Blog
/
/
July 8, 2021

Minimizing the REvil Impact Delivered via Kaseya Servers

Ransomware group REvil recently infiltrated Managed Service Providers for 1,500+ companies. See how Darktrace's autonomous response protected customer data.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
08
Jul 2021

As the USA prepared for a holiday weekend ahead of the Fourth of July, the ransomware group REvil were leveraging a vulnerability in Kaseya software to attack Managed Service Providers (MSPs) and their downstream customers. At least 1,500 companies appear to have been affected, even ones with no direct relationship to Kaseya.

At the time of writing, it appears that a zero-day vulnerability was used to gain access to the Kaseya VSA servers, before deploying ransomware on the endpoints managed by those VSA servers. This modus operandi vastly differs from previous ransomware campaigns which have traditionally been human-operated, direct intrusions.

The analysis below offers Darktrace’s insights into the campaign by looking at a real-life example. It highlights how Self-Learning AI detected the ransomware attack, and how Antigena protected customer data on the network from being encrypted.

Dissecting REvil ransomware from the network perspective

Antigena detected the first signs of ransomware on the network as soon as encryption had begun. The graphic below illustrates the start of the ransomware encryption over SMB shares. When the graphic was taken, the attack was happening live and had never been seen before. As it was a novel threat, Darktrace stopped the network encryption without any static signatures or rules.

Figure 1: Darktrace detects encryption from the infected device

The ransomware began to take action at 11:08:32, shown by the ‘SMB Delete Success’ from the infected laptop to an SMB server. While the laptop sometimes reads files on that SMB server, it never deletes these types of files on this particular file share, so Darktrace detected this activity as new and unusual.

Simultaneously, the infected laptop created the ransom note ‘943860t-readme.txt’. Again, the ‘SMB Write Success’ to the SMB server was new activity – and crucially, Darktrace did not look for a static string or a known ransom note. Instead – by previously learning the ‘normal’ behavior of every entity, peer group, and the overall enterprise – it identified that the activity was unusual and new for this organization and device.

By detecting and correlating these subtle anomalies, Darktrace identified this as the earliest stages of ransomware encryption on the network and Antigena took immediate action.

Figure 2: Snapshot of Antigena’s actions

Antigena took two precise steps:

  1. Enforce ‘pattern of life’ for five minutes: This prevented the infected laptop from making any connections that were new or unusual. In this case, it prevented any further new SMB encryption activity.
  2. Quarantine device for 24 hours: Usually, Antigena would not take such drastic action, but it was clear that this activity closely resembled ransomware behavior, so Antigena decided to quarantine the device on the network completely to prevent it from doing any further damage.

For several minutes, the infected laptop kept trying to connect to other internal devices via SMB to continue the encryption activity. It was blocked by Antigena at every stage, limiting the spread of the attack and mitigating any damage posed via the network encryption.

Figure 3: End of the attack

On a technical level, Antigena delivered the blocking mechanisms via integrations with native security controls such as existing firewalls, or by taking action itself to disrupt the connections.

The below graphic shows the ‘pattern of life’ for all network connections for the infected laptop. The three red dots represent Darktrace’s detections and pinpoint the exact moment in time when REvil ransomware was installed on the laptop. The graphic also shows an abrupt stop to all network communication as Antigena quarantined the device.

Figure 4: Network connections from the compromised laptop

Attacks will always get in

During the incident, part of the encryption happened locally on the endpoint device, which Darktrace had no visibility over. Furthermore, the Internet-facing Kaseya VSA server that was initially compromised was not visible to Darktrace in this case.

Nevertheless, Self-Learning AI detected the infection as soon as it reached the network. This shows the importance of being able to defend against active ransomware within the enterprise. Organizations cannot rely solely on a single layer of defense to keep threats out. An attacker will always – eventually – breach your environment. Defense therefore needs to change its approach towards detecting and mitigating damage once an adversary is inside.

Many cyber-attacks succeed in bypassing endpoint controls and begin to spread aggressively in corporate environments. Autonomous Response can provide resilience in such cases, even for novel campaigns and new strains of malware.

