How VPC Traffic Mirroring Boosts Darktrace Security
09
Mar 2021
Find out how Amazon VPC Traffic Mirroring enhances Darktrace's cloud security. Learn about its impact on advanced threat detection and management.
Darktrace's Cyber AI brings real-time visibility and adaptive, autonomous defense to your AWS cloud security strategy.
The platform continuously learns what normal behavior looks like for every user, device, and workload in your AWS environment. With this deep understanding of usual ‘patterns of life,’ Darktrace can recognize the subtle deviations that point to a threat, from account takeovers to critical misconfigurations.
This bespoke, real-time knowledge of usual activity allows Darktrace to spot the unknown and unpredictable threats that get through policy-based defenses – all without relying on any rules, signatures, or prior assumptions.
With Amazon Virtual Private Cloud (Amazon VPC) Traffic Mirroring, Darktrace’s self-learning AI can seamlessly access granular packet data in AWS cloud environments, helping the platform build a rich understanding of context. AWS’s recent announcement of the extension of VPC Traffic Mirroring to non-Nitro instance types now allows our customers to gain agentless Cyber AI defense across these instances as well.
Expanding VPC traffic mirroring to non-Nitro instances
Amazon VPC Traffic Mirroring replicates the network traffic from EC2 instances within VPCs and allows customers to leverage this traffic for Darktrace’s AI-driven threat detection and investigation. Darktrace’s Cyber AI learns ‘on the job’ what normal activity looks like in customer AWS environments, in part using the real-time visibility provided by VPC Traffic Mirroring. The platform continuously adapts as each customer’s business evolves, a critical feature given the speed and scale of development in the cloud.
Previously, customers could only enable VPC Traffic Mirroring on their Nitro-based EC2 instances. Now, AWS has announced that this seamless access to hundreds of features from network traffic is extended to select non-Nitro instance types, supporting Darktrace’s ability to easily learn the bespoke behavioral patterns of our customers’ Amazon VPCs.
Customers can now enable VPC Traffic Mirroring on additional instances types such as C4, D2, G3, G3s, H1, I3, M4, P2, P3, R4, X1 and X1e that use the Xen-based hypervisor.* This feature is available in all 20 regions where VPC Traffic Mirroring is currently supported.
VPC Traffic Mirroring supports many of Darktrace’s extensive use cases across AWS, which include:
Data exfiltration and destruction: Detects anomalous device connections and user access, as well as unusual resource deletion, modification, and movement;
Critical misconfigurations: Catches open S3 buckets, anomalous permission changes, and unusual activity around compliance-related data and devices;
Compromised credentials: Spots unusual logins, including brute force attempts and unusual login source/time, as well as unusual user behavior, from rule changes to password resets;
Insider threat and admin abuse: Identifies the subtle signs of malicious insiders – including sensitive file access, resource modification, role changes, and adding/deleting users.
Figure 1: Darktrace illuminates activity in AWS
Autonomous investigation and response for AWS cloud environments
The Darktrace Security Module for AWS provides additional visibility across AWS environments via interaction with AWS CloudTrail, allowing for AI-powered monitoring of management and administration activity. With this deep knowledge of how your business operates in the cloud, Darktrace delivers total coverage across all your AWS services, including:
EC2
IAM
S3
VPC
Lambda
Athena
DynamoDB
Route 53
ACM
RDS
The recently announced Version 5 of the Darktrace, which focuses on protecting the cloud and the remote workforce, further augments Darktrace’s coverage of AWS environments. Among many other exciting new features, Version 5 extends the reach of Cyber AI Analyst and Darktrace RESPOND to cloud environments like AWS VPCs.
Cyber AI Analyst augments the work of security teams by autonomously reporting on the full scope of security incidents and reduces triage time by up to 92%. Cyber AI Analyst can now also conduct on-demand investigations into users and devices of interest, ingest third-party alerts to trigger new investigations, and automatically feed AI-generated Incident Reports to any SIEM, SOAR, or downstream ticketing system.
Meanwhile, Darktrace RESPOND brings Autonomous Response to the critical infrastructure which AWS VPCs provide. Darktrace's responses are surgically precise and intelligently maintain normal business operations while stopping emerging threats in real time.**
“Darktrace's innovations are outstanding and have really meshed with our current needs as a security team, from the flexibility of our new cloud-delivered deployment to the extended visibility of the Darktrace Client Sensors.”
– CISO, Real Estate
We have also launched a dedicated user interface for visualization and intuitive analysis of cloud-based threats identified across AWS via the Darktrace Security Module.
Self-Learning AI defense across the enterprise
Darktrace offers AI-driven defense of cloud infrastructure in AWS, as well as across SaaS applications, email, corporate networks, industrial systems, and remote endpoints. Taking a fundamentally unique approach, Darktrace provides the industry’s only self-learning platform that gives complete coverage and visibility across the organization.
This is a critical benefit, as businesses and workforces today are increasingly complex and dynamic. Darktrace can connect the dots between unusual behavior in disparate infrastructure areas and ensure cloud security is not siloed from the monitoring of the rest of the organization.
Darktrace’s adaptive and unified approach allows the solution to detect, investigate, and respond to the full range of threats facing the enterprise – even those unpredictable threats that move across dynamic and diverse environments.
* VPC Traffic Mirroring is not supported on the T2, R3 and I2 instance types and previous generation instances. ** This product is only available in AWS for customers who leverage Darktrace osSensors.
Like this and want more?
Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newsletter
Stay ahead of threats with the Darktrace blog newsletter
Get the latest insights from the cybersecurity landscape, including threat trends, incident analysis, and the latest Darktrace product developments – delivered directly to your inbox, monthly.
Thanks, your request has been received
A member of our team will be in touch with you shortly.
Oops! Something went wrong while submitting the form.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Andrew Tsonchev
VP of Technology
Andrew is a technical expert on cyber security and advises Darktrace’s strategic customers on advanced threat defense, AI and autonomous response. He has a background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. His comments on cyber security and the threat to critical national infrastructure have been reported in international media, including CNBC and the BBC World.
A snake in the net: Defending against AiTM phishing threats and Mamba 2FA
What are Adversary-in-the-Middle (AiTM) phishing kits?
Phishing-as-a-Service (PhaaS) platforms have significantly lowered the barriers to entry for cybercriminals, enabling a new wave of sophisticated phishing attacks. Among the most concerning developments in this landscape is the emergence of Adversary-in-the-Middle (AiTM) phishing kits, which enhance traditional phishing tactics by allowing attackers to intercept and manipulate communications in real-time. The PhaaS marketplace offers a wide variety of innovative capabilities, with basic services starting around USD 120 and more advanced services costing around USD 250 monthly [1].
These AiTM kits are designed to create convincing decoy pages that mimic legitimate login interfaces, often pre-filling user information to increase credibility. By acting as a man-in-the-middle, attackers can harvest sensitive data such as usernames, passwords, and even multi-factor authentication (MFA) tokens without raising immediate suspicion. This capability not only makes AiTM attacks more effective but also poses a significant challenge for cybersecurity defenses [2].
Mamba 2FA is one such example of a PhaaS strain with AiTM capabilities that has emerged as a significant threat to users of Microsoft 365 and other enterprise systems. Discovered in May 2024, Mamba 2FA employs advanced AiTM tactics to bypass MFA, making it particularly dangerous for organizations relying on these security measures.
What is Mamba 2FA?
Phishing Mechanism
Mamba 2FA employs highly convincing phishing pages that closely mimic legitimate Microsoft services like OneDrive and SharePoint. These phishing URLs are crafted with a specific structure, incorporating Base64-encoded parameters. This technique allows attackers to tailor the phishing experience to the targeted organization, making the deception more effective. If an invalid parameter is detected, users are redirected to a benign error page, which helps evade automated detection systems [5].
