September 20, 2022

Modern Extortion: Detecting Data Theft From the Cloud

Darktrace highlights a handful of data theft incidents on shared cloud platforms, showing that cloud computing can be a vulnerable place for modern extortion.

Written by

Adrianne Marques

Senior Research Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Adrianne Marques

Senior Research Analyst

Sep 2022

Ransomware Industry

The ransomware industry has benefitted from a number of factors in recent years: inadequate cyber defenses, poorly regulated cryptocurrency markets, and geopolitical tensions have allowed gangs to extort increasingly large ransoms while remaining sheltered from western law enforcement [1]. However, one of the biggest success stories of the ransomware industry has been the adaptability and evolution of attacker TTPs (tactics, techniques and procedures). The WannaCry and NotPetya attacks of 2017 popularized a form of ransomware which used encryption algorithms to hold data to ransom in exchange for a decryption key. Last year in 2021, almost all ransomware strains evolved to use double extortion tactics: holding stolen data to ransom as well as encrypted data [2]. Now, some ransomware gangs have dropped encryption entirely, and are using data theft as their sole means of extortion.

Using data theft for extortion is not new. In 2020 the Finnish psychotherapy center Vastaamo had over 40,000 patient records stolen. Impacted patients were told that their psychiatric transcripts would be published online if they failed to pay a Bitcoin ransom. [3]. A later report by BlackFog in May 2021 predicted data theft extortion would become one of the key emerging cybersecurity trends that year [4]. Adoption of offline back-ups and endpoint detection had made encryption harder, while a large-scale move to Cloud and SaaS platforms offered new vectors for data theft. By moving from data encryption to data exfiltration, ransomware attackers pivoted from targeting data availability within the CIA triad (Confidentiality, Integrity, Availability) to threatening data confidentiality.

In November 2021, Darktrace detected a data theft incident following the compromise of two SaaS accounts within an American tech customer’s Office365 environment. The client was a longstanding user of Darktrace DETECT/Network, and was in the process of expanding their coverage by trialing Darktrace DETECT+RESPOND/ Apps + Cloud.

Attack Overview

On November 23^rd 2021, an Ask the Expert (ATE) ticket was raised prompting investigation into a breached SaaS model, ‘SaaS / Access / Unusual External Source for SaaS Credential Use’, and the activities of a user (censored as UserA) over the prior week.

1. Office365: UserA

The account UserA had been logging in from an unusual location in Nigeria on November 21^st. At the time of the incident there were no flags of malicious activity from this IP in widely used OSINT sources. It is also highly probable the attacker was not located in Nigeria but using Nigerian infrastructure in order to hide their true location. Regardless, the location of the login from this IP and ASN was considered highly unusual for users within the customer’s digital estate. The specific user in question most commonly accessed their account from IP ranges located in the US.

Figure 1: In the Geolocation tab of the External Sites Summary on the SaaS Console, UserA was seen logging in from Nigeria when previous logins were exclusively from USA

Further investigation revealed an additional anomaly in the Outlook Web activity of UserA. The account was using the Firefox browser to access their account for the first time in at least 4 weeks (the maximum period for which the customer stored such data). SaaS logs detailing the access of confidential folders and other suspicious actions were identified using the Advanced Search (AS) query:

@fields.saas_actor:"UserA@[REDACTED]" AND @fields.saas_software:"Firefox"

Most actions were ‘MailItemsAccessed’ events originating from IPs located in Nigeria [5,6] and one other potentially malicious IP located in the US [7].

‘MailItemsAccessed’ is part of the new Advanced Audit functionality from Microsoft and can be used to determine when email data is accessed by mail protocols and clients. A bind mail access type denotes an individual access to an email message [8].

Figure 2: AS logs shows UserA had not used Firefox to access Office365 for at least 4 weeks prior to the unusual login on the 21st November

Below are details of the main suspicious SaaS activities:

· Time: 2021-11-21 09:05:25 - 2021-11-22 16:57:39 UTC

· SaaS Actor: UserA@[REDACTED]

· SaaS Service: Office365

· SaaS Service Product: Exchange

· SaaS Software: Firefox

· SaaS Office365 Parent Folders:

          o   \Accounts/Passwords
          o   \Invoices
         o   \Sent Items
          o   \Inbox
          o   \Recoverable Items\Deletions

· SaaS Event:

          o   MailItemsAccessed
          o   UserLoggedIn
          o   Update

· SaaS Office365 Mail Access Type: Bind (47 times)

· Source IP addresses:

          o   105.112.59[.]83
          o   105.112.36[.]212
          o   154.6.17[.]16
          o   45.130.83[.]129

· SaaS User Agents:

o Client=OWA;Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0;
o Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0

· Total SaaS logs: 57

At the start of the month on the 5^th November, the user had also been seen logging in from a potentially malicious endpoint [9] in Europe, performing ‘MailItemsAccessed’ and ‘Updates’ events with subjects and a resource location related to invoices and wire transfers from the Sent items folder. This suggests the initial compromise had been earlier in the month, giving the threat actor time to make preparations for the final stages of the attack.

Figure 3: Event log showing the activity of UserA from IP 45.135.187[.]108

2. Office365: UserB

Looking into the model breach ‘SaaS / Access / Suspicious Credential Use And Login User-Agent’, it was seen that a second account, UserB, was also observed logging in from a rare and potentially malicious location in Bangladesh [7]. Similar to UserA, this user had previously logged in exclusively from the USA, and no other accounts within the digital estate had been observed interacting with the Bangladeshi IP address. The login event appeared to bypass MFA (Multi-factor Authentication) and a suspicious user agent, BAV2ROPC, was used. Against misconfigured accounts, this Microsoft user agent is commonly used by attackers to bypass MFA on Office365. It targets Exchange’s Basic Authentication (normally used in POP3/IMAP4 conditions) and results in an OAuth flow which circumvents the additional password security brought by MFA [10].

During the session, additional resources were accessed which appear to be associated with bill and invoice payments. In addition, on the 4^th November, two new suspicious email rules named “..” were created from rare IPs (107.10.56[.]48 and 76.189.202[.]66). This type of behavior is commonly seen during SaaS compromises to delete or forward emails. Typically, an email rule created by a human user will be named to reflect the change being made, such as ‘Move emails from Legal to Urgent’. In contrast, malicious email rules are often short and undescriptive. The rule “..” is likely to blend in without arousing suspicion, while also being easy for the attacker to create and remember.

Details of these rule changes are as follows:

·      Time: 2021-11-04 13:25:06, 2021-11-05 15:50:00 [UTC]
·      SaaS Service: Office365
·      SaaS Service Product: Exchange
·      SaaS Status Message: True
·      SaaS Source IP addresses: 107.10.56[.]48, 76.189.202[.]66
·      SaaS Account Name: O365
·      SaaS Actor: UserB@[REDACTED]
·      SaaS Event: SetInboxRule
·      SaaS Office365 Modified Property Names:
          o   AlwaysDeleteOutlookRulesBlob, Force, Identity, MoveToFolder, Name, FromAddressContainsWords, StopProcessingRules
          o   AlwaysDeleteOutlookRulesBlob, Force, Identity, Name, FromAddressContainsWords, StopProcessingRules
·      SaaS Resource Name: ..

During cloud account compromises, attackers will often use sync operations to download emails to their local email client. During the operations, these clients typically download a large set of mail items from the cloud to a local computer. If the attacker is able to sync all mail items to their mail client, the entire mailbox can be compromised. The attacker is able to disconnect from the account and review and search the email without generating additional event logs.

Both accounts UserA and UserB were observed using ‘MailItemsAccessed’ sync operations between the 1^st and 23^rd November when this attack occurred. However, based on the originating IP of the sync operations, the activity is likely to have been initiated by the legitimate, US-based users. Once the security team were able to confirm the events were expected and legitimate, they could establish that the contents of the mailbox were not a part of the data breach.

Accomplish Mission

After gaining access to the Office365 accounts, sensitive data was downloaded by the attackers to their local system. Either on or before 14^th December, the attacker had seemingly uploaded the documents onto a data leak website. In total, 130MB of data had been made available for download in two separate packages. The packages included audit and accounting financial documents, with file extensions such as DB, XLSX, and PDF.

Figure 4: The two data packages uploaded by the attacker and the extracted contents

In a sample of past SaaS activity of UserA, the subject and attachments appear related to the ‘OUTSTANDING PREPAY WIRES 2021’ excel document found from the data leak website in Figure 4, suggesting a further possibility that the account was associated with the leaked data.

Historic SaaS activity associated with UserA:

·      Time: 2021-11-05 21:21:18 [UTC]
·      SaaS Office365 Logon Type: Owner
·      Protocol: OFFICE365
·      SaaS Account Name: O365
·      SaaS Actor: UserA@[REDACTED].com
·      SaaS Event: Send
·      SaaS Service: Office365
·      SaaS Service Product: Exchange
·      SaaS Status Message: Succeeded
·      SaaS Office365 Attachment: WIRE 2021.xlsx (92406b); image.png (9084b); image.png (1454b); image.png (1648b); image.png (1691b); image.png (1909b); image.png (2094b)
·      SaaS Office365 Subject: Wires 11/8/21
·      SaaS Resource Location: \Drafts
·      SaaS User Agent: Client=OWA;Action=ViaProxy

Based on the available evidence, it is highly likely that the data packages contain the data stolen during the account compromise the previous month.

Once the credentials of an Office365 account are stolen, an attacker can not only access the user's mailbox, but also a full range of Office365 applications such as SharePoint folders, Teams Chat, or files in the user's OneDrive [11]. For example, files shared in Teams chat are stored in OneDrive for Business in a folder named Microsoft Teams Chat Files in the default Document library on SharePoint. One of the files visible on the data leak website, called ‘[REDACTED] CONTRACT.3.1.2020.pdf’, was also observed in the default document folder of a third user account (UserC) within the victim organization, suggesting the compromised accounts may have been able to access shared files stored on other accounts by moving laterally via other O365 applications such as Teams.

One example can be seen in the below AS logs:

·      Time: 2021-11-11 01:58:35 [UTC]
·      SaaS Resource Type: File
·      Protocol: OFFICE365
·      SaaS Account Name: 0365
·      SaaS Actor: UserC@[REDACTED]
·      SaaS Event: FilePreviewed
·      SaaS Service Product: OneDrive
·      SaaS Metric: ResourceViewed
·      SaaS Office365 Application Name: Media Analysis and Transformation Service
·      SaaS Office365 File Extension: pdf
·      SaaS Resource Location: https://[REDACTED]-my.sharepoint.com/personal/userC_[REDACTED]_com/Documents/Microsoft Teams Chat Files/[REDACTED] CONTRACT 3.1.2020.pdf
·      SaaS Resource Name: [REDACTED] CONTRACT 3.1.2020.pdf
·      SaaS Service: Office365
·      SaaS Service Product: OneDrive
·      SaaS User Agent: OneDriveMpc-Transform_Thumbnail/1.0

In the period between the 1^st and 30^th November, the customer’s Darktrace DETECT/Apps trial had raised multiple high-level alerts associated with SaaS account compromise, but there was no evidence of file encryption.

Establish Foothold

Looking back at the start of the attack, it is unclear exactly how the attacker evaded the customer’s pre-existing security stack. At the time of the incident, the victim was using a Barracuda email gateway and Microsoft 365 Threat Management for their cloud environment.

Darktrace detected no indication the accounts were compromised via credential bruteforcing, which would have enabled the attacker to bypass the Azure Active Directory smart lockout (if enabled). The credentials may have been harvested via a phishing campaign which successfully evaded the list of known ‘bad’ domains maintained by their email gateway.

Upon gaining access to the account, the Microsoft Defender for Cloud Apps anomaly detection policies would have been expected to raise an alert [12]. In this instance, the unusual login from Nigeria occurred over 16 hours after the previous login from the US, potentially evading anomaly detection policies such as the ‘Impossible Travel’ rule.

Figure 5: Event log showing the user accessing mail from USA a day before the suspicious usage from Nigeria

Darktrace Coverage

Darktrace DETECT

Throughout this event, high scoring model breaches associated with the attack were visible in the customer’s SaaS Console. In addition, there were two Cyber AI Analyst incidents for ‘Possible Account Hijack’ associated with the two compromised SaaS Office365 accounts, UserA and UserB. The visibility given by Darktrace DETECT also enabled the security team to confirm which files had been accessed and were likely part of the data leak.

Figure 6: Example Cyber AI Analyst incident of UserB SaaS Office365 account

Darktrace RESPOND

In this incident, the attackers successfully compromised O365 accounts in order to exfiltrate customer data. Whilst Darktrace RESPOND/Apps was being trialed and suggested several actions, it was configured in human confirmation mode. The following RESPOND/Apps actions were advised for these activities:

· ‘Antigena [RESPOND] Unusual Access Block’ triggered by the successful login from an unusual IP address, would have actioned the ‘Block IP’ inhibitor, preventing access to the account from the unusual IP for up to 24 hours
· ‘Suspicious Source Activity Block’, triggered by the suspicious user agent used to bypass MFA, would have actioned the ‘Disable User’ inhibitor, disabling the user account for up to 24 hours

During this incident, Darktrace RESPOND/Network was being used in fully autonomous mode in order to prevent the threat actor from pivoting into the network. The security team were unable to conclusively say if any attempts by the attacker to do this had been made.

Concluding Thoughts

Data theft extortion has become a widely used attack technique, and ransomware gangs may increasingly use this technique alone to target organizations without secure data encryption and storage policies.

This case study describes a SaaS data theft extortion incident which bypassed MFA and existing security tools. The attacker appeared to compromise credentials without bruteforce activity, possibly with the use of social engineering through phishing. However, from the first new login, Darktrace DETECT identified the unusual credential use in spite of it being an existing account. Had Darktrace RESPOND/Apps been configured, it would have autonomously responded to halt this login and prevent the attacker from accomplishing their data theft mission.

Thanks to Oakley Cox, Brianna Leddy and Shuh Chin Goh for their contributions.

Appendices

References

[1] https://securelist.com/new-ransomware-trends-in-2022/106457/

[2] https://www.itpro.co.uk/security/ransomware/367624/the-rise-of-double-extortion-ransomware

[3] https://www.malwarebytes.com/blog/news/2020/10/vastaamo-psychotherapy-data-breach-sees-the-most-vulnerable-victims-extorted

[4] https://www.blackfog.com/shift-from-ransomware-to-data-theft-extortion/

[5] https://www.abuseipdb.com/check/105.112.59.83

[6] https://www.abuseipdb.com/check/105.112.36.212

[7] https://www.abuseipdb.com/check/45.130.83.129

[8] https://docs.microsoft.com/en-us/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-worldwide

[9] https://www.abuseipdb.com/check/45.135.187.108

[10] https://www.virustotal.com/gui/ip-address/45.137.20.65/details

[11] https://tidorg.com/new-bec-phishing-attack-steals-office-365-credentials-and-bypasses-mfa/

[12] https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide

Written by

Adrianne Marques

Senior Research Analyst

Inside the SOC

Written by

Adrianne Marques

Senior Research Analyst

Senior Product Marketing Manager, Email

Watch the NIS2 Webinar

Blog

Email

May 21, 2025

Evaluating Email Security: How to Select the Best Solution for Your Organization

When evaluating email security solutions, it’s crucial to move beyond marketing claims and focus on real-world performance. One of the most effective ways to achieve this is through an A/B comparison approach – a side-by-side evaluation of vendors based on consistent, predefined criteria.

This method cuts through biases, reveals true capability differences, and ensures that all solutions are assessed on a level playing field. It’s not just about finding an objectively good solution – it’s about finding the best solution for your organization’s specific needs.

An A/B comparison approach is particularly effective for three main reasons:

Eliminates bias: By comparing solutions under identical conditions, it’s easier to spot differences in performance without the fog of marketing jargon.
Highlights real capabilities: Direct side-by-side testing exposes genuine strengths and weaknesses, making it easier to judge which features are impactful versus merely decorative.
Encourages objective decision-making: This structured method reduces emotional or brand-driven decisions, focusing purely on metrics and performance.

Let’s look at the key factors to consider when setting up your evaluation to ensure a fair, accurate, and actionable comparison.

Deployment: Setting the stage for fair evaluation

To achieve a genuine comparison, deployment must be consistent across all evaluated solutions:

Establish the same scope: All solutions should be granted identical visibility across relevant tenants and domains to ensure parity.
Set a concrete timeline: Deploy and test each solution with the same dataset, at the same points in time. This allows you to observe differences in learning periods and adaptive capabilities.

Equal visibility and synchronized timelines prevent discrepancies that could skew your understanding of each vendor’s true capabilities. But remember – quicker results might not equal better learning or understanding!

Tuning and configurations: Optimizing for real-world conditions

Properly tuning and configuring each solution is critical for fair evaluation:

Compare on optimal performance: Consult with each vendor to understand what optimal deployment looks like for their solution, particularly if machine learning is involved.
Consider the long term: Configuration adjustments should be made with long-term usage in mind. Short-term fixes can mask long-term challenges.
Data visibility: Ensure each solution can retain and provide search capabilities on all data collected throughout the evaluation period.

These steps guarantee that you are comparing fully optimized versions of each platform, not underperforming or misconfigured ones.

Evaluation: Applying consistent metrics

Once deployment and configurations are aligned, the evaluation itself must be consistent, to prevent unfair scoring and help to identify true differences in threat detection and response capabilities.

Coordinate your decision criteria: Ensure all vendors are measured against the same set of criteria, established before testing begins.
Understand vendor threat classification: Each vendor may have different ways of classifying threats, so be sure to understand these nuances.
Maintain communication: If results seem inaccurate, engage with the vendors. Their response and remediation capabilities are part of the evaluation.

Making a decision: Look beyond the metrics

When it comes to reviewing the performance of each solution, it’s important to both consider and look beyond the raw data. This is about choosing the solution that best aligns with your specific business needs, which may include factors and features not captured in the results.

Evaluate based on results: Consider accuracy, threats detected, precision, and response effectiveness.
Evaluate beyond results: Assess the overall experience, including support, integrations, training, and long-term alignment with your security strategy.
Review and communicate: Internally review the findings and communicate them back to the vendors.

Choosing the right email security solution isn’t just about ticking boxes, it’s about strategic alignment with your organization’s goals and the evolving threat landscape. A structured, A/B comparison approach will help ensure that the solution you select is truly the best fit.

For a full checklist of the features and capabilities to compare, as well as how to perform a commercial and technical evaluation, check out the full Buyer’s Checklist for Evaluating Email Security.

[related-resource]

About the author

Carlos Gray

Senior Product Marketing Manager, Email

Blog

OT

May 21, 2025

Adapting to new USCG cybersecurity mandates: Darktrace for ports and maritime systems

What is the Marine Transportation System (MTS)?

Marine Transportation Systems (MTS) play a substantial roll in U.S. commerce, military readiness, and economic security. Defined as a critical national infrastructure, the MTS encompasses all aspects of maritime transportation from ships and ports to the inland waterways and the rail and roadways that connect them.

MTS interconnected systems include:

Waterways: Coastal and inland rivers, shipping channels, and harbors
Ports: Terminals, piers, and facilities where cargo and passengers are transferred
Vessels: Commercial ships, barges, ferries, and support craft
Intermodal Connections: Railroads, highways, and logistics hubs that tie maritime transport into national and global supply chains

The Coast Guard plays a central role in ensuring the safety, security, and efficiency of the MTS, handling over $5.4 trillion in annual economic activity. As digital systems increasingly support operations across the MTS, from crane control to cargo tracking, cybersecurity has become essential to protecting this lifeline of U.S. trade and infrastructure.

Maritime Transportation Systems also enable international trade, making them prime targets for cyber threats from ransomware gangs to nation-state actors.

To defend against growing threats, the United States Coast Guard (USCG) has moved from encouraging cybersecurity best practices to enforcing them, culminating in a new mandate that goes into effect on July 16, 2025. These regulations aim to secure the digital backbone of the maritime industry.

Why maritime ports are at risk

Modern ports are a blend of legacy and modern OT, IoT, and IT digitally connected technologies that enable crane operations, container tracking, terminal storage, logistics, and remote maintenance.

Many of these systems were never designed with cybersecurity in mind, making them vulnerable to lateral movement and disruptive ransomware attack spillover.

The convergence of business IT networks and operational infrastructure further expands the attack surface, especially with the rise of cloud adoption and unmanaged IoT and IIoT devices.

Cyber incidents in recent years have demonstrated how ransomware or malicious activity can halt crane operations, disrupt logistics, and compromise safety at scale threatening not only port operations, but national security and economic stability.

Relevant cyber-attacks on maritime ports

Maersk & Port of Los Angeles (2017 – NotPetya):
A ransomware attack crippled A.P. Moller-Maersk, the world’s largest shipping company. Operations at 17 ports, including the Port of Los Angeles, were halted due to system outages, causing weeks of logistical chaos.

Port of San Diego (2018 – Ransomware Attack):
A ransomware attack targeted the Port of San Diego, disrupting internal IT systems including public records, business services, and dockside cargo operations. While marine traffic was unaffected, commercial activity slowed significantly during recovery.

Port of Houston (2021 – Nation-State Intrusion):
A suspected nation-state actor exploited a known vulnerability in a Port of Houston web application to gain access to its network. While the attack was reportedly thwarted, it triggered a federal investigation and highlighted the vulnerability of maritime systems.

Jawaharlal Nehru Port Trust, India (2022 – Ransomware Incident):
India’s largest container port experienced disruptions due to a ransomware attack affecting operations and logistics systems. Container handling and cargo movement slowed as IT systems were taken offline during recovery efforts.

A regulatory shift: From guidance to enforcement

Since the Maritime Transportation Security Act (MTSA) of 2002, ports have been required to develop and maintain security plans. Cybersecurity formally entered the regulatory fold in 2020 with revisions to 33 CFR Part 105 and 106, requiring port authorities to assess and address computer system vulnerabilities.

In January 2025, the USCG finalized new rules to enforce cybersecurity practices across the MTS. Key elements include (but are not limited to):

A dedicated cyber incident response plan (PR.IP-9)
Routine cybersecurity risk assessments and exercises (ID.RA)
Designation of a cybersecurity officer and regular workforce training (section 3.1)
Controls for access management, segmentation, logging, and encryption (PR.AC-1:7)
Supply chain risk management (ID.SC)
Incident reporting to the National Response Center

Port operators are encouraged to align their programs with the NIST Cybersecurity Framework (CSF 2.0) and NIST SP 800-82r3, which provide comprehensive guidance for IT and OT security in industrial environments.

How Darktrace can support maritime & ports

Unified IT + OT + Cloud coverage

Maritime ports operate in hybrid environments spanning business IT systems (finance, HR, ERP), industrial OT (cranes, gates, pumps, sensors), and an increasing array of cloud and SaaS platforms.

Darktrace is the only vendor that provides native visibility and threat detection across OT/IoT, IT, cloud, and SaaS environments — all in a single platform. This means:

Cranes and other physical process control networks are monitored in the same dashboard as Active Directory and Office 365.
Threats that start in the cloud (e.g., phishing, SaaS token theft) and pivot or attempt to pivot into OT are caught early — eliminating blind spots that siloed tools miss.

This unification is critical to meeting USCG requirements for network-wide monitoring, risk identification, and incident response.

AI that understands your environment. Not just known threats

Darktrace’s AI doesn’t rely on rules or signatures. Instead, it uses Self-Learning AI ^TM that builds a unique “pattern of life” for every device, protocol, user, and network segment, whether it’s a crane router or PLC, SCADA server, Workstation, or Linux file server.

No predefined baselines or manual training
Real-time anomaly detection for zero-days, ransomware, and supply chain compromise
Continuous adaptation to new devices, configurations, and operations

This approach is critical in diverse distributed OT environments where change and anomalous activity on the network are more frequent. It also dramatically reduces the time and expertise needed to classify and inventory assets, even for unknown or custom-built systems.

Supporting incident response requirements

A key USCG requirement is that cybersecurity plans must support effective incident response.

Key expectations include:

‍Defined response roles and procedures: Personnel must know what to do and when (RS.CO-1).
‍Timely reporting: Incidents must be reported and categorized according to established criteria (RS.CO-2, RS.AN-4).‍
Effective communication: Information must be shared internally and externally, including voluntary collaboration with law enforcement and industry peers (RS.CO-3 through RS.CO-5).‍
Thorough analysis: Alerts must be investigated, impacts understood, and forensic evidence gathered to support decision-making and recovery (RS.AN-1 through RS.AN-5).‍
Swift mitigation: Incidents must be contained and resolved efficiently, with newly discovered vulnerabilities addressed or documented (RS.MI-1 through RS.MI-3).‍
Ongoing improvement: Organizations must refine their response plans using lessons learned from past incidents (RS.IM-1 and RS.IM-2).

That means detections need to be clear, accurate, and actionable.

Darktrace cuts through the noise using AI that prioritizes only high-confidence incidents and provides natural-language narratives and investigative reports that explain:

What’s happening, where it’s happening, when it’s happening
Why it’s unusual
How to respond

Result: Port security teams often lean and multi-tasked can meet USCG response-time expectations and reporting needs without needing to scale headcount or triage hundreds of alerts.

Built-for-edge deployment

Maritime environments are constrained. Many traditional SaaS deployment types often are unsuitable for tugboats, cranes, or air-gapped terminal systems.

Darktrace builds and maintains its own ruggedized, purpose-built appliances and unique virtual deployment options that:

Deploy directly into crane networks or terminal enclosures
Require no configuration or tuning, drop-in ready
Support secure over-the-air updates and fleet management
Operate without cloud dependency, supporting isolated and air-gapped systems

Use case: Multiple ports have been able to deploy Darktrace directly into the crane’s switch enclosure, securing lateral movement paths without interfering with the crane control software itself.

Segmentation enforcement & real-time threat containment

Darktrace visualizes real-time connectivity and attack pathways across IT, OT, and IoT it and integrates with firewalls (e.g., Fortinet, Cisco, Palo Alto) to enforce segmentation using AI insights alongside Darktrace’s own native autonomous and human confirmed response capabilities.

Benefits of autonomous and human confirmed response:

Auto-isolate rogue devices before the threat can escalate
Quarantine a suspicious connectivity with confidence operations won’t be halted
Autonomously buy time for human responders during off-hours or holidays
This ensures segmentation isn't just documented but that in the case of its failure or exploitation responses are performed as a compensating control

No reliance on 3^rd parties or external connectivity

Darktrace’s supply chain integrity is a core part of its value to critical infrastructure customers. Unlike solutions that rely on indirect data collection or third-party appliances, Darktrace:

Uses in-house engineered sensors and appliances
Does not require transmission of data to or from the cloud

This ensures confidence in both your cyber visibility and the security of the tools you deploy.

See examples here of how Darktrace stopped supply chain attacks:

Readiness for USCG and Beyond

With a self-learning system that adapts to each unique port environment, Darktrace helps maritime operators not just comply but build lasting cyber resilience in a high-threat landscape.

Cybersecurity is no longer optional for U.S. ports its operationally and nationally critical. Darktrace delivers the intelligence, automation, and precision needed to meet USCG requirements and protect the digital lifeblood of the modern port.

About the author

Daniel Simonds

Director of Operational Technology

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Modern Extortion: Detecting Data Theft From the Cloud

Modern Extortion: Detecting Data Theft From the Cloud

Ransomware Industry

Attack Overview

Accomplish Mission

Establish Foothold

Darktrace Coverage

Darktrace DETECT

Darktrace RESPOND

Concluding Thoughts

Appendices

Catching a RAT: How Darktrace Neutralized AsyncRAT

Evaluating Email Security: How to Select the Best Solution for Your Organization

Enjoying the blog?

More in this series

Combatting the Top Three Sources of Risk in the Cloud

Cloud Security Evolution: Why Security Teams are Taking the Lead

Fusing Vulnerability and Threat Data: Enhancing the Depth of Attack Analysis

Blog

Email

May 21, 2025

Evaluating Email Security: How to Select the Best Solution for Your Organization

Deployment: Setting the stage for fair evaluation

Tuning and configurations: Optimizing for real-world conditions

Evaluation: Applying consistent metrics

Making a decision: Look beyond the metrics

Blog

OT

May 21, 2025

Adapting to new USCG cybersecurity mandates: Darktrace for ports and maritime systems

What is the Marine Transportation System (MTS)?

Why maritime ports are at risk

Relevant cyber-attacks on maritime ports

A regulatory shift: From guidance to enforcement

How Darktrace can support maritime & ports

Unified IT + OT + Cloud coverage

AI that understands your environment. Not just known threats

Supporting incident response requirements

Built-for-edge deployment

Segmentation enforcement & real-time threat containment

No reliance on 3rd parties or external connectivity

See examples here of how Darktrace stopped supply chain attacks:

Readiness for USCG and Beyond

No reliance on 3^rd parties or external connectivity