Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Share
01
Apr 2023
Email communications in the era of generative AI
Today’s headlines on cyber security attacks are dominated by serious breaches that cripple critical national infrastructure providers, wreak geopolitical havoc through nation state espionage, and create paralyzing financial demands through extortion and ransomware. But how do these breaches occur in the first place, and why do they keep happening?
Social engineering – specifically malicious cyber campaigns delivered via email - remain the primary source of an organization’s vulnerability to attack. A recent survey conducted by Darktrace to 6,700 global cross-industry professionals across the UK, US, Australia, France, Germany, and Netherlands, found almost a third (30%) have fallen victim to a fraudulent email. The risk, as ever, seems to be uncontrollably on the rise – 70% of respondents have noticed an increase in the frequency of malicious emails in the last six months.
At the end of last year, I wrote about how widespread accessibility to generative AI has compounded the problem, leading to likely efficiency gains for skilled threat actors launching email attacks. Just a few weeks ago, we published research which demonstrated that while the number of email attacks across our own customer base has remained steady since ChatGPT’s release, those that rely on tricking victims into clicking malicious links have declined, while linguistic complexity, including text volume, punctuation, and sentence length among others, have increased. This indicates that cyber-criminals may be redirecting their focus to crafting more sophisticated social engineering scams that exploit user trust delivered over email.
Our latest findings, conducted by Darktrace Research, today reveal a 135% increase in ‘novel social engineering attacks’ across thousands of active Darktrace/Email customers from January to February 2023, corresponding with the widespread adoption of ChatGPT. A novel social engineering phishing email is an email attack that shows a strong linguistic deviation – semantically and syntactically – compared to other phishing emails. The trend suggests that generative AI, such as ChatGPT, is providing an avenue for threat actors to craft sophisticated and targeted attacks at speed and scale.
Organizations are already well aware of the danger novel threats pose – globally, 82% of respondents reported are concerned that hackers can use generative AI to create scam emails that are indistinguishable from genuine communication.
Navigating the trust deficit
Employees are being exploited continuously through their primary means of communication - email. Given that humans, and our psychology, are at the heart of the problem, organizations have scrambled to develop awareness and training programs that are delivered routinely to employees in an attempt to help them defend themselves and their organization. While a defense-in-depth approach is generally a good practice to follow, the value of security awareness training, teaching employees to spot attempts at social engineering delivered in text format, is diminishing rapidly. This problem has become especially evident now that we find ourselves in a world where ‘bad’ emails look all but undistinguishable to the human eye from ‘good’ emails.
Over emphasizing the responsibility of employees poses a business challenge as well as a security problem: a bloated trust deficit. In times of economic uncertainty, business success is predicated on employee productivity, creativity, and efficiency. All three of these are squashed when employees treat the communication they receive, both internal and external, with forensic suspicion and mistrust.
As generative AI becomes more mainstream – across images, audio, video, and text – we anticipate that this erosion of trust in digital communication will only continue. What happens to the workplace if an employee is left questioning their own perception when communicating with their manager or a colleague, who they can see and hear over a video conference call, but who may be an entirely fictitious creation?
The way forward
The future lies in a partnership between artificial intelligence and human beings where the algorithms are responsible for determining whether communication is malicious or benign, thereby taking the burden of responsibility off the human. In turn, humans can pursue activities that drive productivity and performance. Current training and awareness programs, coupled with traditional email security technologies which assume that knowledge of past attacks will help predict campaigns, are not sustainable in this rapidly evolving landscape.
Our research reveals that traditional email security tools that rely on knowledge of past threats, take an average of thirteen days from an attack being launched on a victim to that attack being detected. This leaves defenders vulnerable for almost two weeks if they rely solely on traditional tools. When this statistic is contextualized against the 135% increase we’ve seen in novel social engineering campaigns, the inefficiency of ‘attack centric’ email security is made perfectly evident. If we don’t know how to define entirely new and unique attacks, how can we ever hope to recognize them based on past attacks?
A deep understanding of ‘you’ is needed in the face of these radical changes to the email threat landscape. Instead of trying to predict attacks, an understanding of your employees’ behavior, based from their email inbox, is needed to create patterns of life for every email user: their relationships, tone and sentiments and hundreds of other data points. By leveraging AI to combat email security threats, we not only reduce risk, but revitalize organizational trusts and contribute to business outcomes.
Ironically, generative AI may be worsening the social engineering challenge, but AI that knows you, could be the parry.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Introducing Version 2 of Darktrace’s Embedding Model for Investigation of Security Threats (DEMIST-2)
Learn how Darktrace’s DEMIST-2 embedding model delivers high-accuracy threat classification and detection across any environment, outperforming larger models with efficiency and precision.
AI Uncovered: Introducing Darktrace Incident Graph Evaluation for Security Threats (DIGEST)
Discover how Darktrace’s new DIGEST model enhances Cyber AI Analyst by using GNNs and RNNs to score and prioritize threats with expert-level precision before damage is done.
Force Multiply Your Security Team with Agentic AI: How the Industry’s Only True Cyber AI Analyst™ Saves Time and Stop Threats
See how Darktrace Cyber AI Analyst™, an agentic AI virtual analyst, cuts through alert noise, accelerates threat response, and strengthens your security team — all without adding headcount.
Ed Metcalf
Senior Director of Product Marketing, AI & Innovation Products
SocGholish: From loader and C2 activity to RansomHub deployment
Over the past year, a clear pattern has emerged across the threat landscape: ransomware operations are increasingly relying on compartmentalized affiliate models. In these models, initial access brokers (IABs) [6], malware loaders, and post-exploitation operators work together.
Due to those specialization roles, a new generation of loader campaigns has risen. Threat actors increasingly employ loader operators to quietly establish footholds on the target network. These entities then hand off access to ransomware affiliates. One loader that continues to feature prominently in such campaigns is SocGholish.
What is SocGholish?
SocGholish is a loader malware that has been utilized since at least 2017 [7]. It has long been associated with fake browser updates and JavaScript-based delivery methods on infected websites.
Threat actors often target outdated or poorly secured CMS-based websites like WordPress. Through unpatched plugins, or even remote code execution flaws, they inject malicious JavaScript into the site’s HTML, templates or external JS resources [8]. Historically, SocGholish has functioned as a first-stage malware loader, ultimately leading to deployment of Cobalt Strike beacons [9], and further facilitating access persistence to corporate environments. More recently, multiple security vendors have reported that infections involving SocGholish frequently lead to the deployment of RansomHub ransomware [3] [5].
This blog explores multiple instances within Darktrace's customer base where SocGholish deployment led to subsequent network compromises. Investigations revealed indicators of compromise (IoCs) similar to those identified by external security researchers, along with variations in attacker behavior post-deployment. Key innovations in post-compromise activities include credential access tactics targeting authentication mechanisms, particularly through the abuse of legacy protocols like WebDAV and SCF file interactions over SMB.
Initial access and execution
Since January 2025, Darktrace’s Threat Research team observed multiple cases in which threat actors leveraged the SocGholish loader for initial access. Malicious actors commonly deliver SocGholish by compromising legitimate websites by injecting malicious scripts into the HTML of the affected site. When the visitor lands on an infected site, they are typically redirected to a fake browser update page, tricking them into downloading a ZIP file containing a JavaScript-based loader [1] [2]. In one case, a targeted user appears to have visited the compromised website garagebevents[.]com (IP: 35.203.175[.]30), from which around 10 MB of data was downloaded.
Figure 1: Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.
