Blog
/
/
May 25, 2022

Understanding Grief Ransomware Attacks

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
25
May 2022
Discover the latest insights on Grief ransomware and how to protect your organization. Stay informed on evolving cybersecurity threats with the cyber experts.

The Grief ransomware strain, also referred to as PayOrGrief, quickly gained a reputation for disruption in mid-to-late 2021. The gang behind the malware used quadruple-extortion ransomware tactics and targeted a range of victims including municipalities and school districts.

In July 2021, just weeks after the strain was first reported to cyber security teams, Grief successfully targeted Thessaloniki, the second largest city in Greece. Faced with a $20 million ransom demand, the municipality’s security team was forced to shut down all of its websites and public-facing services and launch a full investigation into the breach.

Double act: Grief and DoppelPaymer

From its emergence in May 2021, Grief used novel malware which confounded security tools trained on historical attacks. By July, however, the sophistication and efficiency of the group’s attacks led many to suspect that Grief’s operators had experience beyond their supposed two months of operation.

Grief is now widely reported to be a rebrand of the DoppelPaymer ransomware gang, which ended its operations in May 2021 and was believed to be affiliated with the Russian ransomware gang Evil Corp. After adopting the new moniker, however, Grief regularly blew past traditional security tools, amassing well over $10 million in ransom payments in just four months.

Adaptations and rebrands are common techniques adopted by criminal gangs using the Ransomware-as-a-Service business model. The success of Grief’s rebrand illustrates how rapidly a ransomware group can update its attacks and render them unrecognizable to signature-based tools.

Revealing Grief’s tricks with Cyber AI Analyst

In July 2021, PayOrGrief targeted a European manufacturing company which had Darktrace deployed across its network. Darktrace’s early detection of the attack, along with the real-time visibility into its lifecycle offered by Darktrace’s Cyber AI Analyst, meant that each stage of the attack was clear to see.

Figure 1: Timeline of the PayOrGrief attack

The initial intrusion compromised four devices, which Darktrace detected when these devices connected to rare external IPs and downloaded encoded text files. It is likely that the devices were compromised as the result of a targeted phishing campaign, which are often used in Grief attacks as a way of injecting malware such as Dridex onto devices. If deployed within the targeted organization, Antigena Email would have identified the phishing campaign and halted it, before it reached employee inboxes. In this case, however, the attack continued.

Following the initial compromise, C2 (Command and Control) connections were made over an encrypted channel using invalid SSL certificates. An upload of 50MB of data was made from one of the infected devices to the company’s corporate server, which gave the attackers access to the company’s crown jewels: its most sensitive data. From this privileged position, and with keep-alive beacons in place, the attack was ready for detonation.

Several devices were detected attempting to upload data totaling more than 100 GB to the external file storage platform, Mega, using encrypted HTTPS on port 443. However, the attackers did not receive the total package of data they had expected. The organization had deployed Darktrace’s Autonomous Response to protect its key assets and most sensitive data. The AI recognized the anomalous behavior as a significant deviation from the business’s normal ‘pattern of life’ and autonomously blocked uploads from protected devices, preventing exfiltration wherever it was able to do so.

Figure 2: Data exfiltration from a single device, investigated by Cyber AI Analyst

The attackers then continued to spread through the digital environment. Using ‘Living off the Land’ techniques including RDP and SMB, they performed internal reconnaissance, escalated their privileges and moved laterally to additional digital assets. With access to new admin credentials, just ten hours after the initial C2 communications, the attackers commenced ransomware encryption.

It’s highly possible, therefore, that Grief has targeted Darktrace customers previously and been neutralized too early for the attack to be identified and attributed. In this instance, the organization had deployed Autonomous Response only on certain areas of the network, and we are therefore able to see how the attack progressed on unprotected devices.

Unusual suspects

The Indicators of Compromise (IoCs) for Grief ransomware have now been incorporated by many traditional security tools, but this is a short-term solution, and won’t account for further changes in both threat actor tactics and the digital environments they target. Once the Grief moniker has been exhausted, it is more than likely that another will be adopted in its place.

The AI-driven approach to cyber security tackles threats regardless of when and where they arrive, or what name they arrive under. By focusing on developing its sophisticated understanding of the entire digital estate, Darktrace’s Autonomous Response targets specific anomalies with specific, proportionate responses, even when they are part of entirely novel attacks. And when given the freedom to take action against these threats the moment they’re detected, Autonomous Response can ensure that organizations stay protected even when human teams are unavailable.

Thanks to Darktrace analyst Beverly McCann for her insights on the above threat find.

Technical details

Darktrace model detections

  • Device / Suspicious SMB Scanning Activity
  • Device / New User Agents
  • Anomalous Server Activity / Rare External from Server
  • Compliance / External Windows Communications
  • Anomalous Connection / Application Protocol on Uncommon Port
  • Anomalous Connection / Anomalous SSL without SNI to New External
  • Anomalous Connection / Rare External SSL Self-Signed
  • Anomalous Connection / Multiple Connections to New External TCP Port
  • Anomalous Connection / New User Agent to IP Without Hostname
  • Compliance / Remote Management Tool on Server
  • Anomalous Server Activity / Outgoing from Server
  • Anomalous Connection / Multiple HTTP POSTs to Rare Hostname
  • Anomalous Connection / Data Sent to Rare Domain
  • Anomalous Connection / Lots of New Connections
  • Unusual Activity / Unusual File Storage Data Transfer
  • Unusual Activity / Enhanced Unusual External Data Transfer [Enhanced Monitoring]
  • Anomalous Connection / Uncommon 1GiB Outbound
  • Unusual Activity / Unusual External Data to New Ips
  • Anomalous Connection / SMB Enumeration
  • Multiple Device Correlations / Behavioral Change Across Multiple Devices
  • Device / New or Uncommon WMI Activity
  • Unusual Activity / Unusual External Connections
  • Device / ICMP Address Scan
  • Anomalous Connection / Unusual Admin RDP Session
  • Compliance / SMB Version 1 Usage
  • Anomalous Connection / Unusual SMB Version 1
  • Anomalous File / Internal / Additional Extension Appended to SMB File
  • Unusual Activity / Anomalous SMB Move and Write
  • Compromise / Ransomware / Suspicious SMB Activity [Enhanced Monitoring]
  • Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB
  • Anomalous Connection / New or Uncommon Service Control
  • Device / New or Unusual Remote Command Execution
  • User / New Admin Credentials On Client
  • Device / New or Uncommon SMB Named Pipe
  • Device / Multiple Lateral Movement Model Breaches [Enhanced Monitoring]
  • Anomalous Connection / Suspicious Read Write Ratio
  • Device / SMA Lateral Movement
  • Anomalous File / Internal / Unusual Internal EXE File Transfer
  • Anomalous Server Activity / Unusual Unresponsive Server
  • Device / Internet Facing Device with High Priority Alert
  • Multiple Device Correlations / Spreading Unusual SMB Activity
  • Multiple Device Correlations / Multiple Devices Breaching the Same Model

Darktrace Autonomous Response alerts

  • Antigena / Network / Insider Threat / Antigena Network Scan Block
  • Antigena / Network / Insider Threat / Antigena Breaches Over Time Block
  • Antigena / Network / Significant Anomaly / Antigena Significant Anomaly Block
  • Antigena / Network / Significant Anomaly / Antigena Breaches over Time Block
  • Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block
  • Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block
  • Antigena / Network / Insider Threat / Antigena SMB Enumeration Block
  • Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach
  • Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity
  • Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block
  • Antigena / Network / External Threat / Antigena Ransomware Block
  • Antigena / Network / External Threat / SMB Ratio Antigena Block

MITRE ATT&CK techniques observed

Reconnaissance
T1595 — Active Scanning

Resource Development
T1608 — Stage Capabilities

Initial Access
T1190 — Exploit Public-Facing Application

Persistence
T1133 — External Remote Services

Defense Evasion
T1079 — Valid Accounts

Discovery
T1046 — Network Service Scanning
T1083 — File and Directory Discovery
T1018 — Remote System Discovery

Lateral Movement
T1210 — Exploitation of Remote Services
T1080 — Taint Shared Content
T1570 — Lateral Tool Transfer
T1021 — Remote Services

Command and Control
T1071 — Application Layer Protocol
T1095 — Non-Application Layer Protocol
T1571 — Non-Standard Port

Exfiltration
T1041 — Exfiltration over C2 Channel
T1567 — Exfiltration Over Web Service
T1029 — Scheduled Transfer


Impact
T1486 — Data Encrypted for Impact
T1489 — Service Stop
T1529 — System Shutdown/Reboot

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Oakley Cox
Director of Product

Oakley is a Product Manager within the Darktrace R&D team. He collaborates with global customers, including all critical infrastructure sectors and Government agencies, to ensure Darktrace/OT remains the first in class solution for OT Cyber Security. He draws on 7 years’ experience as a Cyber Security Consultant to organizations across EMEA, APAC and ANZ. His research into cyber-physical security has been published by Cyber Security journals and by CISA. Oakley has a Doctorate (PhD) from the University of Oxford.

Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

Email

/

March 19, 2025

Global Technology Provider Transforms Email Threat Detection with Darktrace

Default blog imageDefault blog image

At a glance

  • Within just one month of using Darktrace / EMAIL, the volume of suspicious emails requiring analyst attention dropped by 75%, saving analysts 45 hours per month on analysis and investigation.
  • By offloading most manual, repetitive tasks to Darktrace / EMAIL, the company’s skilled security analysts can focus on developing new capabilities and tackling more complex, rewarding projects.
  • Darktrace recently detected and blocked a highly sophisticated and personalized phishing email that spoofed a Microsoft SharePoint and Teams website and used advanced engineering to impersonate the school of an employee’s family member.
  • The transition from the incumbent solution to Darktrace / EMAIL was seamless and undetectable to the company’s vast of customers and partners, reinforcing the security organization’s role as a business enabler—protecting the company and reducing risk without adding friction.

Securing a complex, distributed business without disruption

The company remains at the forefront of technological innovation and transformation; however, its success and ambitions come with the challenges of managing a distributed global business—balancing digital advancements, existing technology investments, and evolving compliance requirements.

Optimizing a complex tech stack for scalable growth

The organization operates a diverse technology stack spanning Windows, Mac, Linux, and multiple cloud environments, creating a complex and challenging IT landscape. The company’s Chief Information Security Officer (CISO) emphasizes the need for efficiency and agility. “Our goal is to scale and deliver new capabilities without increasing headcount, ensuring that costs remain proportionate to growth.”

Balancing security, governance, and business agility

Committed to responsible practices, this industry leader prioritizes secure and trustworthy technology for its customers who rely on its solutions. “Balancing business agility with governance is a constant challenge," said the CISO. "There’s always a natural push and pull, which I believe is healthy—but achieving the right balance is delicate.”

Protecting critical workflows without impacting productivity

For the organization, email is much more than just a communication tool. “Email plays a critical role in our engineering workflows and is fundamental to how we build our products.” Because of this, the company is extremely cautious about implementing any solution that could introduce friction or disrupt productivity. “There is zero tolerance for disruption, which is why we take a deliberate and methodical approach when evaluating, selecting, and deploying our tools and solutions,” he said.  

More than a vendor: A security partner invested in success

To ensure an optimal security infrastructure, the enterprise security team regularly evaluates market technologies to their existing solutions. With the rapidly evolving threat landscape, the CISO said they “wanted to validate whether we still had best-in-class protection and the right controls in place to secure our organization. It was about assessing whether we could do better in our ongoing effort to fine-tuning our approach to achieve the best possible outcome.”

The team evaluated 15 different email security vendors based on the following criteria:

  1. Efficacy to detect threats
  2. Ability to integrate with existing tooling
  3. Ease of use
  4. A vendor’s approach to partnership  

They initially narrowed the list to five vendors, conducting demo sessions for deeper evaluations before selecting three finalists for a proof of value (POV). We analyzed actual malicious emails with each vendor to assess the accuracy of their detections, allowing for an objective comparison,” said the CISO. Through this rigorous process, the Darktrace / EMAIL security solution emerged as the best fit for their business. “Darktrace’s product performed well and showed a genuine commitment to partnering with us in the long-term to ensure our success.”

The team objectively understood where there were gaps across the different vendors, where they were strong, and where they could use improvement. “Based on the analysis, we knew that Darktrace / EMAIL could deliver as the data supported it, in our specific use cases.  

Partnership, integrity and respect

Throughout the evaluation process, the importance of partnership and mutual respect remained an essential factor to the CISO. “I wanted a company we could develop a long-term strategic partnership with, one that could extend far deeper than just email.” A key factor in choosing Darktrace was the commitment and engagement of its team at every level of the organization. “Darktrace showed integrity, patience and a genuine investment in building a strong relationship with my team.  That's why we're here today.”

“Together, we've delivered some fantastic outcomes”

For the organization, Darktrace / EMAIL has played a crucial role in reducing risk, empowering analysts, and enabling a lean, effective security strategy. “Together, we've delivered some fantastic outcomes,” said the CISO.  

Reducing risk. Empowering analysts

“Within that first month, we saw a 75% drop in suspicious emails that that required manual review, which reduced the time my team spent analyzing and investigating by 45 hours per month,” said the CISO. The security team values Darktrace / EMAIL not only for its ease of use but also for the time it frees up for more meaningful work. “Giving my team the opportunity to tackle complex challenges they enjoy and find more stimulating is important to me.” As they continue to fine-tune and optimize balance levels within Darktrace / EMAIL, he expects even greater efficiency gains in the coming months.

Maximizing protection while staying lean

It’s important for the security group to be proportionate with their spending, said the CISO. “It's all about what is enough security to enable the business. And that means, as our organization grows, it's important that we are as lean and as efficient as possible to deliver the best outcomes for the business.”  Embracing an AI-powered automated approach is an essential component to achieving that goal. By offloading most manual, repetitive tasks to Darktrace / EMAIL, the company’s skilled security analysts can focus on more strategic and proactive initiatives that enable the business.  

Protecting employees from advanced social engineering threats

Recently, Darktrace detected a malicious email targeting an employee, disguised as a spoofed Microsoft SharePoint and Teams website. What made this attack particularly sophisticated was its personalization — it impersonated the school where the employee’s family member attended. Unlike mass malicious emails sent to thousands of people, this was a highly targeted attack, leveraging advanced social engineering tactics to exploit connections within the education system and between family members.  

Protecting without disrupting

A seamless migration is often overlooked but is critical to success for any organization, said the CISO. With a wide ecosystem of partners, email is a highly visible, business-critical function for the organization — "any friction or downtime would have an immediate impact and could throttle the entire business,” he said. However, the transition from their previous solution to Darktrace / EMAIL was exceptionally smooth. “No one realized we changed providers because there was no disruption — no incidents at all. I cannot emphasize just how important that is when I'm trying to position our security organization as an enabling function for the business that protects and reduces risk without adding friction.”

A security partnership for the future

“To survive as a business over the next few years, adopting AI is no longer optional—it’s essential,” said the CISO. However, with the cybersecurity market becoming increasingly saturated, selecting the right solutions and vendors can be overwhelming. He stresses the importance of choosing strategic partners who not only deliver the outcomes you need, but also deeply understand your organization’s unique environment. “You’re only as strong as your partners. Technology innovation and the cybersecurity market are always changing.  At some point every solution will face a challenge—it’s inevitable. The differentiator will be how people respond when that happens.”  

Continue reading
About the author
The Darktrace Community

Blog

/

AI

/

March 19, 2025

Survey findings: How is AI Impacting the SOC?

Default blog imageDefault blog image

There’s no question that AI is already impacting the SOC – augmenting, assisting, and filling the gaps left by staff and skills shortages. We surveyed over 1,500 cybersecurity professionals from around the world to uncover their attitudes to AI cybersecurity in 2025. Our findings revealed striking trends in how AI is changing the way security leaders think about hiring and SOC transformation. Download the full report for the big picture, available now.

Download the full report to explore these findings in depth

The AI-human conundrum

Let’s start with some context. As the cybersecurity sector has rapidly evolved to integrate AI into all elements of cyber defense, the pace of technological advancement is outstripping the development of necessary skills. Given the ongoing challenges in security operations, such as employee burnout, high turnover rates, and talent shortages, recruiting personnel to bridge these skills gaps remains an immense challenge in today’s landscape.

But here, our main findings on this topic seem to contradict each other.

There’s no question over the impact of AI-powered threats – nearly three-quarters (74%) agree that AI-powered threats now pose a significant challenge for their organization.  

When we look at how security leaders are defending against AI-powered threats, over 3 out of 5 (62%) see insufficient personnel to manage tools and alerts as the biggest barrier.  

Yet at the same time, increasing cyber security staff is at the bottom of the priority list for survey participants, with only 11% planning to increase cybersecurity staff in 2025 – less than in 2024. What 64% of stakeholders are committed to, however, is adding new AI-powered tools onto their existing security stacks.

With burnout pervasive, the talent deficit reaching a new peak, and growing numbers of companies unable to fill cybersecurity positions, it may be that stakeholders realize they simply cannot hire enough personnel to solve this problem, no matter how much they may want to. As a result, leaders are looking for methods beyond increasing staff to overcome security obstacles.

Meanwhile, the results show that defensive AI is becoming integral to the SOC as a means of augmenting understaffed teams.

How is AI plugging skills shortages in the SOC?

As explored in our recent white paper, the CISO’s Guide to Navigating the Cybersecurity Skills Shortage, 71% of organizations report unfilled cybersecurity positions, leading to the estimation that less than 10% of alerts are thoroughly vetted. In this scenario, AI has become an essential multiplier to relieve the burden on security teams.

95% of respondents agree that AI-powered solutions can significantly improve the speed and efficiency of their defenses. But how?

The area security leaders expect defensive AI to have the biggest impact is on improving threat detection, followed by autonomous response to threats and identifying exploitable vulnerabilities.

Interestingly, the areas that participants ranked less highly (reducing alert fatigue and running phishing simulation), are the tasks that AI already does well and can therefore be used already to relieve the burden of manual, repetitive work on the SOC.

Different perspectives from different sides of the SOC

CISOs and SecOps teams aren’t necessarily aligned on the AI defense question – while CISOs tend to see it as a strategic game-changer, SecOps teams on the front lines may be more sceptical, wary of its real-world reliability and integration into workflows.  

From the data, we see that while less than a quarter of execs doubt that AI-powered solutions will block and automatically respond to AI threats, about half of SecOps aren’t convinced. And only 17% of CISOs lack confidence in the ability of their teams to implement and use AI-powered solutions, whereas over 40% those in the team doubt their own ability to do so.

This gap feeds into the enthusiasm that executives share about adding AI-driven tools into the stack, while day-to-day users of the tools are more interested in improving security awareness training and improving cybersecurity tool integration.

Levels of AI understanding in the SOC

AI is only as powerful as the people who use it, and levels of AI expertise in the SOC can make or break its real-world impact. If security leaders want to unlock AI’s full potential, they must bridge the knowledge gap—ensuring teams understand not just the different types of AI, but where it can be applied for maximum value.

Only 42% of security professionals are confident that they fully understand all the types of AI in their organization’s security stack.

This data varies between job roles – executives report higher levels of understanding (60% say they know exactly which types of AI are being used) than participants in other roles. Despite having a working knowledge of using the tools day-to-day, SecOps practitioners were more likely to report having a “reasonable understanding” of the types of AI in use in their organization (42%).  

Whether this reflects a general confidence in executives rather than technical proficiency it’s hard to say, but it speaks to the importance of AI-human collaboration – introducing AI tools for cybersecurity to plug the gaps in human teams will only be effective if security professionals are supported with the correct education and training.  

Download the full report to explore these findings in depth

The full report for Darktrace’s State of AI Cybersecurity is out now. Download the paper to dig deeper into these trends, and see how results differ by industry, region, organization size, and job title.  

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI