Blog
/
Email
/
August 2, 2024

Safelink Smuggling: Enhancing Resilience Against Malicious Links

Gain insights into safelink smuggling tactics and learn strategies to protect your organization from the dangers posed by malicious links.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Carlos Gray
Senior Product Marketing Manager, Email
Written by
Stephen Pickman
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
02
Aug 2024

Darktrace security members and researchers have recently seen a rise in what we are calling Safelink Smuggling. Safelinks are URLs rewritten by security solutions to enable additional analysis when the URL is clicked. Once analyzed, they may prompt a user, redirect the browser back to the original URL, or block further access if deemed necessary.

What is Safelink Smuggling?

Safelink Smuggling is a technique that involves an attacker purposely getting their malicious payload rewritten by a security solution’s Safelink capability to then propagate the rewritten URL to others. This technique is a way for attackers to not only avoid detection by traditional email security and other solutions, but also to instill mistrust in all email security solutions. As a result, Safelinks from a range of popular email security providers are often seen in phishing or supply chain attacks. In fact, Darktrace has observed over 300,000 cases of Safelinks being included in unexpected and suspicious contexts over the last 3 months.

How does Safelink Smuggling work?

Safelink Smuggling has two key stages: Getting a malicious link rewritten by an email security solution, then propagating that rewritten link to other victims.

Step one:

Obfuscated a malicious payload through a Safelink capability rewriting the link; Darktrace has seen this attempted through two methods – Compromised Account or Reply-Chain.

  • Method 1: Compromised Account

If an attacker can gain access to a compromised account – whether that’s through brute force, malware or credential theft – they can infiltrate it with malicious links, and then exfiltrate the Safelinks created as the email passes through security filtering. In other words, attackers will send a malicious payload to the compromised inbox, with the intent that the malicious URL gets rewritten. Unlike a normal phishing email where the threat actor wants to avoid having their email blocked, in this case the objective is for the email to get through to the inbox with the link rewritten. As observed by Darktrace, attackers often send the link in isolation as any additional components (i.e., body text or other content in the email) could cause a more severe action such as the email security solution holding the message.

  • Method 2: Reply-Chain

With this method, the attacker sends a malicious link to an email security vendor’s customer in an attempt to solicit a reply from an internal user. This allows them to grab the re-written URL within the reply chain. However, this is a risky tactic which can fail at several points. The attacker has to be confident the initial email won't be blocked outright; they also risk alerting security vendors to the address and the URL intended to be used for the main campaign. They also must be confident that the checks made when the re-written URL is clicked will not lead to a block at the final destination.
Regardless of the method used, the end result will appear as follows:

For example, the original malicious URL may look like this,

faceldu[.]org/Invoice112.zip

(negative surface indicators: recently registered domain, file extension)

And after being rewritten,

securityvevndor[.]com/safe?q=aNDF80dfaAkAH930adbd

(positive surface indicators: established domain, positive reputation, associated with safe content)

Step Two:

Now that the attacker has access to a malicious URL that has been obfuscated by a safe rewrite, attackers can forward or craft an email leveraging that same link. In fact, we have even seen multiple layers of Safelink Smuggling being used to mask a payload further.

The Challenge of Link Rewriting

Traditional email security solutions rewrite all links sent to an organization, but there is an inherent risk to this methodology. Rewriting every link, whether harmless or harmful, leads employees to lose context and creates a false sense of security when interacting with rewritten links in emails. Furthermore, it provides attackers with many opportunities to exploit Safelinks. As demonstrated in Method 2 above, if an email security solution does not rewrite every link, executing such attacks would be significantly more challenging.

Traditionally, rewriting every link made sense from a security perspective, as it allowed servers to thoroughly analyze links for known attack patterns and signatures. However, this approach relies on identifying previously recognized threats. Conversely, Darktrace / EMAIL gathers sufficient information about a link without needing to rewrite it, by analyzing the context and content of the email and the link itself.

In fact, Darktrace is the pioneer in applying selective rewriting to URLs based on suspicious properties or context, a method that other solutions have since adopted. While traditional solutions rewrite links to assess them only after they are clicked, Darktrace / EMAIL takes immediate action to neutralize threats before they reach the inbox.

Darktrace achieves high success rates in detecting malicious links and emails on the first encounter using Self-Learning AI. By understanding 'normal' behavior in email communications, Darktrace identifies subtle deviations indicative of cyber threats and selectively rewrites only those links deemed suspicious, ensuring a targeted, proportionate, and non-disruptive response.

Why do traditional email security solutions miss Safelink attacks?

Traditional security solutions that focus on learning attack patterns will miss Safelink threats as they are often utilized in attacks that have a variety of layers which help the email seem legitimate. Leveraging all the classic techniques seen in a supply chain attack to disguise the sender's intent, taking advantage of the users' inherent trust in familiar sources, the user is more likely to lower their defenses.

For more information: https://darktrace.com/products/email/use-cases/supply-chain-attack

In terms of the URL, if the payload is malicious, why is it difficult for email security solutions to catch it? Primarily, other security vendors will focus on the payload in isolation, attempting to find known attack patterns or signatures such as a domain name or IP with a bad reputation. Unfortunately, with this technique, if the URL has a legitimate domain, it will return a clean track record. Common obfuscation techniques such as captchas, short-links, and click throughs can all be deployed to add layers of complexity to the analysis.

Safelink Smuggling relies heavily on link redirects, which means that web analysis tools will falter as they will only analyze the first redirect. Consequently, when more in-depth analysis on the link itself is performed, the first place the URL takes the user is not the malicious site but rather the default on-click analysis of the vendor in question. Therefore, any traditional browser or link analysis will also return a negative result.

Finally, the context itself is important. In contrast to traditional email security solutions, Darktrace / EMAIL asks who, what, when, where, and why for every single email, and compares it to the pattern of life of both the internal recipient and the external sender, rather than attempting to match patterns with historical threat data. When analyzing an email from an inbound perspective, Darktrace reveals potential deviations from normal, that, when considered sufficiently anomalous, will result in taking a proportional action to the threat assessed.

To illustrate the above, let’s take a look at an example email that Darktrace recently caught.

The following is an email a Darktrace customer received, which Darktrace / EMAIL held before it reached the inbox. In this case, the smuggled Safelink was further obfuscated behind a QR Code. The accompanying document also presented some anomalies in terms of its intent, perceived as a potential social engineering attempt. Finally, the lack of association and low mailing history meant there was no prior context for this email.  

Example of a Safelink Smuggling attack using a popular email security solution’s safelink.
Fig 1: Example of a Safelink Smuggling attack using a popular email security solution’s safelink.

How to mitigate against Safelink Smuggling?

It's difficult for email security vendors to do anything about their links being reused, and reuse should almost be expected by popular operators in the email security space. Therefore, the presence of links from a vendor’s domain in a suspicious email communication rarely indicates a compromise of the link rewrite infrastructure or a compromise of the third-party vendor.

Email security vendors can improve their defense-in-depth, especially around their email provider accounts to avoid Method 1 (Compromised Account attacks) and become more selective with their rewrites to curtail Method 2 (Reply Chain attacks).

Primary protection against Safelink Smuggling should be offered by the email security vendor responsible for inbound email analysis. They need to ensure that techniques such as Safelink Smuggling are not evaded by their detection mechanisms.

Darktrace has long been working on the betterment of security within the email community and innovating our link analysis infrastructure to mitigate against this attack methodology (read more about our major update in 6.2 here), regardless of whether the receiving organization are Darktrace customers.

How does Darktrace deal with Safelink Smuggling today?

Darktrace has been dealing with Safelink Smuggling since launch and has a standardized recommendation for customers who are looking to defend against this threat.

Customers want to avoid being 1) the propagators of this threat and potentially damaging their brand reputation, and 2) being victims of the supply chain attack thereafter.

The principal recommendation to protect customer accounts and consequently their brands is to ensure defense-in-depth. As accounts establish themselves as the crown jewels of any modern enterprise, organizations should vigilantly monitor their account activity with the same rigor they would analyze their network activity. Whether that is through the base account takeover protection offered by Darktrace / EMAIL, or the expanded defense offered by Darktrace / IDENTITY, it is crucial that the accounts themselves have a robust security solution in place.

Secondly, to avoid falling victim to the supply chain attack that leverages a third-party vendor’s link rewrite, it is imperative to use a solution that does not rely on static threat intelligence and link reputation analysis. Rather than chasing attackers by updating rules and signatures, Darktrace leverages Self-Learning AI to learn the communication patterns of both internal and external messages to reveal deviations in both content and context.

Finally, for those customers that already leverage Darktrace / EMAIL we recommend ensuring that lock links are enabled, and that the default warning page is displayed every time a link is rewritten, no matter the perceived severity of the link. This will allow any potential user that clicks on a rewritten Darktrace / EMAIL link to be alerted to the potential nature of the site they are trying to access.

Safelink smuggling example caught by Darktrace

While most cases involve other vendors, analysts recently saw a case where Darktrace's own links were used in this type of attack. A small number of links were leveraged in a campaign targeting both Darktrace and non-Darktrace customers alike. Thankfully, these attempts were all appropriately actioned by those customers that had Darktrace / EMAIL deployed.

In the example below, you will see how Darktrace Cyber AI Analyst describes the example at hand under the Anomaly Indicators section.

Example of Safelink Smuggling attack on Darktrace using the Darktrace Safelink Infrastructure.
Fig 2: Example of Safelink Smuggling attack on Darktrace using the Darktrace Safelink Infrastructure.

First, the display name mismatch can be interpreted as an indicator of social engineering, attempting to deceive the recipient with an IT policy change.

Second, the link itself, which in this case is a hidden redirect to an unusual host for this environment.

Finally, there is a suspected account takeover due to the origin of the email being a long-standing, validated domain that contains a wide variety of suspicious elements.

Darktrace / EMAIL would have held this email from being delivered.

Conclusion

By investigating Safelink Smuggling, Darktrace wants to shine a light on the technique for security teams and help raise awareness of how it can be used to dupe users into lowering their defenses. Challenge your email security vendor on how it deals with link analysis, particularly from trusted senders and applications.

Interested in Darktrace’s approach to defense-in-depth? Check out Darktrace / EMAIL

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Carlos Gray
Senior Product Marketing Manager, Email
Written by
Stephen Pickman

More in this series

No items found.

Blog

/

/

April 22, 2025

Obfuscation Overdrive: Next-Gen Cryptojacking with Layers

man looking at multiple computer screensDefault blog imageDefault blog image

Out of all the services honeypotted by Darktrace, Docker is the most commonly attacked, with new strains of malware emerging daily. This blog will analyze a novel malware campaign with a unique obfuscation technique and a new cryptojacking technique.

What is obfuscation?

Obfuscation is a common technique employed by threat actors to prevent signature-based detection of their code, and to make analysis more difficult. This novel campaign uses an interesting technique of obfuscating its payload.

Docker image analysis

The attack begins with a request to launch a container from Docker Hub, specifically the kazutod/tene:ten image. Using Docker Hub’s layer viewer, an analyst can quickly identify what the container is designed to do. In this case, the container is designed to run the ten.py script which is built into itself.

 Docker Hub Image Layers, referencing the script ten.py.
Figure 1: Docker Hub Image Layers, referencing the script ten.py.

To gain more information on the Python file, Docker’s built in tooling can be used to download the image (docker pull kazutod/tene:ten) and then save it into a format that is easier to work with (docker image save kazutod/tene:ten -o tene.tar). It can then be extracted as a regular tar file for further investigation.

Extraction of the resulting tar file.
Figure 2: Extraction of the resulting tar file.

The Docker image uses the OCI format, which is a little different to a regular file system. Instead of having a static folder of files, the image consists of layers. Indeed, when running the file command over the sha256 directory, each layer is shown as a tar file, along with a JSON metadata file.

Output of the file command over the sha256 directory.
Figure 3: Output of the file command over the sha256 directory.

As the detailed layers are not necessary for analysis, a single command can be used to extract all of them into a single directory, recreating what the container file system would look like:

find blobs/sha256 -type f -exec sh -c 'file "{}" | grep -q "tar archive" && tar -xf "{}" -C root_dir' \;

Result of running the command above.
Figure 4: Result of running the command above.

The find command can then be used to quickly locate where the ten.py script is.

find root_dir -name ten.py

root_dir/app/ten.py

Details of the above ten.py script.
Figure 5: Details of the above ten.py script.

This may look complicated at first glance, however after breaking it down, it is fairly simple. The script defines a lambda function (effectively a variable that contains executable code) and runs zlib decompress on the output of base64 decode, which is run on the reversed input. The script then runs the lambda function with an input of the base64 string, and then passes it to exec, which runs the decoded string as Python code.

To help illustrate this, the code can be cleaned up to this simplified function:

def decode(input):
   reversed = input[::-1]

   decoded = base64.decode(reversed)
   decompressed = zlib.decompress(decoded)
   return decompressed

decoded_string = decode(the_big_text_blob)
exec(decoded_string) # run the decoded string

This can then be set up as a recipe in Cyberchef, an online tool for data manipulation, to decode it.

Use of Cyberchef to decode the ten.py script.
Figure 6: Use of Cyberchef to decode the ten.py script.

The decoded payload calls the decode function again and puts the output into exec. Copy and pasting the new payload into the input shows that it does this another time. Instead of copy-pasting the output into the input all day, a quick script can be used to decode this.

The script below uses the decode function from earlier in order to decode the base64 data and then uses some simple string manipulation to get to the next payload. The script will run this over and over until something interesting happens.

# Decode the initial base64

decoded = decode(initial)
# Remove the first 11 characters and last 3

# so we just have the next base64 string

clamped = decoded[11:-3]

for i in range(1, 100):
   # Decode the new payload

   decoded = decode(clamped)
   # Print it with the current step so we

   # can see what’s going on

   print(f"Step {i}")

   print(decoded)
   # Fetch the next base64 string from the

   # output, so the next loop iteration will

   # decode it

   clamped = decoded[11:-3]

Result of the 63rd iteration of this script.
Figure 7: Result of the 63rd iteration of this script.

After 63 iterations, the script returns actual code, accompanied by an error from the decode function as a stopping condition was never defined. It not clear what the attacker’s motive to perform so many layers of obfuscation was, as one round of obfuscation versus several likely would not make any meaningful difference to bypassing signature analysis. It’s possible this is an attempt to stop analysts or other hackers from reverse engineering the code. However,  it took a matter of minutes to thwart their efforts.

Cryptojacking 2.0?

Cleaned up version of the de-obfuscated code.
Figure 8: Cleaned up version of the de-obfuscated code.

The cleaned up code indicates that the malware attempts to set up a connection to teneo[.]pro, which appears to belong to a Web3 startup company.

Teneo appears to be a legitimate company, with Crunchbase reporting that they have raised USD 3 million as part of their seed round [1]. Their service allows users to join a decentralized network, to “make sure their data benefits you” [2]. Practically, their node functions as a distributed social media scraper. In exchange for doing so, users are rewarded with “Teneo Points”, which are a private crypto token.

The malware script simply connects to the websocket and sends keep-alive pings in order to gain more points from Teneo and does not do any actual scraping. Based on the website, most of the rewards are gated behind the number of heartbeats performed, which is likely why this works [2].

Checking out the attacker’s dockerhub profile, this sort of attack seems to be their modus operandi. The most recent container runs an instance of the nexus network client, which is a project to perform distributed zero-knowledge compute tasks in exchange for cryptocurrency.

Typically, traditional cryptojacking attacks rely on using XMRig to directly mine cryptocurrency, however as XMRig is highly detected, attackers are shifting to alternative methods of generating crypto. Whether this is more profitable remains to be seen. There is not currently an easy way to determine the earnings of the attackers due to the more “closed” nature of the private tokens. Translating a user ID to a wallet address does not appear to be possible, and there is limited public information about the tokens themselves. For example, the Teneo token is listed as “preview only” on CoinGecko, with no price information available.

Conclusion

This blog explores an example of Python obfuscation and how to unravel it. Obfuscation remains a ubiquitous technique employed by the majority of malware to aid in detection/defense evasion and being able to de-obfuscate code is an important skill for analysts to possess.

We have also seen this new avenue of cryptominers being deployed, demonstrating that attackers’ techniques are still evolving - even tried and tested fields. The illegitimate use of legitimate tools to obtain rewards is an increasingly common vector. For example,  as has been previously documented, 9hits has been used maliciously to earn rewards for the attack in a similar fashion.

Docker remains a highly targeted service, and system administrators need to take steps to ensure it is secure. In general, Docker should never be exposed to the wider internet unless absolutely necessary, and if it is necessary both authentication and firewalling should be employed to ensure only authorized users are able to access the service. Attacks happen every minute, and even leaving the service open for a short period of time may result in a serious compromise.

References

1. https://www.crunchbase.com/funding_round/teneo-protocol-seed--a8ff2ad4

2. https://teneo.pro/

Continue reading
About the author
Nate Bill
Threat Researcher

Blog

/

/

April 22, 2025

How NDR and Secure Access Service Edge (SASE) Work Together to Achieve Network Security Outcomes

woman looking out at buildingsDefault blog imageDefault blog image

Modern networks are evolving rapidly, with traffic patterns, user behavior, and critical assets extending far beyond the boundaries of traditional network security tools. As organizations adopt hybrid infrastructures, remote working, and cloud-native services, it is essential to maintain visibility and protect this expanding attack surface.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) are two technologies commonly used to safeguard organizational networks. While both play crucial roles in enhancing security, one does not replace the other. Instead, NDR and SASE complement each other, taking on different roles to create a robust network security framework. This blog will unpack the relationship between NDR and SASE, including the component functionalities that comprise SASE, highlighting their unique contributions to maintaining a comprehensive and resilient network security strategy.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) explained

NDR solutions, such as Darktrace / NETWORK, are designed to detect, investigate, and respond to suspicious activities within any network. By leveraging machine learning and behavioral analytics, NDR continuously monitors network traffic to identify anomalies that could indicate potential threats and to contain those threats at machine speed. These solutions analyze both North-South traffic (between internal and external networks) and East-West traffic (within internal networks), providing comprehensive visibility into network activities.

SASE, on the other hand, comprises multiple solutions, focused on providing hybrid and remote users access to services while adhering to the Zero Trust principle of "never trust, always verify". Within SASE architectures, Zero Trust Network Access (ZTNA) solutions provide secure remote access to private applications and services the user has been explicitly granted, and Secure Web Gateways (SWG) provide Internet access, again based on policy groups. Unlike traditional security models that grant implicit trust to users within the network perimeter, ZTNA requires continuous verification of user identity and device health before granting access to resources. This approach minimizes the attack surface and reduces the risk of unauthorized access to sensitive data and internal applications. Similarly, SWGs filter web traffic based on the verified user identity and can block known malware, further reducing the attack surface for the client estate.

Limitations of SASE highlights the importance of NDR

While SASE, including ZTNA and SWG, is a powerful tool for enforcing secure access to company networks and resources as well as the Internet, it is not a comprehensive security solution, or a replacement for dedicated network monitoring and NDR capabilities. Some of the main limitations include:

  • Focused on policies rather than security: SASE delivers strong networking outcomes but provides policy-based protections, rather than a full suite of security features. It can provide simple alerting for disallowed actions, but it lacks the security context needed for comprehensive threat detection, such as knowing if user credentials have been compromised.
  • Can only detect known threats: SASE solutions cannot detect novel attacks such as zero-days and insider threats. This is because they rely on a rule-based approach that does not have a behavioral understanding of network entities that can detect anomalies or suspicious activity.
  • Limited response capabilities: Due to the limited detection capabilities of SASE solutions, it is not possible to automate response actions to threats that slip past existing policies.  While access to internal resources and the Internet can be revoked or severely limited as part of a response, this must be done after human investigation and analysis, allowing more time for the threat to continue before being contained.
  • Limited scope: SASE provides cloud-hosted secure networking, which lends itself much more toward the client estate of any organization. As a result, servers and unmanaged devices—whether IT/IoT/OT—are mostly out of scope and do not benefit from the policies SASE enforces.

The complementary roles of NDR and ZTNA

NDR solutions provide full visibility into network activity, with the ability to detect and respond to threats that may bypass initial access controls and filters. When combined, NDR and SASE create a layered security approach that addresses different aspects of network security, for example:

  • Detection of novel, unknown and insider threats: NDR solutions can monitor all network traffic using behavioral anomaly detection. This can identify suspicious activities, such as insider threats from authorized users who have passed policy checks, or novel attacks that have never been seen before.
  • Validation of policies: By continuously monitoring network traffic, NDR can validate the effectiveness of existing policies and identify any gaps in security that need addressing due to organizational changes or outdated rule sets.
  • Reducing risk and impact of threats: Together, SASE and NDR solutions shift toward proactive security by reducing the potential impact of a threat through predefined policies and by detecting and containing a threat in its earliest stages, even if it is novel or nuanced.
  • Enhanced contextual information: Alerts raised by SASE solutions can provide additional context into potential threats, which can be used by NDR solutions to increase investigation quality and context.
  • Containment of network threats: SASE solutions can prohibit access to resources on an internal company network or on the Internet if predefined access control criteria are not met or a site matches a threat signature. When combined with an NDR solution, organizations can go far beyond this, detecting and responding to a much wider variety of network threats to prevent attacks from escalating.

When implementing SASE and NDR solutions, it is also crucial to consider the best configurations to maximize interoperability, and integrations will often increase functionality. Well-designed implementations, combined with integrations, will strengthen both SASE and NDR solutions for organizations.

How Darktrace continues to secure SASE networks

With the latest 6.3 update, Darktrace continues to extend its capabilities with new innovations that support modern enterprise networks and the use of SASE across remote and hybrid worker devices. This expands on existing Darktrace integrations and partnerships with SASE vendors such as Netskope and Zscaler.

Traditional methods to contain remote access and internet-born threats are either signature or policy based, and response to nuanced threats requires manual, human-led investigation and decision-making. By the time security teams can react, the damage is often already done.

With Darktrace 6.3, customers using Zscaler can now configure Darktrace Autonomous Response to quarantine ZPA-connected user devices at machine speed. This provides a powerful new mechanism for containing remote threats at the earliest sign of suspicious activity, without disrupting broader operations.

By automatically shutting down ZPA access for compromised user accounts, Darktrace gives SOC teams valuable time to investigate and respond, while continuing to protect the rest of the organization. This integration enhances Darktrace’s ability to take actions for remote user devices, helping customers contain threats faster and keep the business running smoothly.

For organizations using SASE technologies to address the challenges of securing large, distributed networks across a range of geographies, SaaS applications and remote worker devices, Darktrace also now integrates with Netskope Cloud TAP to provide visibility into and analysis over tunneled traffic, reducing blind spots and enabling organizations to maintain detection capabilities across their expanding network perimeters.

Conclusion

While NDR and ZTNA serve distinct purposes, their integration is crucial for a comprehensive security strategy. ZTNA provides robust access controls, ensuring that only authorized users can access network resources. NDR, on the other hand, offers continuous visibility into network activities, detecting and responding to threats that may bypass initial access controls. By leveraging the strengths of both solutions, organizations can enhance their security posture and protect against a wide range of network security threats.

Understanding the complementary roles of NDR and ZTNA is essential for building a resilient security framework. As cyber threats continue to evolve, adopting a multi-layered, defense-in-depth security approach will be key to safeguarding organizational networks.

Click here for more information about the latest product innovations in Darktrace 6.3, or learn more about Darktrace / NETWORK here.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI