Blog
/
Network
/
October 30, 2024

Post-Exploitation Activities on Fortinet Devices: A Network-Based Analysis

This blog explores recent findings from Darktrace's Threat Research team on active exploitation campaigns targeting Fortinet appliances. This analysis focuses on the September 2024 exploitation of FortiManager via CVE-2024-47575, alongside related malicious activity observed in June 2024.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Adam Potter
Senior Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
30
Oct 2024

Introduction: Uncovering active exploitation of Fortinet vulnerabilities

As part of the Darktrace Threat Research team's routine analysis of October's Patch Tuesday vulnerabilities, the team began searching for signs of active exploitation of a critical vulnerability (CVE-2024-23113) affecting the FortiGate to FortiManager (FGFM) protocol.[1]

Although the investigation was prompted by an update regarding CVE 2024-23113, results of the inquiry yielded evidence of widespread exploitation of Fortinet devices in both June and September 2024 potentially via multiple vulnerabilities including CVE 2024-47575. Analysts identified two clusters of activity involving overlapping indicators of compromise (IoCs), likely constituting unique campaigns targeting Fortinet appliances.

This blog will first highlight the finding and analysis of the network-based indicators of FortiManager post-exploitation activity in September, likely involving CVE 2024-47575. The article will then briefly detail a similar pattern of malicious activity observed in June 2024 that involved similar IoCs that potentially comprises a distinct campaign targeting Fortinet perimeter devices.

Fortinet CVE Disclosures

FortiManager devices allow network administrators to manage Fortinet devices on organizations’ networks.[2] One such subset of devices managed through this method are Fortinet firewalls known as FortiGate. These manager and firewall devices communicate with each other via a custom protocol known as FortiGate to FortiManager (FGFM), whereby devices can perform reachability tests and configuration-related actions and reporting.[3] By default, FortiManager devices operate this protocol via port 541.[4]

Fortinet Product Security Incident Response Team released multiple announcements revealing vulnerabilities within the daemon responsible for implementing operability of the FGFM service. Specifically, CVE 2024-23113 enables attackers to potentially perform arbitrary remote command execution through the use of a specially crafted format string to a FortiGate device running the “fgfm daemon”.[5][6]  Similarly, the exploitation of CVE 2024-47575  could also allow remote command execution due to a missing authentication mechanism when targeting specifically FortiManager devices.[7][8]  Given how prolific both FortiGate and FortiManager devices are within the global IT security ecosystem, Darktrace analysts hypothesized that there may have been specific targeting of such devices within the customer base using these vulnerabilities throughout mid to late 2024.

Campaign Analysis

In light of these vulnerability disclosures, Darktrace’s Threat Research team began searching for signs of active exploitation by investigating file download, lateral movement or tooling activity from devices that had previously received suspicious connections on port 541. The team first noticed increases in suspicious activity involving Fortinet devices particularly in mid-September 2024. Further analysis revealed a similar series of activities involving some overlapping devices identified in June 2024. Analysis of these activity clusters revealed a pattern of malicious activity against likely FortiManager devices, including initial exploitation, payload retrieval, and exfiltration of probable configuration data.

Below is an overview of malicious activity we have observed by sector and region:

Sector and region affected by malicious activity on fortigate devices
The sectors of affected customers listed above are categorized according to the United Kingdom’s Standard Industrial Classification (SIC).

Initial Exploitation of FortiManager Devices

Across many of the observed cases in September, activity began with the initial exploitation of FortiManager devices via incoming connectivity over TLS/SSL. Such activity was detected due to the rarity of the receiving devices accepting connections from external sources, particularly over destination port 541. Within nearly all investigated incidents, connectivity began with the source IP, 45.32.41[.]202, establishing an SSL session with likely FortiManager devices.  Device types were determined through a combination of the devices’ hostnames and the noted TLS certificate issuer for such encrypted connections.

Due to the encrypted nature of the connection, it was not possible to ascertain the exploit used in the analyzed cases. However, given the similarity of activities targeting FortiManager devices and research conducted by outside firms, attackers likely utilized CVE 2024-47575.[9] For example, the source IP initiating the SSL sessions also has been referenced by Mandiant as engaging in CVE 2024-47575 exploitation. In addition to a consistent source IP for the connections, a similar JA3 hash was noted across multiple examined accounts, suggesting a similarity in source process for the activity.

In most cases observed by Darktrace, the incoming connectivity was followed by an outgoing connection on port 443 to the IP 45.32.41[.]202. Uncommon reception of encrypted connections over port 541, followed by the initiation of outgoing SSL connections to the same endpoint would suggest probable successful exploitation of FortiManager CVEs during this time.

Model alert logs highlighting the incoming connectivity over port 541 to the FortiManager devices followed by outgoing connection to the external IP.
Figure 1: Model alert logs highlighting the incoming connectivity over port 541 to the FortiManager devices followed by outgoing connection to the external IP.

Payload Retrieval

Investigated devices commonly retrieved some form of additional content after incoming connectivity over port 541. Darktrace’s Threat Research team noted how affected devices would make HTTP GET requests to the initial exploitation IP for the URI: /dom.js. This URI, suggestive of JavaScript content retrieval, was then validated by the HTTP response content type. Although Darktrace could see the HTTP content of the connections, usage of destination port 443 featured prominently during these HTTP requests, suggesting an attempt at encryption of the session payload details.

Figure 2: Advanced Search HTTP log to the exploitation IP noting the retrieval of JavaScript content using the curl user agent.

Cyber AI Analyst investigation into the initial exploitation activity. This incident emphasizes the rare external connectivity over port 443 requesting JavaScript content following the incoming connections over port 541.
Figure 3: Cyber AI Analyst investigation into the initial exploitation activity. This incident emphasizes the rare external connectivity over port 443 requesting JavaScript content following the incoming connections over port 541.

The operators of the campaign also appear to have used a consistent user agent for payload retrieval: curl 8.4.0. Usage of an earlier version of the curl (version 7 .86.0) was only observed in one instance. The incorporation of curl utility to establish HTTP connections therefore suggests interaction with command-line utilities on the inspected Fortinet hosts. Command-line interaction also adds validity to the usage of exploits such as CVE 2024-47575 which enable unauthenticated remote command execution. Moreover, given the egress of data seen by the devices receiving this JavaScript content, Darktrace analysts concluded that this payload likely resulted in the configuration aggregation activity noted by external researchers.

Data Exfiltration

Nearly all devices investigated during the September time period performed some form of data exfiltration using the HTTP protocol. Most frequently, devices would initiate these HTTP requests using the same curl user agent already observed during web callback activity.  Again, usage of this tool heavily suggests interaction with the command-line interface and therefore command execution.

The affected device typically made an HTTP POST request to one or both of the following two rare external IPs: 104.238.141[.]143 and 158.247.199[.]37. One of the noted IPs, 104.238.141[.]143, features prominently within external research conducted by Mandiant during this time. These HTTP POST requests nearly always sent data to the /file endpoint on the destination IPs. Analyzed connections frequently noted an HTTP mime type suggestive of compressed archive content. Some investigations also revealed specific filenames for the data sent externally: “.tm”. HTTP POST requests occurred without a specified hostname. This would suggest the IP address may have already been cached locally on the device from a running process or the IP address was hardcoded into the details of unwarranted code running on the system. Moreover, many such POSTs occurred without a GET request, which can indicate exfiltration activity.

Model alert logs noting both the connection to the IP 158.247.199[.]37 over port 443 without a hostname, and the unusual activity metric describing how the request was made without a prior HTTP GET request. Such activity can indicate malicious data exfiltration.
Figure 4: Model alert logs noting both the connection to the IP 158.247.199[.]37 over port 443 without a hostname, and the unusual activity metric describing how the request was made without a prior HTTP GET request. Such activity can indicate malicious data exfiltration.

Interestingly, in many investigations, analysts noticed a lag period between the initial access and exploitation, and the exfiltration of data via HTTP. Such a pause, sometimes over several hours to over a day, could reflect the time needed to aggregate data locally on the host or as a strategic pause in activity to avoid detection. While not present within every compromise activity logs inspected, the delay could represent slight adjustments in behavior during the campaign by the threat actor.

Figure 5: Advanced search logs showing both the payload retrieval and exfiltration activity, emphasizing the gap in time between payload retrieval and exfiltration via HTTP POST request.

HTTP and file identification details identified during this time also directly correspond to research conducted by Mandiant. Not only do we see overlap in IPs identified as receiving the posted data (104.238.141[.]143) we also directly observed an overlap in filenames for the locally aggregated configuration data. Moreover, the gzip mime type identified in multiple customer investigations also corresponds directly to exfiltration activity noted by Mandiant researchers.

Advanced search logs noting the filename and URL of the posted data to one of the exfiltration IPs. The .tm filename corresponds to the locally stored file on affected FortiManager devices analyzed by external researchers.
Figure 6: Advanced search logs noting the filename and URL of the posted data to one of the exfiltration IPs. The .tm filename corresponds to the locally stored file on affected FortiManager devices analyzed by external researchers.

Activity detected in June 2024

Common indicators

Analysts identified a similar pattern of activity between June 23 and June 25. Activity in this period involved incoming connections from the aforementioned IP 45.32.41[.]202 on either port 541 or port 443 followed by an outgoing connection to the source. This behavior was then followed by HTTP POSTs to the previously mentioned IP address 158.247.199[.]37 in addition to the novel IP: 195.85.114[.]78  using same URI ‘/file’ noted above. Given the commonalties in indicators, time period, and observed behaviors, this grouping of exploitation attempts appears to align closely with the campaign described by Mandiant and may represent exploitation of CVE 2024-47575 in June 2024. The customers targeted in June fall into the same regions and sectors as seen those in the September campaign.

Deviations in behavior

Notably, Darktrace detected a different set of actions during the same June timeframe despite featuring the same infrastructure. This activity involved an initial incoming connection from 158.247.199[.]37 to an internal device on either port 541 or port 443. This was then followed by an outgoing HTTP connection to 158.247.199[.]37 on port 443 with a URI containing varying external IPs. Upon further review, analysts noticed the IPs listed may be the public IPs of the targeted victim, suggesting a potential form device registration by the threat actor or exploit validation. While the time period and infrastructure closely align with the previous campaign described, the difference in activity may suggest another threat actor sharing infrastructure or the same threat actor carrying out a different campaign at the same time. Although the IP 45.32.41[.]202 was contacted, paralleling activity seen in September, analysts did notice a different payload received from the external host, a shell script with the filename ver.sh.

Figure 7: AI Analyst timeline noting the suspicious HTTP behavior from a FortiManager device involving the IP 158.247.199[.] 37.

Darktrace's depth of detection and investigation

Darktrace detected spikes in anomalous behavior from Fortinet devices within the customer base between September 22 and 23, 2024. Following an in-depth investigation into affected accounts and hosts, Darktrace identified a clear pattern where one, or multiple, threat actors leveraged CVEs affecting likely FortiManager devices to execute commands on the host, retrieve malicious content, and exfiltrate sensitive data. During this investigation, analysts then identified possibly related activity in June 2024 highlighted above.

The gathering and exfiltration of configuration data from network security management or other perimeter hosts is a technique that can enable future access by threat actors. This parallels activity previously discussed by Darktrace focused on externally facing devices, such as Palo Alto Networks firewall devices.  Malicious entities could utilize stolen configuration data and potentially stored passwords/hashes to gain initial access in the future, irrespective of the state of device patching. This data can also be potentially sold by initial access brokers on illicit sites. Moreover, groups can leverage this information to establish persistence mechanisms within devices and host networks to enable more impactful compromise activity.

Uncover threat pattens before they strike your network

Network and endpoint management services are essential tools for network administrators and will remain a critical part of IT infrastructure. However, these devices are often configured as internet-facing systems, which can unintentionally expose organizations networks' to attacks. Internet exposure provides malicious groups with novel entry routes into target environments. Although threat actors can swap vulnerabilities to access target networks, the exploitation process leaves behind unusual traffic patterns, making their presence detectable with the right network detection tools.

By detecting the unusual patterns of network traffic which inevitably ensue from exploitation of novel vulnerabilities, Darktrace’s anomaly-based detection and response approach can continue to identify and inhibit such intrusion activities irrespective of exploit used. Eulogizing the principle of least privilege, configuration and asset management, and maintaining the CIA Triad across security operations will continue to help security teams boost their defense posture.

See how anomaly-based detection can enhance your security operations—schedule a personalized demo today.

Get a demo button for Darktrace

Credit to Adam Potter (Senior Cyber Analyst), Emma Foulger (Principal Cyber Analyst), Nahisha Nobregas (Senior Cyber Analyst), Hyeongyung Yeom (Principal Cyber Analyst & Analyst Team Lead, East Asia), Sam Lister (Senior Cyber Analyst)

Appendix

Model Alerts

  • Anomalous Connection / Posting HTTP to IP without Hostname
  • Anomalous Connection / Callback on Web Facing Device
  • Anomalous Server Activity / New Internet Facing Server
  • Anomalous Server Activity / Outgoing from Server

Cyber AI Analyst Incidents

  • Possible HTTP Command and Control
  • Possible HTTP Command and Control to Multiple Endpoints

IoCs

Indicator – Type - Description

104.238.141[.]143 -  IP Address  - C2 infrastructure

158.247.199[.]37 - IP Address - C2 infrastructure

45.32.41[.]202 - IP Address - C2 infrastructure

104.238.141[.]143/file – URL - C2 infrastructure

158.247.199[.]37/file  - URL - C2 infrastructure

45.32.41[.]202/dom.js – URL - C2 infrastructure

.tm – Filename - Gzip file

MITRE Attack Framework

  • Initial Access
    T1190 Exploiting Public-Facing Application
  • Execution:
    T1059 Command and Scripting Interpreter  (Sub-Techniques: T1059.004 Unix Shell, T1059.008 Network Device CLI)
  • Discovery:
    T1083 File and System Discovery
    T1057 Process Discovery
  • Collection:
    T1005 Data From Local System
  • Command and Control:
    T1071 Application Layer Protocols (Sub-Technique:
    T1071.001 Web Protocols)
    T1573  Encrypted Channel
    T1573.001  Symmetric Cryptography
    T1571 Non-Standard Port
    T1105 Ingress Tool Transfer
    T1572 Protocol Tunnelling 
  • Exfiltration:
    T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

References

{1} https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575/

{2} https://docs.fortinet.com/document/fortimanager/6.4.0/ports-and-protocols/606094/fortigate-fortimanager-protocol#:~:text=The%20FortiGate%2DFortiManager%20(FGFM),by%20using%20the%20FGFM%20protocol.

{3)https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/373486/fgfm-fortigate-to-fortimanager-protocol
{4} https://www.fortiguard.com/psirt/FG-IR-24-029
{5} https://www.fortiguard.com/psirt/FG-IR-24-423
{6}https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortimanager.pdf

{7} https://doublepulsar.com/burning-zero-days-fortijump-fortimanager-vulnerability-used-by-nation-state-in-espionage-via-msps-c79abec59773

{8} https://darktrace.com/blog/post-exploitation-activities-on-pan-os-devices-a-network-based-analysis

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Adam Potter
Senior Cyber Analyst

More in this series

No items found.

Blog

/

Network

/

June 5, 2025

Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic

Woman on laptop in office buildingDefault blog imageDefault blog image

What is ClickFix and how does it work?

Amid heightened security awareness, threat actors continue to seek stealthy methods to infiltrate target networks, often finding the human end user to be the most vulnerable and easily exploited entry point.

ClickFix baiting is an exploitation of the end user, making use of social engineering techniques masquerading as error messages or routine verification processes, that can result in malicious code execution.

Since March 2024, the simplicity of this technique has drawn attention from a range of threat actors, from individual cybercriminals to Advanced Persistent Threat (APT) groups such as APT28 and MuddyWater, linked to Russia and Iran respectively, introducing security threats on a broader scale [1]. ClickFix campaigns have been observed affecting organizations in across multiple industries, including healthcare, hospitality, automotive and government [2][3].

Actors carrying out these targeted attacks typically utilize similar techniques, tools and procedures (TTPs) to gain initial access. These include spear phishing attacks, drive-by compromises, or exploiting trust in familiar online platforms, such as GitHub, to deliver malicious payloads [2][3]. Often, a hidden link within an email or malvertisements on compromised legitimate websites redirect the end user to a malicious URL [4]. These take the form of ‘Fix It’ or fake CAPTCHA prompts [4].

From there, users are misled into believing they are completing a human verification step, registering a device, or fixing a non-existent issue such as a webpage display error. As a result, they are guided through a three-step process that ultimately enables the execution of malicious PowerShell commands:

  1. Open a Windows Run dialog box [press Windows Key + R]
  2. Automatically or manually copy and paste a malicious PowerShell command into the terminal [press CTRL+V]
  3. And run the prompt [press ‘Enter’] [2]

Once the malicious PowerShell command is executed, threat actors then establish command and control (C2) communication within the targeted environment before moving laterally through the network with the intent of obtaining and stealing sensitive data [4]. Malicious payloads associated with various malware families, such as XWorm, Lumma, and AsyncRAT, are often deployed [2][3].

Attack timeline of ClickFix cyber attack

Based on investigations conducted by Darktrace’s Threat Research team in early 2025, this blog highlights Darktrace’s capability to detect ClickFix baiting activity following initial access.

Darktrace’s coverage of a ClickFix attack chain

Darktrace identified multiple ClickFix attacks across customer environments in both Europe, the Middle East, and Africa (EMEA) and the United States. The following incident details a specific attack on a customer network that occurred on April 9, 2025.

Although the initial access phase of this specific attack occurred outside Darktrace’s visibility, other affected networks showed compromise beginning with phishing emails or fake CAPTCHA prompts that led users to execute malicious PowerShell commands.

Darktrace’s visibility into the compromise began when the threat actor initiated external communication with their C2 infrastructure, with Darktrace / NETWORK detecting the use of a new PowerShell user agent, indicating an attempt at remote code execution.

Darktrace / NETWORK's detection of a device making an HTTP connection with new PowerShell user agent, indicating PowerShell abuse for C2 communications.
Figure 1: Darktrace / NETWORK's detection of a device making an HTTP connection with new PowerShell user agent, indicating PowerShell abuse for C2 communications.

Download of Malicious Files for Lateral Movement

A few minutes later, the compromised device was observed downloading a numerically named file. Numeric files like this are often intentionally nondescript and associated with malware. In this case, the file name adhered to a specific pattern, matching the regular expression: /174(\d){7}/. Further investigation into the file revealed that it contained additional malicious code designed to further exploit remote services and gather device information.

Darktrace / NETWORK's detection of a numeric file, one minute after the new PowerShell User Agent alert.
Figure 2: Darktrace / NETWORK's detection of a numeric file, one minute after the new PowerShell User Agent alert.

The file contained a script that sent system information to a specified IP address using an HTTP POST request, which also processed the response. This process was verified through packet capture (PCAP) analysis conducted by the Darktrace Threat Research team.

By analyzing the body content of the HTTP GET request, it was observed that the command converts the current time to Unix epoch time format (i.e., 9 April 2025 13:26:40 GMT), resulting in an additional numeric file observed in the URI: /1744205200.

PCAP highlighting the HTTP GET request that sends information to the specific IP, 193.36.38[.]237, which then generates another numeric file titled per the current time.
Figure 3: PCAP highlighting the HTTP GET request that sends information to the specific IP, 193.36.38[.]237, which then generates another numeric file titled per the current time.

Across Darktrace’s investigations into other customers' affected by ClickFix campaigns, both internal information discovery events and further execution of malicious code were observed.

Data Exfiltration

By following the HTTP stream in the same PCAP, the Darktrace Threat Research Team assessed the activity as indicative of data exfiltration involving system and device information to the same command-and-control (C2) endpoint, , 193.36.38[.]237. This endpoint was flagged as malicious by multiple open-source intelligence (OSINT) vendors [5].

PCAP highlighting HTTP POST connection with the numeric file per the URI /1744205200 that indicates data exfiltration to 193.36.38[.]237.
Figure 4: PCAP highlighting HTTP POST connection with the numeric file per the URI /1744205200 that indicates data exfiltration to 193.36.38[.]237.

Further analysis of Darktrace’s Advanced Search logs showed that the attacker’s malicious code scanned for internal system information, which was then sent to a C2 server via an HTTP POST request, indicating data exfiltration

Advanced Search further highlights Darktrace's observation of the HTTP POST request, with the second numeric file representing data exfiltration.
Figure 5: Advanced Search further highlights Darktrace's observation of the HTTP POST request, with the second numeric file representing data exfiltration.

Actions on objectives

Around ten minutes after the initial C2 communications, the compromised device was observed connecting to an additional rare endpoint, 188.34.195[.]44. Further analysis of this endpoint confirmed its association with ClickFix campaigns, with several OSINT vendors linking it to previously reported attacks [6].

In the final HTTP POST request made by the device, Darktrace detected a file at the URI /init1234 in the connection logs to the malicious endpoint 188.34.195[.]44, likely depicting the successful completion of the attack’s objective, automated data egress to a ClickFix C2 server.

Darktrace / NETWORK grouped together the observed indicators of compromise (IoCs) on the compromised device and triggered an Enhanced Monitoring model alert, a high-priority detection model designed to identify activity indicative of the early stages of an attack. These models are monitored and triaged 24/7 by Darktrace’s Security Operations Center (SOC) as part of the Managed Threat Detection service, ensuring customers are promptly notified of malicious activity as soon as it emerges.

Darktrace correlated the separate malicious connections that pertained to a single campaign.
Figure 6: Darktrace correlated the separate malicious connections that pertained to a single campaign.

Darktrace Autonomous Response

In the incident outlined above, Darktrace was not configured in Autonomous Response mode. As a result, while actions to block specific connections were suggested, they had to be manually implemented by the customer’s security team. Due to the speed of the attack, this need for manual intervention allowed the threat to escalate without interruption.

However, in a different example, Autonomous Response was fully enabled, allowing Darktrace to immediately block connections to the malicious endpoint (138.199.156[.]22) just one second after the initial connection in which a numerically named file was downloaded [7].

Darktrace Autonomous Response blocked connections to a suspicious endpoint following the observation of the numeric file download.
Figure 7: Darktrace Autonomous Response blocked connections to a suspicious endpoint following the observation of the numeric file download.

This customer was also subscribed to our Managed Detection and Response service, Darktrace’s SOC extended a ‘Quarantine Device’ action that had already been autonomously applied in order to buy their security team additional time for remediation.

Autonomous Response blocked connections to malicious endpoints, including 138.199.156[.]22, 185.250.151[.]155, and rkuagqnmnypetvf[.]top, and also quarantined the affected device. These actions were later manually reinforced by the Darktrace SOC.
Figure 8: Autonomous Response blocked connections to malicious endpoints, including 138.199.156[.]22, 185.250.151[.]155, and rkuagqnmnypetvf[.]top, and also quarantined the affected device. These actions were later manually reinforced by the Darktrace SOC.

Conclusion

ClickFix baiting is a widely used tactic in which threat actors exploit human error to bypass security defenses. By tricking end point users into performing seemingly harmless, everyday actions, attackers gain initial access to systems where they can access and exfiltrate sensitive data.

Darktrace’s anomaly-based approach to threat detection identifies early indicators of targeted attacks without relying on prior knowledge or IoCs. By continuously learning each device’s unique pattern of life, Darktrace detects subtle deviations that may signal a compromise. In this case, Darktrace's Autonomous Response, when operating in a fully autonomous mode, was able to swiftly contain the threat before it could progress further along the attack lifecycle.

Credit to Keanna Grelicha (Cyber Analyst) and Jennifer Beckett (Cyber Analyst)

Appendices

NETWORK Models

  • Device / New PowerShell User Agent
  • Anomalous Connection / New User Agent to IP Without Hostname
  • Anomalous Connection / Posting HTTP to IP Without Hostname
  • Anomalous Connection / Powershell to Rare External
  • Device / Suspicious Domain
  • Device / New User Agent and New IP
  • Anomalous File / New User Agent Followed By Numeric File Download (Enhanced Monitoring Model)
  • Device / Initial Attack Chain Activity (Enhanced Monitoring Model)

Autonomous Response Models

  • Antigena / Network::Significant Anomaly::Antigena Significant Anomaly from Client Block
  • Antigena / Network::Significant Anomaly::Antigena Enhanced Monitoring from Client Block
  • Antigena / Network::External Threat::Antigena File then New Outbound Block
  • Antigena / Network::External Threat::Antigena Suspicious File Block
  • Antigena / Network::Significant Anomaly::Antigena Alerts Over Time Block
  • Antigena / Network::External Threat::Antigena Suspicious File Block

IoC - Type - Description + Confidence

·       141.193.213[.]11 – IP address – Possible C2 Infrastructure

·       141.193.213[.]10 – IP address – Possible C2 Infrastructure

·       64.94.84[.]217 – IP address – Possible C2 Infrastructure

·       138.199.156[.]22 – IP address – C2 server

·       94.181.229[.]250 – IP address – Possible C2 Infrastructure

·       216.245.184[.]181 – IP address – Possible C2 Infrastructure

·       212.237.217[.]182 – IP address – Possible C2 Infrastructure

·       168.119.96[.]41 – IP address – Possible C2 Infrastructure

·       193.36.38[.]237 – IP address – C2 server

·       188.34.195[.]44 – IP address – C2 server

·       205.196.186[.]70 – IP address – Possible C2 Infrastructure

·       rkuagqnmnypetvf[.]top – Hostname – C2 server

·       shorturl[.]at/UB6E6 – Hostname – Possible C2 Infrastructure

·       tlgrm-redirect[.]icu – Hostname – Possible C2 Infrastructure

·       diagnostics.medgenome[.]com – Hostname – Compromised Website

·       /1741714208 – URI – Possible malicious file

·       /1741718928 – URI – Possible malicious file

·       /1743871488 – URI – Possible malicious file

·       /1741200416 – URI – Possible malicious file

·       /1741356624 – URI – Possible malicious file

·       /ttt – URI – Possible malicious file

·       /1741965536 – URI – Possible malicious file

·       /1.txt – URI – Possible malicious file

·       /1744205184 – URI – Possible malicious file

·       /1744139920 – URI – Possible malicious file

·       /1744134352 – URI – Possible malicious file

·       /1744125600 – URI – Possible malicious file

·       /1[.]php?s=527 – URI – Possible malicious file

·       34ff2f72c191434ce5f20ebc1a7e823794ac69bba9df70721829d66e7196b044 – SHA-256 Hash – Possible malicious file

·       10a5eab3eef36e75bd3139fe3a3c760f54be33e3 – SHA-1 Hash – Possible malicious file

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique  

Spearphishing Link - INITIAL ACCESS - T1566.002 - T1566

Drive-by Compromise - INITIAL ACCESS - T1189

PowerShell - EXECUTION - T1059.001 - T1059

Exploitation of Remote Services - LATERAL MOVEMENT - T1210

Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071

Automated Exfiltration - EXFILTRATION - T1020 - T1020.001

References

[1] https://www.logpoint.com/en/blog/emerging-threats/clickfix-another-deceptive-social-engineering-technique/

[2] https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape

[3] https://cyberresilience.com/threatonomics/understanding-the-clickfix-attack/

[4] https://www.group-ib.com/blog/clickfix-the-social-engineering-technique-hackers-use-to-manipulate-victims/

[5] https://www.virustotal.com/gui/ip-address/193.36.38.237/detection

[6] https://www.virustotal.com/gui/ip-address/188.34.195.44/community

[7] https://www.virustotal.com/gui/ip-address/138.199.156.22/detection

Continue reading
About the author
Keanna Grelicha
Cyber Analyst

Blog

/

Proactive Security

/

June 4, 2025

Beyond Discovery: Adding Intelligent Vulnerability Validation to Darktrace / Attack Surface Management

Man on computer doing workDefault blog imageDefault blog image

Introducing Exploit Prediction Assessment

Security teams are drowning in vulnerability alerts, but only a fraction of those issues pose a real threat. The new Exploit Prediction Assessment feature in Darktrace / Attack Surface Management helps teams cut through the noise by validating which vulnerabilities on their external attack surface can be actively exploited.

Instead of relying solely on CVSS scores or waiting for patch cycles, Exploit Prediction Assessment uses safe, targeted simulations to test whether exposed systems can be compromised, delivering fast, evidence-based results in under 72 hours.

This capability augments traditional pen testing and complements existing ASM workflows by transforming passive discovery into actionable insight. With EPA, security teams move from reacting to long lists of potential vulnerabilities to making confident, risk-based decisions on what actually matters.

Key highlights of Exploit Prediction Assessment

Simulated attacks to validate real risk

Exploit Prediction Assessment conducts safe, simulated attacks on assets with potential security vulnerabilities that have been identified by Darktrace / Attack Surface Management. This real-time testing validates your systems' susceptibility to compromise by confirming which vulnerabilities are present and exploitable on your attack surface.

Prioritize what matters most

Confirmed security risks can be prioritized for mitigation, ensuring that the most critical threats are promptly addressed. This takes the existing letter ranking system and brings it a step further by drilling down to yet another level. Even in the most overwhelming situations, teams will be able to act on a pragmatic, clear-cut plan.

Fast results, tailored to your environment

Customers set the scope of the Exploit Prediction Assessment within Darktrace / Attack Surface Management and receive the results of the surgical vulnerability testing within 72 hours. Users will see 1 of 2 shields:

1. A green shield with a check mark: Meaning no vulnerabilities were found on scanned CVEs for the asset.

2. A red shield with a red x: Meaning at least one vulnerability was found on scanned CVEs for the asset.

Why it's a game changer

Traditionally, attack surface management tools have focused on identifying exposed assets and vulnerabilities but lacked the context to determine which issues posed the greatest risk. Without context on what’s exploitable, security teams are left triaging long lists of potential risks, operating in isolation from broader business objectives. This misalignment ultimately leads to both weakened risk posture and cross team communication and execution.

This is where Continuous Threat Exposure Management (CTEM) becomes essential. Introduced by Gartner, CTEM is a framework that helps organizations continuously assess, validate, and improve their exposure to real-world threats. The goal isn’t just visibility, it’s to understand how an attacker could move through your environment today, and what to fix first to stop them.

Exploit Prediction Assessment brings this philosophy to life within Darktrace / Attack Surface Management. By safely simulating exploit attempts against identified vulnerabilities, it validates which exposures are truly at risk—transforming ASM from a discovery tool into a risk-based decision engine.

This capability directly supports the validation and prioritization phases of CTEM, helping teams focus on exploitable vulnerabilities rather than theoretical ones.  This shift from visibility to action reduces the risk of critical vulnerabilities in the technology stack being overlooked, turning overwhelming vulnerability data into focused, clear actionable insights.

As attack surfaces continue to grow and change, organizations need more than static scans they need continuous, contextual insight. Exploit Prediction Assessment ensures your ASM efforts evolve with the threat landscape, making CTEM a practical reality, not just a strategy.

Exploit Prediction Assessment in action

With Darktrace / Attack Surface Management organizations can get Exploit Prediction Assessment, and the cyber risk team no longer guesses which vulnerabilities matter most. Instead, they identify several externally exposed areas of their attack surface, then use the feature to surgically test for exploitability across these exposed endpoints. Within 72 hours, they receive a report:  

Positive outcome: Based on information in the html or the headers it seems that a vulnerable software version is running on an externally exposed infrastructure. By running a targeted attack on this infrastructure, we can confirm that it cannot be abused.

Negative outcome: Based on information in the html or the headers it seems that a vulnerable software version is running on an externally exposed infrastructure. By running a targeted attack on this infrastructure, we can confirm that it can be exploited, so we can predict it being exploited.

This second outcome changes everything. The team immediately prioritizes the exploitable asset for patching and takes the necessary adjustments to mitigate exposure until the fix is deployed.

Instead of spreading their resources thin across dozens of alerts, they focus on what poses a real threat, saving time, reducing risk, and demonstrating actionable results to stakeholders.

Conclusion

Exploit Predication Assessment bolsters Darktrace’s commitment to proactive cybersecurity. It supports intelligent prioritization of vulnerabilities, keeping organizations ahead of emerging threats. With this new addition to / Attack Surface Management, teams have another tool to empower a more efficient approach to addressing security gaps in real-time.

Stay tuned for more updates and insights on how Darktrace continues to develop a culture of proactive security across the entire ActiveAI Security Platform.

[related-resource]

Continue reading
About the author
Kelland Goodin
Product Marketing Specialist
Your data. Our AI.
Elevate your network security with Darktrace AI