AI is everywhere, predominantly because it has changed the way humans interact with data. AI is a powerful tool for data analytics, predictions, and recommendations, but accuracy, safety, and security are paramount for operationalization.

In cybersecurity, AI-powered solutions are becoming increasingly necessary to keep up with modern business complexity and this new age of cyber-threat, marked by attacker innovation, use of AI, speed, and scale. The emergence of these new threats calls for a varied and layered approach in AI security technology to anticipate asymmetric threats.

While many cybersecurity vendors are adding AI to their products, they are not always communicating the capabilities or data used clearly. This is especially the case with Large Language Models (LLMs). Many products are adding interactive and generative capabilities which do not necessarily increase the efficacy of detection and response but rather are aligned with enhancing the analyst and security team experience and data retrieval.

Consequently, many  people erroneously conflate generative AI with other types of AI. Similarly, only 31% of security professionals report that they are “very familiar” with supervised machine learning, the type of AI most often applied in today’s cybersecurity solutions to identify threats using attack artifacts and facilitate automated responses. This confusion around AI and its capabilities can result in suboptimal cybersecurity measures, overfitting, inaccuracies due to ineffective methods/data, inefficient use of resources, and heightened exposure to advanced cyber threats.

Vendors must cut through the AI market and demystify the technology in their products for safe, secure, and accurate adoption. To that end, let’s discuss common AI techniques in cybersecurity as well as how Darktrace applies them.

Modernizing cybersecurity with AI

Machine learning has presented a significant opportunity to the cybersecurity industry, and many vendors have been using it for years. Despite the high potential benefit of applying machine learning to cybersecurity, not every AI tool or machine learning model is equally effective due to its technique, application, and data it was trained on.

Supervised machine learning and cybersecurity

Supervised machine models are trained on labeled, structured data to facilitate automation of a human-led trained tasks. Some cybersecurity vendors have been experimenting with supervised machine learning for years, with most automating threat detection based on reported attack data using big data science, shared cyber-threat intelligence, known or reported attack behavior, and classifiers.

In the last several years, however, more vendors have expanded into the behavior analytics and anomaly detection side. In many applications, this method separates the learning, when the behavioral profile is created (baselining), from the subsequent anomaly detection. As such, it does not learn continuously and requires periodic updating and re-training to try to stay up to date with dynamic business operations and new attack techniques. Unfortunately, this opens the door for a high rate of daily false positives and false negatives.

Unsupervised machine learning and cybersecurity

Unlike supervised approaches, unsupervised machine learning does not require labeled training data or human-led training. Instead, it independently analyzes data to detect compelling patterns without relying on knowledge of past threats. This removes the dependency of human input or involvement to guide learning.

However, it is constrained by input parameters, requiring a thoughtful consideration of technique and feature selection to ensure the accuracy of the outputs. Additionally, while it can discover patterns in data as they are anomaly-focused, some of those patterns may be irrelevant and distracting.

When using models for behavior analytics and anomaly detection, the outputs come in the form of anomalies rather than classified threats, requiring additional modeling for threat behavior context and prioritization. Anomaly detection performed in isolation can render resource-wasting false positives.

LLMs and cybersecurity

LLMs are a major aspect of mainstream generative AI, and they can be used in both supervised and unsupervised ways. They are pre-trained on massive volumes of data and can be applied to human language, machine language, and more.

With the recent explosion of LLMs in the market, many vendors are rushing to add generative AI to their products, using it for chatbots, Retrieval-Augmented Generation (RAG) systems, agents, and embeddings. Generative AI in cybersecurity can optimize data retrieval for defenders, summarize reporting, or emulate sophisticated phishing attacks for preventative security.

But, since this is semantic analysis, LLMs can struggle with the reasoning necessary for security analysis and detection consistently. If not applied responsibly, generative AI can cause confusion by “hallucinating,” meaning referencing invented data, without additional post-processing to decrease the impact or by providing conflicting responses due to confirmation bias in the prompts written by different security team members.‍

Combining techniques in a multi-layered AI approach

Each type of machine learning technique has its own set of strengths and weaknesses, so a multi-layered, multi-method approach is ideal to enhance functionality while overcoming the shortcomings of any one method.

Darktrace’s multi-layered AI engine is powered by multiple machine learning approaches, which operate in combination for cyber defense. This allows Darktrace to protect the entire digital estates of the organizations it secures, including corporate networks, cloud computing services, SaaS applications, IoT, Industrial Control Systems (ICS), and email systems.

Plugged into the organization’s infrastructure and services, our AI engine ingests and analyzes the raw data and its interactions within the environment and forms an understanding of the normal behavior, right down to the granular details of specific users and devices. The system continually revises its understanding about what is normal based on evolving evidence, continuously learning as opposed to baselining techniques.

This dynamic understanding of normal partnered with dozens of anomaly detection models means that the AI engine can identify, with a high degree of precision, events or behaviors that are both anomalous and unlikely to be benign. Understanding anomalies through the lens of many models as well as autonomously fine-tuning the models’ performances gives us a higher understanding and confidence in anomaly detection.

The next layer provides event correlation and threat behavior context to understand the risk level of an anomalous event(s). Every anomalous event is investigated by Cyber AI Analyst that uses a combination of unsupervised machine learning models to analyze logs with supervised machine learning trained on how to investigate. This provides anomaly and risk context along with investigation outcomes with explainability.

The ability to identify activity that represents the first footprints of an attacker, without any prior knowledge or intelligence, lies at the heart of the AI system’s efficacy in keeping pace with threat actor innovations and changes in tactics and techniques. It helps the human team detect subtle indicators that can be hard to spot amid the immense noise of legitimate, day-to-day digital interactions. This enables advanced threat detection with full domain visibility.

Digging deeper into AI: Mapping specific machine learning techniques to cybersecurity functions

Visibility and control are vital for the practical adoption of AI solutions, as it builds trust between human security teams and their AI tools. That is why we want to share some specific applications of AI across our solutions, moving beyond hype and buzzwords to provide grounded, technical explanations.

Darktrace’s technology helps security teams cover every stage of the incident lifecycle with a range of comprehensive analysis and autonomous investigation and response capabilities.

1. Behavioral prediction: Our AI understands your unique organization by learning normal patterns of life. It accomplishes this with multiple clustering algorithms, anomaly detection models, Bayesian meta-classifier for autonomous fine-tuning, graph theory, and more.‍
2. Real-time threat detection: With a true understanding of normal, our AI engine connects anomalous events to risky behavior using probabilistic models. 
3. ‍Investigation: Darktrace performs in-depth analysis and investigation of anomalies, in particular automating Level 1 of a SOC team and augmenting the rest of the SOC team through prioritization for human-led investigations. Some of these methods include supervised and unsupervised machine learning models, semantic analysis models, and graph theory.‍
4. Response: Darktrace calculates the proportional action to take in order to neutralize in-progress attacks at machine speed. As a result, organizations are protected 24/7, even when the human team is out of the office. Through understanding the normal pattern of life of an asset or peer group, the autonomous response engine can isolate the anomalous/risky behavior and surgically block. The autonomous response engine also has the capability to enforce the peer group’s pattern of life when rare and risky behavior continues.‍
5. Customizable model editor: This layer of customizable logic models tailors our AI’s processing to give security teams more visibility as well as the opportunity to adapt outputs, therefore increasing explainability, interpretability, control, and the ability to modify the operationalization of the AI output with auditing.

See the complete AI architecture in the paper “The AI Arsenal: Understanding the Tools Shaping Cybersecurity.”

Machine learning is the fundamental ally in cyber defense

Traditional security methods, even those that use a small subset of machine learning, are no longer sufficient, as these tools can neither keep up with all possible attack vectors nor respond fast enough to the variety of machine-speed attacks, given their complexity compared to known and expected patterns.

Security teams require advanced detection capabilities, using multiple machine learning techniques to understand the environment, filter the noise, and take action where threats are identified.

Darktrace’s multi-layered AI comes together to achieve behavioral prediction, real-time threat detection and response, and incident investigation, all while empowering your security team with visibility and control.

Download the full report

Discover specifically how Darktrace applies different types of AI to improve cybersecurity efficacy and operations in this technical paper.

‍

In a previous Inside the SOC blog, Darktrace investigated RansomHub and its growing impact on the threat landscape due to its use by the ShadowSyndicate threat group. Here, RansomHub is revisited with new insights on this ransomware-as-a-service (RaaS) platform that has rapidly gained traction among threat actors of late.

In recent months, Darktrace’s Threat Research team has noted a significant uptick in potential compromises affecting the fleet, indicating that RansomHub is becoming a preferred tool for cybercriminals.  This article delves into the increasing adoption of RansomHub, the tactics, techniques, and procedures (TTPs) employed by its affiliates, and the broader implications for organizations striving to protect their systems.

RansomHub overview & background

One notable threat group to have transitioned from ALPHV (BlackCat)-aligned operations to RansomHub-aligned operations is ScatteredSpider [1]. The adoption of RansomHub by ScatteredSpider and other threat actors suggests a possible power shift among threat groups, given the increasing number of cybercriminals adopting it, including those who previously relied on ALPHV’s malware code [2].

ALPHV was a RaaS strain used by cybercriminals to breach Change Healthcare in February 2024 [2]. However, there are claims that the ransom payment never reached the affiliate using ALPHV, leading to a loss of trust in the RaaS. Around the same time, Operation Cronos resulted in the shutdown of LockBit and the abandonment of its affiliates [2]. Consequently, RansomHub emerged as a prominent RaaS successor.

RansomHub targets

The RansomHub ransomware group has been observed targeting various sectors, including critical infrastructure, financial and government services, and the healthcare sector [4]. They use ransomware variants rewritten in GoLang to target both Windows and Linux systems [5]. RansomHub is known for employing double extortion attacks, encrypting data using “Curve25519” encryption [6].

RansomHub tactics and techniques

The attackers leverage phishing attacks and social engineering techniques to lure their victims. Once access is gained, they use sophisticated tools to maintain control over compromised networks and exploit vulnerabilities in systems like Windows, Linux, ESXI, and NAS.

In more recent RansomHub attacks, tools such as Atera and Splashtop have been used to facilitate remote access, while NetScan has been employed to discover and retrieve information about network devices [7].

External researchers have observed that RansomHub uses several legitimate tools, or a tactic known as Living-off-the-Land (LOTL), to carry out their attacks. These tools include:

• SecretServerSecretStealer: A PowerShell script that allows for the decryption of passwords [1].
• Ngrok: A legitimate reverse proxy tool that creates a secure tunnel to servers located behind firewalls, used by the group for lateral movement and data exfiltration.
• Remmina: An open-source remote desktop client for POSIX-based operating systems, enabling threat actors to access remote services [1].

By using these legitimate tools instead of traditional malware, RansomHub can avoid detection and maintain a lower profile during their operations.

Darktrace’s Coverage of RansomHub

Darktrace’s Security Operations Center (SOC) detected several notable cases of likely RansomHub activity across the customer base in recent months. In all instances, threat actors performed network scanning and brute force activities.

During the investigation of a confirmed RansomHub attack in January 2025, the Darktrace Threat Research team identified multiple authentication attempts as attackers tried to retrieve valid credentials. It is plausible that the attackers gained entry to customer environments through their Remote Desktop (RD) web server. Following this, various RDP connections were made to pivot to other devices within the network.

The common element among the cases investigated was that, in most instances, devices were seen performing outgoing connections to splashtop[.]com, a remote access and support software service, after the scanning activity had occurred. On one customer network, following this activity, the same device was seen connecting to the domain agent-api[.]atera[.]com and IP 20.37.139[.]187, which are seemingly linked to Atera, a Remote Monitoring and Management (RMM) tool.

In a separate case, a Darktrace observed a device attempting to perform SMB scanning activity, trying to connect to multiple internal devices over port 445. Cyber AI Analyst was able to detect and correlate these individual connections into a single reconnaissance incident.

Similar connections to Remote Monitoring and Management (RMM) tools were also detected in a different customer environment, as alerted by Darktrace’s SOC. Unusual connections to Splashtop and Atera were made from the alerted device. Following this, the same device was observed sending a large volume of data over SSH Rclone to a rare external endpoint on the unusual port 448, triggered multiple models in Darktrace / NETWORK.

In the cases observed, data exfiltration occurred alongside the encryption of files likely indicating double extortion tactics. In September 2024, the Darktrace’s Threat Research team identified a 6-digit alphanumeric additional extension similar to “.293ac3”. This case was closely linked to a RansomHub attack, which was also analyzed in a different blog post by Darktrace [8].

Conclusion

RansomHub exemplifies the evolving RaaS ecosystem, where threat actors capitalize on ready-made platforms to launch sophisticated attacks with ease. The activities observed highlight its growing popularity among cybercriminals. The analysis showed that the different attacks investigated followed a similar pattern of activity.

First, attackers perform reconnaissance activities, including widespread scanning from multiple devices and reverse DNS sweeps. They then use high-privileged credentials to pivot among devices and establish remote connections using RMM tools such as Atera. A common element among most attacks that reached the data encryption stage is the use of a 6-digit alphanumeric extension.

In all cases, Darktrace alerted on the unusual activities observed, creating not only model alerts but also Cyber AI Analyst incidents. Both Darktrace Security Operations Support and Darktrace Managed Threat Detection services provided 24/7 assistance to clients affected by RansomHub. The analyst team continued investigating these incidents, gathering data and IoCs seen in the RansomHub incidents, providing valuable insight and guidance throughout the process.

As RansomHub continues to gain traction, it serves as a stark reminder of the need for robust cybersecurity measures, proactive threat intelligence, and continued vigilance.

Credit to Maria Geronikolou (Cyber Analyst) and Nahisha Nobregas (Senior Cyber Analyst)

Appendices

Darktrace Model Detections

Network Reconnaissance

o   Device / Network Scan

o   Device / ICMP Address Scan

o   Device / RDP Scan

o   Device / Anomalous LDAP Root Searches

o   Anomalous Connection / SMB Enumeration

o   Device / Spike in LDAP Activity

o   Device / Suspicious Network Scan Activity

Lateral Movement

o   Device / Multiple Lateral Movement Model Alerts

o   Device / Increase in New RPC Services

o   Device / New or Uncommon WMI Activity

o   Device / Possible SMB/NTLM Brute Force

o   Device / SMB Session Brute Force (Non-Admin)

o   Device / Anomalous NTLM Brute Force

o   Compliance / Default Credential Usage

o   Compliance / Outgoing NTLM Request from DC

C2 Activity

o   Anomalous Server Activity / Outgoing from Server

o   Anomalous Connection / Multiple Connections to New External TCP Port

o   Unusual Activity / Unusual External Activity

o   Compliance / Remote Management Tool On Server

Data Exfiltration

o   Unusual Activity / Enhanced Unusual External Data Transfer

o   Anomalous Connection / Outbound SSH to Unusual Port

o   Compliance / SSH to Rare External Destination

o   Unusual Activity / Unusual External Data to New Endpoint

o   Unusual Activity / Unusual External Data Transfer

o   Attack Path Modelling / Unusual Data Transfer on Critical Attack Path

o   Compliance / Possible Unencrypted Password File On Server‍

Autonomous Response Models

-       Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

-       Antigena/Network/Insider Threat/Antigena SMB Enumeration Block

-       Antigena / Network / Significant Anomaly / Antigena Alerts Over Time Block

-       Antigena / Network / Significant Anomaly / Antigena Controlled and Model Alert

List of Indicators of Compromise (IoCs)

o   38.244.145[.]85

o   20.37.139[.]187 agent-api.atera[.]com

o   108.157.150[.]120 ps.atera[.]com

o   st-v3-univ-srs-win-3720[.]api[.]splashtop[.]com

MITRE ATT&CK Mapping

• RECONNAISSANCE T1592.004
• RECONNAISSANCE T1595.002
• DISCOVERY T1046
• DISCOVERY T1083
• DISCOVERY T1135
• DISCOVERY T1018
• INITIAL ACCESS T1190
• CREDENTIAL ACCESS T1110
• LATERAL MOVEMENT T1210
• COMMAND AND CONTROL T1001
• EXFILTRATION T1041
• EXFILTRATION T1567.002

References

[1] https://www.guidepointsecurity.com/blog/worldwide-web-an-analysis-of-tactics-and-techniques-attributed-to-scattered-spider/

[2] https://www.theregister.com/2024/07/16/scattered_spider_ransom/

[3] https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/

[4] https://thehackernews.com/2024/09/ransomhub-ransomware-group-targets-210.html

[5] https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomhub

[6] https://areteir.com/article/malware-spotlight-ransomhub-ransomware/
[7] https://www.security.com/threat-intelligence/ransomhub-knight-ransomware

[8] https://darktrace.com/blog/ransomhub-ransomware-darktraces-investigation-of-the-newest-tool-in-shadowsyndicates-arsenal