Blog
/
OT
/
June 12, 2024

Safeguarding Distribution Centers in the Digital Age

With complex digital and physical systems, that are increasingly interconnected, the expanding attack surface calls for a unified security solution. Explore the challenges, risks, and potential solutions for organizations aiming at securing distribution centers from cyber threats.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Daniel Simonds
Director of Operational Technology
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
12
Jun 2024

Challenges securing distribution centers

For large retail providers, e-commerce organizations, logistics & supply chain organizations, and other companies who rely on the distribution of goods to consumers cybersecurity efforts are often focused on an immense IT infrastructure. However, there's a critical, often overlooked segment of infrastructure that demands vigilant monitoring and robust protection: distribution centers.

Distribution centers play a critical role in the business operations of supply chains, logistics, and the retail industry. They serve as comprehensive logistics hubs, with many organizations operating multiple centers worldwide to meet consumer needs. Depending on their size and hours of operation, even just one hour of downtime at these centers can result in significant financial losses, ranging from tens to hundreds of thousands of dollars per hour.

Due to the time-sensitive nature and business criticality of distribution centers, there has been a rise in applying modern technologies now including AI applications to enhance efficiency within these facilities. Today’s distribution centers are increasingly connected to Enterprise IT networks, the cloud and the internet to manage every stage of the supply chain. Additionally, it is common for organizations to allow 3rd party access to the distribution center networks and data for reasons including allowing them to scale their operations effectively.

However, this influx of new technologies and interconnected systems across IT, OT and cloud introduces new risks on the cybersecurity front. Distribution center networks include industrial operational technologies ICS/OT, IoT technologies, enterprise network technology, and cloud systems working in coordination. The convergence of these technologies creates a greater chance that blind spots exist for security practitioners and this increasing presence of networked technology increases the attack surface and potential for vulnerability. Thus, having cybersecurity measures that cover IT, OT or Cloud alone is not enough to secure a complex and dynamic distribution center network infrastructure.  

The OT network encompasses various systems, devices, hardware, and software, such as:

  • Enterprise Resource Planning (ERP)
  • Warehouse Execution System (WES)
  • Warehouse Control System (WCS)
  • Warehouse Management System (WMS)
  • Energy Management Systems (EMS)
  • Building Management Systems (BMS)
  • Distribution Control Systems (DCS)
  • Enterprise IT devices
  • OT and IoT: Engineering workstations, ICS application and management servers, PLCs, HMI, access control, cameras, and printers
  • Cloud applications

Distribution centers: An expanding attack surface

As these distribution centers have become increasingly automated, connected, and technologically advanced, their attack surfaces have inherently increased. Distribution centers now have a vastly different potential for cyber risk which includes:  

  • More networked devices present
  • Increased routable connectivity within industrial systems
  • Externally exposed industrial control systems
  • Increased remote access
  • IT/OT enterprise to industrial convergence
  • Cloud connectivity
  • Contractors, vendors, and consultants on site or remoting in  

Given the variety of connected systems, distribution centers are more exposed to external threats than ever before. Simultaneously, distribution center’s business criticality has positioned them as interesting targets to cyber adversaries seeking to cause disruption with significant financial impact.

Increased connectivity requires a unified security approach

When assessing the unique distribution center attack surface, the variety of interconnected systems and devices requires a cybersecurity approach that can cover the diverse technology environment.  

From a monitoring and visibility perspective, siloed IT, OT or cloud security solutions cannot provide the comprehensive asset management, threat detection, risk management, and response and remediation capabilities across interconnected digital infrastructure that a solution natively covering IT, cloud, OT, and IoT can provide.  

The problem with using siloed cybersecurity solutions to cover a distribution center is the visibility gaps that are inherently created when using multiple solutions to try and cover the totality of the diverse infrastructure. What this means is that for cross domain and multi-stage attacks, depending on the initial access point and where the adversary plans on actioning their objectives, multiple stages of the attack may not be detected or correlated if they security solutions lack visibility into OT, IT, IoT and cloud.

Comprehensive security under one solution

Darktrace leverages Self-Learning AI, which takes a new approach to cybersecurity. Instead of relying on rules and signatures, this AI trains on the specific business to learn a ‘pattern of life’ that models normal activity for every device, user, and connection. It can be applied anywhere an organization has data, and so can natively cover IT, OT, IoT, and cloud.  

With these models, Darktrace / OT provides improved visibility, threat detection and response, and risk management for proactive hardening recommendations.  

Visibility: Darktrace is the only OT security solution that natively covers IT, IoT and OT in unison. AI augmented workflows ensure OT cybersecurity analysts and operation engineers can manage IT and OT environments, leveraging a live asset inventory and tailored dashboards to optimize security workflows and minimize operator workload.

Threat detection, investigation, and response: The AI facilitates anomaly detection capable of detecting known, unknown, and insider threats and precise response for OT environments that contains threats at their earliest stages before they can jeopardize control systems. Darktrace immediately understands, identifies, and investigates all anomalous activity in OT networks, whether human or machine driven and uses Explainable AI to generate investigation reports via Darktrace’s Cyber AI Analyst.

Proactive risk identification: Risk management capabilities like attack path modeling can prioritize remediation and mitigation that will most effectively reduce derived risk scores. Rather than relying on knowledge of past attacks and CVE lists and scores, Darktrace AI learns what is ‘normal’ for its environment, discovering previously unknown threats and risks by detecting subtle shifts in behavior and connectivity. Through the application of Darktrace AI for OT environments, security teams can investigate novel attacks, discover blind spots, get live-time visibility across all their physical and digital assets, and reduce the time to detect, respond to, and triage security events.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Daniel Simonds
Director of Operational Technology

More in this series

No items found.

Blog

/

/

April 22, 2025

Obfuscation Overdrive: Next-Gen Cryptojacking with Layers

man looking at multiple computer screensDefault blog imageDefault blog image

Out of all the services honeypotted by Darktrace, Docker is the most commonly attacked, with new strains of malware emerging daily. This blog will analyze a novel malware campaign with a unique obfuscation technique and a new cryptojacking technique.

What is obfuscation?

Obfuscation is a common technique employed by threat actors to prevent signature-based detection of their code, and to make analysis more difficult. This novel campaign uses an interesting technique of obfuscating its payload.

Docker image analysis

The attack begins with a request to launch a container from Docker Hub, specifically the kazutod/tene:ten image. Using Docker Hub’s layer viewer, an analyst can quickly identify what the container is designed to do. In this case, the container is designed to run the ten.py script which is built into itself.

 Docker Hub Image Layers, referencing the script ten.py.
Figure 1: Docker Hub Image Layers, referencing the script ten.py.

To gain more information on the Python file, Docker’s built in tooling can be used to download the image (docker pull kazutod/tene:ten) and then save it into a format that is easier to work with (docker image save kazutod/tene:ten -o tene.tar). It can then be extracted as a regular tar file for further investigation.

Extraction of the resulting tar file.
Figure 2: Extraction of the resulting tar file.

The Docker image uses the OCI format, which is a little different to a regular file system. Instead of having a static folder of files, the image consists of layers. Indeed, when running the file command over the sha256 directory, each layer is shown as a tar file, along with a JSON metadata file.

Output of the file command over the sha256 directory.
Figure 3: Output of the file command over the sha256 directory.

As the detailed layers are not necessary for analysis, a single command can be used to extract all of them into a single directory, recreating what the container file system would look like:

find blobs/sha256 -type f -exec sh -c 'file "{}" | grep -q "tar archive" && tar -xf "{}" -C root_dir' \;

Result of running the command above.
Figure 4: Result of running the command above.

The find command can then be used to quickly locate where the ten.py script is.

find root_dir -name ten.py

root_dir/app/ten.py

Details of the above ten.py script.
Figure 5: Details of the above ten.py script.

This may look complicated at first glance, however after breaking it down, it is fairly simple. The script defines a lambda function (effectively a variable that contains executable code) and runs zlib decompress on the output of base64 decode, which is run on the reversed input. The script then runs the lambda function with an input of the base64 string, and then passes it to exec, which runs the decoded string as Python code.

To help illustrate this, the code can be cleaned up to this simplified function:

def decode(input):
   reversed = input[::-1]

   decoded = base64.decode(reversed)
   decompressed = zlib.decompress(decoded)
   return decompressed

decoded_string = decode(the_big_text_blob)
exec(decoded_string) # run the decoded string

This can then be set up as a recipe in Cyberchef, an online tool for data manipulation, to decode it.

Use of Cyberchef to decode the ten.py script.
Figure 6: Use of Cyberchef to decode the ten.py script.

The decoded payload calls the decode function again and puts the output into exec. Copy and pasting the new payload into the input shows that it does this another time. Instead of copy-pasting the output into the input all day, a quick script can be used to decode this.

The script below uses the decode function from earlier in order to decode the base64 data and then uses some simple string manipulation to get to the next payload. The script will run this over and over until something interesting happens.

# Decode the initial base64

decoded = decode(initial)
# Remove the first 11 characters and last 3

# so we just have the next base64 string

clamped = decoded[11:-3]

for i in range(1, 100):
   # Decode the new payload

   decoded = decode(clamped)
   # Print it with the current step so we

   # can see what’s going on

   print(f"Step {i}")

   print(decoded)
   # Fetch the next base64 string from the

   # output, so the next loop iteration will

   # decode it

   clamped = decoded[11:-3]

Result of the 63rd iteration of this script.
Figure 7: Result of the 63rd iteration of this script.

After 63 iterations, the script returns actual code, accompanied by an error from the decode function as a stopping condition was never defined. It not clear what the attacker’s motive to perform so many layers of obfuscation was, as one round of obfuscation versus several likely would not make any meaningful difference to bypassing signature analysis. It’s possible this is an attempt to stop analysts or other hackers from reverse engineering the code. However,  it took a matter of minutes to thwart their efforts.

Cryptojacking 2.0?

Cleaned up version of the de-obfuscated code.
Figure 8: Cleaned up version of the de-obfuscated code.

The cleaned up code indicates that the malware attempts to set up a connection to teneo[.]pro, which appears to belong to a Web3 startup company.

Teneo appears to be a legitimate company, with Crunchbase reporting that they have raised USD 3 million as part of their seed round [1]. Their service allows users to join a decentralized network, to “make sure their data benefits you” [2]. Practically, their node functions as a distributed social media scraper. In exchange for doing so, users are rewarded with “Teneo Points”, which are a private crypto token.

The malware script simply connects to the websocket and sends keep-alive pings in order to gain more points from Teneo and does not do any actual scraping. Based on the website, most of the rewards are gated behind the number of heartbeats performed, which is likely why this works [2].

Checking out the attacker’s dockerhub profile, this sort of attack seems to be their modus operandi. The most recent container runs an instance of the nexus network client, which is a project to perform distributed zero-knowledge compute tasks in exchange for cryptocurrency.

Typically, traditional cryptojacking attacks rely on using XMRig to directly mine cryptocurrency, however as XMRig is highly detected, attackers are shifting to alternative methods of generating crypto. Whether this is more profitable remains to be seen. There is not currently an easy way to determine the earnings of the attackers due to the more “closed” nature of the private tokens. Translating a user ID to a wallet address does not appear to be possible, and there is limited public information about the tokens themselves. For example, the Teneo token is listed as “preview only” on CoinGecko, with no price information available.

Conclusion

This blog explores an example of Python obfuscation and how to unravel it. Obfuscation remains a ubiquitous technique employed by the majority of malware to aid in detection/defense evasion and being able to de-obfuscate code is an important skill for analysts to possess.

We have also seen this new avenue of cryptominers being deployed, demonstrating that attackers’ techniques are still evolving - even tried and tested fields. The illegitimate use of legitimate tools to obtain rewards is an increasingly common vector. For example,  as has been previously documented, 9hits has been used maliciously to earn rewards for the attack in a similar fashion.

Docker remains a highly targeted service, and system administrators need to take steps to ensure it is secure. In general, Docker should never be exposed to the wider internet unless absolutely necessary, and if it is necessary both authentication and firewalling should be employed to ensure only authorized users are able to access the service. Attacks happen every minute, and even leaving the service open for a short period of time may result in a serious compromise.

References

1. https://www.crunchbase.com/funding_round/teneo-protocol-seed--a8ff2ad4

2. https://teneo.pro/

Continue reading
About the author
Nate Bill
Threat Researcher

Blog

/

/

April 22, 2025

How NDR and Secure Access Service Edge (SASE) Work Together to Achieve Network Security Outcomes

woman looking out at buildingsDefault blog imageDefault blog image

Modern networks are evolving rapidly, with traffic patterns, user behavior, and critical assets extending far beyond the boundaries of traditional network security tools. As organizations adopt hybrid infrastructures, remote working, and cloud-native services, it is essential to maintain visibility and protect this expanding attack surface.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) are two technologies commonly used to safeguard organizational networks. While both play crucial roles in enhancing security, one does not replace the other. Instead, NDR and SASE complement each other, taking on different roles to create a robust network security framework. This blog will unpack the relationship between NDR and SASE, including the component functionalities that comprise SASE, highlighting their unique contributions to maintaining a comprehensive and resilient network security strategy.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) explained

NDR solutions, such as Darktrace / NETWORK, are designed to detect, investigate, and respond to suspicious activities within any network. By leveraging machine learning and behavioral analytics, NDR continuously monitors network traffic to identify anomalies that could indicate potential threats and to contain those threats at machine speed. These solutions analyze both North-South traffic (between internal and external networks) and East-West traffic (within internal networks), providing comprehensive visibility into network activities.

SASE, on the other hand, comprises multiple solutions, focused on providing hybrid and remote users access to services while adhering to the Zero Trust principle of "never trust, always verify". Within SASE architectures, Zero Trust Network Access (ZTNA) solutions provide secure remote access to private applications and services the user has been explicitly granted, and Secure Web Gateways (SWG) provide Internet access, again based on policy groups. Unlike traditional security models that grant implicit trust to users within the network perimeter, ZTNA requires continuous verification of user identity and device health before granting access to resources. This approach minimizes the attack surface and reduces the risk of unauthorized access to sensitive data and internal applications. Similarly, SWGs filter web traffic based on the verified user identity and can block known malware, further reducing the attack surface for the client estate.

Limitations of SASE highlights the importance of NDR

While SASE, including ZTNA and SWG, is a powerful tool for enforcing secure access to company networks and resources as well as the Internet, it is not a comprehensive security solution, or a replacement for dedicated network monitoring and NDR capabilities. Some of the main limitations include:

  • Focused on policies rather than security: SASE delivers strong networking outcomes but provides policy-based protections, rather than a full suite of security features. It can provide simple alerting for disallowed actions, but it lacks the security context needed for comprehensive threat detection, such as knowing if user credentials have been compromised.
  • Can only detect known threats: SASE solutions cannot detect novel attacks such as zero-days and insider threats. This is because they rely on a rule-based approach that does not have a behavioral understanding of network entities that can detect anomalies or suspicious activity.
  • Limited response capabilities: Due to the limited detection capabilities of SASE solutions, it is not possible to automate response actions to threats that slip past existing policies.  While access to internal resources and the Internet can be revoked or severely limited as part of a response, this must be done after human investigation and analysis, allowing more time for the threat to continue before being contained.
  • Limited scope: SASE provides cloud-hosted secure networking, which lends itself much more toward the client estate of any organization. As a result, servers and unmanaged devices—whether IT/IoT/OT—are mostly out of scope and do not benefit from the policies SASE enforces.

The complementary roles of NDR and ZTNA

NDR solutions provide full visibility into network activity, with the ability to detect and respond to threats that may bypass initial access controls and filters. When combined, NDR and SASE create a layered security approach that addresses different aspects of network security, for example:

  • Detection of novel, unknown and insider threats: NDR solutions can monitor all network traffic using behavioral anomaly detection. This can identify suspicious activities, such as insider threats from authorized users who have passed policy checks, or novel attacks that have never been seen before.
  • Validation of policies: By continuously monitoring network traffic, NDR can validate the effectiveness of existing policies and identify any gaps in security that need addressing due to organizational changes or outdated rule sets.
  • Reducing risk and impact of threats: Together, SASE and NDR solutions shift toward proactive security by reducing the potential impact of a threat through predefined policies and by detecting and containing a threat in its earliest stages, even if it is novel or nuanced.
  • Enhanced contextual information: Alerts raised by SASE solutions can provide additional context into potential threats, which can be used by NDR solutions to increase investigation quality and context.
  • Containment of network threats: SASE solutions can prohibit access to resources on an internal company network or on the Internet if predefined access control criteria are not met or a site matches a threat signature. When combined with an NDR solution, organizations can go far beyond this, detecting and responding to a much wider variety of network threats to prevent attacks from escalating.

When implementing SASE and NDR solutions, it is also crucial to consider the best configurations to maximize interoperability, and integrations will often increase functionality. Well-designed implementations, combined with integrations, will strengthen both SASE and NDR solutions for organizations.

How Darktrace continues to secure SASE networks

With the latest 6.3 update, Darktrace continues to extend its capabilities with new innovations that support modern enterprise networks and the use of SASE across remote and hybrid worker devices. This expands on existing Darktrace integrations and partnerships with SASE vendors such as Netskope and Zscaler.

Traditional methods to contain remote access and internet-born threats are either signature or policy based, and response to nuanced threats requires manual, human-led investigation and decision-making. By the time security teams can react, the damage is often already done.

With Darktrace 6.3, customers using Zscaler can now configure Darktrace Autonomous Response to quarantine ZPA-connected user devices at machine speed. This provides a powerful new mechanism for containing remote threats at the earliest sign of suspicious activity, without disrupting broader operations.

By automatically shutting down ZPA access for compromised user accounts, Darktrace gives SOC teams valuable time to investigate and respond, while continuing to protect the rest of the organization. This integration enhances Darktrace’s ability to take actions for remote user devices, helping customers contain threats faster and keep the business running smoothly.

For organizations using SASE technologies to address the challenges of securing large, distributed networks across a range of geographies, SaaS applications and remote worker devices, Darktrace also now integrates with Netskope Cloud TAP to provide visibility into and analysis over tunneled traffic, reducing blind spots and enabling organizations to maintain detection capabilities across their expanding network perimeters.

Conclusion

While NDR and ZTNA serve distinct purposes, their integration is crucial for a comprehensive security strategy. ZTNA provides robust access controls, ensuring that only authorized users can access network resources. NDR, on the other hand, offers continuous visibility into network activities, detecting and responding to threats that may bypass initial access controls. By leveraging the strengths of both solutions, organizations can enhance their security posture and protect against a wide range of network security threats.

Understanding the complementary roles of NDR and ZTNA is essential for building a resilient security framework. As cyber threats continue to evolve, adopting a multi-layered, defense-in-depth security approach will be key to safeguarding organizational networks.

Click here for more information about the latest product innovations in Darktrace 6.3, or learn more about Darktrace / NETWORK here.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI