Blog
/
/
May 12, 2021

How AI Protects Critical Infrastructure From Ransomware

Explore the role of AI in safeguarding critical infrastructure from ransomware, as revealed by Darktrace's latest insights.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
David Masson
VP, Field CISO
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
12
May 2021

Modern Threats to OT Environments

At the 2021 RSA cyber security conference, US Secretary of Homeland Security Alejandro Mayorkas made an era-defining statement regarding the cyber security landscape: “Let me be clear: ransomware now poses a national security threat.”

Last weekend, Mayorkas’ words rang true. A ransomware attack on the Colonial Pipeline – responsible for nearly half of the US East Coast’s diesel, gasoline, and jet fuel – resulted in the shutdown of a critical fuel network supplying a number of Eastern states.

The fallout from the attack demonstrated how widespread and damaging the consequences of ransomware can be. Against critical infrastructure and utilities, cyber-attacks have the potential to disrupt supplies, harm the environment, and even threaten human lives.

Though full details remain to be confirmed, the attack is reported to have been conducted by an affiliate of the cyber-criminal group called DarkSide, and likely leveraged common remote desktop tools. Remote access has been enabled as an exploitable vulnerability within critical infrastructure by the shift to remote work that many organizations made last year, including those with Industrial Control Systems (ICS) and Operational Technology (OT).

The rise of industrial ransomware

Ransomware against industrial environments is on the rise, with a reported 500% increase since 2018. Oftentimes, these threats leverage the convergence of IT and OT systems, first targeting IT before pivoting to OT. This was seen with the EKANS ransomware that included ICS processes in its ‘kill list’, as well as the Cring ransomware that compromised ICS after first exploiting a vulnerability in a virtual private network (VPN).

It remains to be seen whether the initial attack vector in the Colonial Pipeline compromise exploited a technical vulnerability, compromised credentials, or a targeted spear phishing campaign. It has been reported that the attack first impacted IT systems, and that Colonial then shut down OT operations as a safety precaution. Colonial confirms that the ransomware “temporarily halted all pipeline operations and affected some of our IT systems,” showing that, ultimately, both OT and IT were affected. This is a great example of how many OT systems depend on IT, such that an IT cyber-attack has the ability to take down OT and ICS processes.

In addition to locking down systems, the threat actors also stole 100GB of sensitive data from Colonial. This kind of double extortion attack — in which data is exfiltrated before files are encrypted — has unfortunately become the norm rather than the exception, with over 70% of ransomware attacks involving exfiltration. Some ransomware gangs have even announced that they are dropping encryption altogether in favor of data theft and extortion methods.

Earlier this year, Darktrace defended against a double extortion ransomware attack waged against a critical infrastructure organization, which also leveraged common remote access tools. This blog will outline the threat find in depth, showing how Darktrace’s self-learning AI responded autonomously to an attack strikingly similar to the Colonial Pipeline incident.

Darktrace threat find

Ransomware against electric utilities equipment supplier

In an attack against a North American equipment supplier for electrical utilities earlier this year, Darktrace/OT demonstrated its ability to protect critical infrastructure against double extortion ransomware that targeted organizations with ICS and OT.

The ransomware attack initially targeted IT systems, and, thanks to self-learning Cyber AI, was stopped before it could spill over into OT and disrupt operations.

The attacker first compromised an internal server in order to exfiltrate data and deploy ransomware over the course of 12 hours. The short amount of time between initial compromise and deployment is unusual, as ransomware threat actors often wait several days to spread stealthily as far across the cyber ecosystem as possible before striking.

Figure 1: A timeline of the attack

How did the attack bypass the rest of the security stack?

The attacker leveraged ‘Living off the Land’ techniques to blend into the business’ normal ‘patterns of life’, using a compromised admin credential and a remote management tool approved by the organization, in its attempts to remain undetected.

Darktrace commonly sees the abuse of legitimate remote management software in attackers’ arsenal of techniques, tactics, and procedures (TTPs). Remote access is also becoming an increasingly common vector of attack in ICS attacks in particular. For example, in the cyber-incident at the Florida water treatment facility last February, attackers exploited a remote management tool in attempts to manipulate the treatment process.

The specific strain of ransomware deployed by this attacker also successfully evaded detection by anti-virus by using a unique file extension when encrypting files. These forms of ‘signatureless’ ransomware easily slip past legacy approaches to security that rely on rules, signatures, threat feeds, and lists of documented Common Vulnerabilities and Exposures (CVEs), as these are methods that can only detect previously documented threats.

The only way to detect never-before-seen threats like signatureless ransomware is for a technology to find anomalous behavior, rather than rely on lists of ‘known bads’. This can be achieved with self-learning technology, which spots even the most subtle deviations from the normal ‘patterns of life’ for all devices, users, and all the connections between them.

Darktrace insights

Initial compromise and establishing foothold

Despite the abuse of a legitimate tool and the absence of known signatures, Darktrace/OT was able to use a holistic understanding of normal activity to detect the malicious activity at multiple points in the attack lifecycle.

The first clear sign of an emerging threat that was alerted by Darktrace was the unusual use of a privileged credential. The device also served an unusual remote desktop protocol (RDP) connection from a Veeam server shortly before the incident, indicating that the attacker may have moved laterally from elsewhere in the network.

Three minutes later, the device initiated a remote management session which lasted 21 hours. This allowed the attacker to move throughout the broader cyber ecosystem while remaining undetected by traditional defences. Darktrace, however, was able to detect unusual remote management usage as another early warning indicative of an attack.

Double threat part one: Data exfiltration

One hour after the initial compromise, Darktrace detected unusual volumes of data being sent to a 100% rare cloud storage solution, pCloud. The outbound data was encrypted using SSL, but Darktrace created multiple alerts relating to large internal downloads and external uploads that were a significant deviation from the device’s normal ‘pattern of life’.

The device continued to exfiltrate data for nine hours. Analysis of the files downloaded by the device, which were transferred using the unencrypted SMB protocol, suggests that they were sensitive in nature. Fortunately, Darktrace was able to pinpoint the specific files that were exfiltrated so that the customer could immediately evaluate the potential implications of the compromise.

Double threat part two: File encryption

A short time later, at 01:49 local time, the compromised device began encrypting files in a SharePoint back-up share drive. Over the next three and a half hours, the device encrypted over 13,000 files on at least 20 SMB shares. In total, Darktrace produced 23 alerts for the device in question, which amounted to 48% of all the alerts produced in the corresponding 24-hour period.

Darktrace’s Cyber AI Analyst then automatically launched an investigation, identifying the internal data transfers and the file encryption over SMB. From this, it was able to present incident reports that connected the dots among these disparate anomalies, piecing them together into a coherent security narrative. This put the security team in a position to immediately take remediating action.

If the customer had been using Darktrace’s autonomous response technology, there is no doubt the activity would have been halted before significant volumes of data could have been exfiltrated or files encrypted. Fortunately, after seeing both the alerts and Cyber AI Analyst reports, the customer was able to use Darktrace’s ‘Ask the Expert’ (ATE) service for incident response to mitigate the impact of the attack and assist with disaster recovery.

Figure 2: AI Analyst Incident reporting an unusual reprogram command using the MODBUS protocol. The incident includes a plain English summary, relevant technical information, and the investigation process used by the AI.  

Detecting the threat before it could disrupt critical infrastructure

The targeted supplier was overseeing OT and had close ties to critical infrastructure. By facilitating the early-stage response, Darktrace prevented the ransomware from spreading further onto the factory floor. Crucially, Darktrace also minimized operational disruption, helping to avoid the domino effect which the attack could have had, affecting not only the supplier itself, but also the electric utilities that this supplier supports.

As both the recent Colonial Pipeline incident and the above threat find reveal, ransomware is a pressing concern for organizations overseeing industrial operations across all forms of critical infrastructure, from pipelines to the power grid and its suppliers. With self-learning AI, these attack vectors can be dealt with before the damage is done through real-time threat detection, autonomous investigations, and — if activated — targeted machine-speed response.

Looking forward: Using Self-Learning AI to protect critical infrastructure across the board

In late April, the Biden administration announced an ambitious effort to “safeguard US critical infrastructure from persistent and sophisticated threats.” The Department of Energy’s (DOE) 100-day plan specifically seeks technologies “that will provide cyber visibility, detection, and response capabilities for industrial control systems of electric utilities.”

The Biden administration’s cyber sprint clearly calls for a technology that protects critical energy infrastructure, rather than merely best practice measures and regulations. As seen in the above threat find, Darktrace AI is a powerful technology that leverages unsupervised machine learning to autonomously safeguard critical infrastructure and its suppliers with machine speed and precision.

Darktrace enhances detection, mitigation, and forensic capabilities to detect  sophisticated and novel attacks, along with insider threats and pre-existing infections, using Self-Learning Cyber AI, without rules, signatures, or lists of CVEs. Incident investigations provided in real time by Cyber AI Analyst jumpstart remediation with actionable insights, containing emerging attacks at their early stages, before they escalate into crisis.

Enable near real-time situational awareness and response capabilities

Darktrace immediately understands, identifies, and investigates all anomalous activity in ICS/OT networks, whether human or machine driven. Additionally, Darktrace actions targeted response where appropriate to neutralize threats, either actively or in human confirmation mode. Because Self-learning AI adapts alongside evolutions in the ecosystem, organizations benefit from real-time awareness with no tuning or human input necessary

Deploy technologies to increase visibility of threats in ICS and OT systems

Darktrace contextualizes security events, adapts to novel techniques, and translates findings into a security narrative that can be actioned by humans in minutes. Delivering a unified view across IT and OT systems.

Darktrace detects, investigates, and responds to threats at higher Purdue levels and in IT systems before they ‘spill over’ into OT. ‘Plug and play’ deployment seamlessly integrates with technological architecture, presenting 3D network topology with granular visibility into all users, devices, and subnets.

Darktrace's asset identification continuously catalogues all ICS/OT devices and identifies and investigates all threatening activity indicative of emerging attacks – be it ICS ransomware, APTs, zero-day exploits, insider threats, pre-existing infections, DDoS, crypto-mining, misconfigurations, or never-before-seen attacks.

Thanks to Darktrace analyst Oakley Cox for his insights on the above threat find.

Darktrace model detections:

  • Initial compromise:
  • User / New Admin Credential on Client
  • Data exfiltration:
  • Anomalous Connection / Uncommon 1 GiB Outbound
  • Anomalous Connection / Low and Slow Exfiltration
  • Device / Anomalous SMB Followed by Multiple Model Breaches
  • Anomalous Connection / Download and Upload
  • File encryption:
  • Compromise / Ransomware / Suspicious SMB Activity
  • Anomalous Connection / SMB Enumeration
  • Device / Anomalous RDP Followed by Multiple Model Breaches
  • Anomalous File / Internal / Additional Extension Appended to SMB File
  • Anomalous Connection / Sustained MIME Type Conversion
  • Anomalous Connection / Suspicious Read Write Ratio
  • Device / Multiple Lateral Movement Model Breaches

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
David Masson
VP, Field CISO

More in this series

No items found.

Blog

/

Email

/

June 18, 2025

Darktrace Collaborates with Microsoft: Unifying Email Security with a Shared Vision

Default blog imageDefault blog image

In today’s threat landscape, email remains the most targeted vector for cyberattacks. Organizations require not only multi-layered defenses but also advanced, integrated systems that work collaboratively to proactively mitigate threats before they cause damage

That’s why we’re proud to announce a new integration between Darktrace / EMAIL and Microsoft Defender for Office 365, delivering a Unified Quarantine experience that empowers security teams with seamless visibility, control, and response across both platforms.

This announcement builds on a strong and growing collaboration. In 2024, Darktrace was honored as Microsoft UK Partner of the Year and recognized as a Security Trailblazer at the annual Microsoft Security 20/20 Awards, a testament to our shared commitment to innovation and customer-centric security.

A Shared Mission: Stopping Threats at Machine Speed

This integration is more than a technical milestone,as it’s a reflection of a shared mission: to protect organizations from both known and unknown threats, with efficiency, accuracy, and transparency.

  • Microsoft Defender for Office 365 delivers a comprehensive security framework that safeguards Microsoft 365 email and collaboration workloads leveraging advanced AI, global threat intelligence and information on known attack infrastructure.
  • Darktrace / EMAIL complements this with Self-Learning AI that understands the unique communication patterns within each organization, detecting subtle anomalies that evade traditional detection methods.

Together, we’re delivering multi-layered, adaptive protection that’s greater than the sum of its parts.

“Our integration with Microsoft gives security teams the tools they need to act faster and more precisely to detect and respond to threats,” said Jill Popelka, CEO of Darktrace. “Together, we’re strengthening defenses where it matters most to our customers: at the inbox.”

Unified Quarantine: One View, Total Clarity

The new Unified Quarantine experience gives customers a single pane of glass to view and manage email threatsregardless of which product took action. This means:

  • Faster investigations with consolidated visibility
  • Clear attribution of actions and outcomes across both platforms
  • Streamlined workflows for security teams managing complex environments

“This integration is a testament to the power of combining Microsoft’s global threat intelligence with Darktrace’s unique ability to understand the ‘self’ of an organization,” said Jack Stockdale, CTO of Darktrace. “Together, we’re delivering a new standard in proactive, adaptive email security.”

A New Era of Collaborative Cyber Defense

This collaboration represents a broader shift in cybersecurity: from siloed tools to integrated ecosystems. As attackers become more sophisticated, defenders must move faster, smarter, and in unison.

Through this integration, Darktrace and Microsoft establish a new standard for collaboration between native and third-party security solutions, enhancing not only threat detection but also comprehensive understanding and proactive measures against threats.

We’re excited to bring this innovation to our customers and continue building a future where AI and human expertise collaborate to secure the enterprise.

[related-resource]

Continue reading
About the author
Carlos Gray
Senior Product Marketing Manager, Email

Blog

/

Network

/

June 18, 2025

Customer Case Study: Leading Petrochemical Manufacturer

Default blog imageDefault blog image

Headquartered in Saudi Arabia, this industry leading petrochemical manufacturer serves customers in more than 80 countries across diverse markets throughout Europe, Africa, Latin America, the Middle East, China, and Southeast Asia.

Cyber resiliency critical to growth strategy

This leading petrochemical manufacturer’s vision is to be one of the major global players in the production and marketing of designated petrochemicals and downstream products. The company aims to significantly increase its capacity to up to a million metric tons within the next few years.

With cyber-attacks on critical infrastructure increasing 30% globally last year, cyber resiliency is essential to supporting the company’s strategic business goals of:

  • Maximizing production through efficient asset utilization
  • Maximizing sales by conducting 90% of its business outside Saudi Arabia
  • Optimizing resources and processes by integrating with UN Global Compact principles for sustainability and efficiency
  • Growing its business portfolio by engaging in joint ventures to diversify production and add value to the economy

However, the industry leader faced several challenges in its drive to fortify its cybersecurity defenses.

Visibility gaps delay response time

The company’s existing security setup provided limited visibility to the in-house security team, hindering its ability to detect anomalous network and user activity in real time. This resulted in delayed responses to potential incidents, making proactive issue resolution difficult and any remediation in the event of a successful attack costly and time-consuming.

Manual detection drains resources

Without automated detection and response capabilities, the organization’s security team had to manually monitor for suspicious activity – a time-consuming and inefficient approach that strained resources and left the organization vulnerable. This made it difficult for the team to stay current with training or acquire new skills and certifications, which are core to the ethos of both the company’s owners and the team itself.

Cyber-attacks on critical infrastructure increasing

The petrochemical manufacturer is part of a broader ecosystem of companies, making the protection of its supply chain – both upstream and downstream – critical. With several manufacturing entities and multiple locations, the customer’s internal structure is complex and challenging to secure. As cyber-attacks on critical infrastructure escalate, it needed a more comprehensive approach to safeguard its business and the wider ecosystem.

Keeping and growing skills and focus in-house

To strengthen its cybersecurity strategy, the company considered two options:

  1. Make a significant initial and ongoing investment in a Security Operations Center (SOC), which would involve skills development outside the company and substantial management overhead.
  2. Use a combination of new, automated tools and an outsourced Managed Detection and Response (MDR) service to reduce the burden on internal security specialists and allow the company to invest in upskilling its staff so they can focus on more strategic tasks.

Faced with this choice between entirely outsourcing security and augmenting the security team with new capabilities, the customer chose the second option, selecting Darktrace to automate the company’s monitoring, detection, and response. Today, the petrochemical manufacturer is using:

Extending the SOC with 24/7 expert support

To alleviate the burden on its lean security team, the company augmented its in-house capabilities with Darktrace’s Managed Detection & Response service. This support acts as an extension of its SOC, providing 24/7 monitoring, investigation, and escalation of high-priority threats. With Darktrace’s global SOC managing alert triage and autonomously containing threats, the organization’s internal team can focus on strategic initiatives. The result is a stronger security posture and increased capacity to proactively address evolving cyber risks – without expanding headcount or sacrificing visibility.

A unique approach to AI

In its search for a new security platform, the company’s Director of Information Technology said Darktrace’s autonomous response capability, coupled with Self-Learning AI-driven threat reduction, were two big reasons for selecting Darktrace over competing products and services.

AI was a huge factor – no one else was doing what Darktrace was doing with [AI].”

Demonstrated visibility

Before Darktrace, the customer had no visibility into the network activity to and from remote worker devices. Some employees need the ability to connect to its networks at any time and from any location, including the Director of Information Technology. The trial deployment of Darktrace / ENDPOINT was a success and gave the team peace of mind that, no matter the location or device, high-value remote workers were protected by Darktrace.

Modular architecture  

Darktrace's modular architecture allowed the company to deploy security controls across its complex, multi-entity environment. The company’s different locations run on segregated networks but are still interconnected and need to be protected. Darktrace / NETWORK provides a unified view and coordinated security response across the organization’s entire network infrastructure, including endpoint devices.

Results

The petrochemical manufacturer is using Darktrace across all of its locations and has achieved total visibility across network and user activity. “Darktrace is increasing in value every day,” said the Director of Information Technology.

I don’t have a big team, and Darktrace makes our lives very, very easy, not least the automation of some of the tasks that require constant manual review.”

Time savings frees analysts to focus on proactive security

Darktrace / NETWORK provides continuous, AI-driven monitoring and analysis of the company’s network activity, user behavior, and threat patterns, establishing a baseline of what normal activity looks like, and then alerting analysts to any deviations from normal traffic, activity, and behaviors. Darktrace’s autonomous response capabilities speed up response to detected threats, meaning intervention from the security team is required for fewer incidents and alerts.

In October 2024 alone, Darktrace Cyber AI Analyst saved the team 810 investigation hours, and autonomously responded to 180 anomalous behaviors that were uncovered during the investigations. With Darktrace managing the majority of threat detection and response efforts, the security team has been able to change its day-to-day activity from manual review of traffic and alerts and belated response to activity, to proactively fortifying its detection and response posture and upskilling to meet evolving requirements.  

Layered email protection reduces phishing threats

The company’s email infrastructure posed a challenge due to petrochemical industry regulations requiring on-premises email servers, with some security delivered via Microsoft Azure. By integrating Darktrace / EMAIL into the Azure stack, the organization has reduced the volume of phishing emails its users receive by 5%.

“Now we have one more layer of security related to email – every email goes through two filters. If something is not being caught or traced by Azure, it is being detected by Darktrace,” said the Director of Information Technology. “As a result, we’re now seeing only about 15% to 20% of the phishing emails we used to receive before implementing Darktrace.”

Preparing for a secure future

The time saved using Darktrace has helped the security team take proactive steps, including preparing for new cyber resilience regulations for Saudi Arabia’s Critical National Infrastructure, as mandated by the National Cybersecurity Authority (NCA).

“The team now has ample time to prepare policies and procedures that meet the new NCA regulations and, in some cases, enhance the requirements of the new law,” said the Director of Information Technology. “All of this is possible because they don’t need to keep watch; Darktrace takes on so much of that task for them.”

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI