Blog
/

Inside the SOC

/
June 3, 2024

The Price of Admission: Countering Stolen Credentials with Darktrace

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
03
Jun 2024
This blog examines a network compromise that stemmed from the purchase of leaked credentials from the dark web. Credentials purchased from dark web marketplaces allow unauthorized access to internal systems. Such access can be used to exfiltrate data, disrupt operations, or deploy malware.

Using leaked credentials to gain unauthorized access

Dark web marketplaces selling sensitive data have increased accessibility for malicious actors, similar to Ransomware-as-a-Service (RaaS), lowering the barrier to entry usually associated with malicious activity. By utilizing leaked credentials, malicious actors can easily gain unauthorized access to accounts and systems which they can leverage to carry out malicious activities like data exfiltration or malware deployment.

Usage of leaked credentials by malicious actors is a persistent concern for both organizations and security providers. Google Cloud’s ‘H1 2024 Threat Horizons Report’ details that initial access seen in 2.9% of cloud compromises observed on Google Cloud resulted from leaked credential usage [1], with the ‘IBM X-Force Threat Intelligence Index 2024’ reporting 71% year-on-year increase in cyber-attacks which utilize stolen or compromised credentials [2].

Darktrace coverage of leaked credentials

In early 2024, one Darktrace customer was compromised by a malicious actor after their internal credentials had been leaked on the dark web. Subsequent attack phases were detected by Darktrace/Network and the customer was alerted to the suspicious activity via the Proactive Threat Notification (PTN) service, following an investigation by Darktrace’s Security Operation Center (SOC).

Darktrace detected a device on the network of a customer in the US carrying out a string of anomalous activity indicative of network compromise. The device was observed using a new service account to authenticate to a Virtual Private Network (VPN) server, before proceeding to perform a range of suspicious activity including internal reconnaissance and lateral movement.

Malicious actors seemingly gained access to a previously unused service account for which they were able to set up multi-factor authentication (MFA) to access the VPN. As this MFA setup was made possible by the configuration of the customer’s managed service provider (MSP), the initial access phase of the attack fell outside of Darktrace’s purview.

Unfortunately for the customer in this case, Darktrace RESPOND™ was not enabled on the network at the time of the attack. Had RESPOND been active, it would have been able to autonomously act against the malicious activity by disabling users, strategically blocking suspicious connections and limiting devices to their expected patterns of activity.

Attack timeline of leaked credentials spotted by darktrace

Network Scanning Activity

On February 22, 2024, Darktrace detected the affected device performing activity indicative of network scanning, namely initiating connections on multiple ports, including ports 80, 161 389 and 445, to other internal devices. While many of these internal connection attempts were unsuccessful, some successful connections were observed.

Devices on a network can gather information about other internal devices by performing network scanning activity. Defensive scanning can be used to support network security, allowing internal security teams to discover vulnerabilities and potential entry points that require their attention, however attackers are also able to take advantage of such information, such as open ports and services available on internal devices, with offensive scanning.

Brute Force Login Attempts

Darktrace proceeded to identify the malicious actor attempting to access a previously unused service account for which they were able to successfully establish MFA to access the organization’s VPN. As the customer’s third-party MSP had been configured to allow all users to login to the organization’s VPN using MFA, this login was successful. Moreover, the service account had never previously been used and MFA and never been established, allowing the attacker to leverage it for their own nefarious means.

Darktrace/Network identified the attacker attempting to authenticate over the Kerberos protocol using a total of 30 different usernames, of which two were observed successfully authenticating. There was a total of 6 successful Kerberos logins identified from two different credentials.  Darktrace also observed over 100 successful NTLM attempts from the same device for multiple usernames including “Administrator” and “mail”. These credentials were later confirmed by the customer to have been stolen and leaked on the dark web.

Advanced Search query results showing the usernames that successfully authenticated via NTLM.
Figure 1: Advanced Search query results showing the usernames that successfully authenticated via NTLM.

Even though MFA requirements had been satisfied when the threat actor accessed the organization’s VPN, Darktrace recognized that this activity represented a deviation from its previously learned behavior.

Malicious actors frequently attempt to gain unauthorized access to accounts and internal systems by performing login attempts using multiple possible usernames and passwords. This type of brute-force activity is typically accomplished using computational power via the use of software or scripts to attempt different username/password combinations until one is successful.

By purchasing stolen credentials from dark web marketplaces, attackers are able to significantly increase the success rate of brute-force attacks and, if they do gain access, they can easily act on their objectives, be that exfiltrating sensitive data or moving through their target networks to further the compromise.

Share Enumeration

Around 30 minutes after the initial network scanning activity, the compromised device was observed performing SMB enumeration using one of the aforementioned accounts. Darktrace understood that this activity was suspicious as the device had never previously been used to perform SMB activity and had not been tagged as a security device.

Darktrace/Network identifying the suspicious SMB enumeration performed by the compromised device.
Figure 2: Darktrace/Network identifying the suspicious SMB enumeration performed by the compromised device.

Such enumeration can be used by malicious actors to gain insights into the structures and configurations of a target device, view permissions associated with shared resources, and also view general identifying information about the system.

Darktrace further identified that the device connected to the named pipe “srvsvc”. By enumerating over srvsvc, a threat actor is able to request a list of all available SMB shares on a destination device, enabling further data gathering as part of network reconnaissance. Srvsvc also provides access to remote procedure call (RPC) for various services on a destination device.

At this stage, a Darktrace/Network Enhanced Monitoring model was triggered for lateral movement activity taking place on the customer’s network. As this particular customer was subscribed to the PTN service, the Enhanced Monitoring model alert was promptly triaged and investigated by the Darktrace SOC. The customer was alerted to the emerging activity and given full details of the incident and the SOC team’s investigation.

Attack and Reconnaissance Tool Usage

A few minutes later, Darktrace observed the device making a connection with a user agent associated with the Nmap network scanning tool, “Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse[.]html)”. While these tools are often used legitimately by an organization’s security team, they can also be used maliciously by attackers to exploit vulnerabilities that attackers may have unearthed during earlier reconnaissance activity.

As such services are often seen as normal network traffic, attackers can often use them to bypass traditional security measures. Darktrace’s Self-Learning AI, however, was able to recognize that the affected device was not a security device and therefore not expected to carry out such activity, even if it was using a legitimate Nmap service.

Darktrace/Network identifying the compromised device using the Nmap scanning tool.
Figure 3: Darktrace/Network identifying the compromised device using the Nmap scanning tool.

Further Lateral Movement

Following this suspicious Nmap usage, Darktrace observed a range of additional anomalous SMB activity from the aforementioned compromised account. The affected device attempted to establish almost 900 SMB sessions, as well as performing 65 unusual file reads from 29 different internal devices and over 300 file deletes for the file “delete.me” from over 100 devices using multiple paths, including ADMIN$, C$, print$.

Darktrace also observed the device making several DCE-RPC connections associated with Active Directory Domain enumeration, including DRSCrackNames and DRSGetNCChanges; a total of more than 1000 successful DCE-RPC connection were observed to a domain controller.

As this customer did not have Darktrace/Network's autonomous response deployed on their network, the above detailed lateral movement and network reconnaissance activity was allowed to progress unfettered, until Darktrace’s SOC alerted the customer’s security team to take urgent action. The customer also received follow-up support through Darktrace’s Ask the Expert (ATE) service, allowing them to contact the analyst team directly for further details and support on the incident.

Thanks to this early detection, the customer was able to quickly identify and disable affected user accounts, effectively halting the attack and preventing further escalation.

Conclusions

Given the increasing trend of ransomware attackers exfiltrating sensitive data for double extortion and the rise of information stealers, stolen credentials are commonplace across dark web marketplaces. Malicious actors can exploit these leaked credentials to drastically lower the barrier to entry associated with brute-forcing access to their target networks.

While implementing well-configured MFA and enforcing regular password changes can help protect organizations, these measures alone may not be enough to fully negate the advantage attackers gain with stolen credentials.

In this instance, an attacker used leaked credentials to compromise an unused service account, allowing them to establish MFA and access the customer’s VPN. While this tactic may have allowed the attacker to evade human security teams and traditional security tools, Darktrace’s AI detected the unusual use of the account, indicating a potential compromise despite the organization’s MFA requirements being met. This underscores the importance of adopting an intelligent decision maker, like Darktrace, that is able to identify and respond to anomalies beyond standard protective measures.

Credit to Charlotte Thompson, Cyber Security Analyst, Ryan Traill, Threat Content Lead

Appendices

Darktrace DETECT Model Coverage

-       Device / Suspicious SMB Scanning Activity (Model Alert)

-       Device / ICMP Address Scan (Model Alert)

-       Device / Network Scan (Model Alert)

-       Device / Suspicious LDAP Search Operation (Model Alert)

-       User / Kerberos Username Brute Force (Model Alert)

-       Device / Large Number of Model Breaches (Model Alert)

-       Anomalous Connection / SMB Enumeration (Model Alert)

-       Device / Multiple Lateral Movement Model Breaches (Enhanced Monitoring Model Alert)

-       Device / Possible SMB/NTLM Reconnaissance (Model Alert)

-       Anomalous Connection / Possible Share Enumeration Activity (Model Alert)

-       Device / Attack and Recon Tools (Model Alert)

MITRE ATT&CK Mapping

Tactic – Technique - Code

INITIAL ACCESS - Hardware Additions     -T1200

DISCOVERY - Network Service Scanning -T1046

DISCOVERY - Remote System Discovery - T1018

DISCOVERY - Domain Trust Discovery      - T1482

DISCOVERY - File and Directory Discovery - T1083

DISCOVERY - Network Share Discovery - T1135

RECONNAISSANCE - Scanning IP Blocks - T1595.001

RECONNAISSANCE - Vulnerability Scanning - T1595.002

RECONNAISSANCE - Client Configurations - T1592.004

RECONNAISSANCE - IP Addresses - T1590.005

CREDENTIAL ACCESS - Brute Force - T1110

LATERAL MOVEMENT - Exploitation of Remote Services -T1210

References

  1. 2024 Google Cloud Threat Horizons Report
    https://services.google.com/fh/files/misc/threat_horizons_report_h12024.pdf
  2. IBM X-Force Threat Intelligence Index 2024
    https://www.ibm.com/reports/threat-intelligence
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Charlotte Thompson
Cyber Analyst
Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

January 16, 2025

/
No items found.

Reimagining Your SOC: How to Achieve Proactive Network Security

Default blog imageDefault blog image

Introduction: Challenges and solutions to SOC efficiency

For Security Operation Centers (SOCs), reliance on signature or rule-based tools – solutions that are always chasing the latest update to prevent only what is already known – creates an excess of false positives. SOC analysts are therefore overwhelmed by a high volume of context-lacking alerts, with human analysts able to address only about 10% due to time and resource constraints. This forces many teams to accept the risks of addressing only a fraction of the alerts while novel threats go completely missed.

74% of practitioners are already grappling with the impact of an AI-powered threat landscape, which amplifies challenges like tool sprawl, alert fatigue, and burnout. Thus, achieving a resilient network, where SOC teams can spend most of their time getting proactive and stopping threats before they occur, feels like an unrealistic goal as attacks are growing more frequent.

Despite advancements in security technology (advanced detection systems with AI, XDR tools, SIEM aggregators, etc...), practitioners are still facing the same issues of inefficiency in their SOC, stopping them from becoming proactive. How can they select security solutions that help them achieve a proactive state without dedicating more human hours and resources to managing and triaging alerts, tuning rules, investigating false positives, and creating reports?

To overcome these obstacles, organizations must leverage security technology that is able to augment and support their teams. This can happen in the following ways:

  1. Full visibility across the modern network expanding into hybrid environments
  2. Have tools that identifies and stops novel threats autonomously, without causing downtime
  3. Apply AI-led analysis to reduce time spent on manual triage and investigation

Your current solutions might be holding you back

Traditional cybersecurity point solutions are reliant on using global threat intelligence to pattern match, determine signatures, and consequently are chasing the latest update to prevent only what is known. This means that unknown threats will evade detection until a patient zero is identified. This legacy approach to threat detection means that at least one organization needs to be ‘patient zero’, or the first victim of a novel attack before it is formally identified.

Even the point solutions that claim to use AI to enhance threat detection rely on a combination of supervised machine learning, deep learning, and transformers to

train and inform their systems. This entails shipping your company’s data out to a large data lake housed somewhere in the cloud where it gets blended with attack data from thousands of other organizations. The resulting homogenized dataset gets used to train AI systems — yours and everyone else’s — to recognize patterns of attack based on previously encountered threats.

While using AI in this way reduces the workload of security teams who would traditionally input this data by hand, it emanates the same risk – namely, that AI systems trained on known threats cannot deal with the threats of tomorrow. Ultimately, it is the unknown threats that bring down an organization.

The promise and pitfalls of XDR in today's threat landscape

Enter Extended Detection and Response (XDR): a platform approach aimed at unifying threat detection across the digital environment. XDR was developed to address the limitations of traditional, fragmented tools by stitching together data across domains, providing SOC teams with a more cohesive, enterprise-wide view of threats. This unified approach allows for improved detection of suspicious activities that might otherwise be missed in siloed systems.

However, XDR solutions still face key challenges: they often depend heavily on human validation, which can aggravate the already alarmingly high alert fatigue security analysts experience, and they remain largely reactive, focusing on detecting and responding to threats rather than helping prevent them. Additionally, XDR frequently lacks full domain coverage, relying on EDR as a foundation and are insufficient in providing native NDR capabilities and visibility, leaving critical gaps that attackers can exploit. This is reflected in the current security market, with 57% of organizations reporting that they plan to integrate network security products into their current XDR toolset[1].

Why settling is risky and how to unlock SOC efficiency

The result of these shortcomings within the security solutions market is an acceptance of inevitable risk. From false positives driving the barrage of alerts, to the siloed tooling that requires manual integration, and the lack of multi-domain visibility requiring human intervention for business context, security teams have accepted that not all alerts can be triaged or investigated.

While prioritization and processes have improved, the SOC is operating under a model that is overrun with alerts that lack context, meaning that not all of them can be investigated because there is simply too much for humans to parse through. Thus, teams accept the risk of leaving many alerts uninvestigated, rather than finding a solution to eliminate that risk altogether.

Darktrace / NETWORK is designed for your Security Operations Center to eliminate alert triage with AI-led investigations , and rapidly detect and respond to known and unknown threats. This includes the ability to scale into other environments in your infrastructure including cloud, OT, and more.

Beyond global threat intelligence: Self-Learning AI enables novel threat detection & response

Darktrace does not rely on known malware signatures, external threat intelligence, historical attack data, nor does it rely on threat trained machine learning to identify threats.

Darktrace’s unique Self-learning AI deeply understands your business environment by analyzing trillions of real-time events that understands your normal ‘pattern of life’, unique to your business. By connecting isolated incidents across your business, including third party alerts and telemetry, Darktrace / NETWORK uses anomaly chains to identify deviations from normal activity.

The benefit to this is that when we are not predefining what we are looking for, we can spot new threats, allowing end users to identify both known threats and subtle, never-before-seen indicators of malicious activity that traditional solutions may miss if they are only looking at historical attack data.

AI-led investigations empower your SOC to prioritize what matters

Anomaly detection is often criticized for yielding high false positives, as it flags deviations from expected patterns that may not necessarily indicate a real threat or issues. However, Darktrace applies an investigation engine to automate alert triage and address alert fatigue.

Darktrace’s Cyber AI Analyst revolutionizes security operations by conducting continuous, full investigations across Darktrace and third-party alerts, transforming the alert triage process. Instead of addressing only a fraction of the thousands of daily alerts, Cyber AI Analyst automatically investigates every relevant alert, freeing up your team to focus on high-priority incidents and close security gaps.

Powered by advanced machine-learning techniques, including unsupervised learning, models trained by expert analysts, and tailored security language models, Cyber AI Analyst emulates human investigation skills, testing hypotheses, analyzing data, and drawing conclusions. According to Darktrace Internal Research, Cyber AI Analyst typically provides a SOC with up to  50,000 additional hours of Level 2 analysis and written reporting annually, enriching security operations by producing high level incident alerts with full details so that human analysts can focus on Level 3 tasks.

Containing threats with Autonomous Response

Simply quarantining a device is rarely the best course of action - organizations need to be able to maintain normal operations in the face of threats and choose the right course of action. Different organizations also require tailored response functions because they have different standards and protocols across a variety of unique devices. Ultimately, a ‘one size fits all’ approach to automated response actions puts organizations at risk of disrupting business operations.

Darktrace’s Autonomous Response tailors its actions to contain abnormal behavior across users and digital assets by understanding what is normal and stopping only what is not. Unlike blanket quarantines, it delivers a bespoke approach, blocking malicious activities that deviate from regular patterns while ensuring legitimate business operations remain uninterrupted.

Darktrace offers fully customizable response actions, seamlessly integrating with your workflows through hundreds of native integrations and an open API. It eliminates the need for costly development, natively disarming threats in seconds while extending capabilities with third-party tools like firewalls, EDR, SOAR, and ITSM solutions.

Unlocking a proactive state of security

Securing the network isn’t just about responding to incidents — it’s about being proactive, adaptive, and prepared for the unexpected. The NIST Cybersecurity Framework (CSF 2.0) emphasizes this by highlighting the need for focused risk management, continuous incident response (IR) refinement, and seamless integration of these processes with your detection and response capabilities.

Despite advancements in security technology, achieving a proactive posture is still a challenge to overcome because SOC teams face inefficiencies from reliance on pattern-matching tools, which generate excessive false positives and leave many alerts unaddressed, while novel threats go undetected. If SOC teams are spending all their time investigating alerts then there is no time spent getting ahead of attacks.

Achieving proactive network resilience — a state where organizations can confidently address challenges at every stage of their security posture — requires strategically aligned solutions that work seamlessly together across the attack lifecycle.

References

1.       Market Guide for Extended Detection and Response, Gartner, 17thAugust 2023 - ID G00761828

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response

Blog

/

January 15, 2025

/

Ransomware

RansomHub Ransomware: Darktrace’s Investigation of the Newest Tool in ShadowSyndicate's Arsenal

Default blog imageDefault blog image

What is ShadowSyndicate?

ShadowSyndicate, also known as Infra Storm, is a threat actor reportedly active since July 2022, working with various ransomware groups and affiliates of ransomware programs, such as Quantum, Nokoyawa, and ALPHV. This threat actor employs tools like Cobalt Strike, Sliver, IcedID, and Matanbuchus malware in its attacks. ShadowSyndicate utilizes the same SSH fingerprint (1ca4cbac895fc3bd12417b77fc6ed31d) on many of their servers—85 as of September 2023. At least 52 of these servers have been linked to the Cobalt Strike command and control (C2) framework [1].

What is RansomHub?

First observed following the FBI's takedown of ALPHV/BlackCat in December 2023, RansomHub quickly gained notoriety as a Ransomware-as-a-Service (RaaS) operator. RansomHub capitalized on the law enforcement’s disruption of the LockBit group’s operations in February 2024 to market themselves to potential affiliates who had previously relied on LockBit’s encryptors. RansomHub's success can be largely attributed to their aggressive recruitment on underground forums, leading to the absorption of ex-ALPHV and ex-LockBit affiliates. They were one of the most active ransomware operators in 2024, with approximately 500 victims reported since February, according to their Dedicated Leak Site (DLS) [2].

ShadowSyndicate and RansomHub

External researchers have reported that ShadowSyndicate had as many as seven different ransomware families in their arsenal between July 2022, and September 2023. Now, ShadowSyndicate appears to have added RansomHub’s their formidable stockpile, becoming an affiliate of the RaaS provider [1].

Darktrace’s analysis of ShadowSyndicate across its customer base indicates that the group has been leveraging RansomHub ransomware in multiple attacks in September and October 2024. ShadowSyndicate likely shifted to using RansomHub due to the lucrative rates offered by this RaaS provider, with affiliates receiving up to 90% of the ransom—significantly higher than the general market rate of 70-80% [3].

In many instances where encryption was observed, ransom notes with the naming pattern “README_[a-zA-Z0-9]{6}.txt” were written to affected devices. The content of these ransom notes threatened to release stolen confidential data via RansomHub’s DLS unless a ransom was paid. During these attacks, data exfiltration activity to external endpoints using the SSH protocol was observed. The external endpoints to which the data was transferred were found to coincide with servers previously associated with ShadowSyndicate activity.

Darktrace’s coverage of ShadowSyndicate and RansomHub

Darktrace’s Threat Research team identified high-confidence indicators of compromise (IoCs) linked to the ShadowSyndicate group deploying RansomHub. The investigation revealed four separate incidents impacting Darktrace customers across various sectors, including education, manufacturing, and social services. In the investigated cases, multiple stages of the kill chain were observed, starting with initial internal reconnaissance and leading to eventual file encryption and data exfiltration.

Attack Overview

Timeline attack overview of ransomhub ransomware

Internal Reconnaissance

The first observed stage of ShadowSyndicate attacks involved devices making multiple internal connection attempts to other internal devices over key ports, suggesting network scanning and enumeration activity. In this initial phase of the attack, the threat actor gathers critical details and information by scanning the network for open ports that might be potentially exploitable. In cases observed by Darktrace affected devices were typically seen attempting to connect to other internal locations over TCP ports including 22, 445 and 3389.

C2 Communication and Data Exfiltration

In most of the RansomHub cases investigated by Darktrace, unusual connections to endpoints associated with Splashtop, a remote desktop access software, were observed briefly before outbound SSH connections were identified.

Following this, Darktrace detected outbound SSH connections to the external IP address 46.161.27[.]151 using WinSCP, an open-source SSH client for Windows used for secure file transfer. The Cybersecurity and Infrastructure Security Agency (CISA) identified this IP address as malicious and associated it with ShadowSyndicate’s C2 infrastructure [4]. During connections to this IP, multiple gigabytes of data were exfiltrated from customer networks via SSH.

Data exfiltration attempts were consistent across investigated cases; however, the method of egress varied from one attack to another, as one would expect with a RaaS strain being employed by different affiliates. In addition to transfers to ShadowSyndicate’s infrastructure, threat actors were also observed transferring data to the cloud storage and file transfer service, MEGA, via HTTP connections using the ‘rclone’ user agent – a command-line program used to manage files on cloud storage. In another case, data exfiltration activity occurred over port 443, utilizing SSL connections.

Lateral Movement

In investigated incidents, lateral movement activity began shortly after C2 communications were established. In one case, Darktrace identified the unusual use of a new administrative credential which was quickly followed up with multiple suspicious executable file writes to other internal devices on the network.

The filenames for this executable followed the regex naming convention “[a-zA-Z]{6}.exe”, with two observed examples being “bWqQUx.exe” and “sdtMfs.exe”.

Cyber AI Analyst Investigation Process for the SMB Writes of Suspicious Files to Multiple Devices' incident.
Figure 1: Cyber AI Analyst Investigation Process for the SMB Writes of Suspicious Files to Multiple Devices' incident.

Additionally, script files such as “Defeat-Defender2.bat”, “Share.bat”, and “def.bat” were also seen written over SMB, suggesting that threat actors were trying to evade network defenses and detection by antivirus software like Microsoft Defender.

File Encryption

Among the three cases where file encryption activity was observed, file names were changed by adding an extension following the regex format “.[a-zA-Z0-9]{6}”. Ransom notes with a similar naming convention, “README_[a-zA-Z0-9]{6}.txt”, were written to each share. While the content of the ransom notes differed slightly in each case, most contained similar text. Clear indicators in the body of the ransom notes pointed to the use of RansomHub ransomware in these attacks. As is increasingly the case, threat actors employed double extortion tactics, threatening to leak confidential data if the ransom was not paid. Like most ransomware, RansomHub included TOR site links for communication between its "customer service team" and the target.

Figure 2: The graph shows the behavior of a device with encryption activity, using the “SMB Sustained Mimetype Conversion” and “Unusual Activity Events” metrics over three weeks.

Since Darktrace’s Autonomous Response capability was not enabled during the compromise, the ransomware attack succeeded in its objective. However, Darktrace’s Cyber AI Analyst provided comprehensive coverage of the kill chain, enabling the customer to quickly identify affected devices and initiate remediation.

Figure 3: Cyber AI Analyst panel showing the critical incidents of the affected device from one of the cases investigated.

In lieu of Autonomous Response being active on the networks, Darktrace was able to suggest a variety of manual response actions intended to contain the compromise and prevent further malicious activity. Had Autonomous Response been enabled at the time of the attack, these actions would have been quickly applied without any human interaction, potentially halting the ransomware attack earlier in the kill chain.

Figure 4: A list of suggested Autonomous Response actions on the affected devices."

Conclusion

The Darktrace Threat Research team has noted a surge in attacks by the ShadowSyndicate group using RansomHub’s RaaS of late. RaaS has become increasingly popular across the threat landscape due to its ease of access to malware and script execution. As more individual threat actors adopt RaaS, security teams are struggling to defend against the increasing number of opportunistic attacks.

For customers subscribed to Darktrace’s Security Operations Center (SOC) services, the Analyst team promptly investigated detections of the aforementioned unusual and anomalous activities in the initial infection phases. Multiple alerts were raised via Darktrace’s Managed Threat Detection to warn customers of active ransomware incidents. By emphasizing anomaly-based detection and response, Darktrace can effectively identify devices affected by ransomware and take action against emerging activity, minimizing disruption and impact on customer networks.

Credit to Kwa Qing Hong (Senior Cyber Analyst and Deputy Analyst Team Lead, Singapore) and Signe Zahark (Principal Cyber Analyst, Japan)

Appendices

Darktrace Model Detections

Antigena Models / Autonomous Response:

Antigena / Network / Insider Threat / Antigena Network Scan Block

Antigena / Network / Insider Threat / Antigena SMB Enumeration Block

Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity

Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach

Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

Antigena / Network / External Threat / Antigena Suspicious File Pattern of Life Block

Antigena / Network / External Threat / Antigena File then New Outbound Block


Network Reconnaissance:

Device / Network Scan

Device / ICMP Address Scan

Device / RDP Scan
Device / Anomalous LDAP Root Searches
Anomalous Connection / SMB Enumeration
Device / Spike in LDAP Activity

C2:

Enhanced Monitoring - Device / Lateral Movement and C2 Activity

Enhanced Monitoring - Device / Initial Breach Chain Compromise

Enhanced Monitoring - Compromise / Suspicious File and C2

Compliance / Remote Management Tool On Server

Anomalous Connection / Outbound SSH to Unusual Port


External Data Transfer:

Enhanced Monitoring - Unusual Activity / Enhanced Unusual External Data Transfer

Unusual Activity / Unusual External Data Transfer

Anomalous Connection / Data Sent to Rare Domain

Unusual Activity / Unusual External Data to New Endpoint

Compliance / SSH to Rare External Destination

Anomalous Connection / Application Protocol on Uncommon Port

Enhanced Monitoring - Anomalous File / Numeric File Download

Anomalous File / New User Agent Followed By Numeric File Download

Anomalous Server Activity / Outgoing from Server

Device / Large Number of Connections to New Endpoints

Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

Anomalous Connection / Uncommon 1 GiB Outbound

Lateral Movement:

User / New Admin Credentials on Server

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / High Volume of New or Uncommon Service Control

Anomalous File / Internal / Executable Uploaded to DC

Anomalous Connection / Suspicious Activity On High Risk Device

File Encryption:

Compliance / SMB Drive Write

Anomalous File / Internal / Additional Extension Appended to SMB File

Compromise / Ransomware / Possible Ransom Note Write

Anomalous Connection / Suspicious Read Write Ratio

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

83.97.73[.]198 - IP - Data exfiltration endpoint

108.181.182[.]143 - IP - Data exfiltration endpoint

46.161.27[.]151 - IP - Data exfiltration endpoint

185.65.212[.]164 - IP - Data exfiltration endpoint

66[.]203.125.21 - IP - MEGA endpoint used for data exfiltration

89[.]44.168.207 - IP - MEGA endpoint used for data exfiltration

185[.]206.24.31 - IP - MEGA endpoint used for data exfiltration

31[.]216.148.33 - IP - MEGA endpoint used for data exfiltration

104.226.39[.]18 - IP - C2 endpoint

103.253.40[.]87 - IP - C2 endpoint

*.relay.splashtop[.]com - Hostname - C2 & data exfiltration endpoint

gfs***n***.userstorage.mega[.]co.nz - Hostname - MEGA endpoint used for data exfiltration

w.api.mega[.]co.nz - Hostname - MEGA endpoint used for data exfiltration

ams-rb9a-ss.ams.efscloud[.]net - Hostname - Data exfiltration endpoint

MITRE ATT&CK Mapping

Tactic - Technqiue

RECONNAISSANCE – T1592.004 Client Configurations

RECONNAISSANCE – T1590.005 IP Addresses

RECONNAISSANCE – T1595.001 Scanning IP Blocks

RECONNAISSANCE – T1595.002 Vulnerability Scanning

DISCOVERY – T1046 Network Service Scanning

DISCOVERY – T1018 Remote System Discovery

DISCOVERY – T1083 File and Directory Discovery
INITIAL ACCESS - T1189 Drive-by Compromise

INITIAL ACCESS - T1190 Exploit Public-Facing Application

COMMAND AND CONTROL - T1001 Data Obfuscation

COMMAND AND CONTROL - T1071 Application Layer Protocol

COMMAND AND CONTROL - T1071.001 Web Protocols

COMMAND AND CONTROL - T1573.001 Symmetric Cryptography

COMMAND AND CONTROL - T1571 Non-Standard Port

DEFENSE EVASION – T1078 Valid Accounts

DEFENSE EVASION – T1550.002 Pass the Hash

LATERAL MOVEMENT - T1021.004 SSH

LATERAL MOVEMENT – T1080 Taint Shared Content

LATERAL MOVEMENT – T1570 Lateral Tool Transfer

LATERAL MOVEMENT – T1021.002 SMB/Windows Admin Shares

COLLECTION - T1185 Man in the Browser

EXFILTRATION - T1041 Exfiltration Over C2 Channel

EXFILTRATION - T1567.002 Exfiltration to Cloud Storage

EXFILTRATION - T1029 Scheduled Transfer

IMPACT – T1486 Data Encrypted for Impact

References

1.     https://www.group-ib.com/blog/shadowsyndicate-raas/

2.     https://www.techtarget.com/searchsecurity/news/366617096/ESET-RansomHub-most-active-ransomware-group-in-H2-2024

3.     https://cyberint.com/blog/research/ransomhub-the-new-kid-on-the-block-to-know/

4.     https://www.cisa.gov/sites/default/files/2024-05/AA24-131A.stix_.xml

Continue reading
About the author
Qing Hong Kwa
Senior Cyber Analyst and Deputy Analyst Team Lead, Singapore
Your data. Our AI.
Elevate your network security with Darktrace AI