Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Share
02
Dec 2019
“The next phase in our journey toward autonomous security is Autonomous Response decision-making.”
Lawrence Pingree, Research Vice President, Gartner
We’ve talked extensively on this blog about Autonomous Response: the AI-powered technology that, according to Gartner, represents a paradigm shift in cyber defense. As the first such Autonomous Response tool, Darktrace Antigena has already thwarted countless cyber-attacks, from a spear phishing campaign against a major city to an IoT smart locker attack targeting a popular amusement park. Antigena’s surgical intervention afforded their security teams the time they needed to investigate — stopping the clock in seconds by containing just the malicious behavior.
For all its benefits, however, Autonomous Response does have one drawback: it can make for slightly anticlimactic blog posts. In place of captivating, step-by-step descriptions of malware spreading throughout the enterprise and inflicting irrevocable damage, Antigena case studies end a mere moment after they start, with the “patient zero” employee completely unaware of the compromise that could have been.
In this particular case, however, Antigena was deployed in Human Confirmation Mode — a starter mode wherein the AI’s actions must first be approved by the security team. Absent such approval, the result was both an in-depth look at a sophisticated ransomware attack, as well as a remarkable illustration of how Antigena reacted in real time to every stage of that attack’s lifecycle:
Initial download
Patient zero here was a device that Darktrace detected downloading an executable file from a server with which no other devices on the network had ever communicated. Downloads like this one regularly bypass conventional endpoint tools, since they cannot be programmed in advance to catch the full range of unpredictable future threats. By contrast, because Darktrace AI learned the typical behavior of the company’s unique users and devices while ‘on the job’, it easily determined the download to be anomalous.
Figure 1: Darktrace alerts on the 100% rare connection and subsequent download — as it occurs.
Had Antigena been in Active Mode at the time, this would have marked the end of the blog post. By blocking all connections to the associated IP and port, Antigena would have instantly stopped the download — without otherwise impacting the device at all.
Figure 2: Antigena, in Human Confirmation Mode, recommends that it block the suspicious activity.
Command and control
Following the download, Darktrace observed the device making an HTTP GET request to the same rare endpoint. The continuation of this suspicious activity precipitated an escalation in Antigena’s recommended response, which would now have blocked all outgoing traffic from the breached device to prevent any infection from spreading.
Darktrace then detected the device making yet more unusual external connections to endpoints that, in many cases, had self-signed SSL certificates. Such self-signed certificates do not require verification by a trusted authority and are therefore frequently utilized by cyber-criminals. As a consequence, the outgoing connections from our infected device are likely the installed malware communicating with its command and control infrastructure, as Darktrace flagged below:
Figure 3: Darktrace alerts on the suspicious SSL certificates.
Figure 4: Antigena recommends taking action to block the connections in question.
Internal reconnaissance
Beyond the unusual external activity observed from the breached device, it also began to deviate significantly from its typical pattern of internal behavior. Indeed, Darktrace detected the device making over 160,000 failed internal connections on two key ports: Remote Desktop Protocol port 3389 and SMB port 445. This activity — known as network scanning — provides crucial reconnaissance, giving the attacker insight into the network structure, the services available on each device, and any potential vulnerabilities. Ports 3389 and 445 are especially common targets.
Figure 5: Darktrace tracks this ransomware attack at every step, though the security team does not mount a response in time.
The unusual external connections to self-signed SSL certificates, combined with the highly anomalous internal connectivity from the device, would have caused Antigena to escalate further. Alas, the attack proceeds.
Darktrace detected no further anomalous activity from patient zero for the next four days — perhaps a mechanism to remain under the radar. Yet this period of dormancy concluded when, once again, the device connected to a rare domain with a self-signed SSL certificate, likely reaching out to its command and control infrastructure for additional instructions.
Lateral movement
A day later — in a sign that suggests the prior scanning was somewhat fruitful — the infected device performed a large amount of unusual SMB activity consistent with the malware attempting to move laterally across the network. Darktrace picked up on the breached device sending unusual outgoing SMB writes to the remote administration tool PsExec to a total of 38 destination devices, 28 of which it compromised with a malicious file.
Darktrace recognized this activity as highly anomalous for the particular device, as it doesn’t usually communicate with these destination devices in this manner. Antigena would therefore would have surgically blocked the remote administration behavior by first containing the patient zero device to its normal ‘pattern of life’, and then by escalating to blocking all outgoing connections from the device if lateral movement had continued. Antigena’s escalation can be seen below: the first action is taken at 08:03, the second, more severe action at 08:43.
Figure 6: Darktrace repeatedly alerts on the unusual SMB traffic with high confidence — thanks to its evolving understanding of the device’s typical ‘pattern of life’.
Figure 7: Antigena again recommends immediate intervention, this time to impede lateral movement.
Encryption
Darktrace observed the first sign of the ransomware’s ultimate objective — encrypting files — on a different device, which also performed a large volume of unusual SMB activity. After accessing a multitude of SMB shares that it hadn’t accessed previously, it systematically appended those files with the .locked extension. When all was said and done, this encryption activity was seen from no less than 40 internal devices.
In Active Mode, Antigena Ransomware Block would have fully quarantined the devices — a culmination of increasingly severe Antigena actions from the initial infection of patient zero, to the command and control communication, to the internal reconnaissance, to the lateral movement, and finally to the file encryption.
Figure 8: Antigena Ransomware Block was fully armed and prepared to fight back against the infection.
The case for boring blog posts
No other approach to cyber security is able to track ransomware so comprehensively throughout its lifecycle, as programming legacy tools to flag all remote administration behavior, for instance, would inundate security teams with thousands of false positive alerts. Thus, only Darktrace’s understanding ‘self’ for each infected device can shed light on such activities — in the rare cases when they are anomalous.
Figure 9: An overview of Darktrace’s myriad warnings throughout the five-day attack with each colored dot representing a high-confidence alert.
However, intriguing though it may be to track this lifecycle to conclusion, the technology to write far less intriguing blog posts already exists and is already proven. Autonomous Response will render this kind of threat story a relic of the past, and for organizations with sensitive data and critical intellectual property to safeguard, the days of boring security blogs cannot come soon enough.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AI Insider Threats: How Generative AI is Changing Insider Risk
How generative AI changes insider behavior
AI systems, especially generative platforms such as chatbots, are designed for engagement with humans. They are equipped with extraordinary human-like responses that can both confirm, and inflate, human ideas and ideology; offering an appealing cognitive partnership between machine and human. When considering this against the threat posed by insiders, the type of diverse engagement offered by AI can greatly increase the speed of an insider event, and can facilitate new attack platforms to carry out insider acts.
This article offers analysis on how to consider this new paradigm of insider risk, and outlines key governance principles for CISOs, CSOs and SOC managers to manage the threats inherent with AI-powered insider risk.
What is an insider threat?
There are many industry or government definitions of what constitutes insider threat. At its heart, it relates to the harm created when trusted access to sensitive information, assets or personnel is abused bywith malicious intent, or through negligent activities.
Traditional methodologies to manage insider threat have relied on two main concepts: assurance of individuals with access to sensitive assets, and a layered defense system to monitor for any breach of vulnerability. This is often done both before, and after access has been granted. In the pre-access state, assurance is gained through security or recruitment checks. Once access is granted, controls such as privileged access, and zero-trust architecture offer defensive layers.
How does AI change the insider threat paradigm?
While these two concepts remain central to the management of insider threats, the introduction of AI offers three key new aspects that will re-shape the paradigm:.
AI can act as a cognitive amplifier, influencing and affecting the motivations that can lead to insider-related activity. This is especially relevant for the deliberate insider - someone who is considering an act of insider harm. These individuals can now turn to AI systems to validate their thinking, provide unique insights, and, crucially, offer encouragement to act. With generative systems hard-wired to engage and agree with users, this can turn a helpful AI system into a dangerous AI hype machine for those with harmful insider intent.
AI can act as an operational enabler. AI can now develop and increase the range of tools needed to carry out insider acts. New social engineering platforms such as vishing and deepfakes give adversaries a new edge to create insider harm. AI can generate solutions and operational platforms at increasing speeds; often without the need for human subject matter expertise to execute the activities. As one bar for advanced AI capabilities continues to be raised, the bar needed to make use of those platforms has become significantly lower.
AI can act as a semi-autonomous insider, particularly when agentic AI systems or non-human identities are provided broad levels of autonomy; creating a vector of insider acts with little-to-no human oversight or control. As AI agents assume many of the orchestration layers once reserved for humans, they do so without some of the restricted permissions that generally bind service accounts. With broad levels of accessibility and authority, these non-human identities (NHIs) can themselves become targets of insider intent. Commonly, this refers to the increasing risks of prompt injection, poisoning, or other types of embedded bias. In many ways, this mirrors the risks of social engineering traditionally faced by humans. Even without deliberate or malicious efforts to corrupt them, AI systems and AI agents can carry out unintended actions; creating vulnerabilities and opportunities for insider harm.
How to defend against AI-powered insider threats
The increasing attack surfaces created or facilitated by AI is a growing concern. In Darktrace’s own AI cybersecurity research, the risks introduced, and acknowledged, through the proliferation of AI tools and systems continues to outstrip traditional policies and governance guardrails. 22% of respondents in the survey cited ‘insider misuse aided by generative AI’ as a major threat concern. And yet, in the same survey, only 37% of all respondents have formal policies in place to manage the safe and responsible use of AI. This draws a significant and worrying delta between the known risks and threat concerns, and the ability (and resources) to mitigate them.
What can CISOs and SOC leaders do to protect their organization from AI insider threats?
Given the rapid adaptation, adoption, and scale of AI systems, implementing the right levels of AI governance is non-negotiable. Getting the correct balance between AI-driven productivity gains and careful compliance will lead to long-term benefits. Adapting traditional insider threat structures to account for newer risks posed through the use of AI will be crucial. And understanding the value of AI systems that add to your cybersecurity resilience rather than imperil it will be essential.
For those responsible for the security and protection of their business assets and data holdings, the way AI has changed the paradigm of insider threats can seem daunting. Adopting strong, and suitable AI governance can become difficult to introduce due to the volume and complexity of systems needed to be monitored. As well as traditional insider threat mitigations such as user monitoring, access controls and active management, the speed and autonomy of some AI systems need different, as well as additional layers of control.
How Darktrace helps protect against AI-powered insider threats
Darktrace has demonstrated that, through platforms such as our proprietary Cyber AI Analyst, and our latest product Darktrace / SECURE AI, there are ways AI systems can be self-learning, self-critical and resilient to unpredictable AI behavior whilst still offering impressive returns; complementing traditional SOC and CISO strategies to combat insider threat.
With / SECURE AI, some of the ephemeral risks drawn through AI use can be more easily governed. Specifically, the ability to monitor conversational prompts (which can both affect AI outputs as well as highlight potential attempts at manipulation of AI; raising early flags of insider intent); the real-time observation of AI usage and development (highlighting potential blind-spots between AI development and deployment); shadow AI detection (surfacing unapproved tools and agents across your IT stack) and; the ability to know which identities (human or non-human) have permission access. All these features build on the existing foundations of strong insider threat management structures.
How to take a defense-in-depth approach to AI-powered insider threats
Even without these tools, there are four key areas where robust, more effective controls can mitigate AI-powered insider threat. Each of the below offers a defencce-in-depth approach: layering acknowledgement and understanding of an insider vector with controls that can bolster your defenses.
Identity and access controls
Having a clear understanding of the entities that can access your sensitive information, assets and personnel is the first step in understanding the landscape in which insider harm can occur. AI has shown that it is not just flesh and bone operators who can administer insider threats; Non-Human Identities (such as agentic AI systems) can operate with autonomy and freedom if they have the right credentials. By treating NHIs in the same way as human operators (rather than helpful machine-based tools), and adding similar mitigation and management controls, you can protect both your business, and your business-based identities from insider-related attention.
Visibility and shadow AI detection
Configuring AI systems carefully, as well as maintaining internal monitoring, can help identify ‘shadow AI’ usage; defined as the use of unsanctioned AI tools within the workplace1 (this topic was researched in Darktrace’s own paper on "How to secure AI in the enterprise". The adoption of shadow AI could be the result of deliberate preference, or ‘shortcutting’; where individuals use systems and models they are familiar with, even if unsanctioned. As well as some performance risks inherent with the use of shadow AI (such as data leakage and unwanted actions), it could also be a dangerous precursor for insider-related harm (either through deliberate attempts to subvert regular monitoring, or by opening vulnerabilities through unpatched or unaccredited tooling).
Prompt and Output Guardrails
The ability to introduce guardrails for AI systems offers something of a traditional “perimeter protection” layer in AI defense architecture; checking prompts and outputs against known threat vectors, or insider threat methodologies. Alone, such traditional guardrails offer limited assurance. But, if tied with behavior-centric threat detection, and an enforcement system that deters both malicious and accidental insider activities, this would offer considerable defense- in- depth containment.
Forensic logging and incident readiness response
The need for detection, data capture, forensics, and investigation are inherent elements of any good insider threat strategy. To fully understand the extent or scope of any suspected insider activity (such as understanding if it was deliberate, targeted, or likely to occur again), this rich vein of analysis could prove invaluable. As the nature of business increasingly turns ephemeral; with assets secured in remote containers, information parsed through temporary or cloud-based architecture, and access nodes distributed beyond the immediate visibility of internal security teams, the development of AI governance through containment, detection, and enforcement will grow ever more important.
Enabling these controls can offer visibility and supervision over some of the often-expressed risks about AI management. With the right kind of data analytics, and with appropriate human oversight for high-risk actions, it can illuminate the core concerns expressed through a new paradigm of AI-powered insider threats by:
Ensuring deliberately mis-configured AI systems are exposed through regular monitoring.
Highlighting changes in systems-based activity that might indicate harmful insider actions; whether malicious or accidental.
Promoting a secure-by-design process that discourages and deters insider-related ambitions.
Ensuring the control plane for identity-based access spans humans, NHIs and AI models, and:
Offering positive containment strategies that will help curate the extent of AI control, and minimize unwanted activities.
Why insider threat remains a human challenge
At its root, and however it has been configured, AI is still an algorithmic tool; something designed to automate, process and manage computational functions at machine speed, and boost productivity. Even with the best cybersecurity defenses in place, the success of an insider threat management program will still depend on the ability of human operators to identify, triage, and manage the insider threat attack surface.
AI governance policies, human-in-the-loop break points, and automated monitoring functions will not guard against acts of insider harm unless there is intention to manage this proactively, and through a strong culture of how to guard against abuses of trust and responsibility.
Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor
Darktrace have identified activity consistent with Chinese-nexus operations, a Twill Typhoon-linked campaign targeting customer environments, primarily within the Asia-Pacific & Japan (APJ) region
Beginning in late September 2025, multiple affected hosts were observed making requests to domains impersonating content delivery networks (CDNs), including infrastructure masquerading as Yahoo- and Apple-affiliated services. Across these cases, Darktrace identified a consistent behavioral execution pattern: the retrieval of legitimate binaries alongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework.
The activity aligns with patterns described in Darktrace’s previous Chinese-nexus operations report, Crimson Echo. In this case, observed modular intrusion chains built on legitimate software, and staged payload delivery. Threat actors retrieve legitimate binaries alongside configuration files and malicious DLLs to enable sideloading of a .NET-based RAT.
Observed Campaign
Across cases, the same ordered sequence appears: retrieval of a legitimate executable, (2) retrieval of a matching .config file, (3) retrieval of the malicious
DLL, (4) repeated DLL downloads over time, and (5) command-and-control (C2) communication. The .config file retrieves a malicious binary, while the legitimate binary provides a legitimate process to run it in.
Darktrace assesses with moderate confidence that this activity aligns with publicly reported Twill Typhoon tradecraft. The observed use of FDMTP, DLL sideloading, and overlapping infrastructure is consistent with previously observed operations, though not unique to a single actor. While initial access was not directly observed, previous Twill Typhoon campaigns have typically involved spear-phishing.
What Darktrace Observed
Since late September 2025, Darktrace has observed multiple customer environments making HTTP GET requests to infrastructure presenting as “CDN” endpoints for well-known platforms (including Yahoo and Apple lookalikes). Across cases, the affected hosts retrieved legitimate executables, then matching .config files (same base filename), then DLLs intended for sideloading. The sequencing of a legitimate binary + configuration + DLL has been previously observed in campaigns linked to China-nexus threat actors.
In several cases, affected hosts also issued outbound requests to a /GetCluster endpoint, including the protocol=Dotnet-Tcpdmtp parameter. This activity was repeatedly followed by retrieval of DLL content that was subsequently used for search-order hijacking within legitimate processes.
In the September–October 2025 cases, Darktrace alerting commonly surfaced early-stage registration and C2 setup behaviors, followed by retrieval of a DLL (e.g., Client.dll) from the same external host, sometimes repeatedly over multiple days, consistent with establishing and maintaining the execution chain.
In April 2026, a finance-sector endpoint initiated a series of GET requests to yahoo-cdn[.]it[.]com, first fetching legitimate binaries (including vshost.exe and dfsvc.exe), then repeatedly retrieving associated configuration and DLL components (including dfsvc.exe.config and dnscfg.dll) over an 11-day window. The use of both Visual Studio hosting and OneClick (dfsvc.exe) paths are used to ensure the malware can run in the targeted environment.
Technical Analysis
Initial staging and execution
While the initial access method is unknown, Darktrace security researchers identified multiple archives containing the malware.
A representative example includes a ZIP archive (“test.zip”) containing:
A legitimate executable: biz_render.exe (Sogou Pinyin IME)
A malicious DLL: browser_host.dll
Contained within the zip archive named “test.zip” is the legitimate binary “biz_render.exe”, a popular Chinese Input Method Editor (IME) Sogou Pinyin.
Alongside the legitimate binary is a malicious DLL named “browser_host.dll”. As the legitimate binary loads a legitimate DLL named “browser_host.dll” via LoadLibraryExW, the malicious DLL has been named the same to sideload the malicious DLL into biz_render.exe. By supplying a malicious DLL with an identical name, the actor hijacks execution flow, enabling the payload to execute within a trusted process.
The legitimate binary invokes the function GetBrowserManagerInstance from the sideloaded “browser_host.dll”, which then performs XOR-based decryption of embedded strings (key 0x90) to resolve and dynamically load mscoree.dll.
The DLL uses the Windows Common Language Runtime (CLR) to execute managed .NET code inside the process rather than relying solely on native binaries. During execution, the loader loads a payload directly into memory as .NET assemblies, enabling an in-memory execution.
C2 Registration
A GET request is made to:
GET /GetCluster?protocol=DotNet-TcpDmtp&tag={0}&uid={1}
with the custom header:
Verify_Token: Dmtp
This returns Base64-encoded and gzip-compressed IP addresses used for subsequent communication.
Figure 2: Decoded IPs.
Staged payload retrieval
Subsequent activity includes retrieval of multiple components from yahoo-cdn.it[.]com. The following GET requests are made:
Dfsvc.exe is the legitimate Windows ClickOnce Engine, part of the .NET framework used for updating ClickOnce Applications. Accompanying dfsvc.exe is a legitimate dfsvc.exe.config file that is used to store configuration data for the application. However, in this instance the malware has replaced the legitimate dfsvc.exe.config with the one retrieved from the server in: C:\Windows\Microsoft.NET\Framework64\v4.0.30319.
Additionally, vhost.exe the legitimate Visual Studio hosting process is retrieved from the server, along with “Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll” and “config.etl”. The DLL is used to decrypt the AES encrypted payload in config.etl and load it. The encrypted payload is dnscfg.dll, which can be loaded into vshost instead of dfsvc, and may be used if the environment does not support .NET.
Figure 3: ClickOnce configuration.
The malicious configuration disables logging, forces the application to load dnscfg.dll from the remote server, and uses a custom AppDomainManager to ensure the DLL is executed during initialization of dfsvc.exe. To ensure persistence, a scheduled task is added for %APPDATA%\Local\Microsoft\WindowsApps\dfsvc.exe.
Core payload
The DLL dnscfg.dll is a .NET binary named Client.TcpDmtp.dll. The payload is a heavily obfuscated backdoor that generates its logic at runtime and communicates with the command and control (C2) over custom TCP, DMTP (Duplex Message Transport Protocol) and appears to be an updated version of FDMTP to version 3.2.5.1
Once connected, the malware enters a persistent loop (LoopMessage), enabling it to receive commands from the remote server.
Figure 5: DMTP Connect function.
Rather than referencing values directly, they are retrieved through containers that are resolved at runtime. String values are stored in an encrypted byte array (_0) and decrypted by a custom XOR-based string decryption routine (dcsoft). The lower 16 bits of the provided key are XORed with 0xA61D (42525) to derive the initial XOR key, while subsequent bits define the string length and offset into the encrypted byte array. Each character is reconstructed from two encrypted bytes and XORed with the incrementing key value, producing the plaintext string used by the payload.
Figure 6: Decrypted strings.
Embedded in the resources section are multiple compressed binaries, the majority of which are library files. The only exceptions are client.core.dll and client.dmtpframe.dll.
Figure 7: Resources.
Modular framework and plugins
The payload embeds multiple compressed libraries, notably:
client.core.dll
client.dmtpframe.dll
Client.core.dll is a core library used for system profiling, C2 communication and plugin execution. The implant has the functionality to retrieve information including antivirus products, domain name, HWID, CLR version, administrator status, hardware details, network details, operating system, and user.
Figure 8: Client.Core.Info functions.
Additionally, the component is responsible for loading plugins, with support for both binary and JSON-based plugin execution. This allows plugins to receive commands and parameters in different formats depending on the task being performed.
The framework handles details such as plugin hashes, method names, task identifiers, caller tracking, and argument processing, allowing plugins to be executed consistently within the environment. In addition to execution management, the library also provides plugins with access to common runtime functionality such as logging, communication, and process handling.
Figure 9: Client.core functions.
client.dmtpframe.dll handles:
DMTP communication
Heartbeats and reconnection
Plugin persistence via registry:
HKCU\Software\Microsoft\IME\{id}
Client.dmtpframe.dll is built on the TouchSocket DMTP networking library and continues to manage the remote plugins. The DLL implements remote communication features including heartbeat maintenance, reconnection handling, RPC-style messaging, SSL support, and token-based verification. The DLL also has the ability to add plugins to the registry under HKCU/Software/Microsoft/IME/{id} for persistence.
Plugins observed
While the full set of plugins remains unknown, researchers were able to identify four plugins, including:
Persist.WpTask.dll - used to create, remove and trigger scheduled Windows tasks remotely.
Persist.registry.dll - used to manage registry persistence with the ability to create, and delete registry values, along with hidden persistence keys.
Persist.extra.dll - used to load and persist the main framework.
Assist.dll - used to remotely retrieve files or commands, as well as manipulate system processes.
Figure 10: Plugins stored in IME registry.
Figure 11: Obfuscated script in plugin resources.
Persist.extra.dll is a module that is used to load a script “setup.log” to load and persist the main framework. Stored within the resources section of the binary is an obfuscated script that creates a .NET COM object that is added to the registry key HKCU\Software\Classes\TypeLib\ {9E175B61-F52A-11D8-B9A5-505054503030} \1.0\1\Win64 for persistence. After deobfuscating this script, another DLL is revealed named “WindowsBase.dll”.
Figure 12: Registry entry for script.
The binary checks in with icloud-cdn[.]net every five minutes, retrieves a version string, downloads an encrypted payload named checksum.bin, saves it locally as C:\ProgramData\USOShared\Logs\checksum.etl, decrypts it with AES using the hardcoded key POt_L[Bsh0=+@0a., and loads the decrypted assembly directly from memory via Assembly.Load(byte[]). The version.txt file acts as an update marker so it only re-downloads when the remote version changes, while the mutex prevents duplicate instances.
Figure 13: USOShared/Logs.
Checksum.etl is decrypted with AES and loaded into memory, loading another .NET DLL named “Client.dll”. This binary is the same as “dnscfg.dll” mentioned at the start and allows the threat actors to update the main framework based on the version.
Conclusion
Across cases, Darktrace consistently observed the following sequence:
Retrieval of legitimate executables
Retrieval of DLLs for sideloading
C2 registration via /GetCluster
This approach is consistent with broader China-nexus tradecraft. As outlined in Darktrace’s Crimson Echo report, the stable feature of this activity is behavioral. Infrastructure rotates and payloads can change, but the execution model persists. For defenders, the implication is straightforward: detection anchored to individual indicators will degrade quickly. Detection anchored to a behavioral sequence offer a far more durable approach.
Credit to Tara Gould (Malware Research Lead), Adam Potter (Senior Cyber Analyst), Emma Foulger (Global Threat Research Operations Lead), Nathaniel Jones (VP, Security & AI Strategy)
Edited by Ryan Traill (Content Manager)
Appendices
A detailed list of detection models and triggered indicators is provided alongside IoCs.