Within milliseconds of the connection establishment, the user’s device initiated several HTTPS sessions over the destination port 443 to the external endpoint 176.53.147[.]97, linked to the following Keitaro TDS domains:
packedbrick[.]com
rednosehorse[.]com
blackshelter[.]org
blacksaltys[.]com
To evade detection, SocGholish uses highly obfuscated code and relies on traffic distribution systems (TDS) [3]. TDS is a tool used in digital and affiliate marketing to manage and distribute incoming web traffic based on predefined rules. More specifically, Keitaro is a premium self-hosted TDS frequently utilized by attackers as a payload repository for malicious scripts following redirects from compromised sites. In the previously noted example, it appears that the device connected to the compromised website, which then retrieved JavaScript code from the aforementioned Keitaro TDS domains. The script served by those instances led to connections to the endpoint virtual.urban-orthodontics[.]com (IP: 185.76.79[.]50), successfully completing SocGholish’s distribution.
Figure 2: Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.
Persistence
During some investigations, Darktrace researchers observed compromised devices initiating HTTPS connections to the endpoint files.pythonhosted[.]org (IP: 151.101.1[.]223), suggesting Python package downloads. External researchers have previously noted how attackers use Python-based backdoors to maintain access on compromised endpoints following initial access via SocGholish [5].
Credential access and lateral movement
Credential access – external
Darktrace researchers identified observed some variation in kill chain activities following initial access and foothold establishment. For example, Darktrace detected interesting variations in credential access techniques. In one such case, an affected device attempted to contact the rare external endpoint 161.35.56[.]33 using the Web Distributed Authoring and Versioning (WebDAV) protocol. WebDAV is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. WebDAV enables remote shares to be mounted over HTTP or HTTPS, similar to how SMB operates, but using web-based protocols. Windows supports WebDAV natively, which means a UNC path pointing to an HTTP or HTTPS resource can trigger system-level behavior such as authentication.
In this specific case, the system initiated outbound connections using the ‘Microsoft-WebDAV-MiniRedir/10.0.19045’ user-agent, targeting the URI path of /s on the external endpoint 161.35.56[.]33. During these requests, the host attempted to initiate NTML authentication and even SMB sessions over the web, both of which failed. Despite the session failures, these attempts also indicate a form of forced authentication. Forced authentication exploits a default behavior in Windows where, upon encountering a UNC path, the system will automatically try to authenticate to the resource using NTML – often without any user interaction. Although no files were directly retrieved, the WebDAV server was still likely able to retrieve the user’s NTLM hash during the session establishment requests, which can later be used by the adversary to crack the password offline.
Credential access – internal
In another investigated incident, Darktrace observed a related technique utilized for credential access and lateral movement. This time, the infected host uploaded a file named ‘Thumbs.scf’ to multiple internal SMB network shares. Shell Command File ( SCF) is a legacy Windows file format used primarily for Windows Explorer shortcuts. These files contain instructions for rendering icons or triggering shell commands, and they can be executed implicitly when a user simply opens a folder containing the file – no clicks required.
The ‘Thumbs.scf’ file dropped by the attacker was crafted to exploit this behavior. Its contents included a [Shell] section with the Command=2 directive and an IconFile path pointing to a remote UNC resource on the same external endpoint, 161.35.56[.]33, seen in the previously described case – specifically, ‘\\161.35.56[.]33\share\icon.ico’. When a user on the internal network navigates to the folder containing the SCF file, their system will automatically attempt to load the icon. In doing so, the system issues a request to the specified UNC path, which again prompts Windows to initiate NTML authentication.
This pattern of activity implies that the attacker leveraged passive internal exposure; users who simply browsed a compromised share would unknowingly send their NTML hashes to an external attacker-controlled host. Unlike the WebDAV approach, which required initiating outbound communication from the infected host, this SCF method relies on internal users to interact with poisoned folders.
Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.
Command-and-control
Following initial compromise, affected devices would then attempt outbound connections using the TLS/SSL protocol over port 443 to different sets of command-and-control (C2) infrastructure associated with SocGholish. The malware frequently uses obfuscated JavaScript loaders to initiate its infection chain, and once dropped, the malware communicates back to its infrastructure over standard web protocols, typically using HTTPS over port 443. However, this set of connections would precede a second set of outbound connections, this time to infrastructure linked to RansomHub affiliates, possibly facilitating the deployed Python-based backdoor.
Connectivity to RansomHub infrastructure relied on defense evasion tactics, such as port-hopping. The idea behind port-hopping is to disguise C2 traffic by avoiding consistent patterns that might be caught by firewalls, and intrusion detection systems. By cycling through ephemeral ports, the malware increases its chances of slipping past basic egress filtering or network monitoring rules that only scrutinize common web traffic ports like 443 or 80. Darktrace analysts identified systems connecting to destination ports such as 2308, 2311, 2313 and more – all on the same destination IP address associated with the RansomHub C2 environment.
Figure 4: Advanced Search connection logs showing connections over destination ports that change rapidly.
Conclusion
Since the beginning of 2025, Darktrace analysts identified a campaign whereby ransomware affiliates leveraged SocGholish to establish network access in victim environments. This activity enabled multiple sets of different post exploitation activity. Credential access played a key role, with affiliates abusing WebDAV and NTML over SMB to trigger authentication attempts. The attackers were also able to plant SCF files internally to expose NTML hashes from users browsing shared folders. These techniques evidently point to deliberate efforts at early lateral movement and foothold expansion before deploying ransomware. As ransomware groups continue to refine their playbooks and work more closely with sophisticated loaders, it becomes critical to track not just who is involved, but how access is being established, expanded, and weaponized.
Credit to Chrisina Kreza (Cyber Analyst) and Adam Potter (Senior Cyber Analyst)
Appendices
Darktrace / NETWORK model alerts
· Anomalous Connection / SMB Enumeration
· Anomalous Connection / Multiple Connections to New External TCP Port
· Anomalous Connection / Multiple Failed Connections to Rare Endpoint
· Anomalous Connection / New User Agent to IP Without Hostname
· Compliance / External Windows Communication
· Compliance / SMB Drive Write
· Compromise / Large DNS Volume for Suspicious Domain
· Compromise / Large Number of Suspicious Failed Connections
· Device / Anonymous NTML Logins
· Device / External Network Scan
· Device / New or Uncommon SMB Named Pipe
· Device / SMB Lateral Movement
· Device / Suspicious SMB Activity
· Unusual Activity / Unusual External Activity
· User / Kerberos Username Brute Force
MITRE ATT&CK mapping
· Credential Access – T1187 Forced Authentication
· Credential Access – T1110 Brute Force
· Command and Control – T1071.001 Web Protocols
· Command and Control – T1571 Non-Standard Port
· Discovery – T1083 File and Directory Discovery
· Discovery – T1018 Remote System Discovery
· Discovery – T1046 Network Service Discovery
· Discovery – T1135 Network Share Discovery
· Execution – T1059.007 JavaScript
· Lateral Movement – T1021.002 SMB/Windows Admin Shares
Your Vendors, Your Risk: Rethinking Third-Party Security in the Age of Supply Chain Attacks
When most people hear the term supply chain attack, they often imagine a simple scenario: one organization is compromised, and that compromise is used as a springboard to attack another. This kind of lateral movement is common, and often the entry vector is as mundane and as dangerous as email.
Take, for instance, a situation where a trusted third-party vendor is breached. An attacker who gains access to their systems can then send malicious emails to your organization, emails that appear to come from a known and reputable source. Because the relationship is trusted, traditional phishing defenses may not be triggered, and recipients may be more inclined to engage with malicious content. From there, the attacker can establish a foothold, move laterally, escalate privileges, and launch a broader campaign.
This is one dimension of a supply chain cyber-attack, and it’s well understood in many security circles. But the risk doesn’t end there. In fact, it goes deeper, and it often hits the most important asset of all: your customers' data.
The risk beyond the inbox
What happens when customer data is shared with a third party for legitimate processing purposes for example billing, analytics, or customer service and that third party is then compromised?
In that case, your customer data is breached, even if your own systems were never touched. That’s the uncomfortable truth about modern cybersecurity: your risk is no longer confined to your own infrastructure. Every entity you share data with becomes an extension of your attack surface. Thus, we should rethink how we perceive responsibility.
It’s tempting to think that securing our environment is our job, and securing their environment is theirs. But if a breach of their environment results in the exposure of our customers, the accountability and reputational damage fall squarely on our shoulders.
The illusion of boundaries
In an era where digital operations are inherently interconnected, the lines of responsibility can blur quickly. Legally and ethically, organizations are still responsible for the data they collect even if that data is processed, stored, or analyzed by a third party. A customer whose data is leaked because of a vendor breach will almost certainly hold the original brand responsible, not the third-party processor they never heard of.
This is particularly important for industries that rely on extensive outsourcing and platform integrations (SaaS platforms, marketing tools, CRMs, analytics platforms, payment processors). The list of third-party vendors with access to customer data grows year over year. Each integration adds convenience, but also risk.
Encryption isn’t a silver bullet
One of the most common safeguards used in these data flows is encryption. Encrypting customer data in transit is a smart and necessary step, but it’s far from enough. Once data reaches the destination system, it typically needs to be decrypted for use. And the moment it is decrypted, it becomes vulnerable to a variety of attacks like ransomware, data exfiltration, privilege escalation, and more.
In other words, the question isn’t just is the data secure in transit? The more important question is how is it protected once it arrives?
A checklist for organizations evaluating third-parties
Given these risks, what should responsible organizations do when they need to share customer data with third parties?
Start by treating third-party security as an extension of your own security program. Here are some foundational controls that can make a difference:
Due diligence before engagement: Evaluate third-party vendors based on their security posture before signing any contracts. What certifications do they hold? What frameworks do they follow? What is their incident response capability?
Contractual security clauses: Build in specific security requirements into vendor contracts. These can include requirements for encryption standards, access control policies, and data handling protocols.
Third-party security assessments: Require vendors to provide evidence of their security controls. Independent audits, penetration test results, and SOC 2 reports can all provide useful insights.
Ongoing monitoring and attestations: Security isn’t static. Make sure vendors provide regular security attestations and reports. Where possible, schedule periodic reviews or audits, especially for vendors handling sensitive data.
Minimization and segmentation: Don’t send more data than necessary. Data minimization limits the exposure in the event of a breach. Segmentation, both within your environment and within vendor access levels, can further reduce risk.
Incident response planning: Ensure you have a playbook for handling third-party incidents, and that vendors do as well. Coordination in the event of a breach should be clear and rapid.
The human factor: Customers and communication
There’s another angle to supply chain cyber-attacks that’s easy to overlook: the post-breach exploitation of public knowledge. When a breach involving customer data hits the news, it doesn’t take long for cybercriminals to jump on the opportunity.
Attackers can craft phishing emails that appear to be follow-ups from the affected organization: “Click here to reset your password,” “Confirm your details due to the breach,” etc.
A breach doesn’t just put customer data at risk it also opens the door to further fraud, identity theft, and financial loss through social engineering. This is why post-breach communication and phishing mitigation strategies are valuable components of an incident response strategy.
Securing what matters most
Ultimately, protecting against supply chain cyber-attacks isn’t just about safeguarding your own perimeter. It’s about defending the integrity of your customers’ data, wherever it goes. When customer data is entrusted to you, the duty of care doesn’t end at your firewall.
Relying on vendors to “do their part” is not enough. True due diligence means verifying, validating, and continuously monitoring those extended attack surfaces. It means designing controls that assume failure is possible, and planning accordingly.
In today’s threat landscape, cybersecurity is no longer just a technical discipline. It’s a trust-building exercise. Your customers expect you to protect their information, and rightly so. And when a supply chain attack happens, whether the breach originated with you or your partner, the damage lands in the same place: your brand, your customers, your responsibility.
