Blog
Inside the SOC
PlugX Malware: A RAT’s Race to Adapt and Survive
What is PlugX Remote Access Trojan?
As malicious actors across the threat landscape continue to pursue more efficient and effective ways of compromising target networks, all while remaining undetected by security measures, it is unsurprising to see an increase in the use of remote access trojans (RATs) in recent years. RATs typically operate stealthily, evading security tools while offering threat actors remote control over infected devices, allowing attackers to execute a wide range of malicious activities like data theft or installing additional malware.
PlugX is one such example of a RAT that has attributed to Chinese threat actors such as Mustang Panda, since it first appeared in the wild back in 2008. It is known for its use in espionage, a modular and plug-in style approach to malware development. It has the ability to evolve with the latest tactics, techniques, and procedures (TTPs) that allow it to avoid the detection of traditional security tools as it implants itself target devices.
How Does PlugX Work?
The ultimate goal of any RAT is to remotely control affected devices with a wide range of capabilities, which in PlugX’s case has typically included rebooting systems, keylogging, managing critical system processes, and file upload/downloads. One technique PlugX heavily relies on is dynamic-link library (DLL) sideloading to infiltrate devices. This technique involves executing a malicious payload that is embedded within a benign executable found in a data link library (DLL) [1]. The embedded payload within the DLL is often encrypted or obfuscated to prevent detection.
What’s more, a new variant of PlugX was observed in the wild across Papua New Guinea, Ghana, Mongolia, Zimbabwe, and Nigeria in August 2022, that added several new capabilities to its toolbox.
The new variation is reported to continuously monitor affected environments for new USB devices to infect, allowing it to spread further through compromised networks [2]. It is then able to hide malicious files within a USB device by using a novel technique that prevents them from being viewed on Windows operating systems (OS). These hidden files can only be viewed on a Unix-like (.nix) OS, or by analyzing an affected USB devices with a forensic tool [2]. The new PlugX variant also has the ability to create a hidden directory, “RECYCLER.BIN”, containing a collection of stolen documents, likely in preparation for exfiltration via its command and control (C2) channels. [3]
Since December 2022, PlugX has been observed targeting networks in Europe through malware delivery via HTML smuggling campaigns, a technique that has been dubbed SmugX [4].
This evasive tactic allows threat actors to prepare and deploy malware via phishing campaigns by exploiting legitimate HTML5 and JavaScript features [5].
Darktrace Coverage of PlugX
Between January and March 2023, Darktrace observed activity relating to the PlugX RAT on multiple customers across the fleet. While PlugX’s TTPs may have bypassed traditional security tools, the anomaly-based detection capabilities of Darktrace DETECT™ allowed it to identify and alert the subtle deviations in the behavior of affected devices, while Darktrace RESPOND™ was able to take immediate mitigative action against such anomalous activity and stop attackers in their tracks.
C2 Communication
Between January and March 2023, Darktrace detected multiple suspicious connections related to the PlugX RAT within customer environments. When a device has been infected, it will typically communicate through C2 infrastructure established for the PlugX RAT. In most cases observed by Darktrace, affected devices exhibited suspicious C2 connections to rare endpoints that were assessed with moderate to high confidence to be linked to PlugX.
On the network of one Darktrace customer the observed communication was a mix of successful and unsuccessful connections at a high volume to rare endpoints on ports such as 110, 443, 5938, and 80. These ports are commonly associated with POP3, HTTPS, TeamViewer RDP / DynGate, and HTTP, respectively. Figure 1 below showcases this pattern of activity.
On another customer’s network, Darktrace observed C2 communication involving multiple failed connection attempts to another rare external endpoint associated with PlugX. The device in this case was detected attempting connections to the endpoint, 45.142.166[.]112 on ports 110, 80, and 443 which caused the DETECT model ‘Anomalous Connection / Multiple Failed Connections to Rare Endpoint’ to breach. This model examines devices attempting connections to a rare external endpoint over a short period of time, and it breached in response to almost all PlugX C2 related activity detected by Darktrace. This highlights Darktrace DETECT’s unique ability to identify anomalous activity which appears benign or uncertain, rather than relying on traditional signature-based detections.
New User Agent
Darktrace DETECT’s Self-Learning AI approach to threat detection also allowed it to recognize connections to PlugX associated endpoints that utilized a new user agent. In almost all connections to PlugX endpoints detected by Darktrace, the same user agent, Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36, was observed, illustrating a clear pattern in PlugX-related activity
In one example from February 2023, an affected device successfully connected to an endpoint associated with PlugX, 45.142.166[.]112, while using the aforementioned new user agent, as depicted in Figure 3.
On March 21, 2023, Darktrace observed similar activity on a separate customer’s network affected by connections to PlugX. This activity included connections to the same endpoint, 45.142.166[.]112. The connection was an HTTP POST request made via proxy with the same new user agent, ‘Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36’. When investigated further this user agent actually reveals very little about itself and appears to be missing a couple of common features that are typically contained in a user agent string, such as a web browser and its version or the mention of Safari before its build ID (‘537.36’).
Additionally, for this connection the URI observed consisted of a random string of 8 hexadecimal characters, namely ‘d819f07a’. This is a technique often used by malware to communicate with its C2 servers, while evading the detection of signature-based detection tools. Darktrace, however, recognized that this external connection to an endpoint with no hostname constituted anomalous behavior, and could have been indicative of a threat actor communicating with malicious infrastructure, thus the ‘Anomalous Connection / Possible Callback URI’ model was breached.
Numeric File Download
Darktrace’s detection of PlugX activity on another customer’s network, in February 2023, helped to demonstrate related patterns of activity within the C2 communication and tooling attack phases. Observed PlugX activity on this network followed the subsequent pattern; a connection to a PlugX endpoints is made, followed by a HTTP POST request to a numeric URI with a random string of 8 hexadecimal characters, as previously highlighted. Darktrace identified that this activity represented unusual ‘New Activity’ for this device, and thus treated it with suspicion.
The device in question continued to connect to the endpoint and make HTTP POST connections to various URIs relating to PlugX. Additionally, the user agent `Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36` was again detected for these connections. Figure 6 details the activity captured by Darktrace’s Cyber AI Analyst.
Darktrace detected that during these connections, the device in question attempted to download a suspicious file named only with numbers. The use of numeric file names is a technique often used by threat actors to obfuscate the download of malicious files or programs and bypass traditional security tools. Darktrace understood that the download of a numeric file, coupled with the use of an anomalous new user agent, mean the incident should be treated with suspicion. Fortunately, Darktrace RESPOND was enabled in autonomous response mode during this attack, meaning it was able to automatically block the device from downloading the file, or any other files, from the suspicious external location for a two-hour period, potentially preventing the download of PlugX’s malicious tooling.
Conclusion
Amid the continued evolution of PlugX from an espionage tool to a more widely available malware, it is essential that threat detection does not rely on a set of characteristics or indicators, but rather is focused on anomalies. Throughout these cases, Darktrace demonstrated the efficacy of its detection and alerting on emerging activity pertaining to a particularly stealthy and versatile RAT. Over the years, PlugX has continually looked to evolve and survive in the ever-changing threat landscape by adapting new capabilities and TTPs through which it can infect a system and spread to new devices without being noticed by security teams and their tools.
However, Darktrace’s Self-Learning AI allows it to gain a strong understanding of customer networks, learning what constitutes expected network behavior which in turn allows it to recognize the subtle deviations indicative of an ongoing compromise.
Darktrace’s ability to identify emerging threats through anomaly-based detection, rather than relying on established threat intelligence, uniquely positions it to detect and respond to highly adaptable and dynamic threats, like the PlugX malware, regardless of how it may evolve in the future.
Credit to: Nahisha Nobregas, SOC Analyst & Dylan Hinz, Cyber Analyst
Appendices
MITRE ATT&CK Framework
Execution
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
Persistence and Privilege Escalation
- T1547.001 Boot or Logon AutoStart Execution: Registry Run Keys / Startup Folder
- T1574.001 Hijack Execution Flow: DLL Search Order Hijacking
- T1574.002 Hijack Execution Flow: DLL Side-Loading
- T1543.003 Create or Modify System Process: Windows Service
- T1140 Deobfuscate / Decode Files or Information
- T1083 File and Directory Discovery
Defense Evasion
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1036.004 Masquerading: Task or Service
- T1036.005 Masquerading: Match Legitimate Name or Location
- T1027.006 Obfuscated Files or Information: HTML Smuggling
Credential Access
- T1056.001 Input Capture: Keylogging
Collection
- T1105 Ingress Tool Transfer
Command and Control
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1070.003 Mail Protocols
- T1071.001 Web Protocol
DETECT Model Breaches
- Anomalous Connection / Multiple Failed Connections to Rare Endpoint
- Anomalous Connection / New User Agent to IP Without Hostname
- Anomalous File / New User Agent Followed By Numeric File Download
- Anomalous Connection / Possible Callback URL
Indicators of Compromise (IoCs)
IoC - Type - Description + Confidence
45.142.166[.]112 - IP - PlugX C2 Endpoint / moderate - high
103.56.53[.]46 - IP - PlugX C2 Endpoint / moderate - high
Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36 - User Agent - PlugX User Agent / moderate – high
/8891431c - URI - PlugX URI / moderate-high
/ba12b866 - URI - PlugX URI / moderate -high
References
1. https://www.crowdstrike.com/blog/dll-side-loading-how-to-combat-threat-actor-evasion-techniques/
2. https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/
3. https://news.sophos.com/en-us/2023/03/09/border-hopping-plugx-usb-worm/
4. https://thehackernews.com/2023/07/chinese-hackers-use-html-smuggling-to.html
5. https://www.cyfirma.com/outofband/html-smuggling-a-stealthier-approach-to-deliver-malware/
Like this and want more?