Figure 1: Phishing page mimicking the Microsoft OneDrive service.
Real-Time Communication
A standout feature of Mamba 2FA is its use of the Socket.IO JavaScript library. This library facilitates real-time communication between the phishing page and the attackers' backend servers. As users input sensitive information, such as usernames, passwords, and MFA tokens on the phishing site, this data is immediately relayed to the attackers, enabling swift unauthorized access [5].
Multi-Factor Authentication Bypass
Mamba 2FA specifically targets MFA methods that are not resistant to phishing, such as one-time passwords (OTPs) and push notifications. When a user enters their MFA token, it is captured in real-time by the attackers, who can then use it to access the victim's account immediately. This capability significantly undermines traditional security measures that rely on MFA for account protection.
Infrastructure and Distribution
The platform's infrastructure consists of two main components: link domains and relay servers. Link domains handle initial phishing attempts, while relay servers are responsible for stealing credentials and completing login processes on behalf of the attacker. The relay servers are designed to mask their IP addresses by using proxy services, making it more difficult for security systems to block them [3].
Evasion Techniques
To evade detection by security tools, Mamba 2FA employs several strategies:
Sandbox Detection: The platform can detect if it is being analyzed in a sandbox environment and will redirect users to harmless pages like Google’s 404 error page.
Dynamic URL Generation: The URLs used in phishing attempts are frequently rotated and often short-lived to avoid being blacklisted by security solutions.
HTML Attachments: Phishing emails often include HTML attachments that appear benign but contain hidden JavaScript that redirects users to the phishing page [5].
Darktrace’s Coverage of Mamba 2FA
Starting in July 2024, the Darktrace Threat Research team detected a sudden rise in Microsoft 365 customer accounts logging in from unusual external sources. These accounts were accessed from an anomalous endpoint, 2607:5500:3000:fea[::]2, and exhibited unusual behaviors upon logging into Software-as-a-Service (SaaS) accounts. This activity strongly correlates with a phishing campaign using Mamba 2FA, first documented in late June 2024 and tracked as Mamba 2FA by Sekoia [2][3].
Darktrace / IDENTITY was able to identify the initial stages of the Mamba 2FA campaign by correlating subtle anomalies, such as unusual SaaS login locations. Using AI based on peer group analysis, it detected unusual behavior associated with these attacks. By leveraging Autonomous Response actions, Darktrace was able to neutralize these threats in every instance of the campaign detected.
On July 23, a SaaS user was observed logging in from a rare ASN and IP address, 2607:5500:3000:fea::2, originating from the US and successfully passed through MFA authentication.
Figure 2: Model Alert Event Log showing Darktrace’s detection of a SaaS user mailbox logging in from an unusual source it correlates with Mamba 2FA relay server.
Almost an hour later, the SaaS user was observed logging in from another suspicious IP address, 45.133.172[.]86, linked to ASN AS174 COGENT-174. This IP, originating from the UK, successfully passed through MFA validation.
Following this unusual access, the SaaS user was notably observed reading emails and files that could contain sensitive payment and contract information. This behavior suggests that the attacker may have been leveraging contextual information about the target to craft further malicious phishing emails or fraudulent invoices. Subsequently, the user was detected creating a new mailbox rule titled 'fdsdf'. This rule was configured to redirect emails from a specific domain to the 'Deleted Items' folder and automatically mark them as read.
Implications of Unusual Email Rules
Such unusual email rule configurations are a common tactic employed by attackers. They often use these rules to automatically forward emails containing sensitive keywords—such as "invoice”, "payment", or "confidential"—to an external address. Additionally, these rules help conceal malicious activities, keeping them hidden from the target and allowing the attacker to operate undetected.
Figure 3: The model alert “SaaS / Compliance / Anomalous New Email Rule,” pertaining to the unusual email rule created by the SaaS user named ‘fdsdf’.
Blocking the action
A few minutes later, the SaaS user from the unusual IP address 45.133.172[.]86 was observed attempting to send an email with the subject “RE: Payments.” Subsequently, Darktrace detected the user engaging in activities that could potentially establish persistence in the compromised account, such as registering a new authenticator app. Recognizing this sequence of anomalous behaviors, Darktrace implemented an Autonomous Response inhibitor, disabling the SaaS user for two hours. This action effectively contained potential malicious activities, such as the distribution of phishing emails and fraudulent invoices, and gave the customer’s security team the necessary time to conduct a thorough investigation and implement appropriate security measures.
Figure 4: Device Event Log displaying Darktrace’s Autonomous Response taking action by blocking the SaaS account.
Figure 5: Darktrace / IDENTITY highlighting the 16 model alerts that triggered during the observed compromise.
In another example from mid-July, similar activities related to the campaign were observed on another customer network. A SaaS user was initially detected logging in from the unusual external endpoint 2607:5500:3000:fea[::]2.
Figure 6: The SaaS / Compromise / SaaS Anomaly Following Anomalous Login model alert was triggered by an unusual login from a suspicious IP address linked to Mamba 2FA.
A few minutes later, in the same manner as demonstrated in the previous case, the actor was observed logging in from another rare endpoint, 102.68.111[.]240. However, this time it was from a source IP located in Lagos, Nigeria, which no other user on the network had been observed connecting from. Once logged in, the SaaS user updated the settings to "User registered Authenticator App with Notification and Code," a possible attempt to maintain persistence in the SaaS account.
Figure 7: Darktrace / IDENTITY highlighted the regular locations for the SaaS user. The rarity scores associated with the Mamba 2FA IP location and another IP located in Nigeria were classified as having very low regularity scores for this user.
Based on unusual patterns of user behavior, a Cyber AI Analyst Incident was also generated, detailing all potential account hijacking activities. Darktrace also applied an Autonomous Response action, disabling the user for over five hours. This swift action was crucial in preventing further unauthorized access, potential data breaches and further implications.
Figure 8: Cyber AI Analyst Incident detailing the unusual activities related to the SaaS account hijacking.
Since the customer had subscribed to Darktrace Security Operations Centre (SOC) services, Darktrace analysts conducted an additional human investigation confirming the account compromise.
How Darktrace Combats Phishing Threats
The initial entry point for Mamba 2FA account compromises primarily involves phishing campaigns using HTML attachments and deceptive links. These phishing attempts are designed to mimic legitimate Microsoft services, such as OneDrive and SharePoint, making them appear authentic to unsuspecting users. Darktrace / EMAIL leverages multiple capabilities to analyze email content for known indicators of phishing. This includes looking for suspicious URLs, unusual attachments (like HTML files with embedded JavaScript), and signs of social engineering tactics commonly used in phishing campaigns like Mamba 2FA. With these capabilities, Darktrace successfully detected Mamba 2FA phishing emails in networks where this tool is integrated into the security layers, consequently preventing further implications and account hijacks of their users.
Mamba 2FA URL Structure and Domain Names
The URL structure used in Mamba 2FA phishing attempts is specifically designed to facilitate the capture of user credentials and MFA tokens while evading detection. These phishing URLs typically follow a pattern that incorporates Base64-encoded parameters, which play a crucial role in the operation of the phishing kit.
The URLs associated with Mamba 2FA phishing pages generally follow this structure [6]:
https://{domain}/{m,n,o}/?{Base64 string}
Below are some potential Mamba 2FA phishing emails, with the Base64 strings already decoded, that were classified as certain threats by Darktrace / EMAIL. This classification was based on identifying multiple suspicious characteristics, such as HTML attachments containing JavaScript code, emails from senders with no previous association with the recipients, analysis of redirect links, among others. These emails were autonomously blocked from being delivered to users' inboxes.
Figure 9: Darktrace / EMAIL highlighted a possible phishing email from Mamba 2FA, which was classified as a 100% anomaly.
Figure 10: Darktrace / EMAIL highlighted a URL that resembles the characteristics associated with Mamba 2FA.
Conclusion
The rise of PhaaS platforms and the advent of AiTM phishing kits represent a concerning evolution in cyber threats, pushing the boundaries of traditional phishing tactics and exposing significant vulnerabilities in current cybersecurity defenses. The ability of these attacks to effortlessly bypass traditional security measures like MFA underscores the need for more sophisticated, adaptive strategies to combat these evolving threats.
By identifying and responding to anomalous activities within Microsoft 365 accounts, Darktrace not only highlights the importance of comprehensive monitoring but also sets a new standard for proactive threat detection. Furthermore, the autonomous threat response capabilities and the exceptional proficiency of Darktrace / EMAIL in intercepting and neutralizing sophisticated phishing attacks illustrate a robust defense mechanism that can effectively safeguard users and maintain the integrity of digital ecosystems.
Credit to Patrick Anjos (Senior Cyber Analyst) and Nahisha Nobregas (Senior Cyber Analyst)
Appendices
Darktrace Model Detections
SaaS / Access / M365 High Risk Level Login
SaaS / Access / Unusual External Source for SaaS Credential Use
SaaS / Compromise / Login From Rare Endpoint While User Is Active
SaaS / Compliance / M365 Security Information Modified
SaaS / Compromise / Unusual Login and New Email Rule
Protecting your hybrid cloud: The future of cloud security in 2025 and beyond
Cloud security in 2025
The future of cybersecurity is being shaped by the rapid adoption of cloud technologies.
As Gartner reports, “By 2027, more than 70% of enterprises will use industry cloud platforms to accelerate their business initiatives, up from less than 15% in 2023” [1].
As organizations continue to transition workloads and sensitive data to cloud environments, the complexity of securing distributed infrastructures grows. In 2025, cloud security will need to address increasingly sophisticated threats with innovative approaches to ensure resilience and trust.
Emerging threats in cloud security:
Supply chain attacks in the cloud: Threat actors are targeting vulnerabilities in cloud networks, including third-party integrations and APIs. These attacks can have wide-spanning impacts, jeopardizing data security and possibly even compromising multiple organizations at once. As a result, robust detection and response capabilities are essential to identify and neutralize these attacks before they escalate.
Advanced misconfiguration exploits: Misconfigurations remain a leading cause of cloud security breaches. Attackers are exploiting these vulnerabilities across dynamic infrastructures, underscoring the need for tools that provide continuous compliance validation in the future of cloud computing.
Credential theft with evolving Tactics, Techniques, and Procedures (TTPs): While credential theft can result from phishing attacks, it can also happen through other means like malware, lateral movement, data breaches, weak and reused passwords, and social engineering. Adversarial innovation in carrying out these attacks requires security teams to use proactive defense strategies.
Insider threats and privilege misuse: Inadequate monitoring of Identity and Access Management (IAM) in cloud security increases the risk of insider threats. The adoption of zero-trust architectures is key to mitigating these risks.
Threats exploiting dynamic cloud scaling: Attackers take advantage of the dynamic nature of cloud computing, leveraging ephemeral workloads and autoscaling features to evade detection. This makes adaptive and AI-driven detection and response critical because it can more easily parse behavioral data that would take human security teams longer to investigate.
Where the industry is headed
In 2025, cloud infrastructures will become even more distributed and interconnected. Multi-cloud and hybrid models will dominate, so organizations will have to optimize workloads across platforms. At the same time, the growing adoption of edge computing and containerized applications will decentralize operations further. These trends demand security solutions that are agile, unified, and capable of adapting to rapid changes in cloud environments.
Emerging challenges in securing cloud environments
The transition to highly distributed and dynamic cloud ecosystems introduces the following key challenges:
Limited visibility As organizations adopt multiple platforms and services, gaining a unified view of cloud architectures becomes increasingly difficult. This lack of visibility makes it unclear where sensitive data resides, which identities can access it and how, and if there are potential vulnerabilities in configurations and API infrastructure. Without end-to-end monitoring, detecting and mitigating threats in real time becomes nearly impossible.
Complex environments The blend of public, private, and hybrid clouds, coupled with diverse service types (SaaS, PaaS, IaaS), creates a security landscape rife with configuration challenges. Each layer adds complexity, increasing the risk of misconfigurations, inconsistent policy enforcement, and gaps in defenses – all of which attackers may exploit.
Dynamic nature of cloud Cloud infrastructures are designed to scale resources on demand, but this fluidity poses significant challenges to threat detection and incident response. Changes in configurations, ephemeral workloads, and fluctuating access points mean that on-prem network security mindsets cannot be applied to cloud security and many traditional cloud security approaches still fall short in addressing threats in real time.
Looking forward: Protecting the cloud in 2025 and beyond
Addressing these challenges requires innovation in visibility tools, AI-driven threat detection, and policy automation. The future of cloud security hinges on solutions that adapt to complexity and scale, ensuring organizations can securely navigate the growing demands of cloud-first operations.
Unlike supervised ML, which relies on labeled datasets, unsupervised ML identifies patterns and deviations in data without predefined rules, making it particularly effective in dynamic and unpredictable environments like the cloud. By analyzing the baseline behavior in cloud environments, such as typical user activity, network traffic, and resource utilization, unsupervised ML and supporting models can identify behavioral deviations linked to suspicious activity like unusual login times, irregular API calls, or unexpected data transfers, therefore flagging them as potential threats.
Learn more about how multi-layered ML improves real-time cloud detection and response in the data sheet “AI enhances cloud security.”
Agent vs. Agentless deployment
The future of cloud security is increasingly focused on combining agent-based and agentless solutions to address the complexities of hybrid and multi-cloud environments.
This integrated approach enables organizations to align security measures with the specific risks and operational needs of their assets, ensuring comprehensive protection.
Agent-based systems provide deep monitoring and active threat mitigation, making them ideal for high-security environments like financial services and healthcare, where compliance and sensitive data require stringent safeguards.
Meanwhile, agentless systems offer broad visibility and scalability, seamlessly covering dynamic cloud resources without the need for extensive deployment efforts.
Together, a combination of these approaches ensures that all parts of the cloud environment are protected according to their unique risk profiles and functional requirements.
The growing adoption of this strategy highlights a shift toward adaptive, scalable, and efficient security solutions, reflecting the priorities of a rapidly evolving cloud landscape.
Shifting responsibilities: security teams must get more comfortable with cloud mindsets
Traditionally, many organizations left cloud security to dedicated cloud teams. However, it is becoming more and more common for security teams to take on the responsibilities of securing the cloud. This is also true of organizations undergoing cloud migration and spinning up cloud infrastructure for the first time.
Notably, the usual approaches to other types of cybersecurity can’t be applied the exact same way to the cloud. With the inherent dynamism and flexibility of the cloud, the necessary security mindset differs greatly from those for the network or datacenters, with which security teams may be more familiar.
For example, IAM is both critical and distinct to cloud computing, and the associated policies, rules, and downstream impacts require intentional care. IAM rules not only govern people, but also non-human entities like service accounts, API keys, and OAuth tokens. These considerations are unique to cloud security, and established teams may need to learn new skills to reduce security gaps in the cloud.
The importance of visibility: The future of network security in the cloud
As organizations transition to cloud environments, they still have much of their data in on-premises networks, meaning that maintaining visibility across both on-premises and cloud environments is essential for securing critical assets and ensuring seamless operations. Without a unified security strategy, gaps between these infrastructures and the teams which manage them can leave organizations vulnerable to cyber-attacks.
Shared visibility across both on-premises and cloud environments unifies SecOps and DevOps teams, enabling them to generate actionable insights and develop a cohesive approach. This alignment helps confidently mitigate risks across the cloud and network while streamlining workflows and accelerating the cloud migration journey—all without compromising security or operational continuity.
