Blog
/
/
October 21, 2020

Protecting Healthcare Organizations from Maze Ransomware

Discover how Darktrace detected and protected a healthcare organization from a Maze ransomware attack. Stay informed and protect your data today.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
21
Oct 2020

Ransomware, with more severe consequences and against increasingly high-stakes targets, continues to cause chaos and disruption to organizations globally. Earlier this year saw a surge in a strain of ransomware known as ‘Maze’, which shut down operations at leading optical products provider Canon and wreaked havoc in Fortune 500 companies like Cognizant.

Ransomware targeting healthcare

Just last month, news of a woman in Germany dying after a ransomware attack on the Dusseldorf University Hospital hit the headlines, confirming that the threat to people is no longer theoretical.

Ransomware affects all industries but 2020 has seen cyber-criminals increasingly hit essential services like healthcare, local government and critical infrastructure – intentionally or as collateral damage. As the stakes rise, so too does the need to understand how to prevent these devastating and pervasive attacks.

Once deployed, ransomware can spread laterally through an organization’s digital infrastructure in seconds, taking entire systems offline in minutes. Attackers often strike at night or at weekends, when they know security teams’ response time will be slower. Machine-speed attacks require machine-speed defenses that can detect and respond to this threat without human guidance, and autonomously block the threat.

This blog explains how AI detects and stops ransomware by learning ‘normal’ across the digital estate – from email and SaaS applications to the network, cloud, IoT and industrial control systems – by looking at an example of a Maze ransomware attack caught by Darktrace in a customer’s environment.

Darktrace’s Immune System detected the threat as soon as it emerged, but as the Autonomous Response capability was configured in passive mode, neutralizing the threat still required human action. This means that attackers were able to move laterally across the organization at speed and began to encrypt files before the security team stepped in. In active mode, Antigena Network would have contained the activity in its earliest stages.

How does Darktrace detect ransomware like Maze?

As soon as Darktrace is deployed – whether virtually or on-premise – the AI begins to learn the ‘pattern of life’ for every user and device across the organization. This enables the technology to detect anomalous activity indicative of a cyber-threat. It does this without relying on hard-coded rules and signatures; an approach that requires a ‘Patient Zero’ before updating these lists and containing subsequent identical threats. When it comes to a novel instance of ransomware spreading across an organization and infecting hundreds of devices in seconds, such an approach becomes useless.

With an understanding of the organization’s ‘pattern of life’, Darktrace’s AI recognizes unusual activity in real time. Such activity might include:

ActivityDarktrace detectionsUnusual downloads from C2 serversEXE from Rare Destination / Masqueraded File TransferBrute forcing publicly accessible RDP serversIncoming RDP brute force modelsBrute forcing access to web portal user accounts with weak passwords or lacking MFAVarious brute force modelsC2 via Cobalt Strike / Empire PowershellSSL Beaconing to Rare Endpoint / Empire Powershell and Cobalt Strike modelsNetwork scanning for reconnaissance & EternalBlue exploitSuspicious Network Scan model known to download Advanced IP Scanner after successful exploitMimikatz usage for privilege escalationUnusual Admin SMB Session / Unusual RDP Admin Session (Procdump, PingCastle, and Bloodhound)Psexec / ‘Living off the Land’ for lateral movementUnusual Remote Command Execution / Unusual PSexec / Unusual DCE RPCData exfiltration to C2 serversData Sent to Rare Domain / Unusual Internal Download / Unusual External UploadEncryptionSuspicious SMB Activity / Additional File Extensions AppendedExfiltration of passwords through various cloud storage servicesData Sent to New External DomainRDP tunnels using NgrokOutbound RDP / Various beaconing models

In addition, Darktrace is able to identify attempts to brute force access on Internet-facing servers. It can also detect specific searches for passwords stored in plain text as well as various password manager databases.

Maze ransomware analysis

Figure 1: A timeline of the attack

Most recently, Darktrace’s AI detected a case of Maze ransomware targeting a healthcare organization. Darktrace’s Immune System spotted every stage of the attack lifecycle within seconds, and the Cyber AI Analyst immediately launched an automated investigation of the full incident, surfacing a natural-language, actionable summary for the security team.

The initial infection vector was spear phishing. Maze is frequently delivered to healthcare organizations using pandemic-themed phishing emails. Darktrace also offers AI-powered email security that understands normal behavior for every Microsoft 365 user and spots anomalies that are indicative of phishing, but in the absence of this protection, the emails were waved through by traditional gateways.

The attacker began engaging in network scanning activity and enumeration to escalate access within the Research and Development subnet. Darktrace’s AI detected a successful compromise of admin level credentials, unusual RDP activities and multiple Kerberos authentication attempts.

Darktrace detected the attacker uploading a domain controller, before batch files were written to multiple file shares, which were used for the encryption process.

An infected device then connected to a suspicious domain that is associated to Maze mazedecrypt[.]top and the TOR browser bundle was downloaded, likely for C2 purposes. A large volume of sensitive data from the R&D subnet was then uploaded to a rare domain. This is typical of Maze ransomware, which is seen as a ‘double threat’ in that it not only seeks to encrypt critical files but also sends a copy of them back to the attacker.

This form of attack, also known as doxware, then provides the attacker with leverage in the possible event that the organization refused to pay the ransom – they can sell the data on the Dark Web, or threaten to leak intellectual property to competitors, for instance.

Real-time automated investigations with Cyber AI Analyst

Throughout the attack lifecycle, multiple high-fidelity alerts were generated by Darktrace AI and this prompted the Cyber AI Analyst to automatically launch an investigation in the background, stitching together the different events into a single, comprehensive security incident, which it then displayed for human review in a single screen.

Figure 2: The data exfiltration to a rare external domain

Figure 3: Darktrace’s user interface highlighting the unusual activity and model breaches on a domain controller directly linked with the ransomware attack

Targeted, double-threat attacks like Maze ransomware are on the rise and extremely dangerous – and they are increasingly targeting high-stakes environments. Thousands of organizations are turning to AI, not only to detect and investigate on ransomware intrusions as demonstrated above, but to autonomously respond to events as they occur. Ransomware attacks like these show organizations why autonomous response in active mode is not just a nice to have – but necessary – as fast-moving threats demand machine-speed responses.

In a previous blog, we looked at a novel zero-day ransomware attack that slipped through legacy security tools – but Antigena Network was configured in active mode, autonomously stopping the threat in its tracks. This unique capability is becoming crucial for organizations in every industry who find themselves targeted by increasingly sophisticated attack methods.

Thanks to Darktrace analyst Adam Stevens for his insights on the above threat find.

Learn more about Autonomous Response

Darktrace model detections

  • Device / Suspicious Network Scan Activity
  • Device / Network Scan
  • Device / ICMP Address Scan
  • Unusual Activity / Unusual Internal Connections
  • Device / Multiple Lateral Movement Model Breaches
  • Experimental / Executable Uploaded to DC
  • Compromise / Ransomware::Suspicious SMB Activity
  • Compromise / Ransomware::Ransom or Offensive Words Written to SMB
  • Compliance / SMB Drive Write
  • Compliance / High Priority Compliance Model Breach
  • Anomalous Connection / SMB Enumeration
  • Device / Suspicious File Writes to Multiple Hidden SMB Shares
  • Device / New or Unusual Remote Command Execution
  • Anomalous Connection / New or Uncommon Service Control
  • Anomalous Connection / SMB Enumeration
  • Experimental / Possible RPC Execution
  • Anomalous Connection / High Volume of New or Uncommon Service Control
  • Experimental / Possible Ransom Note
  • Anomalous File / Internal::Additional Extension Appended to SMB File
  • Compliance / Tor Package Download
  • Device / Suspicious Domain
  • Device / Long Agent Connection to New Endpoint
  • Anomalous Connection / Data Sent to Rare Domain

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO

More in this series

No items found.

Blog

/

/

May 2, 2025

SocGholish: From loader and C2 activity to RansomHub deployment

laptop and hand typingDefault blog imageDefault blog image

Over the past year, a clear pattern has emerged across the threat landscape: ransomware operations are increasingly relying on compartmentalized affiliate models. In these models, initial access brokers (IABs) [6], malware loaders, and post-exploitation operators work together.

Due to those specialization roles, a new generation of loader campaigns has risen. Threat actors increasingly employ loader operators to quietly establish footholds on the target network. These entities then hand off access to ransomware affiliates. One loader that continues to feature prominently in such campaigns is SocGholish.

What is SocGholish?

SocGholish is a loader malware that has been utilized since at least 2017 [7].  It has long been associated with fake browser updates and JavaScript-based delivery methods on infected websites.

Threat actors often target outdated or poorly secured CMS-based websites like WordPress. Through unpatched plugins, or even remote code execution flaws, they inject malicious JavaScript into the site’s HTML, templates or external JS resources [8].  Historically, SocGholish has functioned as a first-stage malware loader, ultimately leading to deployment of Cobalt Strike beacons [9], and further facilitating access persistence to corporate environments. More recently, multiple security vendors have reported that infections involving SocGholish frequently lead to the deployment of RansomHub ransomware [3] [5].

This blog explores multiple instances within Darktrace's customer base where SocGholish deployment led to subsequent network compromises. Investigations revealed indicators of compromise (IoCs) similar to those identified by external security researchers, along with variations in attacker behavior post-deployment. Key innovations in post-compromise activities include credential access tactics targeting authentication mechanisms, particularly through the abuse of legacy protocols like WebDAV and SCF file interactions over SMB.

Initial access and execution

Since January 2025, Darktrace’s Threat Research team observed multiple cases in which threat actors leveraged the SocGholish loader for initial access. Malicious actors commonly deliver SocGholish by compromising legitimate websites by injecting malicious scripts into the HTML of the affected site. When the visitor lands on an infected site, they are typically redirected to a fake browser update page, tricking them into downloading a ZIP file containing a JavaScript-based loader [1] [2]. In one case, a targeted user appears to have visited the compromised website garagebevents[.]com (IP: 35.203.175[.]30), from which around 10 MB of data was downloaded.

Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.
Figure 1: Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.

Within milliseconds of the connection establishment, the user’s device initiated several HTTPS sessions over the destination port 443 to the external endpoint 176.53.147[.]97, linked to the following Keitaro TDS domains:

  • packedbrick[.]com
  • rednosehorse[.]com
  • blackshelter[.]org
  • blacksaltys[.]com

To evade detection, SocGholish uses highly obfuscated code and relies on traffic distribution systems (TDS) [3].  TDS is a tool used in digital and affiliate marketing to manage and distribute incoming web traffic based on predefined rules. More specifically, Keitaro is a premium self-hosted TDS frequently utilized by attackers as a payload repository for malicious scripts following redirects from compromised sites. In the previously noted example, it appears that the device connected to the compromised website, which then retrieved JavaScript code from the aforementioned Keitaro TDS domains. The script served by those instances led to connections to the endpoint virtual.urban-orthodontics[.]com (IP: 185.76.79[.]50), successfully completing SocGholish’s distribution.

Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.
Figure 2: Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.

Persistence

During some investigations, Darktrace researchers observed compromised devices initiating HTTPS connections to the endpoint files.pythonhosted[.]org (IP: 151.101.1[.]223), suggesting Python package downloads. External researchers have previously noted how attackers use Python-based backdoors to maintain access on compromised endpoints following initial access via SocGholish [5].

Credential access and lateral movement

Credential access – external

Darktrace researchers identified observed some variation in kill chain activities following initial access and foothold establishment. For example, Darktrace detected interesting variations in credential access techniques. In one such case, an affected device attempted to contact the rare external endpoint 161.35.56[.]33 using the Web Distributed Authoring and Versioning (WebDAV) protocol. WebDAV is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. WebDAV enables remote shares to be mounted over HTTP or HTTPS, similar to how SMB operates, but using web-based protocols. Windows supports WebDAV natively, which means a UNC path pointing to an HTTP or HTTPS resource can trigger system-level behavior such as authentication.

In this specific case, the system initiated outbound connections using the ‘Microsoft-WebDAV-MiniRedir/10.0.19045’ user-agent, targeting the URI path of /s on the external endpoint 161.35.56[.]33. During these requests, the host attempted to initiate NTML authentication and even SMB sessions over the web, both of which failed. Despite the session failures, these attempts also indicate a form of forced authentication. Forced authentication exploits a default behavior in Windows where, upon encountering a UNC path, the system will automatically try to authenticate to the resource using NTML – often without any user interaction. Although no files were directly retrieved, the WebDAV server was still likely able to retrieve the user’s NTLM hash during the session establishment requests, which can later be used by the adversary to crack the password offline.

Credential access – internal

In another investigated incident, Darktrace observed a related technique utilized for credential access and lateral movement. This time, the infected host uploaded a file named ‘Thumbs.scf’ to multiple internal SMB network shares. Shell Command File ( SCF) is a legacy Windows file format used primarily for Windows Explorer shortcuts. These files contain instructions for rendering icons or triggering shell commands, and they can be executed implicitly when a user simply opens a folder containing the file – no clicks required.

The ‘Thumbs.scf’ file dropped by the attacker was crafted to exploit this behavior. Its contents included a [Shell] section with the Command=2 directive and an IconFile path pointing to a remote UNC resource on the same external endpoint, 161.35.56[.]33, seen in the previously described case – specifically, ‘\\161.35.56[.]33\share\icon.ico’. When a user on the internal network navigates to the folder containing the SCF file, their system will automatically attempt to load the icon. In doing so, the system issues a request to the specified UNC path, which again prompts Windows to initiate NTML authentication.

This pattern of activity implies that the attacker leveraged passive internal exposure; users who simply browsed a compromised share would unknowingly send their NTML hashes to an external attacker-controlled host. Unlike the WebDAV approach, which required initiating outbound communication from the infected host, this SCF method relies on internal users to interact with poisoned folders.

Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.
Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.

Command-and-control

Following initial compromise, affected devices would then attempt outbound connections using the TLS/SSL protocol over port 443 to different sets of command-and-control (C2) infrastructure associated with SocGholish. The malware frequently uses obfuscated JavaScript loaders to initiate its infection chain, and once dropped, the malware communicates back to its infrastructure over standard web protocols, typically using HTTPS over port 443. However, this set of connections would precede a second set of outbound connections, this time to infrastructure linked to RansomHub affiliates, possibly facilitating the deployed Python-based backdoor.

Connectivity to RansomHub infrastructure relied on defense evasion tactics, such as port-hopping. The idea behind port-hopping is to disguise C2 traffic by avoiding consistent patterns that might be caught by firewalls, and intrusion detection systems. By cycling through ephemeral ports, the malware increases its chances of slipping past basic egress filtering or network monitoring rules that only scrutinize common web traffic ports like 443 or 80. Darktrace analysts identified systems connecting to destination ports such as 2308, 2311, 2313 and more – all on the same destination IP address associated with the RansomHub C2 environment.

Figure 4: Advanced Search connection logs showing connections over destination ports that change rapidly.

Conclusion

Since the beginning of 2025, Darktrace analysts identified a campaign whereby ransomware affiliates leveraged SocGholish to establish network access in victim environments. This activity enabled multiple sets of different post exploitation activity. Credential access played a key role, with affiliates abusing WebDAV and NTML over SMB to trigger authentication attempts. The attackers were also able to plant SCF files internally to expose NTML hashes from users browsing shared folders. These techniques evidently point to deliberate efforts at early lateral movement and foothold expansion before deploying ransomware. As ransomware groups continue to refine their playbooks and work more closely with sophisticated loaders, it becomes critical to track not just who is involved, but how access is being established, expanded, and weaponized.

Credit to Chrisina Kreza (Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

Appendices

Darktrace / NETWORK model alerts

·       Anomalous Connection / SMB Enumeration

·       Anomalous Connection / Multiple Connections to New External TCP Port

·       Anomalous Connection / Multiple Failed Connections to Rare Endpoint

·       Anomalous Connection / New User Agent to IP Without Hostname

·       Compliance / External Windows Communication

·       Compliance / SMB Drive Write

·       Compromise / Large DNS Volume for Suspicious Domain

·       Compromise / Large Number of Suspicious Failed Connections

·       Device / Anonymous NTML Logins

·       Device / External Network Scan

·       Device / New or Uncommon SMB Named Pipe

·       Device / SMB Lateral Movement

·       Device / Suspicious SMB Activity

·       Unusual Activity / Unusual External Activity

·       User / Kerberos Username Brute Force

MITRE ATT&CK mapping

·       Credential Access – T1187 Forced Authentication

·       Credential Access – T1110 Brute Force

·       Command and Control – T1071.001 Web Protocols

·       Command and Control – T1571 Non-Standard Port

·       Discovery – T1083 File and Directory Discovery

·       Discovery – T1018 Remote System Discovery

·       Discovery – T1046 Network Service Discovery

·       Discovery – T1135 Network Share Discovery

·       Execution – T1059.007 JavaScript

·       Lateral Movement – T1021.002 SMB/Windows Admin Shares

·       Resource Deployment – T1608.004 Drive-By Target

List of indicators of compromise (IoCs)

·       garagebevents[.]com – 35.203.175[.]30 – Possibly compromised website

·       packedbrick[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       rednosehorse[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       blackshelter[.]org – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       blacksaltys[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       virtual.urban-orthodontics[.]com – 185.76.79[.]50

·       msbdz.crm.bestintownpro[.]com – 166.88.182[.]126 – SocGholish C2

·       185.174.101[.]240 – RansomHub Python C2

·       185.174.101[.]69 – RansomHub Python C2

·       108.181.182[.]143 – RansomHub Python C2

References

[1] https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/socgholish-malware/

[2] https://intel471.com/blog/threat-hunting-case-study-socgholish

[3] https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html

[4] https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware

[5] https://www.guidepointsecurity.com/blog/ransomhub-affiliate-leverage-python-based-backdoor/

[6] https://www.cybereason.com/blog/how-do-initial-access-brokers-enable-ransomware-attacks

[7] https://attack.mitre.org/software/S1124/

[8] https://expel.com/blog/incident-report-spotting-socgholish-wordpress-injection/

[9] https://www.esentire.com/blog/socgholish-to-cobalt-strike-in-10-minutes

Continue reading
About the author
Christina Kreza
Cyber Analyst

Blog

/

/

May 1, 2025

Your Vendors, Your Risk: Rethinking Third-Party Security in the Age of Supply Chain Attacks

man on cellphoneDefault blog imageDefault blog image

When most people hear the term supply chain attack, they often imagine a simple scenario: one organization is compromised, and that compromise is used as a springboard to attack another. This kind of lateral movement is common, and often the entry vector is as mundane and as dangerous as email.

Take, for instance, a situation where a trusted third-party vendor is breached. An attacker who gains access to their systems can then send malicious emails to your organization, emails that appear to come from a known and reputable source. Because the relationship is trusted, traditional phishing defenses may not be triggered, and recipients may be more inclined to engage with malicious content. From there, the attacker can establish a foothold, move laterally, escalate privileges, and launch a broader campaign.

This is one dimension of a supply chain cyber-attack, and it’s well understood in many security circles. But the risk doesn’t end there. In fact, it goes deeper, and it often hits the most important asset of all: your customers' data.

The risk beyond the inbox

What happens when customer data is shared with a third party for legitimate processing purposes for example billing, analytics, or customer service and that third party is then compromised?

In that case, your customer data is breached, even if your own systems were never touched. That’s the uncomfortable truth about modern cybersecurity: your risk is no longer confined to your own infrastructure. Every entity you share data with becomes an extension of your attack surface. Thus, we should rethink how we perceive responsibility.

It’s tempting to think that securing our environment is our job, and securing their environment is theirs. But if a breach of their environment results in the exposure of our customers, the accountability and reputational damage fall squarely on our shoulders.

The illusion of boundaries

In an era where digital operations are inherently interconnected, the lines of responsibility can blur quickly. Legally and ethically, organizations are still responsible for the data they collect even if that data is processed, stored, or analyzed by a third party. A customer whose data is leaked because of a vendor breach will almost certainly hold the original brand responsible, not the third-party processor they never heard of.

This is particularly important for industries that rely on extensive outsourcing and platform integrations (SaaS platforms, marketing tools, CRMs, analytics platforms, payment processors). The list of third-party vendors with access to customer data grows year over year. Each integration adds convenience, but also risk.

Encryption isn’t a silver bullet

One of the most common safeguards used in these data flows is encryption. Encrypting customer data in transit is a smart and necessary step, but it’s far from enough. Once data reaches the destination system, it typically needs to be decrypted for use. And the moment it is decrypted, it becomes vulnerable to a variety of attacks like ransomware, data exfiltration, privilege escalation, and more.

In other words, the question isn’t just is the data secure in transit? The more important question is how is it protected once it arrives?

A checklist for organizations evaluating third-parties

Given these risks, what should responsible organizations do when they need to share customer data with third parties?

Start by treating third-party security as an extension of your own security program. Here are some foundational controls that can make a difference:

Due diligence before engagement: Evaluate third-party vendors based on their security posture before signing any contracts. What certifications do they hold? What frameworks do they follow? What is their incident response capability?

Contractual security clauses: Build in specific security requirements into vendor contracts. These can include requirements for encryption standards, access control policies, and data handling protocols.

Third-party security assessments: Require vendors to provide evidence of their security controls. Independent audits, penetration test results, and SOC 2 reports can all provide useful insights.

Ongoing monitoring and attestations: Security isn’t static. Make sure vendors provide regular security attestations and reports. Where possible, schedule periodic reviews or audits, especially for vendors handling sensitive data.

Minimization and segmentation: Don’t send more data than necessary. Data minimization limits the exposure in the event of a breach. Segmentation, both within your environment and within vendor access levels, can further reduce risk.

Incident response planning: Ensure you have a playbook for handling third-party incidents, and that vendors do as well. Coordination in the event of a breach should be clear and rapid.

The human factor: Customers and communication

There’s another angle to supply chain cyber-attacks that’s easy to overlook: the post-breach exploitation of public knowledge. When a breach involving customer data hits the news, it doesn’t take long for cybercriminals to jump on the opportunity.

Attackers can craft phishing emails that appear to be follow-ups from the affected organization: “Click here to reset your password,” “Confirm your details due to the breach,” etc.

A breach doesn’t just put customer data at risk it also opens the door to further fraud, identity theft, and financial loss through social engineering. This is why post-breach communication and phishing mitigation strategies are valuable components of an incident response strategy.

Securing what matters most

Ultimately, protecting against supply chain cyber-attacks isn’t just about safeguarding your own perimeter. It’s about defending the integrity of your customers’ data, wherever it goes. When customer data is entrusted to you, the duty of care doesn’t end at your firewall.

Relying on vendors to “do their part” is not enough. True due diligence means verifying, validating, and continuously monitoring those extended attack surfaces. It means designing controls that assume failure is possible, and planning accordingly.

In today’s threat landscape, cybersecurity is no longer just a technical discipline. It’s a trust-building exercise. Your customers expect you to protect their information, and rightly so. And when a supply chain attack happens, whether the breach originated with you or your partner, the damage lands in the same place: your brand, your customers, your responsibility.

[related-resource]

Continue reading
About the author
Tony Jarvis
VP, Field CISO | Darktrace
Your data. Our AI.
Elevate your network security with Darktrace AI