Blog
/
Network
/
November 6, 2023

How PlugX Malware Has Evolved & Adapted

Discover how Darktrace effectively detected and thwarted the PlugX remote access trojan in 2023 despite its highly evasive and adaptive nature.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Nahisha Nobregas
SOC Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
06
Nov 2023

What is PlugX Remote Access Trojan?

Understanding remote access trojans (RATs)

As malicious actors across the threat landscape continue to pursue more efficient and effective ways of compromising target networks, all while remaining undetected by security measures, it is unsurprising to see an increase in the use of remote access trojans (RATs) in recent years. RATs typically operate stealthily, evading security tools while offering threat actors remote control over infected devices, allowing attackers to execute a wide range of malicious activities like data theft or installing additional malware.

Definition and general functionality of RATs: A Remote Access Trojan (RAT) is a type of malware that enables unauthorized remote control of an infected computer. Once installed, RATs allow attackers to monitor user activities, steal sensitive information, manipulate files, and execute commands. RATs are typically distributed via phishing emails, malicious attachments, drive-by downloads, or exploiting software vulnerabilities. Due to their ability to provide comprehensive control over a compromised system, RATs pose a significant security threat to individuals and organizations.

Historical overview of PlugX

PlugX is one such example of a RAT that has attributed to Chinese threat actors such as Mustang Panda, since it first appeared in the wild back in 2008. It is known for its use in espionage, a modular and plug-in style approach to malware development. It has the ability to evolve with the latest tactics, techniques, and procedures (TTPs) that allow it to avoid the detection of traditional security tools as it implants itself target devices.

How does PlugX work?

The ultimate goal of any RAT is to remotely control affected devices with a wide range of capabilities, which in PlugX’s case has typically included rebooting systems, keylogging, managing critical system processes, and file upload/downloads. One technique PlugX heavily relies on is dynamic-link library (DLL) sideloading to infiltrate devices. This technique involves executing a malicious payload that is embedded within a benign executable found in a data link library (DLL) [1]. The embedded payload within the DLL is often encrypted or obfuscated to prevent detection.

What’s more, a new variant of PlugX was observed in the wild across Papua New Guinea, Ghana, Mongolia, Zimbabwe, and Nigeria in August 2022, that added several new capabilities to its toolbox.

Key capabilities of PlugX

The new variation is reported to continuously monitor affected environments for new USB devices to infect, allowing it to spread further through compromised networks [2]. It is then able to hide malicious files within a USB device by using a novel technique that prevents them from being viewed on Windows operating systems (OS). These hidden files can only be viewed on a Unix-like (.nix) OS, or by analyzing an affected USB devices with a forensic tool [2]. The new PlugX variant also has the ability to create a hidden directory, “RECYCLER.BIN”, containing a collection of stolen documents, likely in preparation for exfiltration via its command and control (C2) channels. [3]

Since December 2022, PlugX has been observed targeting networks in Europe through malware delivery via HTML smuggling campaigns, a technique that has been dubbed SmugX [4].

This evasive tactic allows threat actors to prepare and deploy malware via phishing campaigns by exploiting legitimate HTML5 and JavaScript features [5].

Darktrace Coverage of PlugX

Between January and March 2023, Darktrace observed activity relating to the PlugX RAT on multiple customers across the fleet. While PlugX’s TTPs may have bypassed traditional security tools, the anomaly-based detection capabilities of Darktrace allowed it to identify and alert the subtle deviations in the behavior of affected devices, while Darktrace was able to take immediate mitigative action against such anomalous activity and stop attackers in their tracks.  

C2 Communication

Between January and March 2023, Darktrace detected multiple suspicious connections related to the PlugX RAT within customer environments. When a device has been infected, it will typically communicate through C2 infrastructure established for the PlugX RAT. In most cases observed by Darktrace, affected devices exhibited suspicious C2 connections to rare endpoints that were assessed with moderate to high confidence to be linked to PlugX.

On the network of one Darktrace customer the observed communication was a mix of successful and unsuccessful connections at a high volume to rare endpoints on ports such as 110, 443, 5938, and 80. These ports are commonly associated with POP3, HTTPS, TeamViewer RDP / DynGate, and HTTP, respectively.  Figure 1 below showcases this pattern of activity.

Figure 1: Model Breach Event Log demonstrating various successful and unsuccessful connections to the PlugX C2 endpoint 103.56.53[.]46 via various destination ports.

On another customer’s network, Darktrace observed C2 communication involving multiple failed connection attempts to another rare external endpoint associated with PlugX. The device in this case was detected attempting connections to the endpoint, 45.142.166[.]112 on ports 110, 80, and 443 which caused the DETECT model ‘Anomalous Connection / Multiple Failed Connections to Rare Endpoint’ to breach. This model examines devices attempting connections to a rare external endpoint over a short period of time, and it breached in response to almost all PlugX C2 related activity detected by Darktrace. This highlights Darktrace DETECT’s unique ability to identify anomalous activity which appears benign or uncertain, rather than relying on traditional signature-based detections.

Figure 2: Device Event Log demonstrating various successful and unsuccessful connections to the PlugX C2 endpoint 45.142.166[.]112 via various destination on January 27, 2023.

New User Agent

Darktrace's Self-Learning AI approach to threat detection also allowed it to recognize connections to PlugX associated endpoints that utilized a new user agent. In almost all connections to PlugX endpoints detected by Darktrace, the same user agent, Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36, was observed, illustrating a clear pattern in PlugX-related activity

In one example from February 2023, an affected device successfully connected to an endpoint associated with PlugX, 45.142.166[.]112, while using the aforementioned new user agent, as depicted in Figure 3.

Figure 3: The Device Event log above showcases a successful connection to the PlugX associated IP address, 45.142.166[.]112 using the new user agent ‘Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36’.

On March 21, 2023, Darktrace observed similar activity on a separate customer’s network affected by connections to PlugX. This activity included connections to the same endpoint, 45.142.166[.]112. The connection was an HTTP POST request made via proxy with the same new user agent, ‘Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36’. When investigated further this user agent actually reveals very little about itself and appears to be missing a couple of common features that are typically contained in a user agent string, such as a web browser and its version or the mention of Safari before its build ID (‘537.36’).

Additionally, for this connection the URI observed consisted of a random string of 8 hexadecimal characters, namely ‘d819f07a’. This is a technique often used by malware to communicate with its C2 servers, while evading the detection of signature-based detection tools. Darktrace, however, recognized that this external connection to an endpoint with no hostname constituted anomalous behavior, and could have been indicative of a threat actor communicating with malicious infrastructure, thus the ‘Anomalous Connection / Possible Callback URI’ model was breached.

Figure 4: An affected device was detected using the new user agent, ‘Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36’ while connecting to the rare external endpoint 45.142.166[.]112 via proxy.

Numeric File Download

Darktrace’s detection of PlugX activity on another customer’s network, in February 2023, helped to demonstrate related patterns of activity within the C2 communication and tooling attack phases. Observed PlugX activity on this network followed the subsequent pattern; a connection to a PlugX endpoints is made, followed by a HTTP POST request to a numeric URI with a random string of 8 hexadecimal characters, as previously highlighted. Darktrace identified that this activity represented unusual ‘New Activity’ for this device, and thus treated it with suspicion.

Figure 5: New activity was identified by Darktrace in the Device Event Log shown above for connections to the endpoint 45.142.166[.]112 followed by HTTP POSTs to URIs “/8891431c” and “/ba12b866” on February 15, 2023.

The device in question continued to connect to the endpoint and make HTTP POST connections to various URIs relating to PlugX. Additionally, the user agent `Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36` was again detected for these connections. Figure 6 details the activity captured by Darktrace’s Cyber AI Analyst.

Figure 6: The image above showcases activity captured by Darktrace’s AI Analyst for PlugX connections made on February 15, 2023.

Darktrace detected that during these connections, the device in question attempted to download a suspicious file named only with numbers. The use of numeric file names is a technique often used by threat actors to obfuscate the download of malicious files or programs and bypass traditional security tools. Darktrace understood that the download of a numeric file, coupled with the use of an anomalous new user agent, mean the incident should be treated with suspicion. Fortunately, Darktrace RESPOND was enabled in autonomous response mode during this attack, meaning it was able to automatically block the device from downloading the file, or any other files, from the suspicious external location for a two-hour period, potentially preventing the download of PlugX’s malicious tooling.

Conclusion

Amid the continued evolution of PlugX from an espionage tool to a more widely available malware, it is essential that threat detection does not rely on a set of characteristics or indicators, but rather is focused on anomalies. Throughout these cases, Darktrace demonstrated the efficacy of its detection and alerting on emerging activity pertaining to a particularly stealthy and versatile RAT. Over the years, PlugX has continually looked to evolve and survive in the ever-changing threat landscape by adapting new capabilities and TTPs through which it can infect a system and spread to new devices without being noticed by security teams and their tools.

However, Darktrace’s Self-Learning AI allows it to gain a strong understanding of customer networks, learning what constitutes expected network behavior which in turn allows it to recognize the subtle deviations indicative of an ongoing compromise.

Darktrace’s ability to identify emerging threats through anomaly-based detection, rather than relying on established threat intelligence, uniquely positions it to detect and respond to highly adaptable and dynamic threats, like the PlugX malware, regardless of how it may evolve in the future.

Credit to: Nahisha Nobregas, SOC Analyst & Dylan Hinz, Cyber Analyst

Appendices

MITRE ATT&CK Framework

Execution

  • T1059.003 Command and Scripting Interpreter: Windows Command Shell

Persistence and Privilege Escalation

  • T1547.001 Boot or Logon AutoStart Execution: Registry Run Keys / Startup Folder
  • T1574.001 Hijack Execution Flow: DLL Search Order Hijacking
  • T1574.002 Hijack Execution Flow: DLL Side-Loading
  • T1543.003 Create or Modify System Process: Windows Service
  • T1140 Deobfuscate / Decode Files or Information
  • T1083 File and Directory Discovery

Defense Evasion

  • T1564.001 Hide Artifacts: Hidden Files and Directories
  • T1036.004 Masquerading: Task or Service
  • T1036.005 Masquerading: Match Legitimate Name or Location
  • T1027.006 Obfuscated Files or Information: HTML Smuggling

Credential Access

  • T1056.001 Input Capture: Keylogging

Collection

  • T1105 Ingress Tool Transfer

Command and Control

  • T1573.001 Encrypted Channel: Symmetric Cryptography
  • T1070.003 Mail Protocols
  • T1071.001 Web Protocol

DETECT Model Breaches

  • Anomalous Connection / Multiple Failed Connections to Rare Endpoint
  • Anomalous Connection / New User Agent to IP Without Hostname
  • Anomalous File / New User Agent Followed By Numeric File Download
  • Anomalous Connection / Possible Callback URL

Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

45.142.166[.]112 - IP - PlugX C2 Endpoint / moderate - high

103.56.53[.]46 - IP - PlugX C2 Endpoint / moderate - high

Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36 - User Agent - PlugX User Agent / moderate – high

/8891431c - URI - PlugX URI / moderate-high

/ba12b866 - URI - PlugX URI / moderate -high

References

1. https://www.crowdstrike.com/blog/dll-side-loading-how-to-combat-threat-actor-evasion-techniques/

2. https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/

3. https://news.sophos.com/en-us/2023/03/09/border-hopping-plugx-usb-worm/

4. https://thehackernews.com/2023/07/chinese-hackers-use-html-smuggling-to.html

5. https://www.cyfirma.com/outofband/html-smuggling-a-stealthier-approach-to-deliver-malware/

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Nahisha Nobregas
SOC Analyst

More in this series

No items found.

Blog

/

Network

/

August 8, 2025

Ivanti Under Siege: Investigating the Ivanti Endpoint Manager Mobile Vulnerabilities (CVE-2025-4427 & CVE-2025-4428)

ivanti cve exploitation edge infrastructure Default blog imageDefault blog image

Ivanti & Edge infrastructure exploitation

Edge infrastructure exploitations continue to prevail in today’s cyber threat landscape; therefore, it was no surprise that recent Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities CVE-2025-4427 and CVE-2025-4428 were exploited targeting organizations in critical sectors such as healthcare, telecommunications, and finance across the globe, including across the Darktrace customer base in May 2025.

Exploiting these types of vulnerabilities remains a popular choice for threat actors seeking to enter an organization’s network to perform malicious activity such as cyber espionage, data exfiltration and ransomware detonation.

Vulnerabilities in Ivanti EPMM

Ivanti EPMM allows organizations to manage and configure enterprise mobile devices. On May 13, 2025, Ivanti published a security advisory [1] for their Ivanti Endpoint Manager Mobile (EPMM) devices addressing a medium and high severity vulnerability:

  • CVE-2025-4427, CVSS: 5.6: An authentication bypass vulnerability
  • CVE-2025-4428, CVSS: 7.2: Remote code execution vulnerability

Successfully exploiting both vulnerabilities at the same time could lead to unauthenticated remote code execution from an unauthenticated threat actor, which could allow them to control, manipulate, and compromise managed devices on a network [2].

Shortly after the disclosure of these vulnerabilities, external researchers uncovered evidence that they were being actively exploited in the wild and identified multiple indicators of compromise (IoCs) related to post-exploitation activities for these vulnerabilities [2] [3]. Research drew particular attention to the infrastructure utilized in ongoing exploitation activity, such as leveraging the two vulnerabilities to eventually deliver malware contained within ELF files from Amazon Web Services (AWS) S3 bucket endpoints and to deliver KrustyLoader malware for persistence. KrustyLoader is a Rust based malware that was discovered being downloaded in compromised Ivanti Connect Secure systems back in January 2024 when the zero-day critical vulnerabilities; CVE-2024-21887 and CVE-2023-46805 [10].

This suggests the involvement of the threat actor UNC5221, a suspected China-nexus espionage actor [3].

In addition to exploring the post-exploit tactics, techniques, and procedures (TTPs) observed for these vulnerabilities across Darktrace’s customer base, this blog will also examine the subtle changes and similarities in the exploitation of earlier Ivanti vulnerabilities—specifically Ivanti Connect Secure (CS) and Policy Secure (PS) vulnerabilities CVE-2023-46805 and CVE-2024-21887 in early 2024, as well as CVE-2025-0282 and CVE-2025-0283, which affected CS, PS, and Zero Trust Access (ZTA) in January 2025.

Darktrace Coverage

In May 2025, shortly after Ivanti disclosed vulnerabilities in their EPMM product, Darktrace’s Threat Research team identified attack patterns potentially linked to the exploitation of these vulnerabilities across multiple customer environments. The most noteworthy attack chain activity observed included exploit validation, payload delivery via AWS S3 bucket endpoints, subsequent delivery of script-based payloads, and connections to dpaste[.]com, possibly for dynamic payload retrieval. In a limited number of cases, connections were also made to an IP address associated with infrastructure linked to SAP NetWeaver vulnerability CVE-2025-31324, which has been investigated by Darktrace in an earlier case.

Exploit Validation

Darktrace observed devices within multiple customer environments making connections related to Out-of-Band Application Security Testing (OAST). These included a range of DNS requests and connections, most of which featured a user agent associated with the command-line tool cURL, directed toward associated endpoints. The hostnames of these endpoints consisted of a string of randomly generated characters followed by an OAST domain, such as 'oast[.]live', 'oast[.]pro', 'oast[.]fun', 'oast[.]site', 'oast[.]online', or 'oast[.]me'. OAST endpoints can be leveraged by malicious actors to trigger callbacks from targeted systems, such as for exploit validation. This activity, likely representing the initial phase of the attack chain observed across multiple environments, was also seen in the early stages of previous investigations into the exploitation of Ivanti vulnerabilities [4]. Darktrace also observed similar exploit validation activity during investigations conducted in January 2024 into the Ivanti CS vulnerabilities CVE-2023-46805 and CVE-2024-21887.

Payload Delivery via AWS

Devices across multiple customer environments were subsequently observed downloading malicious ELF files—often with randomly generated filenames such as 'NVGAoZDmEe'—from AWS S3 bucket endpoints like 's3[.]amazonaws[.]com'. These downloads occurred over HTTP connections, typically using wget or cURL user agents. Some of the ELF files were later identified to be KrustyLoader payloads using open-source intelligence (OSINT). External researchers have reported that the KrustyLoader malware is executed in cases of Ivanti EPMM exploitation to gain and maintain a foothold in target networks [2].

In one customer environment, after connections were made to the endpoint fconnect[.]s3[.]amazonaws[.]com, Darktrace observed the target system downloading the ELF file mnQDqysNrlg via the user agent Wget/1.14 (linux-gnu). Further investigation of the file’s SHA1 hash (1dec9191606f8fc86e4ae4fdf07f09822f8a94f2) linked it to the KrustyLoader malware [5]. In another customer environment, connections were instead made to tnegadge[.]s3[.]amazonaws[.]com using the same user agent, from which the ELF file “/dfuJ8t1uhG” was downloaded. This file was also linked to KrustyLoader through its SHA1 hash (c47abdb1651f9f6d96d34313872e68fb132f39f5) [6].

The pattern of activity observed so far closely mirrors previous exploits associated with the Ivanti vulnerabilities CVE-2023-46805 and CVE-2024-21887 [4]. As in those cases, Darktrace observed exploit validation using OAST domains and services, along with the use of AWS endpoints to deliver ELF file payloads. However, in this instance, the delivered payload was identified as KrustyLoader malware.

Later-stage script file payload delivery

In addition to the ELF file downloads, Darktrace also detected other file downloads across several customer environments, potentially representing the delivery of later-stage payloads.

The downloaded files included script files with the .sh extension, featuring randomly generated alphanumeric filenames. One such example is “4l4md4r.sh”, which was retrieved during a connection to the IP address 15.188.246[.]198 using a cURL-associated user agent. This IP address was also linked to infrastructure associated with the SAP NetWeaver remote code execution vulnerability CVE-2025-31324, which enables remote code execution on NetWeaver Visual Composer. External reporting has attributed this infrastructure to a China-nexus state actor [7][8][9].

In addition to the script file downloads, devices on some customer networks were also observed making connections to pastebin[.]com and dpaste[.]com, two sites commonly used to host or share malicious payloads or exploitation instructions [2]. Exploits, including those targeting Ivanti EPMM vulnerabilities, can dynamically fetch malicious commands from sites like dpaste[.]com, enabling threat actors to update payloads. Unlike the previously detailed activity, this behavior was not identified in any prior Darktrace investigations into Ivanti-related vulnerabilities, suggesting a potential shift in the tactics used in post-exploitation stages of Ivanti attacks.

Conclusion

Edge infrastructure vulnerabilities, such as those found in Ivanti EPMM and investigated across customer environments with Darktrace / NETWORK, have become a key tool in the arsenal of attackers in today’s threat landscape. As highlighted in this investigation, while many of the tactics employed by threat actors following successful exploitation of vulnerabilities remain the same, subtle shifts in their methods can also be seen.

These subtle and often overlooked changes enable threat actors to remain undetected within networks, highlighting the critical need for organizations to maintain continuous extended visibility, leverage anomaly based behavioral analysis, and deploy machine speed intervention across their environments.

Credit to Nahisha Nobregas (Senior Cyber Analyst) and Anna Gilbertson (Senior Cyber Analyst)

Appendices

Mid-High Confidence IoCs

(IoC – Type - Description)

-       trkbucket.s3.amazonaws[.]com – Hostname – C2 endpoint

-       trkbucket.s3.amazonaws[.]com/NVGAoZDmEe – URL – Payload

-       tnegadge.s3.amazonaws[.]com – Hostname – C2 endpoint

-       tnegadge.s3.amazonaws[.]com/dfuJ8t1uhG – URL – Payload

-       c47abdb1651f9f6d96d34313872e68fb132f39f5 - SHA1 File Hash – Payload

-       4abfaeadcd5ab5f2c3acfac6454d1176 - MD5 File Hash - Payload

-       fconnect.s3.amazonaws[.]com – Hostname – C2 endpoint

-       fconnect.s3.amazonaws[.]com/mnQDqysNrlg – URL - Payload

-       15.188.246[.]198 – IP address – C2 endpoint

-       15.188.246[.]198/4l4md4r.sh?grep – URL – Payload

-       185.193.125[.]65 – IP address – C2 endpoint

-       185.193.125[.]65/c4qDsztEW6/TIGHT_UNIVERSITY – URL – C2 endpoint

-       d8d6fe1a268374088fb6a5dc7e5cbb54 – MD5 File Hash – Payload

-       64.52.80[.]21 – IP address – C2 endpoint

-       0d8da2d1.digimg[.]store – Hostname – C2 endpoint

-       134.209.107[.]209 – IP address – C2 endpoint

Darktrace Model Detections

-       Compromise / High Priority Tunnelling to Bin Services (Enhanced Monitoring Model)

-       Compromise / Possible Tunnelling to Bin Services

-       Anomalous Server Activity / New User Agent from Internet Facing System

-       Compliance / Pastebin

-       Device / Internet Facing Device with High Priority Alert

-       Anomalous Connection / Callback on Web Facing Device

-       Anomalous File / Script from Rare External Location

-       Anomalous File / Incoming ELF File

-       Device / Suspicious Domain

-       Device / New User Agent

-       Anomalous Connection / Multiple Connections to New External TCP Port

-       Anomalous Connection / New User Agent to IP Without Hostname

-       Anomalous File / EXE from Rare External Location

-       Anomalous File / Internet Facing System File Download

-       Anomalous File / Multiple EXE from Rare External Locations

-       Compromise / Suspicious HTTP and Anomalous Activity

-       Device / Attack and Recon Tools

-       Device / Initial Attack Chain Activity

-       Device / Large Number of Model Alerts

-       Device / Large Number of Model Alerts from Critical Network Device

References

1.     https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US

2.     https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability

3.     https://www.wiz.io/blog/ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428

4.     https://www.darktrace.com/blog/the-unknown-unknowns-post-exploitation-activities-of-ivanti-cs-ps-appliances

5.     https://www.virustotal.com/gui/file/ac91c2c777c9e8638ec1628a199e396907fbb7dcf9c430ca712ec64a6f1fcbc9/community

6.     https://www.virustotal.com/gui/file/f3e0147d359f217e2aa0a3060d166f12e68314da84a4ecb5cb205bd711c71998/community

7.     https://www.virustotal.com/gui/ip-address/15.188.246.198

8.     https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures

9.     https://www.darktrace.com/blog/tracking-cve-2025-31324-darktraces-detection-of-sap-netweaver-exploitation-before-and-after-disclosure

10.  https://www.synacktiv.com/en/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises

The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.

Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein.

Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.

Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.

The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content without notice.

Continue reading
About the author
Nahisha Nobregas
SOC Analyst

Blog

/

Cloud

/

August 7, 2025

How CDR & Automated Forensics Transform Cloud Incident Response

cloud security investigation guy on computer doing workDefault blog imageDefault blog image

Introduction: Cloud investigations

In cloud security, speed, automation and clarity are everything. However, for many SOC teams, responding to incidents in the cloud is often very difficult especially when attackers move fast, infrastructure is ephemeral, and forensic skills are scarce.

In this blog we will walk through an example that shows exactly how Darktrace Cloud Detection and Response (CDR) and automated cloud forensics together, solve these challenges, automating cloud detection, and deep forensic investigation in a way that’s fast, scalable, and deeply insightful.

The Problem: Cloud incidents are hard to investigate

Security teams often face three major hurdles when investigating cloud detections:

Lack of forensic expertise: Most SOCs and security teams aren’t natively staffed with forensics specialists.

Ephemeral infrastructure: Cloud assets spin up and down quickly, leaving little time to capture evidence.

Lack of existing automation: Gathering forensic-level data often requires manual effort and leaves teams scrambling around during incidents — accessing logs, snapshots, and system states before they disappear. This process is slow and often blocked by permissions, tooling gaps, or lack of visibility.

How Darktrace augments cloud investigations

1. Darktrace’s CDR finds anomalous activity in the cloud

An alert is generated for a large outbound data transfer from an externally facing EC2 instance to a rare external endpoint. It’s anomalous, unexpected, and potentially serious.

2. AI-led investigation stitches together the incident for a SOC analyst to look into

When a security incident unfolds, Darktrace’s Cyber AI Analyst TM is the first to surface it, automatically correlating behaviors, surfacing anomalies, and presenting a cohesive incident summary. It’s fast, detailed, and invaluable.

Once the incident is created, more questions are raised.

  • How were the impacted resources compromised?
  • How did the attack unfold over time – what tools and malware were used?
  • What data was accessed and exfiltrated?

What you’ll see as a SOC analyst: The incident begins in Darktrace’s Threat Visualizer, where a Cyber AI Analyst incident has been generated automatically highlighting large anomalous data transfer to a suspicious external IP. This isn’t just another alert, it’s a high-fidelity signal backed by Darktrace’s Self-Learning AI.

Cyber AI Analyst incident created for anomalous outbound data transfer
Figure 1: Cyber AI Analyst incident created for anomalous outbound data transfer

The analyst can then immediately pivot to Darktrace / CLOUD’s architecture view (see below), gaining context on the asset’s environment, ingress/egress points, connected systems, potential attack paths and whether there are any current misconfigurations detected on the asset.

Darktrace / CLOUD architecture view providing critical cloud context
Figure 2: Darktrace / CLOUD architecture view providing critical cloud context

3. Automated forensic capture — No expertise required

Then comes the game-changer, Darktrace’s recent acquisition of Cado enhances its cloud forensics capabilities. From the first alert triggered, Darktrace has already kicked in and automatically processed and analyzed a full volume capture of the EC2. Everything, past and present, is preserved. No need for manual snapshots, CLI commands, or specialist intervention.

Darktrace then provides a clear timeline highlighting the evidence and preserving it. In our example we identify:

  • A brute-force attempt on a file management app, followed by a successful login
  • A reverse shell used to gain unauthorized remote access to the EC2
  • A reverse TCP connection to the same suspicious IP flagged by Darktrace
  • Attacker commands showing how the data was split and prepared for exfiltration
  • A file (a.tar) created from two sensitive archives: product_plans.zip and research_data.zip

All of this is surfaced through the timeline view, ranked by significance using machine learning. The analyst can pivot through time, correlate events, and build a complete picture of the attack — without needing cloud forensics expertise.

Darktrace even gives the ability to:

  • Download and inspect gathered files in full detail, enabling teams to verify exactly what data was accessed or exfiltrated.
  • Interact with the file system as if it were live, allowing investigators to explore directories, uncover hidden artifacts, and understand attacker movement with precision.
Figure 3 Cado critical forensic investigation automated insights
Figure 3: Cado critical forensic investigation automated insights
Figure 4: Cado forensic file analysis of reverse shell and download option
Figure 5: a.tar created from two sensitive archives: product_plans.zip and research_data.zip
Figure 6: Traverse the full file system of the asset

Why this matters?

This workflow solves the hardest parts of cloud investigation:

  1. Capturing evidence before it disappears
  2. Understanding attacker behavior in detail - automatically
  3. Linking detections to impact with full incident visibility

This kind of insight is invaluable for organizations especially regulated industries, where knowing exactly what data was affected is critical for compliance and reporting. It’s also a powerful tool for detecting insider threats, not just external attackers.

Darktrace / CLOUD and Cado together acts as a force multiplier helping with:

  • Reducing investigation time from hours to minutes
  • Preserving ephemeral evidence automatically
  • Empowering analysts with forensic-level visibility

Cloud threats aren’t slowing down. Your response shouldn’t either. Darktrace / CLOUD + Cado gives your SOC the tools to detect, contain, and investigate cloud incidents — automatically, accurately, and at scale.

[related-resource]

Continue reading
About the author
Adam Stevens
Director of Product, Cloud Security
Your data. Our AI.
Elevate your network security with Darktrace AI