Blog
/
Network
/
November 13, 2024

Tactics Behind the Royal and Blacksuit Ransomware

Delve into the complexities of the Royal and Blacksuit ransomware strains and their implications for cybersecurity in today’s digital landscape.
Written by
Signe Zaharka
Principal Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Signe Zaharka
Principal Cyber Analyst
Default blog image
13
Nov 2024

What is BlackSuit Ransomware?

Since late 2023, Darktrace has detected BlackSuit ransomware infiltrating multiple customer networks in the US. This ransomware has targeted a wide range of industries, including arts, entertainment, real estate, public administration, defense, and social security.

Emerging in May 2023, BlackSuit is believed to be a spinoff of Royal ransomware due to similarities in code and Conti, and most likely consists of Russian and Eastern European hackers [1]. Recorded Future reported that the ransomware had affected 95 organizations worldwide, though the actual number is likely much higher [2]. While BlackSuit does not appear to focus on any particular sector, it has targeted multiple organizations in the healthcare, education, IT, government, retail and manufacturing industries [3]. Employing double extortion tactics, BlackSuit not only encrypts files but also steals sensitive data to leverage ransom payments.

BlackSuit has demanded over USD 500 million in ransoms, with the highest individual demand reaching USD 60 million [4]. Notable targets include CDK Global, Japanese media conglomerate Kadokawa, multiple educational institutions, Octapharma Plasma, and the government of Brazil [5][6][7][8].

Darktrace’s Coverage of BlackSuit Ransomware Attack

Case 1, November 2023

The earliest attack on a Darktrace customer by BlackSuit was detected at the start of November 2023. The unusual network activity began on a weekend—a time commonly chosen by ransomware groups to increase their chances of success, as many security teams operate with reduced staff. Darktrace identified indicators of the attackers’ presence on the network for almost two weeks, during which a total of 15 devices exhibited suspicious behavior.

The attack commenced with unusual internal SMB (Server Message Block) connections using a compromised service account. An internal device uploaded an executable (zzza.exe) to a domain controller (DC) and shortly after, wrote a script (socks5.ps1) to another device. According to a Cybersecurity Advisory from the CISA (Cybersecurity and Infrastructure Security Agency, US), the script file was a PowerShell reverse proxy [9].

Approximately an hour and a half later, the device to which the script was written exhibited uncommon WMI (Windows Management Instrumentation) activity. Two hours after receiving the executable file, the DC was observed making an outgoing NTLM request, using PowerShell to remotely execute commands, distributing differently named executable files (<PART OF THE CUSTOMER’S NAME>.exe), and controlling services on other devices.

Eighteen hours after the start of the unusual activity, Darktrace detected another device making repeated connections to “mystuff.bublup[.]com”, which the aforementioned CISA Advisory identifies as a domain used by BlackSuit for data exfiltration [9].

About ten minutes after the suspicious executables were distributed across the network, and less than 24 hours after the start of the unusual activity, file encryption began. A total of ten devices were seen appending the “.blacksuit” extension to files saved on other devices using SMB, as well as writing ransom notes (readme.blacksuit.txt). The file encryption lasted less than 20 minutes.

An example of the contents of a BlackSuit ransom note being written over SMB.
Figure 1: An example of the contents of a BlackSuit ransom note being written over SMB.

During this compromise, external connections to endpoints related to ConnectWise’s ScreenConnect remote management tool were also seen from multiple servers, suggesting that the tool was likely being abused for command-and-control (C2) activity. Darktrace identified anomalous connectivity associated with ScreenConnect was seen up to 11 days after the start of the attack.

10 days after the start of the compromise, an account belonging to a manager was detected adding “.blacksuit” extensions to the customer’s Software-a-Service (SaaS) resources while connecting from 173.251.109[.]106. Six minutes after file encryption began, Darktrace flagged the unusual activity and recommended a block. However, since Autonomous Response mode was not enabled, the customer’s security team needed to manually confirm the action. Consequently, suspicious activity continued for about a week after the initial encryption. This included disabling authentication on the account and an unusual Teams session initiated from the suspicious external endpoint 216.151.180[.]147.

Case 2, February 2024

Another BlackSuit compromise occurred at the start of February 2024, when Darktrace identified approximately 50 devices exhibiting ransomware-related activity in another US customer’s environment. Further investigation revealed that a significant number of additional devices had also been compromised. These devices were outside Darktrace’s purview to the customer’s specific deployment configuration. The threat actors managed to exfiltrate around 4 TB of data.

Initial access to the network was gained via a virtual private network (VPN) compromise in January 2024, when suspicious connections from a Romanian IP address were detected. According to CISA, the BlackSuit group often utilizes the services of initial access brokers (IAB)—actors who specialize in infiltrating networks, such as through VPNs, and then selling that unauthorized access to other threat actors [9]. Other initial access vectors include phishing emails, RDP (Remote Desktop Protocol) compromise, and exploitation of vulnerable public-facing applications.

Similar to the first case, the file encryption began at the end of the working week. During this phase of the attack, affected devices were observed encrypting files on other internal devices using two compromised administrator accounts. The encryption activity lasted for approximately six and a half hours. Multiple alerts were sent to the customer from Darktrace’s Security Operations Centre (SOC) team, who began reviewing the activity within four minutes of the start of the file encryption.

Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 2: Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 3: A spike in model alerts on the day when file encryption by BlackSuit was observed in the network.

In this case, the threat actor utilized SystemBC proxy malware for command and control (C2). A domain controller (DC) was seen connecting to 137.220.61[.]94 on the same day the file encryption took place. The DC was also observed connecting to a ProxyScrape domain around the same time, which is related to the SOCKS5 protocol used by SystemBC. During this compromise, RDP, SSH, and SMB were used for lateral movement within the network.

Figure 4: A Cyber AI Analyst investigation alerting to a device on the VPN subnet making suspicious internal SSH connections due to malicious actors moving laterally within the network.

Signs of threat actors potentially being on the network were observed as early as two days prior to the file encryption. This included unusual internal network scanning via multiple protocols (ICMP, SMB, RDP, etc.), credential brute-forcing, SMB access failures, and anonymous SMBv1 sessions. These activities were traced to IP addresses belonging to two desktop devices in the VPN subnet associated with two regular employee user accounts. Threat actors were seemingly able to exploit at least one of these accounts due to LDAP legacy policies being in place on the customer’s environment.

A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Figure 5: A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.
Figure 6: Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.

Case 3, August 2024

The most recently observed BlackSuit compromise occurred in August 2024, when a device was observed attempting to brute-force the credentials of an IT administrator. This activity continued for 11 days.

Once the admin’s account was successfully compromised, network scanning, unusual WMI, and SAMR (Security Account Manager Remote protocol) activity followed. A spike in the use of this account was detected on a Sunday—once again, the attackers seemingly targeting the weekend—when the account was used by nearly 50 different devices.

The compromised admin’s account was exploited for data gathering via SMB, resulting in the movement of 200 GB of data between internal devices in preparation for exfiltration. The files were then archived using the naming convention “*.part<number>.rar”.

Around the same time, Darktrace observed data transfers from 19 internal devices to “bublup-media-production.s3.amazonaws[.]com,” totaling just over 200 GB—the same volume of data gathered internally. Connections to other Bublup domains were also detected. The internal data download and external data transfer activity took approximately 8-9 hours.

Unfortunately, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning any mitigative actions to stop the data gathering or exfiltration required human confirmation.  

One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.
Figure 7: One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.

Once the information was stolen, the threat actor moved on to the final stage of the attack—file encryption. Five internal devices, using either the compromised admin account or connecting via anonymous SMBv1 sessions, were seen encrypting files and writing ransom notes to five other devices on the network. The attempts at file encryption continued for around two hours, but Darktrace’s Autonomous Response capability was able to block the activity and prevent the attack from escalating.

Conclusion

The persistent and evolving threat posed by ransomware like BlackSuit underscores the critical importance of robust cybersecurity measures across all sectors. Since its emergence in 2023, BlackSuit has demonstrated a sophisticated approach to infiltrating networks, leveraging double extortion tactics, and demanding substantial ransoms. The cases highlighted above illustrate the varied methods and persistence of BlackSuit attackers, from exploiting VPN vulnerabilities to abusing remote management tools and targeting off-hours to maximize impact.

Although many similar connection patterns, such as the abuse of Bublup services for data exfiltration or the use of SOCKS5 proxies for C2, were observed during cases investigated by Darktrace, BlackSuit actors are highly sophisticated and tailors their attacks to each target organization. The consequences of a successful attack can be highly disruptive, and remediation efforts can be time-consuming and costly. This includes taking the entire network offline while responding to the incident, restoring encrypted files from backups (if available), dealing with damage to the organization’s reputation, and potential lawsuits.

These BlackSuit ransomware incidents emphasize the need for continuous vigilance, timely updates to security protocols, and the adoption of autonomous response technologies to swiftly counteract such attacks. As ransomware tactics continue to evolve, organizations must remain agile and informed to protect their critical assets and data. By learning from these incidents and enhancing their cybersecurity frameworks, organizations can better defend against the relentless threat of ransomware and ensure the resilience of their operations in an increasingly digital world.

Credit to Signe Zaharka (Principal Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

Insights from Darktrace’s First 6: Half-year threat report for 2024

First 6: half year threat report darktrace screenshot

Darktrace’s First 6: Half-Year Threat Report 2024 highlights the latest attack trends and key threats observed by the Darktrace Threat Research team in the first six months of 2024.

  • Focuses on anomaly detection and behavioral analysis to identify threats
  • Maps mitigated cases to known, publicly attributed threats for deeper context
  • Offers guidance on improving security posture to defend against persistent threats

‍

‍

Appendices

Darktrace Model Detections

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / High Volume of New or Uncommon Service Control

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / Rare WinRM Outgoing

Anomalous Connection / SMB Enumeration

Anomalous Connection / Suspicious Activity On High Risk Device

Anomalous Connection / Suspicious Read Write Ratio

Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB

Anomalous Connection / Sustained MIME Type Conversion

Anomalous Connection / Uncommon 1 GiB Outbound

Anomalous Connection / Unusual Admin SMB Session

Anomalous File / Internal / Additional Extension Appended to SMB File

Anomalous File / Internal / Executable Uploaded to DC

Anomalous File / Internal / Unusual SMB Script Write

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous Server Activity / Outgoing from Server

Anomalous Server Activity / Rare External from Server

Anomalous Server Activity / Write to Network Accessible WebRoot

Compliance / Outgoing NTLM Request from DC

Compliance / Remote Management Tool On Server

Compliance / SMB Drive Write

Compromise / Beacon to Young Endpoint

Compromise / Beaconing Activity To External Rare

Compromise / Ransomware / Possible Ransom Note Read

Compromise / Ransomware / Possible Ransom Note Write

Compromise / Ransomware / SMB Reads then Writes with Additional Extensions

Compromise / Ransomware / Suspicious SMB Activity

Device / Anomalous RDP Followed By Multiple Model Breaches

Device / EXE Files Distributed to Multiple Devices

Device / Internet Facing Device with High Priority Alert

Device / Large Number of Model Breaches

Device / Large Number of Model Breaches from Critical Network Device

Device / Multiple Lateral Movement Model Breaches

Device / Network Scan

Device / New or Uncommon WMI Activity

Device / New or Unusual Remote Command Execution

Device / New User Agent To Internal Server

Device / SMB Lateral Movement

Device / SMB Session Brute Force (Admin)

Device / Suspicious SMB Scanning Activity

Device / Unusual LDAP Query For Domain Admins

SaaS / Access / Teams Activity from Rare Endpoint

SaaS / Resource / SaaS Resources With Additional Extensions

SaaS / Unusual Activity / Disabled Strong Authentication

SaaS / Unusual Activity / Multiple Unusual SaaS Activity Scores

SaaS / Unusual Activity / Unusual SaaS Activity Score

SaaS / Unusual Activity / Unusual Volume of SaaS Modifications

Unusual Activity / Anomalous SMB Delete Volume

Unusual Activity / Anomalous SMB Move & Write

Unusual Activity / High Volume Client Data Transfer

Unusual Activity / High Volume Server Data Transfer

Unusual Activity / Internal Data Transfer

Unusual Activity / SMB Access Failures

Unusual Activity / Sustained Anomalous SMB Activity

Unusual Activity / Unusual External Data to New Endpoint

User / New Admin Credentials on Client

User / New Admin Credentials on Server

User/ Kerberos Password Bruteforce

Autonomous Response Models

Antigena / Network / External Threat / Antigena File then New Outbound Block

Antigena / Network / External Threat / Antigena Ransomware Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

Antigena / Network / External Threat / SMB Ratio Antigena Block

Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity

Antigena / Network / Insider Threat / Antigena Internal Data Transfer Block

Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block

Antigena / Network / Insider Threat / Antigena Network Scan Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Block

Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Pattern of Life Block

Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block

Antigena / Network / Significant Anomaly / Repeated Antigena Breaches

Antigena / SaaS / Antigena Unusual Activity Block

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

.blacksuit - File extension – When encrypting the files, this extension is appended to the filename – High

readme.blacksuit.txt – ransom note - A file demanding cryptocurrency payment in exchange for decrypting the victim's files and not leaking the stolen data – High

mystuff.bublup[.]com, bublup-media-production.s3.amazonaws[.]com – data exfiltration domains related to an organization and project management app that has document sharing functionality – High

137.220.61[.]94:4001 – SystemBC C2 related IP address (this tool is often used by other ransomware groups as well) - Medium

173.251.109[.]106 – IP address seen during a SaaS BlackSuit compromise (during file encryption) – Medium

216.151.180[.]147 – IP address seen during a SaaS BlackSuit compromise (during an unusual Teams session) - Medium

MITRE ATT&CK Mapping

Tactic - Technqiue

Account Manipulation - PERSISTENCE - T1098

Alarm Suppression - INHIBIT RESPONSE FUNCTION - T0878

Application Layer Protocol - COMMAND AND CONTROL - T1071

Automated Collection - COLLECTION - T1119

Block Command Message - INHIBIT RESPONSE FUNCTION - T0803

Block Reporting Message - INHIBIT RESPONSE FUNCTION - T0804

Browser Extensions - PERSISTENCE - T1176

Brute Force I/O - IMPAIR PROCESS CONTROL - T0806

Brute Force - CREDENTIAL ACCESS - T1110

Client Configurations - RECONNAISSANCE - T1592.004 - T1592

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Data Destruction - IMPACT - T1485

Data Destruction - INHIBIT RESPONSE FUNCTION - T0809

Data Encrypted for Impact - IMPACT - T1486

Data from Cloud Storage Object - COLLECTION - T1530

Data Staged - COLLECTION - T1074

Domain Groups - DISCOVERY - T1069.002 - T1069

Email Collection - COLLECTION - T1114

Exfiltration Over C2 Channel - EXFILTRATION - T1041

Exfiltration to Cloud Storage - EXFILTRATION - T1567.002 - T1567

Exploit Public - Facing Application - INITIAL ACCESS - T1190

Exploitation for Privilege Escalation - PRIVILEGE ESCALATION - T0890

Exploitation of Remote Services - LATERAL MOVEMENT - T1210

File and Directory Discovery - DISCOVERY - T1083

File Deletion - DEFENSE EVASION - T1070.004 - T1070

IP Addresses - RECONNAISSANCE - T1590.005 - T1590

Lateral Tool Transfer - LATERAL MOVEMENT - T1570

LLMNR/NBT - NS Poisoning and SMB Relay - CREDENTIAL ACCESS, COLLECTION - T1557.001 - T1557

Modify Alarm Settings - INHIBIT RESPONSE FUNCTION - T0838

Modify Control Logic - IMPAIR PROCESS CONTROL, INHIBIT RESPONSE FUNCTION - T0833

Modify Parameter - IMPAIR PROCESS CONTROL - T0836

Network Service Scanning - DISCOVERY - T1046

Network Share Discovery - DISCOVERY - T1135

Pass the Hash - DEFENSE EVASION, LATERAL MOVEMENT - T1550.002 - T1550

RDP Hijacking - LATERAL MOVEMENT - T1563.002 - T1563

Remote Access Software - COMMAND AND CONTROL - T1219

Remote Desktop Protocol - LATERAL MOVEMENT - T1021.001 - T1021

Remote System Discovery - DISCOVERY - T1018

Rename System Utilities - DEFENSE EVASION - T1036.003 - T1036

Scanning IP Blocks - RECONNAISSANCE - T1595.001 - T1595

Scheduled Transfer - EXFILTRATION - T1029

Service Execution - EXECUTION - T1569.002 - T1569

Service Stop - IMPACT - T1489

SMB/Windows Admin Shares - LATERAL MOVEMENT - T1021.002 - T1021

Stored Data Manipulation - IMPACT - T1565.001 - T1565

Taint Shared Content - LATERAL MOVEMENT - T1080

Valid Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078

Vulnerability Scanning - RECONNAISSANCE - T1595.002 - T1595

Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071

Web Services - RESOURCE DEVELOPMENT - T1583.006 - T1583

Web Shell - PERSISTENCE - T1505.003 - T1505

Windows Management Instrumentation - EXECUTION - T1047

Windows Remote Management - LATERAL MOVEMENT - T1021.006 - T1021

References

1.     https://www.trendmicro.com/en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal.html

2.     https://www.reuters.com/technology/cybersecurity/blacksuit-hacker-behind-cdk-global-attack-hitting-us-car-dealers-2024-06-27/

3.     https://www.sentinelone.com/anthology/blacksuit/

4.     https://thehackernews.com/2024/08/fbi-and-cisa-warn-of-blacksuit.html

5.     https://www.techtarget.com/whatis/feature/The-CDK-Global-outage-Explaining-how-it-happened

6.     https://therecord.media/japanese-media-kadokawa-investigating-cyber

7.     https://therecord.media/plasma-donation-company-cyberattack-blacksuit

8.     https://thecyberexpress.com/government-of-brazil-cyberattack-by-blacksuit/

9.     https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Written by
Signe Zaharka
Principal Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Signe Zaharka
Principal Cyber Analyst

Why Trust is the New Attack Surface: Darktrace’s Mid-Year Threat Update 2026

AI
•
August 3, 2026
Nathaniel Jones
SVP, Global Threat Intelligence
Watch the NIS2 Webinar
Trending blogs
1
Prompt Security in Enterprise AI: Strengths, Weaknesses, and Common Approaches
May 21, 2026
2
What the Darktrace Annual Threat Report 2026 Means for Security Leaders
Feb 26, 2026
3
Journey of a Threat: How Multi-Layered AI Works in Darktrace / EMAIL
May 26, 2026
4
How to Evaluate AI Vendors: 5 Key categories for AI Adoption
May 27, 2026
5
Darktrace Unites Human Behavior and Threat Detection Across Email, Slack, Teams, and Zoom
Mar 25, 2026

More in this series

No items found.
Continue reading
Network
•
July 27, 2026

Hiding in Plain Sight: Uncovering a Multi-Stage Ransomware Attack Through Behavioral Detection

Darktrace detected a multi-stage ransomware intrusion from its earliest stages, identifying reconnaissance, privilege escalation, lateral movement, command-and-control communications, and data exfiltration before encryption occurred. This analysis highlights how behavioral detection exposed attacker activity using legitimate tools and infrastructure, providing multiple opportunities for early intervention and containment.
Alexandra Evzona
Cyber Analyst
Read more
Network
•
June 24, 2026

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

Darktrace researchers analyze a recurring macOS intrusion pattern leveraging ClickFix-style social engineering and AppleScript post-compromise activity. By correlating weak behavioral signals such as HTTP POST beaconing, rare destinations, and SSL anomalies, defenders can detect and disrupt command-and-control activity before sustained attacker control is established.
Justin Torres
Cyber Analyst
Read more
Network
•
June 15, 2026

Hola VPN Abuse: From Proxy Traffic to Malware and Cryptomining

Darktrace’s analysis of Hola VPN-related activity across multiple environments reveals how peer-to-peer proxy functionality can enable malware delivery, command-and-control traffic, and cryptomining. Darktrace data highlights consistent patterns, suspicious downloads from rare endpoints, and post-compromise behavior, demonstrating how seemingly benign software can obscure threats and facilitate further malicious activity.
Min Kim
Cyber Security Analyst
Read more

Blog

/

AI

/

August 5, 2026

Testing a Prompt injection Attack Against an Enterprise AI Agent

prompt injectionDefault blog imageDefault blog image

Key takeaways

  • Darktrace successfully detected and quarantined a prompt injection email before it could be processed by an enterprise AI agent.  
  • Prompt injection attacks increasingly rely on natural language rather than traditional malware, making behavioral analysis an important complement to signature-based detection.  
  • Organizations deploying AI agents should combine model guardrails with behavioral monitoring to reduce the risk of malicious instructions reaching enterprise systems.

How behavioral detection helps stop prompt injection attacks

A Darktrace customer running a Gemini AI agent in Google Cloud asked us two simple questions:

“If my agent can read inbound emails and access internal data, what stops an attacker from hiding malicious instructions in the message? Couldn’t the agent be tricked into deleting or exfiltrating sensitive data?”

The scenario centers on an indirect prompt injection attack, where malicious instructions are hidden inside content that an AI model later interprets as trusted input. The same weakness was exposed by  EchoLeak (CVE-2025-32711), a zero-click Microsoft 365 Copilot vulnerability enabled data exfiltration from a single well-crafted email..

This blog follows the Darktrace team’s investigation of the customer’s hypothesis and examines how the attack interacted with their existing security stack. The results highlight which defenses held, where gaps emerged, and how behavioral detection mattered more than guardrails. This investigation also demonstrates why behavioral detection is becoming increasingly important for AI security, as prompt injections often contain no traditional indicators of compromise.  

How do prompt injection attacks work?

Prompt injection works by carefully crafting the content and structure of the prompt to alter the LLM’s behavior or output in unintended ways. This can cause models to violate guardrails, generate harmful content or enable unauthorised access.

Prompt injection attack example

The well-known example, EchoLeak (CVE-2025-32711), was a zero-click vulnerability in Microsoft 365 Copilot that relied on a carefully crafted email containing hidden instructions that the AI system interpreted as commands rather than content, creating a pathway for unauthorized access to sensitive information without any user interaction.

While Darktrace / SECURE AI is designed to prevent agents from producing unintended outcomes, we wanted to see if we could catch and prevent this threat type earlier in the attack life-cycle, at the email security layer.

How we tested prompt injection attacks on an enterprise agent

Summary:

  1. Claude generated a prompt injection payload.  
  2. Hidden instructions were embedded in an email.  
  3. The email passed traditional validation checks.  
  4. Darktrace analyzed the language and sender behavior.  
  5. The email was quarantined before the AI agent could process it.

To test Darktrace / EMAIL against this attack class, we opened Claude, gave it the customer's context and problem statement (Gemini agent with inbox access, internal tool calls), told it we were validating Darktrace / EMAIL's detection of prompt injections, and asked for a test payload. See below:

Figure 1
Figure 2

Despite the guardrails supposedly built into the model, Claude surprisingly gave us the entire exploit in plaintext (albeit very basic), illegible to a human as the text was sent in white text (see Figure 1) but framed as an authoritative override for anything downstream reading the mail programmatically (i.e. the Gemini agent).

How Darktrace detected a prompt injection attack

We then sent the Claude-crafted email from a freemail address to the target recipient’s inbox. Despite the email containing no malicious payload, the freemail address having no malicious reputation, and the validation checks all passing, Darktrace  /EMAIL flagged the email as a 93/100 anomaly and moved it to junk, out of scope for the AI agent.

Figure 3: The test email sent with the hidden prompt injection
Figure 4: The email analysis in Darktrace / EMAIL 
Figure 5: Darktrace / EMAIL detection of malicious activity

The interesting part is what triggered the detection (see Figure 5)

  • Possible machine prompt content: text in the body detected as instructions written for a machine to execute, not for a human to read
  • Possible machine prompt content + basic suspicious correspondence: the same content, correlated with sender-side anomalies: freemail domain (yahoo[.]com), unknown correspondent, no prior mail history with the recipient, and suspicious references to payment information

Neither of those is a signature match. Nothing in the email was on a blacklist. There was no malware, no link and no attachment. Darktrace analyzed the context in which the email was delivered and flagged it as likely risky.  The anomalous language features and the context of the sender relative to the recipient's normal behavior, combined with the unusual hidden text (prompt) were enough for Darktrace / EMAIL to act on the risk.

Result: Darktrace / EMAIL autonomously junked the email, out of scope for any AI agent parsing the inbox.

Why behavioral security makes a difference detecting prompt injection attacks

Cyberattacks don't look like traditional exploits anymore. They now operate in natural language, not strictly code.

That breaks the traditional stack. AV, firewalls, static scanning and signature-based SEGs all assume a payload to inspect.  

A prompt injection has no payload. It's just an instruction, written in natural language, dressed up as anything the attacker wants: an invoice, an HR request, a calendar invite, some simple PowerPoint slides.

EchoLeak proved that hidden instructions can sit inside an email invisible to the user but fully readable by the LLM, and the LLM will follow them blindly.  

This test and GTG-1002 proved that the LLM itself can be socially engineered. Tell it you're an authorized tester and it will hand you the attack.

Rules and static classifiers can catch the obvious cases. But natural language has infinite variants, and the attack surface is the model's innate functionality to comply.  

The deeper problem here is intent: an LLM can't reliably tell whether an instruction in its context came from its developer, its user, or an attacker who slipped it into an email. To the LLM, everything reads as language and looks like a legitimate ask. This is why behavioural detection wins, as you become aware of intent when you look at the context of an interaction. Does this sender normally send this kind of message to this recipient? Does this prompt fit the user's normal pattern? Is this agent behaving the way this agent normally behaves?  

Intent can't be read off a single email, it emerges from behavioral context. Which is how Darktrace enables threat detection, through behavioral understanding.

Why enterprise AI security requires more than guardrails

Claude didn't roll over immediately… the first section of the response was a (slight) pushback, but then it wrote the payload anyway without having to ask twice.

Here the framing of the prompt did all the work. The “testing security capabilities” angle moved the model from refusal to unquestioned compliance to the user prompt.

This isn't the first time this has happened, of course. Anthropic disclosed in November 2025 that a Chinese state-sponsored group they tracked as GTG-1002 ran the first documented AI-orchestrated espionage campaign against ~30 targets by posing as employees of a legitimate cybersecurity firm doing authorised penetration testing.

The takeaway isn't that AI guardrails are ineffective. They raise the cost of low-effort attacks and remain an important first layer of defense. However, for most organizations today, they’re the only line of defense when deploying AI agents. If a prompt injection bypasses those controls, organizations still need a way to detect and stop malicious behavior elsewhere in the attack chain.

Attackers will continue to have working prompt injections easily and quickly. The question is what stops one when it lands in an inbox your agent is reading.

That's where behavioral detection comes in.

How Darktrace detects prompt injection attacks in emails

Two things Darktrace does that a model-level guardrail or static rules and signatures can't:

Natural language analysis at the email or prompt layer. The email is assessed on its own merits: is this content shaped like instructions for a machine, regardless of what the receiving agent decides to do about it?

Behavioral context around the language. An AI agent behaves like an extremely agreeable human, and it will go above and beyond to comply with the user’s request. That's exactly why you must consider the business context, such sender behaviour, mailing history, and organisational norms, as these matter even more when the recipient is an AI.

Darktrace has been perfecting behavioral anomaly detection for over a decade; the same self-learning approach that catches BEC and account takeover applies directly to prompt injection delivery. Our multi-layered AI stack extracts content from the message, builds behavioural understanding through social graphing and Pattern of Life analysis, and then combines natural language, topic, inducement, sender relationship and anomaly signals before deciding what action to take.  

This matters for prompt injection because the threat is not the plain language itself, but the intent behind the language that can cause an AI agent to respond in unexpected ways.

How to secure enterprise AI operations from prompt injection attacks

Email was the entry point in this case, but it is only one of many possible vectors.  

Anywhere an agent can retrieve information, an attacker can potentially introduce a prompt injection.

Emails, documents, SharePoint sites, web pages, knowledge bases, chat platforms, and third-party integrations all provide opportunities to influence an agent's behavior. Wherever an agent finds its orders, a prompt injection opportunity exists.

This is why securing AI requires more than blocking malicious inputs. Organizations also need visibility into how agents behave after consuming information from across their environment. If an agent begins accessing unexpected data, taking unusual actions, or operating outside its normal patterns, those behaviors may provide the strongest signal that something has gone wrong.

Effective AI security requires defense in depth: reducing the likelihood of malicious instructions reaching the agent while maintaining the ability to detect and investigate suspicious behavior if they do.

The challenge isn't protecting a single entry point. It's recognizing that, in an AI-powered environment, every source of information is also a potential source of influence.

Are you deploying autonomous agents across your enterprise and want to see this tested in your environment? Let's talk.

Continue reading
About the author
Carlo Loregian
Solutions Engineer

Blog

/

AI

/

August 4, 2026

Extending AI Security Visibility with Darktrace and Microsoft Agent 365

microsoft darktrace integrationDefault blog imageDefault blog image

AI agents are rapidly becoming embedded in everyday business operations, helping employees automate workflows, access information, and accelerate decision-making. As organizations embrace agentic AI, security teams face a growing challenge: understanding how AI is being used, what agents can access, and where risk may emerge.

As agents take on more business-critical work, security teams often need to move across multiple portals to understand risks spanning identity, data, and threat activity. This fragmented view can make it difficult to assess an agent's overall risk posture and determine where attention is needed. Organizations need a way to bring these signals together without disrupting existing security investments or workflows.

Today, Darktrace is announcing an integration between Darktrace / SECURE AI and Microsoft Agent 365 that brings Darktrace's Adaptive AI-driven risk signals directly into the Microsoft 365 Admin Center. By extending the visibility and risk understanding provided by Darktrace / SECURE AI into the Microsoft ecosystem, organizations can gain a more unified understanding of AI agent risk across their environments.

As one of the first security companies to partner with Microsoft to contribute third-party risk signals to the Agent Registry, Darktrace is helping shape how organizations understand and manage AI agent risk.

Extending visibility into the Microsoft Agent 365 experience

Microsoft Agent 365 provides administrators with a centralized registry of AI agents operating within their environment. As organizations expand their use of AI agents, this centralized visibility becomes increasingly important for governance and oversight.

This new integration extends that visibility by allowing Darktrace-generated risk signals to be surfaced directly within the Microsoft Agent 365 experience. By combining Microsoft's agent management and security capabilities with Darktrace's AI-powered risk analysis, organizations gain greater awareness of potential security concerns associated with AI agents operating across their environments.

By integrating Darktrace telemetry into Agent 365, customers can:  

  • Surface Darktrace-detected risks and signals alongside Microsoft-native signals in a single interface
  • Identify potentially compromised or anomalous AI agents more quickly
  • Gain unified understanding of context and agent behavior  

This approach reinforces a single control plane for AI security while allowing organizations to continue leveraging existing investments across both platforms.  

Why unified visibility of AI agent risk signals matters

As AI adoption accelerates across Microsoft environments, organizations must manage new forms of behavior, access patterns, and risk. Security teams need more than inventories and permissions. They need visibility into how AI systems operate and how risk evolves over time.  

This integration addresses a critical gap: how to bring behavioral AI security insights into the same control plane as identity, access, and agent management.  

With Darktrace and Microsoft Agent 365 together, organizations benefit from:  

  • Unified visibility: A single pane of glass for understanding AI agent risk signals across Microsoft and Darktrace signals  
  • Faster detection of abnormal agent behavior: Darktrace's Adaptive AI highlights deviations that may not be captured by static controls  
  • Operational efficiency: Security teams can triage and prioritize risk signals without switching between systems
  • Stronger trust in AI deployments: Clear attribution, context, and investigation pathways improve confidence in AI agent usage

Extending Microsoft's AI security model, not replacing it

Securing AI requires a layered approach that combines governance, visibility, threat detection, and risk management. This integration is designed to complement Microsoft's security capabilities, not duplicate them.  

Through Darktrace / SECURE AI, Darktrace contributes:  

  • Identification of risk via advanced prompt analysis  
  • Behavioral anomaly detection across AI agents  
  • Cross-environment threat correlation  
  • Autonomous insight into emerging or unknown risks  

Microsoft provides:  

  • Centralized agent management
  • Identity and access governance
  • Native detection of risk signals and enforcement capabilities

Together, these capabilities create a more complete, layered approach to securing AI-driven enterprises. Organizations gain the governance and policy controls needed to manage AI adoption while benefiting from continuous visibility into how AI is used across the business.

Building the future of secure AI

As AI agents become more deeply embedded in business processes, organizations need more than inventories and static controls. They need to understand how AI is being used, how agents behave, and where risk is emerging across the enterprise.

Darktrace / SECURE AI delivers that understanding through continuous visibility into AI activity, helping security teams assess intent, identify behavioral drift, and uncover emerging risk across both human and agent-driven workflows. Powered by Adaptive AI, it provides the context needed to secure AI as it evolves.  

The integration with Microsoft Agent 365 extends those insights into the workflows organizations already use. Agent 365 provides a unified control plane for governing and securing AI agents, while Darktrace contributes complementary behavioral risk signals that can be surfaced within the Agent 365 experience. Together, they give customers broader context on agent activity and risk while preserving the value of their existing Microsoft and Darktrace investments.

As enterprises move from AI experimentation to AI-powered execution, Microsoft and Darktrace help bring together governance, compliance, behavioral understanding, and oversight in a unified approach to AI security. For organizations adopting Microsoft 365 E7, Darktrace / SECURE AI further strengthens that foundation by providing continuous visibility into AI activity, agent behavior, and emerging risk as AI adoption scales.

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI