Blog
/
Email
/
April 10, 2023

Detecting Malicious Email Activity & AI Impersonating

Discover how two different phishing attempts from some known and unknown senders used a payroll diversion and credential sealing box link to harm users.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Isabelle Cheong
Cyber Security Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
10
Apr 2023

Social engineering has become widespread in the cyber threat landscape in recent years, and the near-universal use of social media today has allowed attackers to research and target victims more effectively. Social engineering involves manipulating users to carry out actions such as revealing sensitive information like login credentials or credit card details. It can also lead to user account compromises, causing huge disruption to an organization’s digital estate. 

As people use social media platforms not only for personal reasons, but also for business purposes, attackers gain information they can exploit in social engineering attacks. For example, a threat actor may attempt to impersonate a known individual or legitimate service to take advantage of a user’s established trust. This is a highly successful method of social engineering because mimicking known contacts makes it difficult for traditional security tools that rely on deny-lists to detect the attack.

In October 2022, Darktrace identified and responded to two separate malicious email campaigns in which threat actors attempted to impersonate known contacts in an effort to compromise customer devices. As it learns the normal behavior of every user in the email system, Darktrace was able to instantly detect these threats and mitigate them autonomously, preventing significant disruption to the customer networks.

Payroll Diversion Fraud Attempt Impersonating a Former Employee 

While a customer in the Canadian energy sector was trialing Darktrace in October 2022, Darktrace/Email™ identified a suspicious email seemingly sent from an employee within the organization. The email was sent to the Senior Director of Human Resources (HR) with a subject line of “Change in payroll Direct Deposit.” The email requested a change in bank account information for an employee. However, Darktrace recognized that the sender was using a free mail address that contained random letters, indicating it may have been algorithmically generated. Since this incident occurred during a trial, Darktrace/Email was not configured to take action. Otherwise, it would have prevented the email from landing in the inbox. In this case though, the email went through, bypassing all other security tools in place.

Although the email was from an unknown sender, the HR director believed the email could have been legitimate as the employee who appeared to be the sender had left the organization seven days prior and no longer had access to their corporate email account. However, after reviewing it in the Darktrace/Email dashboard, the customer grew suspicious and contacted the former employee directly to verify if the request was legitimate. The former employee validated the suspicions by confirming they had sent no such email.

Further investigation by the customer revealed that the former employee had been vocal about their departure on various social media platforms. This gave threat actors valuable information to believably impersonate the former employee and defraud the organization. 

Such attempts to target organizations’ HR departments and divert payroll are common tactics for cyber-criminals and are often identified by Darktrace/Email across the customer base. Darktrace/Email is able to instantly identify the indicators associated with these spoofing attempts and immediately bring them to the attention of the customer’s security team. 

Using Legitimate File Sharing Service to Share a Phishing Link 

On October 7, 2022, a customer in the Singaporean construction sector was targeted by a phishing campaign attempting to impersonate a law firm known to the organization. Almost 200 employees received an email with the subject line “Accepted: Valuation Agreement.” 

Figure 1: Sample of an UI view of the message held showing anomaly indicators, history, association, and validation.

Four days earlier, Darktrace observed communication between another email address associated with the law firm and an employee of the customer. Darktrace/Email noted that it was the first time this correspondent had sent emails to the customer. 

Figure 2: Metrics showing how well the sender’s domain is known within the digital environment.

The emails contained a highly unusual link to a file sharing service, (hxxps://ssvilvensstokes[.]app[.]box[.]com/notes), hidden behind the text “PREVIEW OR PRINT COPY OF DOCUMENT HERE.” Darktrace analysts investigated this event further and found that around 30 similar URLs had been identified as suspicious using OSINT security tools in October 2022, suggesting the customer was not the only target of this phishing campaign.

Figure 3: Preview of the phishing email’s body.
Figure 4: Darktrace’s evaluation of the link contained in the phishing email.

Additional OSINT work revealed that the link directed to a website which appeared to host a PDF file named “Valuation Agreement.” The recipient would then be prompted to follow another link (hulking-citrine-krypton[.]glitch[.]me), again hidden behind the text “OPEN OR ACCESS DOCUMENT HERE” to view the file. Subsequently, the user would be prompted to enter their Microsoft 365 credentials. 

Figure 5: The page displayed when the phishing link was clicked, viewed in a sandbox environment.
Figure 6: Example of a page shown when recipient clicks the second link, accessing “hulking-citrine-krypton[.]glitch[.]me”. 

This page contained the text “This document has been scanned for viruses by Norton Antivirus Security.” This is another example of threat actors’ employing social engineering techniques by impersonating well-known brands, such as established security vendors, to gain the trust of users and increase their likelihood of success.

It is highly probable that a real employee of the law firm had their account hijacked and that a malicious actor was exploiting it to send out these phishing emails en masse as part of a supply chain attack. In such cases, malicious actors rely on their targets’ trust of known contacts to not question departures from their normal conversations. 

Darktrace was able to instantly detect multiple anomalies in these emails, despite the fact that they were seemingly sent by known correspondents. The activity detected automatically triggered model breaches associated with unexpected and visually prominent links. As a result, Darktrace/Email responded by locking the link, stopping users from being able to click it.

Darktrace subsequently identified additional emails from this sender attempting to target other recipients within the company, triggering the model breaches associated with a surge in email sending indicative of a phishing campaign. In response, Darktrace/Email autonomously acted and filed these emails as junk. As more emails were detected across the customer’s environment, the anomaly score of the sender increased and Darktrace ultimately held back over 160 malicious emails, safeguarding recipients from potential account compromise.           

The following Darktrace/Email models were breached throughout the course of this phishing campaign:

  • Unusual/Sender Surge 
  • Unusual/Undisclosed Recipients 
  • Antigena Anomaly 
  • Association/Unlikely Recipient Association 
  • Link/Low Link Association 
  • Link/Visually Prominent Link 
  • Link/Visually Prominent Link Unexpected For Sender 
  • Unusual/New Sender Wide Distribution
  • Unusual/Undisclosed Recipients + New Address Known Domain

Conclusion

Social engineering plays a role in many of the major threats challenging current email cyber security, as attackers can use it to manipulate users into transferring money, revealing credentials, clicking malicious links, and more. 

The above threat stories happened before language generating AI became mainstream with the release of ChatGPT in December 2022. Now, it is even easier for malicious actors to generate sophisticated social engineering emails. By using social media posts as input, social engineering emails written by generative AI can be highly targeted and produced at scale. They often avoid the flags users are trained to look for, like poor grammar and spelling mistakes, and can hide payloads or forgo them entirely.

To mitigate the risk of possible social engineering attempts, it is recommended that organizations implement social media policies that advise employees to be cautious of what they post online and enact procedures to verify if fund transfer requests are legitimate.

Yet these policies are not enough on their own. Darktrace/Email can identify suspicious email traits, whether an email is sent from a known correspondent or an unknown sender. With Self-Learning AI, it knows an organization’s users better than any impersonator could. In this way, Darktrace/Email detects anomalies within emails and neutralizes malicious components at machine-speed, stopping attacks at their earliest stages, before employees fall victim. 

Appendices

List of Indicators of Compromise (IoCs)

Domain:

hxxps://ssvilvensstokes[.]app[.]box[.]com/notes/*?s=* - 1st external link (seen in email)

hxxps://hulking-citrine-krypton[.]glitch[.]me/flk.html - 2nd external link, masked behind “OPEN OR ACCESS DOCUMENT HERE”

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Isabelle Cheong
Cyber Security Analyst

More in this series

No items found.

Blog

/

Email

/

April 14, 2025

Email bombing exposed: Darktrace’s email defense in action

picture of a computer screen showing a password loginDefault blog imageDefault blog image

What is email bombing?

An email bomb attack, also known as a "spam bomb," is a cyberattack where a large volume of emails—ranging from as few as 100 to as many as several thousand—are sent to victims within a short period.

How does email bombing work?

Email bombing is a tactic that typically aims to disrupt operations and conceal malicious emails, potentially setting the stage for further social engineering attacks. Parallels can be drawn to the use of Domain Generation Algorithm (DGA) endpoints in Command-and-Control (C2) communications, where an attacker generates new and seemingly random domains in order to mask their malicious connections and evade detection.

In an email bomb attack, threat actors typically sign up their targeted recipients to a large number of email subscription services, flooding their inboxes with indirectly subscribed content [1].

Multiple threat actors have been observed utilizing this tactic, including the Ransomware-as-a-Service (RaaS) group Black Basta, also known as Storm-1811 [1] [2].

Darktrace detection of email bombing attack

In early 2025, Darktrace detected an email bomb attack where malicious actors flooded a customer's inbox while also employing social engineering techniques, specifically voice phishing (vishing). The end goal appeared to be infiltrating the customer's network by exploiting legitimate administrative tools for malicious purposes.

The emails in these attacks often bypass traditional email security tools because they are not technically classified as spam, due to the assumption that the recipient has subscribed to the service. Darktrace / EMAIL's behavioral analysis identified the mass of unusual, albeit not inherently malicious, emails that were sent to this user as part of this email bombing attack.

Email bombing attack overview

In February 2025, Darktrace observed an email bombing attack where a user received over 150 emails from 107 unique domains in under five minutes. Each of these emails bypassed a widely used and reputable Security Email Gateway (SEG) but were detected by Darktrace / EMAIL.

Graph showing the unusual spike in unusual emails observed by Darktrace / EMAIL.
Figure 1: Graph showing the unusual spike in unusual emails observed by Darktrace / EMAIL.

The emails varied in senders, topics, and even languages, with several identified as being in German and Spanish. The most common theme in the subject line of these emails was account registration, indicating that the attacker used the victim’s address to sign up to various newsletters and subscriptions, prompting confirmation emails. Such confirmation emails are generally considered both important and low risk by email filters, meaning most traditional security tools would allow them without hesitation.

Additionally, many of the emails were sent using reputable marketing tools, such as Mailchimp’s Mandrill platform, which was used to send almost half of the observed emails, further adding to their legitimacy.

 Darktrace / EMAIL’s detection of an email being sent using the Mandrill platform.
Figure 2: Darktrace / EMAIL’s detection of an email being sent using the Mandrill platform.
Darktrace / EMAIL’s detection of a large number of unusual emails sent during a short period of time.
Figure 3: Darktrace / EMAIL’s detection of a large number of unusual emails sent during a short period of time.

While the individual emails detected were typically benign, such as the newsletter from a legitimate UK airport shown in Figure 3, the harmful aspect was the swarm effect caused by receiving many emails within a short period of time.

Traditional security tools, which analyze emails individually, often struggle to identify email bombing incidents. However, Darktrace / EMAIL recognized the unusual volume of new domain communication as suspicious. Had Darktrace / EMAIL been enabled in Autonomous Response mode, it would have automatically held any suspicious emails, preventing them from landing in the recipient’s inbox.

Example of Darktrace / EMAIL’s response to an email bombing attack taken from another customer environment.
Figure 4: Example of Darktrace / EMAIL’s response to an email bombing attack taken from another customer environment.

Following the initial email bombing, the malicious actor made multiple attempts to engage the recipient in a call using Microsoft Teams, while spoofing the organizations IT department in order to establish a sense of trust and urgency – following the spike in unusual emails the user accepted the Teams call. It was later confirmed by the customer that the attacker had also targeted over 10 additional internal users with email bombing attacks and fake IT calls.

The customer also confirmed that malicious actor successfully convinced the user to divulge their credentials with them using the Microsoft Quick Assist remote management tool. While such remote management tools are typically used for legitimate administrative purposes, malicious actors can exploit them to move laterally between systems or maintain access on target networks. When these tools have been previously observed in the network, attackers may use them to pursue their goals while evading detection, commonly known as Living-off-the-Land (LOTL).

Subsequent investigation by Darktrace’s Security Operations Centre (SOC) revealed that the recipient's device began scanning and performing reconnaissance activities shortly following the Teams call, suggesting that the user inadvertently exposed their credentials, leading to the device's compromise.

Darktrace’s Cyber AI Analyst was able to identify these activities and group them together into one incident, while also highlighting the most important stages of the attack.

Figure 5: Cyber AI Analyst investigation showing the initiation of the reconnaissance/scanning activities.

The first network-level activity observed on this device was unusual LDAP reconnaissance of the wider network environment, seemingly attempting to bind to the local directory services. Following successful authentication, the device began querying the LDAP directory for information about user and root entries. Darktrace then observed the attacker performing network reconnaissance, initiating a scan of the customer’s environment and attempting to connect to other internal devices. Finally, the malicious actor proceeded to make several SMB sessions and NTLM authentication attempts to internal devices, all of which failed.

Device event log in Darktrace / NETWORK, showing the large volume of connections attempts over port 445.
Figure 6: Device event log in Darktrace / NETWORK, showing the large volume of connections attempts over port 445.
Darktrace / NETWORK’s detection of the number of the login attempts via SMB/NTLM.
Figure 7: Darktrace / NETWORK’s detection of the number of the login attempts via SMB/NTLM.

While Darktrace’s Autonomous Response capability suggested actions to shut down this suspicious internal connectivity, the deployment was configured in Human Confirmation Mode. This meant any actions required human approval, allowing the activities to continue until the customer’s security team intervened. If Darktrace had been set to respond autonomously, it would have blocked connections to port 445 and enforced a “pattern of life” to prevent the device from deviating from expected activities, thus shutting down the suspicious scanning.

Conclusion

Email bombing attacks can pose a serious threat to individuals and organizations by overwhelming inboxes with emails in an attempt to obfuscate potentially malicious activities, like account takeovers or credential theft. While many traditional gateways struggle to keep pace with the volume of these attacks—analyzing individual emails rather than connecting them and often failing to distinguish between legitimate and malicious activity—Darktrace is able to identify and stop these sophisticated attacks without latency.

Thanks to its Self-Learning AI and Autonomous Response capabilities, Darktrace ensures that even seemingly benign email activity is not lost in the noise.

Credit to Maria Geronikolou (Cyber Analyst and SOC Shift Supervisor) and Cameron Boyd (Cyber Security Analyst), Steven Haworth (Senior Director of Threat Modeling), Ryan Traill (Analyst Content Lead)

Appendices

[1] https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/

[2] https://thehackernews.com/2024/12/black-basta-ransomware-evolves-with.html

Darktrace Models Alerts

Internal Reconnaissance

·      Device / Suspicious SMB Scanning Activity

·      Device / Anonymous NTLM Logins

·      Device / Network Scan

·      Device / Network Range Scan

·      Device / Suspicious Network Scan Activity

·      Device / ICMP Address Scan

·      Anomalous Connection / Large Volume of LDAP Download

·      Device / Suspicious LDAP Search Operation

·      Device / Large Number of Model Alerts

Continue reading
About the author
Maria Geronikolou
Cyber Analyst

Blog

/

Email

/

April 11, 2025

FedRAMP High-compliant email security protects federal agencies from nation-state attacks

U.S. government building with flag against blue skyDefault blog imageDefault blog image

What is FedRAMP High Authority to Operate (ATO)?

Federal Risk and Authorization Management Program (FedRAMP®) High is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment for cloud technologies and federal agencies, ensuring the protection of federal information.  

Cybersecurity is paramount in the Defense Industrial Base (DIB), where protecting sensitive information and ensuring operational resilience from the most sophisticated adversaries has national security implications. Organizations within the DIB must comply with strict security standards to work with the U.S. federal government, and FedRAMP High is one of those standards.

Darktrace achieves FedRAMP High ATO across IT, OT, and email

Last week, Darktrace Federal shared that we achieved FedRAMP® High ATO, a significant milestone that recognizes our ability to serve federal customers across IT, OT, and email via secure cloud-native deployments.  

Achieving the FedRAMP High ATO indicates that Darktrace Federal has achieved the highest standard for cloud security controls and can handle the U.S. federal government’s most sensitive, unclassified data in cloud environments.

Azure Government email security with FedRAMP High ATO

Darktrace has now released Darktrace Commercial Government Cloud High/Email (DCGC High/Email). This applies our email coverage to systems hosted in Microsoft's Azure Government, which adheres to NIST SP 800-53 controls and other federal standards. DCGC High/Email both meets and exceeds the compliance requirements of the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC), providing organizations with a much-needed email security solution that delivers unparalleled, AI-driven protection against sophisticated cyber threats.

In these ways, DCGC High/Email enhances compliance, security, and operational resilience for government and federally-affiliated customers. Notably, it is crucial for securing contractors and suppliers within DIB, helping those organizations implement necessary cybersecurity practices to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

Adopting DCGC High/Email ensures organizations within the DIB can work with the government without needing to invest extensive time and money into meeting the strict compliance standards.

Building DCGC High/Email to ease DIB work with the government

DCGC High/Email was built to achieve FedRAMP High standards and meet the most rigorous security standards required of our customers. This level of compliance not only allows more organizations than ever to leverage our AI-driven technology, but also ensures that customer data is protected by the highest security measures available.

The DIB has never been more critical to national security, which means they are under constant threats from nation state and cyber criminals. We built DCGC High/Email to FedRAMP High controls to ensure sensitive company and federal government communications are secured at the highest level possible.” – Marcus Fowler, CEO of Darktrace Federal

Evolving threats now necessitate DCGC High/Email

According to Darktrace’s 2025 State of AI Cybersecurity report, more than half (54%) of global government cybersecurity professionals report seeing a significant impact from AI-powered cyber threats.  

These aren’t the only types of sophisticated threats. Advanced Persistent Threats (APTs) are launched by nation-states or cyber-criminal groups with the resources to coordinate and achieve long-term objectives.  

These attacks are carefully tailored to specific targets, using techniques like social engineering and spear phishing to gain initial access via the inbox. Once inside, attackers move laterally through networks, often remaining undetected for months or even years, silently gathering intelligence or preparing for a decisive strike.  

However, the barrier for entry for these threat actors has been lowered immensely, likely related to the observed impact of AI-powered cyber threats. Securing email environments is more important than ever.  

Darktrace’s 2025 State of AI Cybersecurity report also found that 89% of government cybersecurity professionals believe AI can help significantly improve their defensive capabilities.  

Darktrace's AI-powered defensive tools are uniquely capable of detecting and neutralizing APTs and other sophisticated threats, including ones that enter via the inbox. Our Self-Learning AI continuously adapts to evolving threats, providing real-time protection.

Darktrace builds to secure the DIB to the highest degree

In summary, Darktrace Federal's achievement of FedRAMP High ATO and the introduction of DCGC High/Email mark significant advancements in our ability to protect defense contractors and federal customers against sophisticated threats that other solutions miss.

For a technical review of Darktrace Federal’s Cyber AI Mission Defense™ solution, download an independent evaluation from the Technology Advancement Center here.

[related-resource]

Continue reading
About the author
Marcus Fowler
CEO of Darktrace Federal and SVP of Strategic Engagements and Threats
Your data. Our AI.
Elevate your network security with Darktrace AI