Thanks to Self-Learning AI, ransomware from the REvil attack could not perform any encryption over the network, and files available on that network were saved. This included the organization’s critical file servers which did not have Kaseya installed and thus did not receive the initial payload via the malicious update directly. By interrupting the attack as it happened, Antigena prevented thousands of files on network shares from being encrypted.

Further observations

Data exfiltration

In contrast to other REvil intrusions Darktrace has caught in the past, no data exfiltration has been observed. This is interesting as it differs from the general trend this last year where cyber-criminal groups generally focus more on the exfiltration of data to hold their victims to ransom, in response to companies becoming better with backups.

Bitcoin

REvil has demanded a total payment of $70 million in Bitcoin. For a group that tries to maximize their profits, this seems odd for two reasons:

  1. How do they expect a single entity to collect $70 million from potentially thousands of affected organizations? They must be aware of the massive logistical challenges behind this, even if they do expect Kaseya to act as a focal point for collecting the money.
  2. Since DarkSide lost access to most of the Colonial Pipeline ransom, ransomware groups have shifted to demanding payments in Monero rather than Bitcoin. Monero appears to be more difficult to track for law enforcement agencies. The fact REvil are using Bitcoin, a more traceable cryptocurrency, appears counter-productive to their usual goal of maximizing profits.

Ransomware-as-a-Service (RaaS)

Darktrace also noticed that other, more traditional ‘big game hunting’ REvil ransomware operations took place over the same weekend. This is not surprising as REvil is running a RaaS model, so it is likely some affiliate groups continued their regular big game hunting attacks while the Kaseya supply chain attack was underway.

Unpredictable is not undefendable

The weekend of the Fourth of July experienced major supply chain attacks against Kaseya and separately, against California-based distributor Synnex. Threats are coming from every direction – leveraging zero-days, social engineering tactics, and other advanced tools.

The case study above demonstrates how self-learning technology detects such attacks and minimizes the damage. It functions as a crucial part of defense-in-depth when other layers – such as endpoint protection, threat intelligence or known signatures and rules – fail to detect unknown threats.

The attack happened in milliseconds, faster than any human security team could react. Autonomous Response has proven invaluable in outpacing this new generation of machine-speed threats. It keeps thousands of organizations safe around the world, around the clock, stopping an attack every second.

Darktrace model detections

  • Compromise / Ransomware / Suspicious SMB Activity
  • Compromise / Ransomware / Suspicious SMB File Extension
  • Compromise / Ransomware / Ransom or Offensive Words Written to SMB
  • Compromise / Ransomware / Ransom or Offensive Words Read from SMB
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO

More in this series

No items found.

Blog

/

/

April 22, 2025

Obfuscation Overdrive: Next-Gen Cryptojacking with Layers

man looking at multiple computer screensDefault blog imageDefault blog image

Out of all the services honeypotted by Darktrace, Docker is the most commonly attacked, with new strains of malware emerging daily. This blog will analyze a novel malware campaign with a unique obfuscation technique and a new cryptojacking technique.

What is obfuscation?

Obfuscation is a common technique employed by threat actors to prevent signature-based detection of their code, and to make analysis more difficult. This novel campaign uses an interesting technique of obfuscating its payload.

Docker image analysis

The attack begins with a request to launch a container from Docker Hub, specifically the kazutod/tene:ten image. Using Docker Hub’s layer viewer, an analyst can quickly identify what the container is designed to do. In this case, the container is designed to run the ten.py script which is built into itself.

 Docker Hub Image Layers, referencing the script ten.py.
Figure 1: Docker Hub Image Layers, referencing the script ten.py.

To gain more information on the Python file, Docker’s built in tooling can be used to download the image (docker pull kazutod/tene:ten) and then save it into a format that is easier to work with (docker image save kazutod/tene:ten -o tene.tar). It can then be extracted as a regular tar file for further investigation.

Extraction of the resulting tar file.
Figure 2: Extraction of the resulting tar file.

The Docker image uses the OCI format, which is a little different to a regular file system. Instead of having a static folder of files, the image consists of layers. Indeed, when running the file command over the sha256 directory, each layer is shown as a tar file, along with a JSON metadata file.

Output of the file command over the sha256 directory.
Figure 3: Output of the file command over the sha256 directory.

As the detailed layers are not necessary for analysis, a single command can be used to extract all of them into a single directory, recreating what the container file system would look like:

find blobs/sha256 -type f -exec sh -c 'file "{}" | grep -q "tar archive" && tar -xf "{}" -C root_dir' \;

Result of running the command above.
Figure 4: Result of running the command above.

The find command can then be used to quickly locate where the ten.py script is.

find root_dir -name ten.py

root_dir/app/ten.py

Details of the above ten.py script.
Figure 5: Details of the above ten.py script.

This may look complicated at first glance, however after breaking it down, it is fairly simple. The script defines a lambda function (effectively a variable that contains executable code) and runs zlib decompress on the output of base64 decode, which is run on the reversed input. The script then runs the lambda function with an input of the base64 string, and then passes it to exec, which runs the decoded string as Python code.

To help illustrate this, the code can be cleaned up to this simplified function:

def decode(input):
   reversed = input[::-1]

   decoded = base64.decode(reversed)
   decompressed = zlib.decompress(decoded)
   return decompressed

decoded_string = decode(the_big_text_blob)
exec(decoded_string) # run the decoded string

This can then be set up as a recipe in Cyberchef, an online tool for data manipulation, to decode it.

Use of Cyberchef to decode the ten.py script.
Figure 6: Use of Cyberchef to decode the ten.py script.

The decoded payload calls the decode function again and puts the output into exec. Copy and pasting the new payload into the input shows that it does this another time. Instead of copy-pasting the output into the input all day, a quick script can be used to decode this.

The script below uses the decode function from earlier in order to decode the base64 data and then uses some simple string manipulation to get to the next payload. The script will run this over and over until something interesting happens.

# Decode the initial base64

decoded = decode(initial)
# Remove the first 11 characters and last 3

# so we just have the next base64 string

clamped = decoded[11:-3]

for i in range(1, 100):
   # Decode the new payload

   decoded = decode(clamped)
   # Print it with the current step so we

   # can see what’s going on

   print(f"Step {i}")

   print(decoded)
   # Fetch the next base64 string from the

   # output, so the next loop iteration will

   # decode it

   clamped = decoded[11:-3]

Result of the 63rd iteration of this script.
Figure 7: Result of the 63rd iteration of this script.

After 63 iterations, the script returns actual code, accompanied by an error from the decode function as a stopping condition was never defined. It not clear what the attacker’s motive to perform so many layers of obfuscation was, as one round of obfuscation versus several likely would not make any meaningful difference to bypassing signature analysis. It’s possible this is an attempt to stop analysts or other hackers from reverse engineering the code. However,  it took a matter of minutes to thwart their efforts.

Cryptojacking 2.0?

Cleaned up version of the de-obfuscated code.
Figure 8: Cleaned up version of the de-obfuscated code.

The cleaned up code indicates that the malware attempts to set up a connection to teneo[.]pro, which appears to belong to a Web3 startup company.

Teneo appears to be a legitimate company, with Crunchbase reporting that they have raised USD 3 million as part of their seed round [1]. Their service allows users to join a decentralized network, to “make sure their data benefits you” [2]. Practically, their node functions as a distributed social media scraper. In exchange for doing so, users are rewarded with “Teneo Points”, which are a private crypto token.

The malware script simply connects to the websocket and sends keep-alive pings in order to gain more points from Teneo and does not do any actual scraping. Based on the website, most of the rewards are gated behind the number of heartbeats performed, which is likely why this works [2].

Checking out the attacker’s dockerhub profile, this sort of attack seems to be their modus operandi. The most recent container runs an instance of the nexus network client, which is a project to perform distributed zero-knowledge compute tasks in exchange for cryptocurrency.

Typically, traditional cryptojacking attacks rely on using XMRig to directly mine cryptocurrency, however as XMRig is highly detected, attackers are shifting to alternative methods of generating crypto. Whether this is more profitable remains to be seen. There is not currently an easy way to determine the earnings of the attackers due to the more “closed” nature of the private tokens. Translating a user ID to a wallet address does not appear to be possible, and there is limited public information about the tokens themselves. For example, the Teneo token is listed as “preview only” on CoinGecko, with no price information available.

Conclusion

This blog explores an example of Python obfuscation and how to unravel it. Obfuscation remains a ubiquitous technique employed by the majority of malware to aid in detection/defense evasion and being able to de-obfuscate code is an important skill for analysts to possess.

We have also seen this new avenue of cryptominers being deployed, demonstrating that attackers’ techniques are still evolving - even tried and tested fields. The illegitimate use of legitimate tools to obtain rewards is an increasingly common vector. For example,  as has been previously documented, 9hits has been used maliciously to earn rewards for the attack in a similar fashion.

Docker remains a highly targeted service, and system administrators need to take steps to ensure it is secure. In general, Docker should never be exposed to the wider internet unless absolutely necessary, and if it is necessary both authentication and firewalling should be employed to ensure only authorized users are able to access the service. Attacks happen every minute, and even leaving the service open for a short period of time may result in a serious compromise.

References

1. https://www.crunchbase.com/funding_round/teneo-protocol-seed--a8ff2ad4

2. https://teneo.pro/

Continue reading
About the author
Nate Bill
Threat Researcher

Blog

/

/

April 22, 2025

How NDR and Secure Access Service Edge (SASE) Work Together to Achieve Network Security Outcomes

woman looking out at buildingsDefault blog imageDefault blog image

Modern networks are evolving rapidly, with traffic patterns, user behavior, and critical assets extending far beyond the boundaries of traditional network security tools. As organizations adopt hybrid infrastructures, remote working, and cloud-native services, it is essential to maintain visibility and protect this expanding attack surface.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) are two technologies commonly used to safeguard organizational networks. While both play crucial roles in enhancing security, one does not replace the other. Instead, NDR and SASE complement each other, taking on different roles to create a robust network security framework. This blog will unpack the relationship between NDR and SASE, including the component functionalities that comprise SASE, highlighting their unique contributions to maintaining a comprehensive and resilient network security strategy.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) explained

NDR solutions, such as Darktrace / NETWORK, are designed to detect, investigate, and respond to suspicious activities within any network. By leveraging machine learning and behavioral analytics, NDR continuously monitors network traffic to identify anomalies that could indicate potential threats and to contain those threats at machine speed. These solutions analyze both North-South traffic (between internal and external networks) and East-West traffic (within internal networks), providing comprehensive visibility into network activities.

SASE, on the other hand, comprises multiple solutions, focused on providing hybrid and remote users access to services while adhering to the Zero Trust principle of "never trust, always verify". Within SASE architectures, Zero Trust Network Access (ZTNA) solutions provide secure remote access to private applications and services the user has been explicitly granted, and Secure Web Gateways (SWG) provide Internet access, again based on policy groups. Unlike traditional security models that grant implicit trust to users within the network perimeter, ZTNA requires continuous verification of user identity and device health before granting access to resources. This approach minimizes the attack surface and reduces the risk of unauthorized access to sensitive data and internal applications. Similarly, SWGs filter web traffic based on the verified user identity and can block known malware, further reducing the attack surface for the client estate.

Limitations of SASE highlights the importance of NDR

While SASE, including ZTNA and SWG, is a powerful tool for enforcing secure access to company networks and resources as well as the Internet, it is not a comprehensive security solution, or a replacement for dedicated network monitoring and NDR capabilities. Some of the main limitations include:

  • Focused on policies rather than security: SASE delivers strong networking outcomes but provides policy-based protections, rather than a full suite of security features. It can provide simple alerting for disallowed actions, but it lacks the security context needed for comprehensive threat detection, such as knowing if user credentials have been compromised.
  • Can only detect known threats: SASE solutions cannot detect novel attacks such as zero-days and insider threats. This is because they rely on a rule-based approach that does not have a behavioral understanding of network entities that can detect anomalies or suspicious activity.
  • Limited response capabilities: Due to the limited detection capabilities of SASE solutions, it is not possible to automate response actions to threats that slip past existing policies.  While access to internal resources and the Internet can be revoked or severely limited as part of a response, this must be done after human investigation and analysis, allowing more time for the threat to continue before being contained.
  • Limited scope: SASE provides cloud-hosted secure networking, which lends itself much more toward the client estate of any organization. As a result, servers and unmanaged devices—whether IT/IoT/OT—are mostly out of scope and do not benefit from the policies SASE enforces.

The complementary roles of NDR and ZTNA

NDR solutions provide full visibility into network activity, with the ability to detect and respond to threats that may bypass initial access controls and filters. When combined, NDR and SASE create a layered security approach that addresses different aspects of network security, for example:

  • Detection of novel, unknown and insider threats: NDR solutions can monitor all network traffic using behavioral anomaly detection. This can identify suspicious activities, such as insider threats from authorized users who have passed policy checks, or novel attacks that have never been seen before.
  • Validation of policies: By continuously monitoring network traffic, NDR can validate the effectiveness of existing policies and identify any gaps in security that need addressing due to organizational changes or outdated rule sets.
  • Reducing risk and impact of threats: Together, SASE and NDR solutions shift toward proactive security by reducing the potential impact of a threat through predefined policies and by detecting and containing a threat in its earliest stages, even if it is novel or nuanced.
  • Enhanced contextual information: Alerts raised by SASE solutions can provide additional context into potential threats, which can be used by NDR solutions to increase investigation quality and context.
  • Containment of network threats: SASE solutions can prohibit access to resources on an internal company network or on the Internet if predefined access control criteria are not met or a site matches a threat signature. When combined with an NDR solution, organizations can go far beyond this, detecting and responding to a much wider variety of network threats to prevent attacks from escalating.

When implementing SASE and NDR solutions, it is also crucial to consider the best configurations to maximize interoperability, and integrations will often increase functionality. Well-designed implementations, combined with integrations, will strengthen both SASE and NDR solutions for organizations.

How Darktrace continues to secure SASE networks

With the latest 6.3 update, Darktrace continues to extend its capabilities with new innovations that support modern enterprise networks and the use of SASE across remote and hybrid worker devices. This expands on existing Darktrace integrations and partnerships with SASE vendors such as Netskope and Zscaler.

Traditional methods to contain remote access and internet-born threats are either signature or policy based, and response to nuanced threats requires manual, human-led investigation and decision-making. By the time security teams can react, the damage is often already done.

With Darktrace 6.3, customers using Zscaler can now configure Darktrace Autonomous Response to quarantine ZPA-connected user devices at machine speed. This provides a powerful new mechanism for containing remote threats at the earliest sign of suspicious activity, without disrupting broader operations.

By automatically shutting down ZPA access for compromised user accounts, Darktrace gives SOC teams valuable time to investigate and respond, while continuing to protect the rest of the organization. This integration enhances Darktrace’s ability to take actions for remote user devices, helping customers contain threats faster and keep the business running smoothly.

For organizations using SASE technologies to address the challenges of securing large, distributed networks across a range of geographies, SaaS applications and remote worker devices, Darktrace also now integrates with Netskope Cloud TAP to provide visibility into and analysis over tunneled traffic, reducing blind spots and enabling organizations to maintain detection capabilities across their expanding network perimeters.

Conclusion

While NDR and ZTNA serve distinct purposes, their integration is crucial for a comprehensive security strategy. ZTNA provides robust access controls, ensuring that only authorized users can access network resources. NDR, on the other hand, offers continuous visibility into network activities, detecting and responding to threats that may bypass initial access controls. By leveraging the strengths of both solutions, organizations can enhance their security posture and protect against a wide range of network security threats.

Understanding the complementary roles of NDR and ZTNA is essential for building a resilient security framework. As cyber threats continue to evolve, adopting a multi-layered, defense-in-depth security approach will be key to safeguarding organizational networks.

Click here for more information about the latest product innovations in Darktrace 6.3, or learn more about Darktrace / NETWORK here.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI