Blog
/
Network
/
June 10, 2024

Darktrace Investigation Into Medusa Ransomware

See how Darktrace empowers organizations to fight back against Medusa ransomware, enhancing their cybersecurity posture with advanced technology.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Maria Geronikolou
Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
10
Jun 2024

What is Living off the Land attack?

In the face of increasingly vigilant security teams and adept defense tools, attackers are continually looking for new ways to circumvent network security and gain access to their target environments. One common tactic is the leveraging of readily available utilities and services within a target organization’s environment in order to move through the kill chain; a popular method known as living off the land (LotL). Rather than having to leverage known malicious tools or write their own malware, attackers are able to easily exploit the existing infrastructure of their targets.

The Medusa ransomware group in particular are known to extensively employ LotL tactics, techniques and procedures (TTPs) in their attacks, as one Darktrace customer in the US discovered in early 2024.

What is Medusa Ransomware?

Medusa ransomware (not to be confused with MedusaLocker) was first observed in the wild towards the end of 2022 and has been a popular ransomware strain amongst threat actors since 2023 [1]. Medusa functions as a Ransomware-as-a-Service (RaaS) platform, providing would-be attackers, also know as affiliates, with malicious software and infrastructure required to carry out disruptive ransomware attacks. The ransomware is known to target organizations across many different industries and countries around the world, including healthcare, education, manufacturing and retail, with a particular focus on the US [2].

How does Medusa Ransomware work?

Medusa affiliates are known to employ a number of TTPs to propagate their malware, most predominantly gaining initial access by exploiting vulnerable internet-facing assets and targeting valid local and domain accounts that are used for system administration.

The ransomware is typically delivered via phishing and spear phishing campaigns containing malicious attachments [3] [4], but it has also been observed using initial access brokers to access target networks [5]. In terms of the LotL strategies employed in Medusa compromises, affiliates are often observed leveraging legitimate services like the ConnectWise remote monitoring and management (RMM) software and PDQ Deploy, in order to evade the detection of security teams who may be unable to distinguish the activity from normal or expected network traffic [2].

According to researchers, Medusa has a public Telegram channel that is used by threat actors to post any data that may have been stolen, likely in an attempt to extort organizations and demand payment [2].  

Darktrace’s Coverage of Medusa Ransomware

Established Foothold and C2 activity

In March 2024, Darktrace / NETWORK identified over 80 devices, including an internet facing domain controller, on a customer network performing an unusual number of activities that were indicative of an emerging ransomware attack. The suspicious behavior started when devices were observed making HTTP connections to the two unusual endpoints, one of which is “go-sw6-02.adventos[.]de”, with the PowerShell and JWrapperDownloader user agents.

Darktrace’s Cyber AI Analyst™ launched an autonomous investigation into the connections and was able to connect the seemingly separate events into one wider incident spanning multiple different devices. This allowed the customer to visualize the activity in chronological order and gain a better understanding of the scope of the attack.

At this point, given the nature and rarity of the observed activity, Darktrace /NETWORK's autonomous response would have been expected to take autonomous action against affected devices, blocking them from making external connections to suspicious locations. However, autonomous response was not configured to take autonomous action at the time of the attack, meaning any mitigative actions had to be manually approved by the customer’s security team.

Internal Reconnaissance

Following these extensive HTTP connections, between March 1 and 7, Darktrace detected two devices making internal connection attempts to other devices, suggesting network scanning activity. Furthermore, Darktrace identified one of the devices making a connection with the URI “/nice ports, /Trinity.txt.bak”, indicating the use of the Nmap vulnerability scanning tool. While Nmap is primarily used legitimately by security teams to perform security audits and discover vulnerabilities that require addressing, it can also be leveraged by attackers who seek to exploit this information.

Darktrace / NETWORK model alert showing the URI “/nice ports, /Trinity.txt.bak”, indicating the use of Nmap.
Figure 1: Darktrace /NETWORK model alert showing the URI “/nice ports, /Trinity.txt.bak”, indicating the use of Nmap.

Darktrace observed actors using multiple credentials, including “svc-ndscans”, which was also seen alongside DCE-RPC activity that took place on March 1. Affected devices were also observed making ExecQuery and ExecMethod requests for IWbemServices. ExecQuery is commonly utilized to execute WMI Query Language (WQL) queries that allow the retrieval of information from WI, including system information or hardware details, while ExecMethod can be used by attackers to gather detailed information about a targeted system and its running processes, as well as a tool for lateral movement.

Lateral Movement

A few hours after the first observed scanning activity on March 1, Darktrace identified a chain of administrative connections between multiple devices, including the aforementioned internet-facing server.

Cyber AI Analyst was able to connect these administrative connections and separate them into three distinct ‘hops’, i.e. the number of administrative connections made from device A to device B, including any devices leveraged in between. The AI Analyst investigation was also able to link the previously detailed scanning activity to these administrative connections, identifying that the same device was involved in both cases.

Cyber AI Analyst investigation into the chain of lateral movement activity.
Figure 2: Cyber AI Analyst investigation into the chain of lateral movement activity.

On March 7, the internet exposed server was observed transferring suspicious files over SMB to multiple internal devices. This activity was identified as unusual by Darktrace compared to the device's normal SMB activity, with an unusual number of executable (.exe) and srvsvc files transferred targeting the ADMIN$ and IPC$ shares.

Cyber AI Analyst investigation into the suspicious SMB write activity.
Figure 3: Cyber AI Analyst investigation into the suspicious SMB write activity.
Graph highlighting the number of successful SMB writes and the associated model alerts.
Figure 4: Graph highlighting the number of successful SMB writes and the associated model alerts.

The threat actor was also seen writing SQLite3*.dll files over SMB using a another credential this time. These files likely contained the malicious payload that resulted in the customer’s files being encrypted with the extension “.s3db”.

Darktrace’s visibility over an affected device performing successful SMB writes.
Figure 5: Darktrace’s visibility over an affected device performing successful SMB writes.

Encryption of Files

Finally, Darktrace observed the malicious actor beginning to encrypt and delete files on the customer’s environment. More specifically, the actor was observed using credentials previously seen on the network to encrypt files with the aforementioned “.s3db” extension.

Darktrace’s visibility over the encrypted files.
Figure 6: Darktrace’s visibility over the encrypted files.


After that, Darktrace observed the attacker encrypting  files and appending them with the extension “.MEDUSA” while also dropping a ransom note with the file name “!!!Read_me_Medusa!!!.txt”

Darktrace’s detection of threat actors deleting files with the extension “.MEDUSA”.
Figure 7: Darktrace’s detection of threat actors deleting files with the extension “.MEDUSA”.
Darktrace’s detection of the Medusa ransom note.
Figure 8: Darktrace’s detection of the Medusa ransom note.

At the same time as these events, Darktrace observed the attacker utilizing a number of LotL techniques including SSL connections to “services.pdq[.]tools”, “teamviewer[.]com” and “anydesk[.]com”. While the use of these legitimate services may have bypassed traditional security tools, Darktrace’s anomaly-based approach enabled it to detect the activity and distinguish it from ‘normal’ network activity. It is highly likely that these SSL connections represented the attacker attempting to exfiltrate sensitive data from the customer’s network, with a view to using it to extort the customer.

Cyber AI Analyst’s detection of “services.pdq[.]tools” usage.
Figure 9: Cyber AI Analyst’s detection of “services.pdq[.]tools” usage.

If this customer had been subscribed to Darktrace's Proactive Threat Notification (PTN) service at the time of the attack, they would have been promptly notified of these suspicious activities by the Darktrace Security Operation Center (SOC). In this way they could have been aware of the suspicious activities taking place in their infrastructure before the escalation of the compromise. Despite this, they were able to receive assistance through the Ask the Expert service (ATE) whereby Darktrace’s expert analyst team was on hand to assist the customer by triaging and investigating the incident further, ensuring the customer was well equipped to remediate.  

As Darktrace /NETWORK's autonomous response was not enabled in autonomous response mode, this ransomware attack was able to progress to the point of encryption and data exfiltration. Had autonomous response been properly configured to take autonomous action, Darktrace would have blocked all connections by affected devices to both internal and external endpoints, as well as enforcing a previously established “pattern of life” on the device to stop it from deviating from its expected behavior.

Conclusion

The threat actors in this Medusa ransomware attack attempted to utilize LotL techniques in order to bypass human security teams and traditional security tools. By exploiting trusted systems and tools, like Nmap and PDQ Deploy, attackers are able to carry out malicious activity under the guise of legitimate network traffic.

Darktrace’s Self-Learning AI, however, allows it to recognize the subtle deviations in a device’s behavior that tend to be indicative of compromise, regardless of whether it appears legitimate or benign on the surface.

Further to the detection of the individual events that made up this ransomware attack, Darktrace’s Cyber AI Analyst was able to correlate the activity and collate it under one wider incident. This allowed the customer to track the compromise and its attack phases from start to finish, ensuring they could obtain a holistic view of their digital environment and remediate effectively.

[related-resource]

Appendices

Credit to Maria Geronikolou, Cyber Analyst, Ryan Traill, Threat Content Lead

Darktrace DETECT Model Detections

Anomalous Connection / SMB Enumeration

Device / Anomalous SMB Followed By Multiple Model Alerts

Device / Suspicious SMB Scanning Activity

Device / Attack and Recon Tools

Device / Suspicious File Writes to Multiple Hidden SMB Share

Compromise / Ransomware / Ransom or Offensive Words Written to SMB

Device / Internet Facing Device with High Priority Alert

Device / Network Scan

Anomalous Connection / Powershell to Rare External

Device / New PowerShell User Agent

Possible HTTP Command and Control

Extensive Suspicious DCE-RPC Activity

Possible SSL Command and Control to Multiple Endpoints

Suspicious Remote WMI Activity

Scanning of Multiple Devices

Possible Ransom Note Accessed over SMB

List of Indicators of Compromise (IoCs)

IoC – Type – Description + Confidence

207.188.6[.]17      -     IP address   -      C2 Endpoint

172.64.154[.]227 - IP address -        C2 Endpoint

go-sw6-02.adventos[.]de.  Hostname  - C2 Endpoint

.MEDUSA             -        File extension     - Extension to encrypted files

.s3db               -             File extension    -  Created file extension

SQLite3-64.dll    -        File           -               Used tool

!!!Read_me_Medusa!!!.txt - File -   Ransom note

Svc-ndscans         -         Credential     -     Possible compromised credential

Svc-NinjaRMM      -       Credential      -     Possible compromised credential

MITRE ATT&CK Mapping

Discovery  - File and Directory Discovery - T1083

Reconnaissance    -  Scanning IP            -          T1595.001

Reconnaissance -  Vulnerability Scanning -  T1595.002

Lateral Movement -Exploitation of Remote Service -  T1210

Lateral Movement - Exploitation of Remote Service -   T1210

Lateral Movement  -  SMB/Windows Admin Shares     -    T1021.002

Lateral Movement   -  Taint Shared Content          -            T1080

Execution   - PowerShell     - T1059.001

Execution  -   Service Execution   -    T1059.002

Impact   -    Data Encrypted for Impact  -  T1486

References

[1] https://unit42.paloaltonetworks.com

[2] https://thehackernews.com

[3] https://trustwave.com

[4] https://www.sangfor.com

[5] https://thehackernews.com

[6]https://any.run

Get the latest insights on emerging cyber threats

This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Maria Geronikolou
Cyber Analyst

More in this series

No items found.

Blog

/

Identity

/

May 23, 2025

From Rockstar2FA to FlowerStorm: Investigating a Blooming Phishing-as-a-Service Platform

man on computerDefault blog imageDefault blog image

What is FlowerStorm?

FlowerStorm is a Phishing-as-a-Service (PhaaS) platform believed to have gained traction following the decline of the former PhaaS platform Rockstar2FA. It employs Adversary-in-the-Middle (AitM) attacks to target Microsoft 365 credentials. After Rockstar2FA appeared to go dormant, similar PhaaS portals began to emerge under the name FlowerStorm. This naming is likely linked to the plant-themed terminology found in the HTML titles of its phishing pages, such as 'Sprout' and 'Blossom'. Given the abrupt disappearance of Rockstar2FA and the near-immediate rise of FlowerStorm, it is possible that the operators rebranded to reduce exposure [1].

External researchers identified several similarities between Rockstar2FA and FlowerStorm, suggesting a shared operational overlap. Both use fake login pages, typically spoofing Microsoft, to steal credentials and multi-factor authentication (MFA) tokens, with backend infrastructure hosted on .ru and .com domains. Their phishing kits use very similar HTML structures, including randomized comments, Cloudflare turnstile elements, and fake security prompts. Despite Rockstar2FA typically being known for using automotive themes in their HTML titles, while FlowerStorm shifted to a more botanical theme, the overall design remained consistent [1].

Despite these stylistic differences, both platforms use similar credential capture methods and support MFA bypass. Their domain registration patterns and synchronized activity spikes through late 2024 suggest shared tooling or coordination [1].

FlowerStorm, like Rockstar2FA, also uses their phishing portal to mimic legitimate login pages such as Microsoft 365 for the purpose of stealing credentials and MFA tokens while the portals are relying heavily on backend servers using top-level domains (TLDs) such as .ru, .moscow, and .com. Starting in June 2024, some of the phishing pages began utilizing Cloudflare services with domains such as pages[.]dev. Additionally, usage of the file “next.php” is used to communicate with their backend servers for exfiltration and data communication. FlowerStorm’s platform focuses on credential harvesting using fields such as email, pass, and session tracking tokens in addition to supporting email validation and MFA authentications via their backend systems [1].

Darktrace’s coverage of FlowerStorm Microsoft phishing

While multiple suspected instances of the FlowerStorm PhaaS platform were identified during Darktrace’s investigation, this blog will focus on a specific case from March 2025. Darktrace’s Threat Research team analyzed the affected customer environment and discovered that threat actors were accessing a Software-as-a-Service (SaaS) account from several rare external IP addresses and ASNs.

Around a week before the first indicators of FlowerStorm were observed, Darktrace detected anomalous logins via Microsoft Office 365 products, including Office365 Shell WCSS-Client and Microsoft PowerApps.  Although not confirmed in this instance, Microsoft PowerApps could potentially be leveraged by attackers to create phishing applications or exploit vulnerabilities in data connections [2].

Darktrace’s detection of the unusual SaaS credential use.
Figure 1: Darktrace’s detection of the unusual SaaS credential use.

Following this initial login, Darktrace observed subsequent login activity from the rare source IP, 69.49.230[.]198. Multiple open-source intelligence (OSINT) sources have since associated this IP with the FlowerStorm PhaaS operation [3][4].  Darktrace then observed the SaaS user resetting the password on the Core Directory of the Azure Active Directory using the user agent, O365AdminPortal.

Given FlowerStorm’s known use of AitM attacks targeting Microsoft 365 credentials, it seems highly likely that this activity represents an attacker who previously harvested credentials and is now attempting to escalate their privileges within the target network.

Darktrace / IDENTITY’s detection of privilege escalation on a compromised SaaS account, highlighting unusual login activity and a password reset event.
Figure 2: Darktrace / IDENTITY’s detection of privilege escalation on a compromised SaaS account, highlighting unusual login activity and a password reset event.

Notably, Darktrace’s Cyber AI Analyst also detected anomalies during a number of these login attempts, which is significant given FlowerStorm’s known capability to bypass MFA and steal session tokens.

Cyber AI Analyst’s detection of new login behavior for the SaaS user, including abnormal MFA usage.
Figure 3: Cyber AI Analyst’s detection of new login behavior for the SaaS user, including abnormal MFA usage.
Multiple login and failed login events were observed from the anomalous source IP over the month prior, as seen in Darktrace’s Advanced Search.
Figure 4: Multiple login and failed login events were observed from the anomalous source IP over the month prior, as seen in Darktrace’s Advanced Search.

In response to the suspicious SaaS activity, Darktrace recommended several Autonomous Response actions to contain the threat. These included blocking the user from making further connections to the unusual IP address 69.49.230[.]198 and disabling the user account to prevent any additional malicious activity. In this instance, Darktrace’s Autonomous Response was configured in Human Confirmation mode, requiring manual approval from the customer’s security team before any mitigative actions could be applied. Had the system been configured for full autonomous response, it would have immediately blocked the suspicious connections and disabled any users deviating from their expected behavior—significantly reducing the window of opportunity for attackers.

Figure 5: Autonomous Response Actions recommended on this account behavior; This would result in disabling the user and blocking further sign-in activity from the source IP.

Conclusion

The FlowerStorm platform, along with its predecessor, RockStar2FA is a PhaaS platform known to leverage AitM attacks to steal user credentials and bypass MFA, with threat actors adopting increasingly sophisticated toolkits and techniques to carry out their attacks.

In this incident observed within a Darktrace customer's SaaS environment, Darktrace detected suspicious login activity involving abnormal VPN usage from a previously unseen IP address, which was subsequently linked to the FlowerStorm PhaaS platform. The subsequent activity, specifically a password reset, was deemed highly suspicious and likely indicative of an attacker having obtained SaaS credentials through a prior credential harvesting attack.

Darktrace’s prompt detection of these SaaS anomalies and timely notifications from its Security Operations Centre (SOC) enabled the customer to mitigate and remediate the threat before attackers could escalate privileges and advance the attack, effectively shutting it down in its early stages.

Credit to Justin Torres (Senior Cyber Analyst), Vivek Rajan (Cyber Analyst), Ryan Traill (Analyst Content Lead)

Appendices

Darktrace Model Alert Detections

·      SaaS / Access / M365 High Risk Level Login

·      SaaS / Access / Unusual External Source for SaaS Credential Use

·      SaaS / Compromise / Login from Rare High-Risk Endpoint

·      SaaS / Compromise / SaaS Anomaly Following Anomalous Login

·      SaaS / Compromise / Unusual Login and Account Update

·      SaaS / Unusual Activity / Unusual MFA Auth and SaaS Activity

Cyber AI Analyst Coverage

·      Suspicious Access of Azure Active Directory  

·      Suspicious Access of Azure Active Directory  

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

69.49.230[.]198 – Source IP – Malicious IP Associated with FlowerStorm, Observed in Login Activity

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique  

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Cloud Service Dashboard - DISCOVERY - T1538

Compromise Accounts - RESOURCE DEVELOPMENT - T1586

Steal Web Session Cookie - CREDENTIAL ACCESS - T1539

References:

[1] https://news.sophos.com/en-us/2024/12/19/phishing-platform-rockstar-2fa-trips-and-flowerstorm-picks-up-the-pieces/

[2] https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-compromised-malicious-app

[3] https://www.virustotal.com/gui/ip-address/69.49.230.198/community

[4] https://otx.alienvault.com/indicator/ip/69.49.230.198

Continue reading
About the author
Justin Torres
Cyber Analyst

Blog

/

Network

/

May 23, 2025

Defending the Frontlines: Proactive Cybersecurity in Local Government

Default blog imageDefault blog image

Serving a population of over 165,000 citizens, this county government delivers essential services that enhance the quality of life for all of its residents in Florida, United States. From public safety and works to law enforcement, economic development, health, and community services, the county’s cybersecurity strategy plays a foundational role in protecting its citizens.

From flying blind to seeing the bigger picture

Safeguarding data from multiple systems, service providers, and citizens is a key aspect of the County’s Systems Management remit. Protecting sensitive information while enabling smooth engagement with multiple external partners poses a unique challenge; the types of data and potential threats are continuously evolving, but resources – both human and financial – remain consistently tight.

When the Chief Information Officer took on his role in 2024, building out a responsive defense-in-depth strategy was central to achieving these goals. However, with limited resources and complex needs, his small security team was struggling with high alert volumes, inefficient tools, and time-consuming investigations that frequently led nowhere.

Meanwhile, issues like insider threats, Denial of Service (DoS), and phishing attacks were growing; the inefficiencies were creating serious security vulnerabilities. As the CIO put it, he was flying blind. With so much data coming in, security analysts were in danger of missing the bigger picture.

“We would just see a single portion of data that could send us down a rabbit hole, thinking something’s going on – only to find out after spending days, weeks, or even months that it was nothing. If you’re only seeing one piece of the issue, it’s really difficult to identify whether something is a legitimate threat or a false positive.”

Local government’s unique cybersecurity challenges

According to the CIO, even with a bigger team, aligning and comparing all the data into a comprehensive, bigger picture would be a major challenge. “The thing about local government specifically is that it’s a complex security environment. We bring together a lot of different individuals and organizations, from construction workers to people who bring projects into our community to better the County. What we work with varies from day to day.”

The challenge wasn’t just about identifying threats, but also about doing so quickly enough to respond before damage was done. The CIO said this was particularly concerning when dealing with sophisticated threats: “We’re dealing with nation-state attackers nowadays, as opposed to ‘script kiddies.’ There’s no time to lose. We’ve got to have cybersecurity that can respond as quickly as they can attack.”

To achieve this, among the most critical challenges the CIO and his team needed to address were:

  • Contextual awareness and visibility across the network: The County team lacked the granular visibility needed to identify potentially harmful behaviors. The IT team needed a tool that uncovered hidden activities and provided actionable insights, with minimal manual intervention.
  • Augmenting human expertise and improving response times: Hiring additional analysts to monitor the environment is prohibitively expensive for many local governments. The IT team needed a cybersecurity solution that could augment existing skills while automating day-to-day tasks. More effective resource allocation would drive improved response times.
  • Preventing email-based threats: Phishing and malicious email links present a persistent threat. The County team needed a way to flag, identify, and hold suspicious messages automatically and efficiently. Given the team’s public service remit, contextual awareness is crucial to ensuring that no legitimate communications are accidentally blocked. Accuracy is extremely important.
  • Securing access and managing insider threats: Having already managed insider threats posed by former staff members, the IT team wanted to adopt a more proactive, deterrent-based approach towards employee IT resource use, preventing incidents before they could occur.

Proactive cybersecurity

Recognizing these challenges, the CIO and County sought AI-driven solutions capable of acting autonomously to support a lean IT team and give the big picture view needed, without getting lost in false positive alerts.

Ease of deployment was another key requirement: the CIO wanted to quickly establish a security baseline for County that would not require extensive pre-planning or disrupt existing systems. Having worked with Darktrace in previous roles, he knew the solution had the capacity to make the critical connections he was looking for, while delivering fast response times and reducing the burden on security teams.

When every second counts, we want to be as close to the same resources as our attackers are utilizing. We have got to have something that can respond as quickly as they can attack. For the County, that’s Darktrace.” – CIO, County Systems Management Department.

Closing network visibility gaps with Darktrace / NETWORK

The County chose Darktrace / NETWORK for unparalleled visibility into the County’s network. With the solution in place, the CIO and his team were able to identify and address previously hidden activities, uncovering insider threats in unexpected places. For example, one team member had installed an unauthorized anonymizer plug-in on their browser, posing a potentially serious security risk via traffic being sent out to the internet. “Darktrace immediately alerted on it,” said CIO. “We were able to deal with the threat proactively and quickly.”

Darktrace / NETWORK continuously monitored and updated its understanding of the County environment, intelligently establishing the different behaviors and network activity. The end result was a level of context awareness that enabled the team to focus on the alerts that mattered most, saving time and effort.

“Darktrace brings all the data we need together, into one picture. We’re able to see what’s going on at a glance, as opposed to spending time trying to identify real threats from false positives,” said the CIO. The ability to automate actions freed the team up to focus on more complex tasks, with 66% of network response actions being applied autonomously, taking the right action at the right time to stop the earliest signs of threatening activity. This reduced pressure on the County’s team members, while buying valuable containment time to perform deeper investigations.

The agentless deployment advantage

For the CIO, one of the major benefits of Darktrace / NETWORK is that it’s agentless. “Agents alert attackers to the presence of security in your environment, it helps them to understand that there’s something else they need to bring down your defenses,” he said. Using Darktrace to mirror network traffic, the County can maintain full visibility across all network entities without alerting attackers and respond to threatening activity at machine speed. “It allows me to sleep better at night, knowing that this tool can effectively unplug the network cable from that device and bring it offline,” said CIO.

Streamlining investigations with Darktrace Cyber AI Analyst

For lean security teams, contextual awareness is crucial in reducing the burden of alert fatigue. Using Cyber AI Analyst, the County team is able to take the pressure off, automatically investigating every relevant event, and reducing thousands of individual alerts to only a small number of incidents that require manual review.

For the County team, the benefits are clear: 520 investigation hours saved in one month, with an average of just 11 minutes investigation time per incident. For the CIO, Darktrace goes beyond reducing workloads, it actually drives security: “It identifies threats almost instantly, bringing together logs and behaviors into a single, clear view.”

The efficiency gain has been so significant that the CIO believes Darktrace augments capabilities beyond the size of a team of analysts. “You could have three analysts working around the clock, but it’s hard to bring all those logs and behaviors together in one place and communicate everything in a coordinated way. Nothing does that as quickly as Darktrace can.”

Catching the threats from within: Defense in depth with Darktrace / IDENTITY

One of the key benefits of Darktrace for the County was its breadth of capability and responsiveness. “We’re looking at everything from multi-factor authentication, insider threats, distributed denial of service attacks,” said the CIO. “I’ve worked with other products in the past, but I’ve never found a tool as good as Darktrace.”

Further insider threats uncovered by Darktrace / IDENTITY included insecure access practices. Some users had logins and passwords on shared network resources or in plain-text files. Darktrace alerted the security team and the threats were mitigated before serious damage was done.

Darktrace / IDENTITY gives organizations advanced visibility of application user behavior from unusual authentication, password sprays, account takeover, resource theft, and admin abuse. Security teams can take targeted actions including the forced log-off of a user or temporary disabling of an account to give the team time to verify legitimacy.

First line of defense against the number one attack vector: Enhancing email security with Darktrace / EMAIL

Email-based threats, such as phishing, are among the most common attack vectors in modern cybersecurity, and a key vector for ransomware attacks. Post implementation performance was so strong that the organization now plans to retire other tools, cutting costs without compromising on security.

Darktrace / EMAIL was one of the first tools that I implemented when I started here,” said CIO. “I really recognize the value of it in our environment.” In addition to detecting and flagging potentially malicious email, the CIO said an unexpected benefit has been the reinforcement of more security-aware behaviors among end users. “People are checking their junk folders now, alerting us and checking to see if something is legitimate or not.”

The CIO said that, unlike traditional email security tools that basically perform only one function, Darktrace has multiple additional capabilities that deliver extra layers of protection compared to one-dimensional alternatives. For example, AI-employee feedback loops leverage insights gained from individual users to not only improve detection rates, but also provide end users with contextual security awareness training, to enhance greater understanding of the risks.

Straightforward integration, ease of use

The County wanted a powerful, responsive solution – without demanding pre-installation or integration needs, and with maximum ease of use. “The integration is relatively painless,” said the CIO. “That’s another real benefit, you can bring Darktrace into your environment and have it up and running faster than you could ever hire additional analysts to look at the same data.”

The team found that, compared to competing products, where there was extensive setup, overhead, and resources, “Darktrace is almost plug-and-play.” According to the CIO, the solution started ingesting information and providing notifications immediately: “You can turn on defense or response mechanisms at a granular level, for email or network – or both at the same time.”

The County sees Darktrace as an integral part of its cybersecurity strategy into the future. “Having worked with Darktrace in the past, it was an easy decision for me to agree to a multi-year partnership,” said the CIO “As we continue to build out our defense-in-depth strategy, the ability to use Darktrace to manage other data sources and identify new, additional behavior will be crucial to our proactive, risk-based approach.”

Darktrace has the capacity to meet the organization’s need for exceptional responsiveness, without burning out teams. “If you’re not overburdening the teams that you do have with significant workloads, they have a lot more agility to deal with things on the fly,” said the CIO.

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI