the potential attack surface continues to expand.

Predictions are not guarantees. But the patterns emerging today suggest that 2026 will be a year where securing AI becomes inseparable from securing the business itself. The organizations that prepare now—by understanding how AI is used, how it behaves, and how it can be misused—will be best positioned to adopt these technologies with confidence in the year ahead.

Learn more about how to secure AI adoption in the enterprise without compromise by registering to join our live launch webinar on February 3, 2026.

About the author

The Darktrace Community

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Tactics Behind the Royal and Blacksuit Ransomware

What is BlackSuit Ransomware?

Darktrace’s Coverage of BlackSuit Ransomware Attack

Case 1, November 2023

Case 2, February 2024

Case 3, August 2024

Conclusion

Insights from Darktrace’s First 6: Half-year threat report for 2024

Appendices

Darktrace Model Detections

Autonomous Response Models

List of Indicators of Compromise (IoCs)

MITRE ATT&CK Mapping

References

Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

How to Secure AI in the Enterprise: A Practical Framework for Models, Data, and Agents

Enjoying the blog?

More in this series

React2Shell: How Opportunist Attackers Exploited CVE-2025-55182 Within Hours

Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System

Blog

AI

December 23, 2025

How to Secure AI in the Enterprise: A Practical Framework for Models, Data, and Agents

Introduction: Why securing AI is now a security priority

What does “securing AI” actually mean?

The five categories of AI risk in the enterprise

1. Defending against misuse and emergent AI behaviors

2. Monitoring and controlling AI in operation

3. Protecting AI development and infrastructure

4. Securing the AI supply chain

5. Strengthening readiness and oversight

Reframing AI security for the boardroom

Conclusion: Securing AI is a lifecycle challenge

Blog

AI

December 22, 2025

The Year Ahead: AI Cybersecurity Trends to Watch in 2026

Introduction: 2026 cyber trends

Agentic AI is the next big insider risk

Prompt Injection moves from theory to front-page breach

Humans are even more outpaced, but not broken

‍AI removes the attacker bottleneck—smaller organizations feel the impact

SaaS platforms become the preferred supply chain target

Increased commercialization of generative AI and AI assistants in cyber attacks

Conclusion