Blog
/
Network
/
November 20, 2023

Understanding and Mitigating Sectop RAT

Understand the risks posed by the Sectop remote access Trojan and how Darktrace implements strategies to enhance cybersecurity defenses.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Justin Torres
Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
20
Nov 2023

Introduction

As malicious actors across the threat landscape continue to look for new ways to gain unauthorized access to target networks, it is unsurprising to see Remote Access Trojans (RATs) leveraged more and more. These RATs are downloaded discretely without the target’s knowledge, typically through seemingly legitimate software downloads, and are designed to gain highly privileged network credentials, ultimately allowing attackers to have remote control over compromised devices. [1]

SectopRAT is one pertinent example of a RAT known to adopt a number of stealth functions in order to gather and exfiltrate sensitive data from its targets including passwords, cookies, autofill and history data stores in browsers, as well as cryptocurrency wallet details and system hardware information. [2]

In early 2023, Darktrace identified a resurgence of the SectopRAT across customer environments, primarily targeting educational industries located in the United States (US), Europe, the Middle East and Africa (EMEA) and Asia-Pacific (APAC) regions. Darktrace DETECT™ was able to successfully identify suspicious activity related to SectopRAT at the network level, as well as any indicators of post-compromise on customer environments that did not have Darktrace RESPOND™ in place to take autonomous preventative action.

What is SectopRAT?

First discovered in early 2019, the SectopRAT is a .NET RAT that contains information stealing capabilities. It is also known under the alias ‘ArechClient2’, and is commonly distributed through drive-by downloads of illegitimate software and utilizes malvertising, including via Google Ads, to increase the chances of it being downloaded.

The malware’s code was updated at the beginning of 2021, which led to refined and newly implemented features, including command and control (C2) communication encryption with Advanced Encryption Stanard 256 (AES256) and additional commands. SectopRAT also has a function called "BrowserLogging", ultimately sending any actions it conducts on web browsers to its C2 infrastructure. When the RAT is executed, it then connects to a Pastebin associated hostname to retrieve C2 information; the requested file reaches out to get the public IP address of the infected device. To receive commands, it connects to its C2 server primarily on port 15647, although other ports have been highlighted by open source intelligence (OSINT), which include 15678, 15649, 228 and 80. Ultimately, sensitive data data gathered from target networks is then exfiltrated to the attacker’s C2 infrastructure, typically in a JSON file [3].

Darktrace Coverage

During autonomous investigations into affected customer networks, Darktrace DETECT was able to identify SSL connections to the endpoint pastebin[.]com over port 443, followed by failed connections to one of the IPs and ports (i.e., 15647, 15648, 15649) associated with SectopRAT. This resulted in the devices breaching the ‘Compliance/Pastebin and Anomalous Connection/Multiple Failed Connections to Rare Endpoint’ models, respectively.

In some instances, Darktrace observed a higher number of attempted connections that resulted in the additional breach of the model ‘Compromise / Large Number of Suspicious Failed Connections’.

Over a period of three months, Darktrace investigated multiple instances of SectopRAT infections across multiple clients, highlighting indicators of compromise (IoCs) through related endpoints.Looking specififically at one customer’s activity which centred on January 25, 2023, one device was observed initially making suspicious connections to a Pastebin endpoint, 104.20.67[.]143, likely in an attempt to receive C2 information.

Darktrace DETECT recognized this activity as suspicious, causing the 'Compliance / Pastebin' DETECT models to breach. In response to this detection, Darktrace RESPOND took swift action against the Pastebin connections by blocking them and preventing the device from carrying out further connections with Pastebin endpoints. Darktrace RESPOND actions related to blocking Pastebin connections were commonly observed on this device throughout the course of the attack and likely represented threat actors attempting to exfiltrate sensitive data outside the network.

Darktrace UI image
Figure 1: Model breach event log highlighting the Darktrace DETECT model breach ‘Compliance / Pastebin’.

Around the same time, Darktrace observed the device making a large number of failed connections to an unusual exernal location in the Netherlands, 5.75.147[.]135, via port 15647. Darktrace recognized that this endpoint had never previously been observed on the customer’s network and that the frequency of the failed connections could be indicative of beaconing activity. Subsequent investigation into the endpoint using OSINT indicated it had links to malware, though Darktrace’s successful detection did not need to rely on this intelligence.

Darktrace model breach event log
Figure 2: Model breach event log highlighting the multiple failed connectiosn to the suspicious IP address, 5.75.147[.]135 on January 25, 2023, causing the Darktrace DETECT model ‘Anomalous Connection / Multiple Failed Connections to Rare Endpoint’ to breach.

After these initial set of breaches on January 25, the same device was observed engaging in further external connectivity roughly a month later on February 27, including additional failed connections to the IP 167.235.134[.]14 over port 15647. Once more, multiple OSINT sources revealed that this endpoint was indeed a malicious C2 endpoint.

Darktrace model breach event log 2
Figure 3: Model breach event log highlighting the multiple failed connectiosn to the suspicious IP address, 167.235.134[.]14 on February 27, 2023, causing the Darktrace DETECT model ‘Anomalous Connection / Multiple Failed Connections to Rare Endpoint’ to breach.

While the initial Darktrace coverage up to this point has highlighted the attempted C2 communication and how DETECT was able to alert on the suspicious activity, Pastebin activity was commonly observed throughout the course of this attack. As a result, when enabled in autonomous response mode, Darktrace RESPOND was able to take swift mitigative action by blocking all connections to Pastebin associated hostnames and IP addresses. These interventions by RESPOND ultimately prevented malicious actors from stealing sensitive data from Darktrace customers.

Darktrace RESPOND action list
Figure 4: A total of nine Darktrace RESPOND actions were applied against suspicious Pastebin activity during the course of the attack.

In another similar case investigated by the Darktrace, multiple devices were observed engaging in external connectivity to another malicious endpoint,  88.218.170[.]169 (AS207651 Hosting technology LTD) on port 15647.  On April 17, 2023, at 22:35:24 UTC, the breach device started making connections; of the 34 attempts, one connection was successful – this connection lasted 8 minutes and 49 seconds. Darktrace DETECT’s Self-Learning AI understood that these connections represented a deviation from the device’s usual pattern of behavior and alerted on the activity with the ‘Multiple Connections to new External TCP Port’ model.

Darktrace model breach event log
Figure 5: Model breach event log highlighting the affected device successfully connecting to the suspicious endpoint, 88.218.170[.]169.
Darktrace advanced search query
Figure 6: Advanced Search query highlighting the one successful connection to the endpoint 88.218.170[.]169 out of the 34 attempted connections.

A few days later, on April 20, 2023, at 12:33:59 (UTC) the source device connected to a Pastebin endpoint, 172.67.34[.]170 on port 443 using the SSL protocol, that had never previously be seen on the network. According to Advanced Search data, the first SSL connection lasted over two hours. In total, the device made 9 connections to pastebin[.]com and downloaded 85 KB of data from it.

Darktrace UI highlighting connections
Figure 7: Screenshot of the Darktrace UI highlighting the affected device making multiple connections to Pastebin and downloading 85 KB of data.

Within the same minute, Darktrace detected the device beginning to make a large number of failed connections to another suspicious endpoints, 34.107.84[.]7 (AS396982 GOOGLE-CLOUD-PLATFORM) via port 15647. In total the affected device was observed initiating 1,021 connections to this malicious endpoint, all occurring over the same port and resulting the failed attempts.

Darktrace advanced search query 2
Figure 8: Advanced Search query highlighting the affected device making over one thousand connections to the suspicious endpoint 34.107.84[.]7, all of which failed.

Conclusion

Ultimately, thanks to its Self-Learning AI and anomaly-based approach to threat detection, Darktrace was able to preemptively identify any suspicious activity relating to SectopRAT at the network level, as well as post-compromise activity, and bring it to the immediate attention of customer security teams.

In addition to the successful and timely detection of SectopRAT activity, when enabled in autonomous response mode Darktrace RESPOND was able to shut down suspicious connections to endpoints used by threat actors as malicious infrastructure, thus preventing successful C2 communication and potential data exfiltration.

In the face of a Remote Access Trojan, like SectopRAT, designed to steal sensitive corporate and personal information, the Darktrace suite of products is uniquely placed to offer organizations full visibility over any emerging activity on their networks and respond to it without latency, safeguarding their digital estate whilst causing minimal disruption to business operations.

Credit to Justin Torres, Cyber Analyst, Brianna Leddy, Director of Analysis

Appendices

Darktrace Model Detection:

  • Compliance / Pastebin
  • Anomalous Connection / Multiple Failed Connections to Rare Endpoint
  • Compromise / Large Number of Suspicious Failed Connections
  • Anomalous Connection / Multiple Connections to New External TCP Port

List of IoCs

IoC - Type - Description + Confidence

5.75.147[.]135 - IP - SectopRAT C2 Endpoint

5.75.149[.]1 - IP - SectopRAT C2 Endpoint

34.27.150[.]38 - IP - SectopRAT C2 Endpoint

34.89.247[.]212 - IP - SectopRAT C2 Endpoint

34.107.84[.]7 - IP - SectopRAT C2 Endpoint

34.141.16[.]89 - IP - SectopRAT C2 Endpoint

34.159.180[.]55 - IP - SectopRAT C2 Endpoint

35.198.132[.]51 - IP - SectopRAT C2 Endpoint

35.226.102[.]12 - IP - SectopRAT C2 Endpoint

35.234.79[.]173 - IP - SectopRAT C2 Endpoint

35.234.159[.]213 - IP - SectopRAT C2 Endpoint

35.242.150[.]95 - IP - SectopRAT C2 Endpoint

88.218.170[.]169 - IP - SectopRAT C2 Endpoint

162.55.188[.]246 - IP - SectopRAT C2 Endpoint

167.235.134[.]14 - IP - SectopRAT C2 Endpoint

MITRE ATT&CK Mapping

Model: Compliance / Pastebin

ID: T1537

Tactic: EXFILTRATION

Technique Name: Transfer Data to Cloud Account

Model: Anomalous Connection / Multiple Failed Connections to Rare Endpoint

ID: T1090.002

Sub technique of: T1090

Tactic: COMMAND AND CONTROL

Technique Name: External Proxy

ID: T1095

Tactic: COMMAND AND CONTROL

Technique Name: Non-Application Layer Protocol

ID: T1571

Tactic: COMMAND AND CONTROL

Technique Name: Non-Standard Port

Model: Compromise / Large Number of Suspicious Failed Connections

ID: T1571

Tactic: COMMAND AND CONTROL

Technique Name: Non-Standard Port

ID: T1583.006

Sub technique of: T1583

Tactic: RESOURCE DEVELOPMENT

Technique Name: Web Services

Model: Anomalous Connection / Multiple Connections to New External TCP Port

ID: T1095        

Tactic: COMMAND AND CONTROL    

Technique Name: Non-Application Layer Protocol

ID: T1571

Tactic: COMMAND AND CONTROL    

Technique Name: Non-Standard Port

References

1.     https://www.techtarget.com/searchsecurity/definition/RAT-remote-access-Trojan

2.     https://malpedia.caad.fkie.fraunhofer.de/details/win.sectop_rat

3.     https://threatfox.abuse.ch/browse/malware/win.sectop_rat

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Justin Torres
Cyber Analyst

More in this series

No items found.

Blog

/

Identity

/

May 27, 2025

From Rockstar2FA to FlowerStorm: Investigating a Blooming Phishing-as-a-Service Platform

man on computerDefault blog imageDefault blog image

What is FlowerStorm?

FlowerStorm is a Phishing-as-a-Service (PhaaS) platform believed to have gained traction following the decline of the former PhaaS platform Rockstar2FA. It employs Adversary-in-the-Middle (AitM) attacks to target Microsoft 365 credentials. After Rockstar2FA appeared to go dormant, similar PhaaS portals began to emerge under the name FlowerStorm. This naming is likely linked to the plant-themed terminology found in the HTML titles of its phishing pages, such as 'Sprout' and 'Blossom'. Given the abrupt disappearance of Rockstar2FA and the near-immediate rise of FlowerStorm, it is possible that the operators rebranded to reduce exposure [1].

External researchers identified several similarities between Rockstar2FA and FlowerStorm, suggesting a shared operational overlap. Both use fake login pages, typically spoofing Microsoft, to steal credentials and multi-factor authentication (MFA) tokens, with backend infrastructure hosted on .ru and .com domains. Their phishing kits use very similar HTML structures, including randomized comments, Cloudflare turnstile elements, and fake security prompts. Despite Rockstar2FA typically being known for using automotive themes in their HTML titles, while FlowerStorm shifted to a more botanical theme, the overall design remained consistent [1].

Despite these stylistic differences, both platforms use similar credential capture methods and support MFA bypass. Their domain registration patterns and synchronized activity spikes through late 2024 suggest shared tooling or coordination [1].

FlowerStorm, like Rockstar2FA, also uses their phishing portal to mimic legitimate login pages such as Microsoft 365 for the purpose of stealing credentials and MFA tokens while the portals are relying heavily on backend servers using top-level domains (TLDs) such as .ru, .moscow, and .com. Starting in June 2024, some of the phishing pages began utilizing Cloudflare services with domains such as pages[.]dev. Additionally, usage of the file “next.php” is used to communicate with their backend servers for exfiltration and data communication. FlowerStorm’s platform focuses on credential harvesting using fields such as email, pass, and session tracking tokens in addition to supporting email validation and MFA authentications via their backend systems [1].

Darktrace’s coverage of FlowerStorm Microsoft phishing

While multiple suspected instances of the FlowerStorm PhaaS platform were identified during Darktrace’s investigation, this blog will focus on a specific case from March 2025. Darktrace’s Threat Research team analyzed the affected customer environment and discovered that threat actors were accessing a Software-as-a-Service (SaaS) account from several rare external IP addresses and ASNs.

Around a week before the first indicators of FlowerStorm were observed, Darktrace detected anomalous logins via Microsoft Office 365 products, including Office365 Shell WCSS-Client and Microsoft PowerApps.  Although not confirmed in this instance, Microsoft PowerApps could potentially be leveraged by attackers to create phishing applications or exploit vulnerabilities in data connections [2].

Darktrace’s detection of the unusual SaaS credential use.
Figure 1: Darktrace’s detection of the unusual SaaS credential use.

Following this initial login, Darktrace observed subsequent login activity from the rare source IP, 69.49.230[.]198. Multiple open-source intelligence (OSINT) sources have since associated this IP with the FlowerStorm PhaaS operation [3][4].  Darktrace then observed the SaaS user resetting the password on the Core Directory of the Azure Active Directory using the user agent, O365AdminPortal.

Given FlowerStorm’s known use of AitM attacks targeting Microsoft 365 credentials, it seems highly likely that this activity represents an attacker who previously harvested credentials and is now attempting to escalate their privileges within the target network.

Darktrace / IDENTITY’s detection of privilege escalation on a compromised SaaS account, highlighting unusual login activity and a password reset event.
Figure 2: Darktrace / IDENTITY’s detection of privilege escalation on a compromised SaaS account, highlighting unusual login activity and a password reset event.

Notably, Darktrace’s Cyber AI Analyst also detected anomalies during a number of these login attempts, which is significant given FlowerStorm’s known capability to bypass MFA and steal session tokens.

Cyber AI Analyst’s detection of new login behavior for the SaaS user, including abnormal MFA usage.
Figure 3: Cyber AI Analyst’s detection of new login behavior for the SaaS user, including abnormal MFA usage.
Multiple login and failed login events were observed from the anomalous source IP over the month prior, as seen in Darktrace’s Advanced Search.
Figure 4: Multiple login and failed login events were observed from the anomalous source IP over the month prior, as seen in Darktrace’s Advanced Search.

In response to the suspicious SaaS activity, Darktrace recommended several Autonomous Response actions to contain the threat. These included blocking the user from making further connections to the unusual IP address 69.49.230[.]198 and disabling the user account to prevent any additional malicious activity. In this instance, Darktrace’s Autonomous Response was configured in Human Confirmation mode, requiring manual approval from the customer’s security team before any mitigative actions could be applied. Had the system been configured for full autonomous response, it would have immediately blocked the suspicious connections and disabled any users deviating from their expected behavior—significantly reducing the window of opportunity for attackers.

Figure 5: Autonomous Response Actions recommended on this account behavior; This would result in disabling the user and blocking further sign-in activity from the source IP.

Conclusion

The FlowerStorm platform, along with its predecessor, RockStar2FA is a PhaaS platform known to leverage AitM attacks to steal user credentials and bypass MFA, with threat actors adopting increasingly sophisticated toolkits and techniques to carry out their attacks.

In this incident observed within a Darktrace customer's SaaS environment, Darktrace detected suspicious login activity involving abnormal VPN usage from a previously unseen IP address, which was subsequently linked to the FlowerStorm PhaaS platform. The subsequent activity, specifically a password reset, was deemed highly suspicious and likely indicative of an attacker having obtained SaaS credentials through a prior credential harvesting attack.

Darktrace’s prompt detection of these SaaS anomalies and timely notifications from its Security Operations Centre (SOC) enabled the customer to mitigate and remediate the threat before attackers could escalate privileges and advance the attack, effectively shutting it down in its early stages.

Credit to Justin Torres (Senior Cyber Analyst), Vivek Rajan (Cyber Analyst), Ryan Traill (Analyst Content Lead)

Appendices

Darktrace Model Alert Detections

·      SaaS / Access / M365 High Risk Level Login

·      SaaS / Access / Unusual External Source for SaaS Credential Use

·      SaaS / Compromise / Login from Rare High-Risk Endpoint

·      SaaS / Compromise / SaaS Anomaly Following Anomalous Login

·      SaaS / Compromise / Unusual Login and Account Update

·      SaaS / Unusual Activity / Unusual MFA Auth and SaaS Activity

Cyber AI Analyst Coverage

·      Suspicious Access of Azure Active Directory  

·      Suspicious Access of Azure Active Directory  

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

69.49.230[.]198 – Source IP – Malicious IP Associated with FlowerStorm, Observed in Login Activity

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique  

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Cloud Service Dashboard - DISCOVERY - T1538

Compromise Accounts - RESOURCE DEVELOPMENT - T1586

Steal Web Session Cookie - CREDENTIAL ACCESS - T1539

References:

[1] https://news.sophos.com/en-us/2024/12/19/phishing-platform-rockstar-2fa-trips-and-flowerstorm-picks-up-the-pieces/

[2] https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-compromised-malicious-app

[3] https://www.virustotal.com/gui/ip-address/69.49.230.198/community

[4] https://otx.alienvault.com/indicator/ip/69.49.230.198

Continue reading
About the author
Justin Torres
Cyber Analyst

Blog

/

Network

/

May 23, 2025

Defending the Frontlines: Proactive Cybersecurity in Local Government

Default blog imageDefault blog image

Serving a population of over 165,000 citizens, this county government delivers essential services that enhance the quality of life for all of its residents in Florida, United States. From public safety and works to law enforcement, economic development, health, and community services, the county’s cybersecurity strategy plays a foundational role in protecting its citizens.

From flying blind to seeing the bigger picture

Safeguarding data from multiple systems, service providers, and citizens is a key aspect of the County’s Systems Management remit. Protecting sensitive information while enabling smooth engagement with multiple external partners poses a unique challenge; the types of data and potential threats are continuously evolving, but resources – both human and financial – remain consistently tight.

When the Chief Information Officer took on his role in 2024, building out a responsive defense-in-depth strategy was central to achieving these goals. However, with limited resources and complex needs, his small security team was struggling with high alert volumes, inefficient tools, and time-consuming investigations that frequently led nowhere.

Meanwhile, issues like insider threats, Denial of Service (DoS), and phishing attacks were growing; the inefficiencies were creating serious security vulnerabilities. As the CIO put it, he was flying blind. With so much data coming in, security analysts were in danger of missing the bigger picture.

“We would just see a single portion of data that could send us down a rabbit hole, thinking something’s going on – only to find out after spending days, weeks, or even months that it was nothing. If you’re only seeing one piece of the issue, it’s really difficult to identify whether something is a legitimate threat or a false positive.”

Local government’s unique cybersecurity challenges

According to the CIO, even with a bigger team, aligning and comparing all the data into a comprehensive, bigger picture would be a major challenge. “The thing about local government specifically is that it’s a complex security environment. We bring together a lot of different individuals and organizations, from construction workers to people who bring projects into our community to better the County. What we work with varies from day to day.”

The challenge wasn’t just about identifying threats, but also about doing so quickly enough to respond before damage was done. The CIO said this was particularly concerning when dealing with sophisticated threats: “We’re dealing with nation-state attackers nowadays, as opposed to ‘script kiddies.’ There’s no time to lose. We’ve got to have cybersecurity that can respond as quickly as they can attack.”

To achieve this, among the most critical challenges the CIO and his team needed to address were:

  • Contextual awareness and visibility across the network: The County team lacked the granular visibility needed to identify potentially harmful behaviors. The IT team needed a tool that uncovered hidden activities and provided actionable insights, with minimal manual intervention.
  • Augmenting human expertise and improving response times: Hiring additional analysts to monitor the environment is prohibitively expensive for many local governments. The IT team needed a cybersecurity solution that could augment existing skills while automating day-to-day tasks. More effective resource allocation would drive improved response times.
  • Preventing email-based threats: Phishing and malicious email links present a persistent threat. The County team needed a way to flag, identify, and hold suspicious messages automatically and efficiently. Given the team’s public service remit, contextual awareness is crucial to ensuring that no legitimate communications are accidentally blocked. Accuracy is extremely important.
  • Securing access and managing insider threats: Having already managed insider threats posed by former staff members, the IT team wanted to adopt a more proactive, deterrent-based approach towards employee IT resource use, preventing incidents before they could occur.

Proactive cybersecurity

Recognizing these challenges, the CIO and County sought AI-driven solutions capable of acting autonomously to support a lean IT team and give the big picture view needed, without getting lost in false positive alerts.

Ease of deployment was another key requirement: the CIO wanted to quickly establish a security baseline for County that would not require extensive pre-planning or disrupt existing systems. Having worked with Darktrace in previous roles, he knew the solution had the capacity to make the critical connections he was looking for, while delivering fast response times and reducing the burden on security teams.

When every second counts, we want to be as close to the same resources as our attackers are utilizing. We have got to have something that can respond as quickly as they can attack. For the County, that’s Darktrace.” – CIO, County Systems Management Department.

Closing network visibility gaps with Darktrace / NETWORK

The County chose Darktrace / NETWORK for unparalleled visibility into the County’s network. With the solution in place, the CIO and his team were able to identify and address previously hidden activities, uncovering insider threats in unexpected places. For example, one team member had installed an unauthorized anonymizer plug-in on their browser, posing a potentially serious security risk via traffic being sent out to the internet. “Darktrace immediately alerted on it,” said CIO. “We were able to deal with the threat proactively and quickly.”

Darktrace / NETWORK continuously monitored and updated its understanding of the County environment, intelligently establishing the different behaviors and network activity. The end result was a level of context awareness that enabled the team to focus on the alerts that mattered most, saving time and effort.

“Darktrace brings all the data we need together, into one picture. We’re able to see what’s going on at a glance, as opposed to spending time trying to identify real threats from false positives,” said the CIO. The ability to automate actions freed the team up to focus on more complex tasks, with 66% of network response actions being applied autonomously, taking the right action at the right time to stop the earliest signs of threatening activity. This reduced pressure on the County’s team members, while buying valuable containment time to perform deeper investigations.

The agentless deployment advantage

For the CIO, one of the major benefits of Darktrace / NETWORK is that it’s agentless. “Agents alert attackers to the presence of security in your environment, it helps them to understand that there’s something else they need to bring down your defenses,” he said. Using Darktrace to mirror network traffic, the County can maintain full visibility across all network entities without alerting attackers and respond to threatening activity at machine speed. “It allows me to sleep better at night, knowing that this tool can effectively unplug the network cable from that device and bring it offline,” said CIO.

Streamlining investigations with Darktrace Cyber AI Analyst

For lean security teams, contextual awareness is crucial in reducing the burden of alert fatigue. Using Cyber AI Analyst, the County team is able to take the pressure off, automatically investigating every relevant event, and reducing thousands of individual alerts to only a small number of incidents that require manual review.

For the County team, the benefits are clear: 520 investigation hours saved in one month, with an average of just 11 minutes investigation time per incident. For the CIO, Darktrace goes beyond reducing workloads, it actually drives security: “It identifies threats almost instantly, bringing together logs and behaviors into a single, clear view.”

The efficiency gain has been so significant that the CIO believes Darktrace augments capabilities beyond the size of a team of analysts. “You could have three analysts working around the clock, but it’s hard to bring all those logs and behaviors together in one place and communicate everything in a coordinated way. Nothing does that as quickly as Darktrace can.”

Catching the threats from within: Defense in depth with Darktrace / IDENTITY

One of the key benefits of Darktrace for the County was its breadth of capability and responsiveness. “We’re looking at everything from multi-factor authentication, insider threats, distributed denial of service attacks,” said the CIO. “I’ve worked with other products in the past, but I’ve never found a tool as good as Darktrace.”

Further insider threats uncovered by Darktrace / IDENTITY included insecure access practices. Some users had logins and passwords on shared network resources or in plain-text files. Darktrace alerted the security team and the threats were mitigated before serious damage was done.

Darktrace / IDENTITY gives organizations advanced visibility of application user behavior from unusual authentication, password sprays, account takeover, resource theft, and admin abuse. Security teams can take targeted actions including the forced log-off of a user or temporary disabling of an account to give the team time to verify legitimacy.

First line of defense against the number one attack vector: Enhancing email security with Darktrace / EMAIL

Email-based threats, such as phishing, are among the most common attack vectors in modern cybersecurity, and a key vector for ransomware attacks. Post implementation performance was so strong that the organization now plans to retire other tools, cutting costs without compromising on security.

Darktrace / EMAIL was one of the first tools that I implemented when I started here,” said CIO. “I really recognize the value of it in our environment.” In addition to detecting and flagging potentially malicious email, the CIO said an unexpected benefit has been the reinforcement of more security-aware behaviors among end users. “People are checking their junk folders now, alerting us and checking to see if something is legitimate or not.”

The CIO said that, unlike traditional email security tools that basically perform only one function, Darktrace has multiple additional capabilities that deliver extra layers of protection compared to one-dimensional alternatives. For example, AI-employee feedback loops leverage insights gained from individual users to not only improve detection rates, but also provide end users with contextual security awareness training, to enhance greater understanding of the risks.

Straightforward integration, ease of use

The County wanted a powerful, responsive solution – without demanding pre-installation or integration needs, and with maximum ease of use. “The integration is relatively painless,” said the CIO. “That’s another real benefit, you can bring Darktrace into your environment and have it up and running faster than you could ever hire additional analysts to look at the same data.”

The team found that, compared to competing products, where there was extensive setup, overhead, and resources, “Darktrace is almost plug-and-play.” According to the CIO, the solution started ingesting information and providing notifications immediately: “You can turn on defense or response mechanisms at a granular level, for email or network – or both at the same time.”

The County sees Darktrace as an integral part of its cybersecurity strategy into the future. “Having worked with Darktrace in the past, it was an easy decision for me to agree to a multi-year partnership,” said the CIO “As we continue to build out our defense-in-depth strategy, the ability to use Darktrace to manage other data sources and identify new, additional behavior will be crucial to our proactive, risk-based approach.”

Darktrace has the capacity to meet the organization’s need for exceptional responsiveness, without burning out teams. “If you’re not overburdening the teams that you do have with significant workloads, they have a lot more agility to deal with things on the fly,” said the CIO.

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI