N-Day Vulnerabilities: Minimizing Risk With Self-Learning AI
27
Jul 2022
See how Darktrace PREVENT, a self-learning AI program, can help your security team measure risk & address N-Day vulnerabilities before an attack occurs.
Responding to the latest critical vulnerability has become a regular routine in the daily life of cyber security professionals.
In the last two years, there has been a carousel of patches for vulnerabilities affecting email servers (ProxyLogon), remote working infrastructure (Atlassian Confluence), third party tools (Kaseya), and supply chain software (Log4j).
In the days following the public disclosure of such vulnerabilities, any associated exploit is referred to as an “N-day”. The release of a patch marks day 1, but over the following days any unpatched systems are at risk of attack from exploits which target the vulnerability. This contrasts with zero-day attacks, which exploit vulnerabilities for which no patch is available, often because knowledge of the vulnerability isn’t yet in the public domain.
N-days occupy a unique space in cyber risk analysis. Headline-grabbing zero-day attacks have the potential to be high impact, but in reality such attacks are rare and have a low likelihood. A more common cyber-attack, using commodity malware which has been well documented in the wild, may have a high likelihood but will have a low impact when faced with a mature security stack. But in the hours and days following the publication of a new vulnerability, there is a high likelihood of a high impact attack against an organization which makes use of a new exploit.
Table 1: A potential qualitative risk analysis comparing three cyber risks: a threat group targets an organization using either commodity malware, a zero-day exploit, or by leveraging an N-day vulnerability.
After a critical vulnerability is published, security teams battle against time and resourcing constraints to apply the appropriate patch or patches, all the while trying to protect assets without a playbook of what an attack may look like. Darktrace has found that 85% of high-risk vulnerabilities are not patched within one week and 70% remain unpatched after a month. In the meantime, threat groups have become armed with a new attack method: an N-day exploit.
In their latest research, Darktrace’s Inside the SOC team detail how the techniques used by Self-Learning AI to detect zero-day attacks can also be leveraged by organizations to Detect and Respond to N-day attacks.
But with Darktrace PREVENT, defenders can go one step further, enabling security teams to harden defenses before the next attack vector is even published.
The Darktrace PREVENT product family empowers defenders to model likely attack paths, intelligently prioritize critical servers or highly exposed people in the organization, and test vulnerable pathways by emulating real-world attacks. Darktrace PREVENT then feeds data back into Darktrace DETECT + RESPOND to harden defenses around critical attack paths or assets and further enhance cyber resilience. For example, if Darktrace PREVENT discovers that a critical database is serving high-risk users, it can feed that information back into Darktrace DETECT, which in turn increases the level of scrutiny around that asset.
Figure 1: Visualising Darktrace’s technology vision of a Cyber AI Loop: four interconnected AI engines continuously enhancing each other’s capabilities.
While Darktrace DETECT + RESPOND wrap what amounts to an ‘AI safety blanket’ around vulnerable assets and attack paths, Darktrace PREVENT presents prioritized recommendations for long term risk mitigation. Stretched security teams therefore know, based on Darktrace’s deep and evolving understanding of the entire business, where to focus their time and resources in order to reduce risk to the greatest extent.
As a result, when the next N-day vulnerability comes around, defenders have the confidence that any prospective impact has already been minimized and the potential cyber risk is low.
Like this and want more?
Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newsletter
Enjoying the blog?
Sign up to receive the latest news and insights from the Darktrace newsletter – delivered directly to your inbox
Thanks for signing up!
Look out for your first newsletter, coming soon.
Oops! Something went wrong while submitting the form.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Oakley Cox
Director of Product
Oakley is a Product Manager within the Darktrace R&D team. He collaborates with global customers, including all critical infrastructure sectors and Government agencies, to ensure Darktrace/OT remains the first in class solution for OT Cyber Security. He draws on 7 years’ experience as a Cyber Security Consultant to organizations across EMEA, APAC and ANZ. His research into cyber-physical security has been published by Cyber Security journals and by CISA. Oakley has a Doctorate (PhD) from the University of Oxford.
RansomHub revisited: New front-runner in the ransomware-as-a-service marketplace
In a previous Inside the SOC blog, Darktrace investigated RansomHub and its growing impact on the threat landscape due to its use by the ShadowSyndicate threat group. Here, RansomHub is revisited with new insights on this ransomware-as-a-service (RaaS) platform that has rapidly gained traction among threat actors of late.
In recent months, Darktrace’s Threat Research team has noted a significant uptick in potential compromises affecting the fleet, indicating that RansomHub is becoming a preferred tool for cybercriminals. This article delves into the increasing adoption of RansomHub, the tactics, techniques, and procedures (TTPs) employed by its affiliates, and the broader implications for organizations striving to protect their systems.
RansomHub overview & background
One notable threat group to have transitioned from ALPHV (BlackCat)-aligned operations to RansomHub-aligned operations is ScatteredSpider [1]. The adoption of RansomHub by ScatteredSpider and other threat actors suggests a possible power shift among threat groups, given the increasing number of cybercriminals adopting it, including those who previously relied on ALPHV’s malware code [2].
ALPHV was a RaaS strain used by cybercriminals to breach Change Healthcare in February 2024 [2]. However, there are claims that the ransom payment never reached the affiliate using ALPHV, leading to a loss of trust in the RaaS. Around the same time, Operation Cronos resulted in the shutdown of LockBit and the abandonment of its affiliates [2]. Consequently, RansomHub emerged as a prominent RaaS successor.
RansomHub targets
The RansomHub ransomware group has been observed targeting various sectors, including critical infrastructure, financial and government services, and the healthcare sector [4]. They use ransomware variants rewritten in GoLang to target both Windows and Linux systems [5]. RansomHub is known for employing double extortion attacks, encrypting data using “Curve25519” encryption [6].
RansomHub tactics and techniques
The attackers leverage phishing attacks and social engineering techniques to lure their victims. Once access is gained, they use sophisticated tools to maintain control over compromised networks and exploit vulnerabilities in systems like Windows, Linux, ESXI, and NAS.
In more recent RansomHub attacks, tools such as Atera and Splashtop have been used to facilitate remote access, while NetScan has been employed to discover and retrieve information about network devices [7].
External researchers have observed that RansomHub uses several legitimate tools, or a tactic known as Living-off-the-Land (LOTL), to carry out their attacks. These tools include:
SecretServerSecretStealer: A PowerShell script that allows for the decryption of passwords [1].
Ngrok: A legitimate reverse proxy tool that creates a secure tunnel to servers located behind firewalls, used by the group for lateral movement and data exfiltration.
Remmina: An open-source remote desktop client for POSIX-based operating systems, enabling threat actors to access remote services [1].
By using these legitimate tools instead of traditional malware, RansomHub can avoid detection and maintain a lower profile during their operations.
Darktrace’s Coverage of RansomHub
Darktrace’s Security Operations Center (SOC) detected several notable cases of likely RansomHub activity across the customer base in recent months. In all instances, threat actors performed network scanning and brute force activities.
During the investigation of a confirmed RansomHub attack in January 2025, the Darktrace Threat Research team identified multiple authentication attempts as attackers tried to retrieve valid credentials. It is plausible that the attackers gained entry to customer environments through their Remote Desktop (RD) web server. Following this, various RDP connections were made to pivot to other devices within the network.
The common element among the cases investigated was that, in most instances, devices were seen performing outgoing connections to splashtop[.]com, a remote access and support software service, after the scanning activity had occurred. On one customer network, following this activity, the same device was seen connecting to the domain agent-api[.]atera[.]com and IP 20.37.139[.]187, which are seemingly linked to Atera, a Remote Monitoring and Management (RMM) tool.
Figure 1: Model Alert Log of an affected device making connections to *atera[.]com.
In a separate case, a Darktrace observed a device attempting to perform SMB scanning activity, trying to connect to multiple internal devices over port 445. Cyber AI Analyst was able to detect and correlate these individual connections into a single reconnaissance incident.
Similar connections to Remote Monitoring and Management (RMM) tools were also detected in a different customer environment, as alerted by Darktrace’s SOC. Unusual connections to Splashtop and Atera were made from the alerted device. Following this, the same device was observed sending a large volume of data over SSH Rclone to a rare external endpoint on the unusual port 448, triggered multiple models in Darktrace / NETWORK.
Figure 2: Advanced Search graph demonstrating the rarity of the external IP 38.244.145[.]85 used for data exfiltration.
Figure 3: Model Alert Log displaying information related to the suspicious IP, including the port used and its rarity for the network.
In the cases observed, data exfiltration occurred alongside the encryption of files likely indicating double extortion tactics. In September 2024, the Darktrace’s Threat Research team identified a 6-digit alphanumeric additional extension similar to “.293ac3”. This case was closely linked to a RansomHub attack, which was also analyzed in a different blog post by Darktrace [8].
Figure 4: Event Log displaying the extension “.293ac3” being appended to encrypted files on an affected customer network.
Conclusion
RansomHub exemplifies the evolving RaaS ecosystem, where threat actors capitalize on ready-made platforms to launch sophisticated attacks with ease. The activities observed highlight its growing popularity among cybercriminals. The analysis showed that the different attacks investigated followed a similar pattern of activity.
First, attackers perform reconnaissance activities, including widespread scanning from multiple devices and reverse DNS sweeps. They then use high-privileged credentials to pivot among devices and establish remote connections using RMM tools such as Atera. A common element among most attacks that reached the data encryption stage is the use of a 6-digit alphanumeric extension.
In all cases, Darktrace alerted on the unusual activities observed, creating not only model alerts but also Cyber AI Analyst incidents. Both Darktrace Security Operations Support and Darktrace Managed Threat Detection services provided 24/7 assistance to clients affected by RansomHub. The analyst team continued investigating these incidents, gathering data and IoCs seen in the RansomHub incidents, providing valuable insight and guidance throughout the process.
As RansomHub continues to gain traction, it serves as a stark reminder of the need for robust cybersecurity measures, proactive threat intelligence, and continued vigilance.
Credit to Maria Geronikolou (Cyber Analyst) and Nahisha Nobregas (Senior Cyber Analyst)
Appendices
Darktrace Model Detections
Network Reconnaissance
o Device / Network Scan
o Device / ICMP Address Scan
o Device / RDP Scan
o Device / Anomalous LDAP Root Searches
o Anomalous Connection / SMB Enumeration
o Device / Spike in LDAP Activity
o Device / Suspicious Network Scan Activity
Lateral Movement
o Device / Multiple Lateral Movement Model Alerts
o Device / Increase in New RPC Services
o Device / New or Uncommon WMI Activity
o Device / Possible SMB/NTLM Brute Force
o Device / SMB Session Brute Force (Non-Admin)
o Device / Anomalous NTLM Brute Force
o Compliance / Default Credential Usage
o Compliance / Outgoing NTLM Request from DC
C2 Activity
o Anomalous Server Activity / Outgoing from Server
o Anomalous Connection / Multiple Connections to New External TCP Port
o Unusual Activity / Unusual External Activity
o Compliance / Remote Management Tool On Server
Data Exfiltration
o Unusual Activity / Enhanced Unusual External Data Transfer
o Anomalous Connection / Outbound SSH to Unusual Port
o Compliance / SSH to Rare External Destination
o Unusual Activity / Unusual External Data to New Endpoint
o Unusual Activity / Unusual External Data Transfer
o Attack Path Modelling / Unusual Data Transfer on Critical Attack Path
o Compliance / Possible Unencrypted Password File On Server
While the success of a SOC team is often measured through incident management effectiveness (E.g MTTD, MTTR), a true measure of maturity is the reduction of annual security incidents.
Organizations face an increasing number of alerts each year, yet the best SOC teams place focus on proactive operations which don’t reduce the threshold for what becomes an incident but targets the source risks that prevent them entirely.
Freeing up time to focus on cyber risk management is a challenge in and of itself, we cover this in the previous two blogs in this series (see above). However, when the time comes to manage risk, there are several challenges that are unique when compared to detection & response functions within cybersecurity.
Why do cyber risks matter?
While the volume of reported CVEs is increasing at an alarming rate[1], determining the criticality of each vulnerability is becoming increasingly challenging, especially when the likelihood and impact may be different for each organization. Yet vulnerabilities have stood as an important signpost in traditional security and mitigation strategies. Now, without clear prioritization, potentially severe risks may go unreported, leaving organizations exposed to significant threats.
Vulnerabilities also represent just one area of potential risks. Cyberattacks are no longer confined to a single technology type. They now traverse various platforms, including cloud services, email systems, and networks. As technology infrastructure continues to expand, so does the attack surface, making comprehensive visibility across all technology types essential for reducing risk and preventing multi-vector attacks.
However, achieving this visibility is increasingly difficult as infrastructure grows and the cyber risk market remains oversaturated. This visibility challenge extends beyond technology to include personnel and individual cyber hygiene which can still exacerbate broader cyberattacks whether malicious or not.
Organizations must adopt a holistic approach to preventative security. This includes improving visibility across all technology types, addressing human risks, and mobilizing swiftly against emerging security gaps.
“By 2026, 60% of cybersecurity functions will implement business-impact-focused risk assessment methods, aligning cybersecurity strategies with organizational objectives.” [2]
The costs of a fragmented approach
Figure 1: Organizations may have a combination of siloed preventative security measures or technologies in place
Unlike other security tools (like SIEM, NDR or SOAR) which contain an established set of capabilities, cyber risk reduction has not traditionally been defined by a single market, rather a variety of products and practices that each provide their own value and are overwhelming if too many are adopted. Just some examples include:
Threat and Vulnerability management: Leverages threat intelligence, CVEs and asset management; however, leaves teams with significant patching workflows, ignores business & human factors and is reliant on the speed of teams to keep up with each passing update.
Continuous Controls Monitoring (CCM): Automatically audits the effectiveness of security controls based on industry frameworks but requires careful prioritization and human calculations to set-up effectively. Focuses solely on mobilization.
Breach and Attack Simulation (BAS): Automates security posture testing through mock scenarios but require previous prioritization and might not tell you how your specific technologies can be mitigated to reduce that risk.
Posture Management technologies: Siloed approaches across Cloud, SaaS, Data Security and even Gen AI that reactively assess misconfigurations and suggest improvements but with only industry frameworks to validate the importance of the risks.
Red teaming & Penetration testing: Required by several regulations including (GDPR, HIPPA, PCI, DSS), many organizations hire 'red teams' to perform real breaches in trusted conditions. Penetration tests reveal many flaws, but are not continuous, requiring third-party input and producing long to-do lists with input of broader business risk dependent on the cost of the service.
Third-party auditors: Organizations also use third-party auditors to identify assets with vulnerabilities, grade compliance, and recommend improvements. At best, these exercises become tick-box exercises for companies to stay in compliance with the responsibility still on the client to perform further discovery and actioning.
Many of these individual solutions on the market offer simple enhancement, or an automated version of an existing human security task. Ultimately, they lack an understanding of the most critical assets at your organization and are limited in scope, only working in a specific technology area or with the data you provide.
Even when these strategies are complete, implementation of the results require resources, coordination, and buy-in from IT, cybersecurity, and compliance departments. Given the nature of modern business structures, this can be labor and time intensive as responsibilities are shared by organizational segmentation spread across IT, governance, risk and compliance (GRC), and security teams.
Prioritize your true cyber risk with a CTEM approach
Organizations with robust security programs benefit from well-defined policies, standards, key risk indicators (KRIs), and operational metrics, making it easier to measure and report cyber risk accurately.
Implementing a framework like Gartner’s CTEM (Continuous Threat Exposure Management) can help governance by defining the most relevant risks to each organization and which specific solutions meet your improvement needs.
This five-step approach—scoping, discovery, prioritization, validation, and mobilization—encourages focused management cycles, better delegation of responsibilities and a firm emphasis on validating potential risks through technological methods like attack path modeling or breach and attack simulation to add credibility.
Implementing CTEM requires expertise and structure. This begins with an exposure management solution developed uniquely alongside a core threat detection and response offering, to provide visibility of an organization’s most critical risks, whilst linking directly to their incident-based workflows.
“By 2026, organizations prioritizing their security investments, based on a continuous threat exposure management program, will realize a two-third reduction in breaches.” [3]
Achieving a proactive security posture across the whole estate
Unlike conventional tools that focus on isolated risks, Darktrace / Proactive Exposure Management breaks down traditional barriers. Teams can define risk scopes with full, prioritized visibility of the critical risks between: IT/OT networks, email, Active Directory, cloud resources, operational groups, (or even the external attack surface by integrating with Darktrace / Attack Surface Management).
Our innovative, AI-led risk discovery provides a view that mirrors actual attacker methodologies. It does this through advanced algorithms that determine risk based on business importance, rather than traditional device-type prioritization. By implementing a sophisticated damage assessment methodology, security teams don’t just prioritize via severity but instead, the inherent impact, damage, weakness and external exposure of an asset or user.
These calculations also revolutionize vulnerability management by combining industry standard CVE measurements with that organization-specific context to ensure patch management efforts are efficient, rather than an endless list.
Darktrace also integrates MITRE ATT&CK framework mappings to connect all risks through attack path modeling. This offers validation to our AI’s scoring by presenting real world incident scenarios that could occur across your technologies, and the actionable mitigations to mobilize against them.
For those human choke points, security may also deploy targeted phishing engagements. These send real but harmless email ‘attacks’ to test employee susceptibility, strengthening your ability to identify weak points in your security posture, while informing broader governance strategies.
Combining risk with live detection and response
Together, each of these capabilities let teams take the best steps towards reducing risk and the volume of incidents they face. However, getting proactive also sharpens your ability to handle live threats if they occur.
During real incidents Darktrace users can quickly evaluate the potential impact of affected assets, create their own risk detections based on internal policies, strengthen their autonomous response along critical attack paths, or even see the possible stage of the next attack.
By continually ingesting risk information into live triage workflows, security teams will develop a proactive-first mindset, prioritizing the assets and alerts that have the most impact to the business. This lets them utilize their resource in the most efficient way, freeing up even more time for risk management, mitigation and ensuring continuity for the business.
Whether your organization is laying the foundation for a cybersecurity program or enhancing an advanced one, Darktrace’s self-learning AI adapts to your needs:
Foundational stage: For organizations establishing visibility and automating detection and response.
Integrated stage: For teams expanding coverage across domains and consolidating tools for simplicity.
Proactive stage: For mature security programs enhancing posture with vulnerability management and risk prioritization.
The Darktrace ActiveAI Security Platform empowers security teams to adopt a preventative defense strategy by using Cyber AI Analyst and autonomous response to fuel quicker triage, incident handling and give time back for proactive efforts designed around business impact. The platform encapsulates the critical capabilities that help organizations be proactive and stay ahead of evolving threats.
![Model Alert Log of an affected device making connections to *atera[.]com.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/67a4f4c351229b3135812411_Screenshot%202025-02-06%20at%209.43.19%E2%80%AFAM.png)
![Advanced Search graph demonstrating the rarity of the external IP 38.244.145[.]85 used for data exfiltration.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/67a4f4ef3ae41e42fd9511e5_Screenshot%202025-02-06%20at%209.44.06%E2%80%AFAM.png)