More in this series
Blog
Inside the SOC
Royal Pains: How Darktrace Refused to Bend the Knee to the MyKings Botnet
Botnets: A persistent cyber threat
Since their appearance in the wild over three decades ago, botnets have consistently been the attack vector of choice for many threat actors. The most prevalent of these attack vectors are distributed denial of service (DDoS) and phishing campaigns. Their persistent nature means that even if a compromised device in identified, attackers can continue to operate by using the additional compromised devices they will likely have on the target network. Similarly, command and control (C2) infrastructure can easily be restructured between infected systems, making it increasingly difficult to remove the infection.
MyKings Botnet
One of the most prevalent and sophisticated examples in recent years is the MyKings botnet, also known as Smominru or DarkCloud. Darktrace has observed numerous cases of MyKings botnet compromises across multiple customer environments in several different industries as far back as August 2022. The diverse tactics, techniques, and procedures (TTPs) and sophisticated kill chains employed by MyKings botnet may prove a challenge to traditional rule and signature-based detections.
However, Darktrace’s anomaly-centric approach enabled it to successfully detect a wide-range of indicators of compromise (IoCs) related to the MyKings botnet and bring immediate awareness to customer security teams, as it demonstrated on the network of multiple customers between March and August 2023.
Background on MyKings Botnet
MyKings has been active and spreading steadily since 2016 resulting in over 520,000 infections worldwide.[1] Although verified attribution of the botnet remains elusive, the variety of targets and prevalence of crypto-mining software on affected devices suggests the threat group behind the malware is financially motivated. The operators behind MyKings appear to be highly opportunistic, with attacks lacking an obvious specific target industry. Across Darktrace’s customer base, the organizations affected were representative of multiple industries such as entertainment, mining, education, information technology, health, and transportation.
Given its longevity, the MyKings botnet has unsurprisingly evolved since its first appearance years ago. Initial analyses of the botnet showed that the primary crypto-related activity on infected devices was the installation of Monero-mining software. However, in 2019 researchers discovered a new module within the MyKings malware that enabled clipboard-jacking, whereby the malware replaces a user's copied cryptowallet address with the operator's own wallet address in order to siphon funds.[2]
Similar to other botnets such as the Outlaw crypto-miner, the MyKings botnet can also kill running processes of unrelated malware on the compromised hosts that may have resulted from prior infection.[3] MyKings has also developed a comprehensive set of persistence techniques, including: the deployment of bootkits, initiating the botnet immediately after a system reboot, configuring Registry run keys, and generating multiple Scheduled Tasks and WMI listeners.[4] MyKings have also been observed rotating tools and payloads over time to propagate the botnet. For example, some operators have been observed utilizing PCShare, an open-source remote access trojan (RAT) customized to conduct C2 services, execute commands, and download mining software[5].
Darktrace Coverage
Across observed customer networks between March and August 2023, Darktrace identified the MyKings botnet primarily targeting Windows-based servers that supports services like MySQL, MS-SQL, Telnet, SSH, IPC, WMI, and Remote Desktop (RDP). In the initial phase of the attack, the botnet would initiate a variety of attacks against a target including brute-forcing and exploitation of unpatched vulnerabilities on exposed servers. The botnet delivers a variety of payloads to the compromised systems including worm downloaders, trojans, executable files and scripts.
This pattern of activity was detected across the network of one particular Darktrace customer in the education sector in early March 2023. Unfortunately, this customer did not have Darktrace RESPOND™ deployed on their network at the time of the attack, meaning the MyKings botnet was able to move through the cyber kill chain ultimately achieving its goal, which in this case was mining cryptocurrency.
Initial Access
On March 6, Darktrace observed an internet-facing SQL server receiving an unusually large number of incoming MySQL connections from the rare external endpoint 171.91.76[.]31 via port 1433. While it is not possible to confirm whether these suspicious connections represented the exact starting point of the infection, such a sudden influx of SQL connection from a rare external endpoint could be indicative of a malicious attempt to exploit vulnerabilities in the server's SQL database or perform password brute-forcing to gain unauthorized access. Given that MyKings typically spreads primarily through such targeting of internet-exposed devices, the pattern of activity is consistent with potential initial access by MyKings.[6]
Initial Command and Control
The device then proceeded to initiate a series of repeated HTTP connections between March 6 and March 10, to the domain www[.]back0314[.]ru (107.148.239[.]111). These connections included HTTP GET requests featuring URIs such as ‘/back.txt', suggesting potential beaconing and C2 communication. The device continued this connectivity to the external host over the course of four days, primarily utilizing destination ports 80, and 6666. While port 80 is commonly utilized for HTTP connections, port 6666 is a non-standard port for the protocol. Such connectivity over non-standard ports can indicate potential detection evasion and obfuscation tactics by the threat actors. During this time, the device also initiated repeated connections to additional malicious external endpoints with seemingly algorithmically generated hostnames such as pc.pc0416[.]xyz.
Tool Transfer
While this beaconing activity was taking place, the affected device also began to receive potential payloads from unusual external endpoints. On April 29, the device made an HTTP GET request for “/power.txt” to the endpoint 192.236.160[.]237, which was later discovered to have multiple open-source intelligence (OSINT) links to malware. Power.txt is a shellcode written in PowerShell which is downloaded and executed with the purpose of disabling Windows Defenders related functions.[7] After the initial script was downloaded (and likely executed), Darktrace went on to detect the device making a series of additional GET requests for several varying compressed and executable files. For example, the device made HTTP requests for '/pld/cmd.txt' to the external endpoint 104.233.224[.]173. In response the external server provided numerous files, including ‘u.exe’, and ‘upsup4.exe’ for download, both of which share file names with previously identified MyKings payloads.
MyKings deploys a diverse array of payloads to expand the botnet and secure a firm position within a compromised system. This multi-faceted approach may render conventional security measures less effective due to the intricacies of and variety of payloads involved in compromises. Darktrace, however, does not rely on static or outdated lists of IoCs in order to detect malicious activity. Instead, DETECT’s Self-Learning AI allows it to identify emerging compromise activity by recognizing the subtle deviations in an affected device’s behavior that could indicate it has fallen into the hands of malicious actors.
Achieving Objectives – Crypto-Mining
Several weeks after the initial payloads were delivered and beaconing commenced, Darktrace finally detected the initiation of crypto-mining operations. On May 27, the originally compromised server connected to the rare domain other.xmrpool[.]ru over port 1081. As seen in the domain name, this endpoint appears to be affiliated with pool mining activity and the domain has various OSINT affiliations with the cryptocurrency Monero coin. During this connection, the host was observed passing Monero credentials, activity which parallels similar mining operations observed on other customer networks that had been compromised by the MyKings botnet.
Although mining activity may not pose an immediate or urgent concern for security unauthorized cryptomining on devices can result in detrimental consequences, such as compromised hardware integrity, elevated energy costs, and reduced productivity, and even potential involvement in money laundering.
Conclusion
Detecting future iterations of the MyKings botnet will likely demand a shift away from an overreliance on traditional rules and signatures and lists of “known bads”, instead requiring organizations to employ AI-driven technology that can identify suspicious activity that represents a deviation from previously established patterns of life.
Despite the diverse range of payloads, malicious endpoints, and intricate activities that constitute a typical MyKing botnet compromise, Darktrace was able successfully detect multiple critical phases within the MyKings kill chain. Given the evolving nature of the MyKings botnet, it is highly probable the botnet will continue to expand and adapt, leveraging new tactics and technologies. By adopting Darktrace’s product of suites, including Darktrace DETECT, organizations are well-positioned to identify these evolving threats as soon as they emerge and, when coupled with the autonomous response technology of Darktrace RESPOND, threats like the MyKings botnet can be stopped in their tracks before they can achieve their ultimate goals.
Credit to: Oluwatosin Aturaka, Analyst Team Lead, Cambridge, Adam Potter, Cyber Analyst
Appendix
IoC Table
IoC - Type - Description + Confidence
162.216.150[.]108- IP - C2 Infrastructure
103.145.106[.]242 - IP - C2 Infrastructure
137.175.56[.]104 - IP - C2 Infrastructure
138.197.152[.]201 - IP - C2 Infrastructure
139.59.74[.]135 - IP - C2 Infrastructure
pc.pc0416[.]xyz - Domain - C2 Infrastructure (DGA)
other.xmrpool[.]ru - Domain - Cryptomining Endpoint
xmrpool[.]ru - Domain - Cryptomining Endpoint
103.145.106[.]55 - IP - Cryptomining Endpoint
ntuser[.]rar - Zipped File - Payload
/xmr1025[.]rar - Zipped File - Payload
/20201117[.]rar - Zipped File - Payload
wmi[.]txt - File - Payload
u[.]exe - Executable File - Payload
back[.]txt - File - Payload
upsupx2[.]exe - Executable File - Payload
cmd[.]txt - File - Payload
power[.]txt - File - Payload
ups[.]html - File - Payload
xmr1025.rar - Zipped File - Payload
171.91.76[.]31- IP - Possible Initial Compromise Endpoint
www[.]back0314[.]ru - Domain - Probable C2 Infrastructure
107.148.239[.]111 - IP - Probable C2 Infrastructure
194.67.71[.]99 - IP- Probable C2 Infrastructure
Darktrace DETECT Model Breaches
- Device / Initial Breach Chain Compromise
- Anomalous File / Masqueraded File Transfer (x37)
- Compromise / Large DNS Volume for Suspicious Domain
- Compromise / Fast Beaconing to DGA
- Device / Large Number of Model Breaches
- Anomalous File / Multiple EXE from Rare External Locations (x30)
- Compromise / Beacon for 4 Days (x2)
- Anomalous Server Activity / New User Agent from Internet Facing System
- Anomalous Connection / New User Agent to IP Without Hostname
- Anomalous Server Activity / New Internet Facing System
- Anomalous File / EXE from Rare External Location (x37)
- Device / Large Number of Connections to New Endpoints
- Anomalous Server Activity / Server Activity on New Non-Standard Port (x3)
- Device / Threat Indicator (x3)
- Unusual Activity / Unusual External Activity
- Compromise / Crypto Currency Mining Activity (x37)
- Compliance / Internet Facing SQL Server
- Device / Anomalous Scripts Download Followed By Additional Packages
- Device / New User Agent
MITRE ATT&CK Mapping
ATT&CK Technique - Technique ID
Reconnaissance – T1595.002 Vulnerability Scanning
Resource Development – T1608 Stage Capabilities
Resource Development – T1588.001 Malware
Initial Access – T1190 Exploit Public-Facing Application
Command and Control – T15568.002 Domain Generated Algorithms
Command and Control – T1571 Non-Standard Port
Execution – T1047 Windows Management Instrumentation
Execution – T1059.001 Command and Scripting Interpreter
Persistence – T1542.003 Pre-OS Boot
Impact – T1496 Resource Hijacking
References
[1] https://www.binarydefense.com/resources/threat-watch/mykings-botnet-is-growing-and-remains-under-the-radar/
[2] https://therecord.media/a-malware-botnet-has-made-more-than-24-7-million-since-2019
[3] https://www.darktrace.com/blog/outlaw-returns-uncovering-returning-features-and-new-tactics
[4] https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophoslabs-uncut-mykings-report.pdf
[5] https://www.antiy.com/response/20190822.html
[6] https://ethicaldebuggers.com/mykings-botnet/
[7] https://ethicaldebuggers.com/mykings-botnet/
Blog
Thought Leadership
The Implications of NIS2 on Cyber Security and AI
The NIS2 Directive requires member states to adopt laws that will improve the cyber resilience of organizations within the EU. It impacts organizations that are “operators of essential services”. Under NIS 1, EU member states could choose what this meant. In an effort to ensure more consistent application, NIS2 has set out its own definition. It eliminates the distinction between operators of essential services and digital service providers from NIS1, instead defining a new list of sectors:
- Energy (electricity, district heating and cooling, gas, oil, hydrogen)
- Transport (air, rail, water, road)
- Banking (credit institutions)
- Financial market infrastructures
- Health (healthcare providers and pharma companies)
- Drinking water (suppliers and distributors)
- Digital infrastructure (DNS, TLD registries, telcos, data center providers, etc.)
- ICT service providers (B2B): MSSPs and managed service providers
- Public administration (central and regional government institutions, as defined per member state)
- Space
- Postal and courier services
- Waste management
- Chemicals
- Food
- Manufacturing of medical devices
- Computers and electronics
- Machinery and equipment
- Motor vehicles, trailers and semi-trailers and other transport equipment
- Digital providers (online market places, online search engines, and social networking service platforms) and research organizations.
With these updates, it becomes harder to try and find industry segments not included within the scope. NIS2 represents legally binding cyber security requirements for a significant region and economy. Standout features that have garnered the most attention include the tight timelines associated with notification requirements. Under NIS 2, in-scope entities must submit an initial report or “early warning” to the competent national authority or computer security incident response team (CSIRT) within 24 hours from when the entity became aware of a significant incident. This is a new development from the first iteration of the Directive, which used more vague language of the need to notify authorities “without undue delay”.
Another aspect gaining attention is oversight and regulation – regulators are going to be empowered with significant investigation and supervision powers including on-site inspections.
The stakes are now higher, with the prospect of fines that are capped at €10 million or 2% of an offending organization’s annual worldwide turnover – whichever is greater. Added to that, the NIS2 Directive includes an explicit obligation to hold members of management bodies personally responsible for breaches of their duties to ensure compliance with NIS2 obligations – and members can be held personally liable.
The risk management measures introduced in the Directive are not altogether surprising – they reflect common best practices. Many organizations (especially those that are newly in scope for NIS2) may have to expand their cyber security capabilities, but there’s nothing controversial or alarming in the required measures. For organizations in this situation, there are various tools, best practices, and frameworks they can leverage. Darktrace in particular provides capabilities in the areas of visibility, incident handling, and reporting that can help.
NIS2 and Cyber AI
The use of AI is not an outright requirement within NIS2 – which may be down to lack of knowledge and expertise in the area, and/or the immaturity of the sector. The clue to this might be in the timing: the provisional agreement on the NIS2 text was reached in May 2022 – six months before ChatGPT and other open-source Generative AI tools propelled broader AI technology into the forefront of public consciousness. If the language were drafted today, it's not far-fetched to imagine AI being mentioned much more prominently and perhaps even becoming a requirement.
NIS2 does, however, very clearly recommend that “member states should encourage the use of any innovative technology, including artificial intelligence”[1]. Another section speaks directly to essential and important entities, saying that they should “evaluate their own cyber security capabilities, and where appropriate, pursue the integration of cyber security enhancing technologies, such as artificial intelligence or machine learning systems…”[2]
One of the recitals states that “member states should adopt policies on the promotion of active cyber protection”. Where active cyber protection is defined as “the prevention, detection, monitoring, analysis and mitigation of network security breaches in an active manner.”[3]
From a Darktrace perspective, our self-learning Cyber AI technology is precisely what enables our technology to deliver active cyber protection – protecting organizations and uplifting security teams at every stage of an incident lifecycle – from proactively hardening defenses before an attack is launched, to real-time threat detection and response, through to recovering quickly back to a state of good health.
The visibility provided by Darktrace is vital to understanding the effectiveness of policies and ensuring policy compliance. NIS2 also covers incident handling and business continuity, which Darktrace HEAL addresses through AI-enabled incident response, readiness reports, simulations, and secure collaborations.
Reporting is integral to NIS2 and organizations can leverage Darktrace’s incident reporting features to present the necessary technical details of an incident and provide a jump start to compiling a full report with business context and impact.
What’s Next for NIS2
We don’t yet know the details for how EU member states will transpose NIS2 into national law – they have until 17th October 2024 to work this out. The Commission also commits to reviewing the functioning of the Directive every three years. Given how much our overall understanding and appreciation for not only the dangers of AI but also its power (perhaps even necessity in the realm of cyber security) is changing, we may see many member states will leverage the recitals’ references to AI in order to make a strong push if not a requirement that essential and important organizations within their jurisdiction leverage AI.
Organizations are starting to prepare now to meet the forthcoming legislation related to NIS2. To see how Darktrace can help, talk to your representative or contact us.
[1] (51) on page 11
[2] (89) on page 17
[3] (57) on page 12
