Blog
/
AI
/
August 9, 2022

Cyber Tactics in the Russo-Ukrainian Conflict

The conflict between Russia and Ukraine has led to fears of a full-scale cyberwar. Learn the cyber attack tactics used, hacking groups involved, and more!
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Rosa Jong
OSINT Analyst
Written by
Taisiia Garkava
Security Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
09
Aug 2022

Introduction

Since the beginning of the Russian invasion of Ukraine in February 2022, cyber communities around the world have been witnessing what can be called a ‘renaissance of cyberwarfare' [1]. Rather than being financially motivated, threat actors are being guided by political convictions to defend allies or attack their enemies. This blog reviews some of the main threat actors involved in this conflict and their ongoing tactics, and advises on how organizations can best protect themselves. Darktrace’s preliminary assessments predicted that attacks would be observed globally with a focus on pro-Ukrainian nations such as North Atlantic Treaty Organization (NATO) members and that identified Advanced Persistent Threat (APT) groups would develop new and complex malware deployed through increasingly sophisticated attack vectors. This blog will show that many of these assessments had unexpected outcomes.

Context for Conflict 

Cyber confrontation between Russia and Ukraine dates back to 2013, when Viktor Yanukovych, (former President of Ukraine) rejected an EU trade pact in favour of an agreement with Russia. This sparked mass protests leading to his overthrow, and shortly after, Russian troops annexed Crimea and initiated the beginning of Russian-Ukrainian ground and cyber warfare. Since then, Russian threat actors have been periodically targeting Ukrainian infrastructure. One of the most notable examples of this, an attack against their national power grid in December 2015, resulted in power outages for approximately 255,000 people in Ukraine and was later attributed to the Russian hacking group Sandworm [2 & 3]. 

Another well-known attack in June 2017 overwhelmed the websites of hundreds of Ukrainian organizations using the infamous NotPetya malware. This attack is still considered the most damaging cyberattack in history, with more than €10 billion euros in financial damage [4]. In February 2022, countries witnessed the next stage of cyberwar against Ukraine with both new and familiar actors deploying various techniques to target their rival’s critical infrastructure. 

Tactic 1: Ransomware

Although some sources suggest US ransomware incidents and expectations of ransom may have declined during the conflict, ransomware still remained a significant tactic deployed globally across this period [5] [6] [7]. A Ukrainian hacking group, Network Battalion 65 (NB65), used ransomware to attack the Russian state-owned television and radio broadcasting network VGTRK. NB65 managed to steal 900,000 emails and 4000 files, and later demanded a ransom which they promised to donate to the Ukrainian army. This attack was unique because the group used the previously leaked source code of Conti, another infamous hacker group that had pledged its support to the Russian government earlier in the conflict. NB65 modified the leaked code to make unique ransomware for each of its targets [5]. 

Against expectations, Darktrace’s customer base appeared to deviate from these ransom trends. Analysts have seen relatively unsophisticated ransomware attacks during the conflict period, with limited evidence to suggest they were connected to any APT activity. Between November 2021 and June 2022, there were 51 confirmed ransomware compromises across the Darktrace customer base. This represents an increase of 43.16% compared to the same period the year before, accounting for relative customer growth. Whilst this suggests an overall growth in ransom cases, many of these confirmed incidents were unattributed and did not appear to be targeting any particular verticals or regions. While there was an increase in the energy sector, this could not be explicitly linked to the conflict. 

The Darktrace DETECT family has a variety of models related to ransomware visibility:

Darktrace Detections for T1486 (Data Encrypted for Impact):

- Compromise / Ransomware / Ransom or Offensive Words Written to SMB

- Compromise / Ransomware / Suspicious SMB Activity

- Anomalous Connection / Sustained MIME Type Conversion

- Unusual Activity / Sustained Anomalous SMB Activity

- Compromise / Ransomware / Suspicious SMB File Extension

- Unusual Activity / Anomalous SMB Read & Write

- Unusual Activity / Anomalous SMB Read & Write from New Device

- SaaS / Resource / SaaS Resources with Additional Extensions

- Compromise / Ransomware / Possible Ransom Note Read

- [If RESPOND is enabled] Antigena / Network / External Threat / Antigena Ransomware Block

Tactic 2: Wipers

One of the largest groups of executables seen during the conflict were wipers. On the eve of the invasion, Ukrainian organizations were targeted by a new wiper malware given the name “HermeticWiper”. Hermetic refers to the name of the Cyprian company “Hermetica Digital Ltd.” which was used by attackers to request a code signing certificate [6]. Such a digital certificate is used to verify the ownership of the code and that it has not been altered. The 24-year-old owner of Hermetica Digital says he had no idea that his company was abused to retrieve a code signing certificate [7]. 

HermeticWiper consists of three components: a worm, decoy ransomware and the wiper malware. The custom worm designed for HermeticWiper was used to spread the malware across the network of its infected machines. ESET researchers discovered that the decoy ransomware and the wiper were released at the same time [8]. The decoy ransomware was used to make it look like the machine was hit by ransomware, when in reality the wiper was already permanently wiping data from the machines. In the attack’s initial stage, it bypasses Windows security features designed to prevent overwriting boot records by installing a separate driver. After wiping data from the machine, HermeticWiper prevents that data from being re-fragmented and overwrites the files to fragment it further. This is done to make it more challenging to reconstruct data for post-compromise forensics [9]. Overall, the function and purpose of HermeticWiper seems similar to that of NotPetya ransomware. 

HermeticWiper is not the only conflict-associated wiper malware which has been observed. In January 2022, Microsoft warned Ukrainian customers that they detected wiper intrusion activity against several European organizations. One example of this was the MBR (Master Boot Record) wiper. This type of wiper overwrites the MBR, the disk sector that instructs a computer on how to load its operating system, with a ransomware note. In reality, the note is a misdirection and the malware destroys the MBR and targeted files [10].  

One of the most notable groups that used wiper malware was Sandworm. Sandworm is an APT attributed to Russia’s foreign military intelligence agency, GRU. The group has been active since 2009 and has used a variety of TTPs within their attacks. They have a history of targeting Ukraine including attacks in 2015 on Ukraine’s energy distribution companies and in 2017 when they used the aforementioned NotPetya malware against several Ukrainian organizations [11]. Another Russian (or pro-Russian) group using wiper malware to target Ukraine is DEV-0586. This group targeted various Ukrainian organizations in January 2022 with Whispergate wiper malware. This type of wiper malware presents itself as ransomware by displaying a file instructing the victim to pay Bitcoin to have their files decrypted [12].  

Darktrace did not observe any confirmed cases of HermeticWiper nor other conflict-associated wipers (e.g IsaacWiper and CaddyWiper) within the customer base over this period. Despite this, Darktrace DETECT has a variety of models related to wipers and data destruction:

Darktrace Detections for T1485 (Data Destruction)- this is the main technique exploited during wiper attacks

- Unusual Activity / Anomalous SMB Delete Volume

- IaaS / Unusual Activity / Anomalous AWS Resources Deleted

- IaaS / Storage / S3 Bucket Delete

- SaaS / Resource / Mass Email Deletes from Rare Location

- SaaS / Resource / Anomalous SaaS Resources Deleted

- SaaS / Resource / Resource Permanent Delete

- [If RESPOND is enabled] Antigena / Network / Manual / Enforce Pattern of Life

- [If RESPOND is enabled] Antigena / SaaS / Antigena Unusual Activity Block

Tactic 3: Spear-Phishing

Another strategy that some threat actors employ is spear-phishing. Targeting can be done using email, social media, messaging, or other platforms.

The hacking group Armageddon (also known as Gamaredon) has been responsible for several spear-phishing attacks during the crisis, primarily targeting individuals involved in the Ukrainian Government [13]. Since the beginning of the war, the group has been sending out a large volume of emails containing an HTML file which, if opened, downloads and launches a RAR payload. Those who click the attached link download an HTA with a PowerShell script which obtains the final Armageddon payload. Using the same strategy, the group is also targeting governmental agencies in the European Union [14]. With high-value targets, the need to improve teaching around phishing identification to minimize the chance of being caught in an attacker's net is higher than ever. 

In comparison to the wider trends, Darktrace analysts again saw little-to-no evidence of conflict-associated phishing campaigns affecting customers. Those phishing attempts which did target customers were largely not conflict-related. In some cases, the conflict was used opportunistically, such as when one customer was targeted with a phishing email referencing Russian bank exclusions from the SWIFT payment system (Figures 1 and 2). The email was identified by Darktrace/Email as a probable attempt at financial extortion and inducement - in this case the company received a spoofed email from a major bank’s remittance department.  

Figure 1- Screencap of targeted phishing email sent to Darktrace customer
Figure 2- Attached file contains soliciting reference to SWIFT, a money payment system which select Russian banks were removed from because of the conflict [15]

 Although the conflict was used as a reference in some examples, in most of Darktrace’s observed phishing cases during the conflict period there was little-to-no evidence to suggest that the company being targeted nor the threat actor behind the phishing attempt was associated with or attributable to the Russia-Ukraine conflict.

However, Darktrace/Email has several model categories which pick up phishing related threats:

Sample of Darktrace for Email Detections for T1566 (Phishing)- this is the overarching technique exploited during spear-phishing events

Model Categories:

- Inducement

- Internal / External User Spoofing

- Internal / External Domain Spoofing

- Fake Support

- Link to Rare Domains

- Link to File Storage

- Redirect Links

- Anomalous / Malicious Attachments

- Compromised Known Sender

Specific models can be located on the Email Console

 

Tactic 4: Distributed-Denial-of-Service (DDoS)

Another tactic employed by both pro-Russian and pro-Ukrainian threat actors was DDoS (Distributed Denial of Service) attacks. Both pro-Russia and pro-Ukraine actors were seen targeting critical infrastructure, information resources, and governmental platforms with mass DDoS attacks. The Ukrainian Minister of Digital Transformation, Mykhailo Fedorov, called on an IT Army of underground Ukrainian hackers and volunteers to protect Ukraine's critical infrastructure and conduct DDoS attacks against Russia [16]. As of 1 August 2022, more than two hundred thousand people are subscribed to the group's official Telegram channel, where potential DDoS targets are announced [17].

Darktrace observed similar pro-Ukraine DDoS behaviors within a variety of customer environments. These DDoS campaigns appeared to involve low-volume individual support combined with crowd-sourced DDoS activity. They were hosted on a range of public-sourced DDoS sites and seemed to share sentiments of groups such as the IT Army of Ukraine (Figure 3).

Figure 3- Example DDoS outsource domain with unusual TLD 

From the Russian side, one of the prominent newly emerged groups, Killnet, is striking back, launching several massive DDoS attacks against the critical infrastructure of countries that provide weaponry to Ukraine [18 & 19]. Today, the number of supporters of Killnet has grown to eighty-four thousand on their Telegram channel. The group has already launched a number of mass attacks on several NATO states, including Germany, Poland, Italy, Lithuania and Norway. This shows the conflict has attracted new and fast-growing groups with large backing and the capacity to undertake widespread attacks. 

DETECT has several models to identify anomalous DoS/DDoS activity:

Darktrace Detection for T1498 (Network Denial of Service)- this is the main technique exploited during DDoS attacks

- Device / Anomaly Indicators / Denial of Service Activity Indicator

- Anomalous Server Activity / Possible Denial of Service Activity

- [If RESPOND is enabled] Antigena / Network / External Threat / Antigena Suspicious Activity Block

What did Darktrace observe?

Darktrace’s cross-fleet detections were largely contrary to expectations. Analysts did not see large-scale complex conflict-linked attacks utilizing either conflict-associated ransomware, malware, or other TTPs. Instead, cyber incidents observed were largely opportunistic, using malware that could be purchased through Malware-as-a-Service models and other widely available toolkits, (rather than APT or conflict-attributable attacks). Overall, this is not to say there have been no repercussions from the conflict or that opportunistic attacks will cease, but evidence suggests that there were fewer wider cyber consequences beyond the initial APT-based attacks seen in the public forum. 

Another trend expected since the beginning of the conflict was targeted responses to sanction announcements focusing on NATO businesses and governments. Analysts, however, saw the limited reactive actions, with little-to-no direct impact from sanction announcements. Although cyber-attacks on some NATO organizations did take place, they were not as widespread or impactful as expected. Lastly, it was thought that exposure to new and sophisticated exploits would increase and be used to weaken NATO nations - especially corporations in critical industries. However, analysts observed relatively common exploits deployed indiscriminately and opportunistically. Overall, with the wider industry expecting chaos, Darktrace analysts did not see the crisis taken advantage of to target wider businesses outside of Ukraine. Based on this comparison between expectations and reality, the conflict has demonstrated the danger of  falling prey to confirmation bias and the need to remain vigilant and expect the unexpected. It may be possible to say that cyberwar is ‘cold’ right now, however the element of surprise is always present, and it is better to be prepared to protect yourself and your organization.    

What to Expect from the Future

As cyberattacks continue to become less monetarily and physically costly, it is to be expected that they will increase in frequency. Even after a political ceasefire is established, hacking groups can harbour resentment and continue their attacks, though possibly on a smaller scale.  

Additionally, the longer this conflict continues, the more sophisticated hacking groups’s attacks may become. In one of their publications, Killnet shared with subscribers that they had created ‘network weaponry’ powerful enough to simultaneously take down five European countries (Figure 4) [20]. Whether or not this claim is true, it is vital to be prepared. The European Union and the United States have supported Ukraine since the start of the invasion, and the EU has also stated that it is considering providing further assistance to help Ukraine in cyberspace [21].

Figure 4- Snapshot of Killnet Telegram announcement

How to Protect Against these Attacks

In the face of wider conflict and cybersecurity tensions, it is crucial that organizations evaluate their security stack and practise the following: 

·       Know what your critical assets are and what software is running on them. 

·       Keep your software up to date. Prioritize patching critical and high vulnerabilities that allow remote code execution. 

·       Enforce Multifactor Authentication (MFA) to the greatest extent possible. 

·       Require the use of a password manager to generate strong and unique passwords for each separate account. 

·       Backup all the essential files on the cloud and external drives and regularly maintain them. 

·       Train your employees to recognize phishing emails, suspicious websites, infected links or other abnormalities to prevent successful compromise of email accounts. 

In order to prevent an organization from suffering damage due to one of the attacks mentioned above, a full-circle approach is needed. This defence starts with a thorough understanding of the attack surface to provide timely mitigation. This can be supported by Darktrace products: 

·       As shown throughout this blog, Darktrace DETECT and Darktrace/Email have several models relating to conflict-associated TTPs and attacks. These help to quickly alert security teams and provide visibility of anomalous behaviors.

·       Darktrace PREVENT/ASM helps to identify vulnerable external-facing assets. By patching and securing these devices, the risk of exploit is drastically reduced.

·       Darktrace RESPOND and RESPOND/Email can make targeted actions to a range of threats such as blocking incoming DDoS connections or locking malicious email links.

Thanks to the Darktrace Threat Intelligence Unit for their contributions to this blog.

Appendices 

Reference List

[1] https://www.atlanticcouncil.org/blogs/ukrainealert/vladimir-putins-ukraine-invasion-is-the-worlds-first-full-scale-cyberwar/ 

[2] https://www.reuters.com/article/us-ukraine-cybersecurity-idUSKCN0VY30K

[3] https://www.reuters.com/article/us-ukraine-cybersecurity-sandworm-idUSKBN0UM00N20160108

[4 & 11] https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ 

[5] https://www.scmagazine.com/analysis/ransomware/despite-hopes-for-decline-ransomware-attacks-increased-during-russia-ukraine-conflict

[6] https://ransomware.org/blog/has-the-ukraine-conflict-disrupted-ransomware-attacks/

[7] https://www.cfr.org/blog/financial-incentives-may-explain-perceived-lack-ransomware-russias-latest-assault-ukraine

[8] https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/ 

[9] https://voi.id/en/technology/138937/hermetica-owner-from-cyprus-didnt-know-his-server-was-used-in-malicious-malware-attack-in-ukraine 

[10] https://www.reuters.com/article/ukraine-crisis-cyber-cyprus-idCAKBN2KT2QI 

[11] https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-ukraine-hit-by-destructive-attacks-before-and-during-the-russian-invasion-with-hermet/ 

[12] https://blog.malwarebytes.com/threat-intelligence/2022/03/hermeticwiper-a-detailed-analysis-of-the-destructive-malware-that-targeted-ukraine/ 

[13] https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ 

[15] https://www.cisa.gov/uscert/ncas/alerts/aa22-057a 

[16] https://attack.mitre.org/groups/G0047/ 

[17] https://cyware.com/news/ukraine-cert-warns-of-increasing-attacks-by-armageddon-group-850081f8 

[18] https://www.bbc.co.uk/news/business-60521822

[19] https://foreignpolicy.com/2022/04/11/russia-cyberwarfare-us-ukraine-volunteer-hackers-it-army/

[20] https://t.me/itarmyofukraine2022

[21] https://www.csoonline.com/article/3664859/russian-ddos-attack-on-lithuania-was-planned-on-telegram-flashpoint-says.html

[19 & 20] https://flashpoint.io/blog/killnet-kaliningrad-and-lithuanias-transport-standoff-with-russia/ 

[21] https://presidence-francaise.consilium.europa.eu/en/news/member-states-united-in-supporting-ukraine-and-strengthening-the-eu-s-telecommunications-and-cybersecurity-resilience/ 

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Rosa Jong
OSINT Analyst
Written by
Taisiia Garkava
Security Analyst

More in this series

No items found.

Blog

/

/

May 16, 2025

Catching a RAT: How Darktrace neutralized AsyncRAT

woman working on laptopDefault blog imageDefault blog image

What is a RAT?

As the proliferation of new and more advanced cyber threats continues, the Remote Access Trojan (RAT) remains a classic tool in a threat actor's arsenal. RATs, whether standardized or custom-built, enable attackers to remotely control compromised devices, facilitating a range of malicious activities.

What is AsyncRAT?

Since its first appearance in 2019, AsyncRAT has become increasingly popular among a wide range of threat actors, including cybercriminals and advanced persistent threat (APT) groups.

Originally available on GitHub as a legitimate tool, its open-source nature has led to widespread exploitation. AsyncRAT has been used in numerous campaigns, including prolonged attacks on essential US infrastructure, and has even reportedly penetrated the Chinese cybercriminal underground market [1] [2].

How does AsyncRAT work?

Original source code analysis of AsyncRAT demonstrates that once installed, it establishes persistence via techniques such as creating scheduled tasks or registry keys and uses SeDebugPrivilege to gain elevated privileges [3].

Its key features include:

  • Keylogging
  • File search
  • Remote audio and camera access
  • Exfiltration techniques
  • Staging for final payload delivery

These are generally typical functions found in traditional RATs. However, it also boasts interesting anti-detection capabilities. Due to the popularity of Virtual Machines (VM) and sandboxes for dynamic analysis, this RAT checks for the manufacturer via the WMI query 'Select * from Win32_ComputerSystem' and looks for strings containing 'VMware' and 'VirtualBox' [4].

Darktrace’s coverage of AsyncRAT

In late 2024 and early 2025, Darktrace observed a spike in AsyncRAT activity across various customer environments. Multiple indicators of post-compromise were detected, including devices attempting or successfully connecting to endpoints associated with AsyncRAT.

On several occasions, Darktrace identified a clear association with AsyncRAT through the digital certificates of the highlighted SSL endpoints. Darktrace’s Real-time Detection effectively identified and alerted on suspicious activities related to AsyncRAT. In one notable incident, Darktrace’s Autonomous Response promptly took action to contain the emerging threat posed by AsyncRAT.

AsyncRAT attack overview

On December 20, 2024, Darktrace first identified the use of AsyncRAT, noting a device successfully establishing SSL connections to the uncommon external IP 185.49.126[.]50 (AS199654 Oxide Group Limited) via port 6606. The IP address appears to be associated with AsyncRAT as flagged by open-source intelligence (OSINT) sources [5]. This activity triggered the device to alert the ‘Anomalous Connection / Rare External SSL Self-Signed' model.

Model alert in Darktrace / NETWORK showing the repeated SSL connections to a rare external Self-Signed endpoint, 185.49.126[.]50.
Figure 1: Model alert in Darktrace / NETWORK showing the repeated SSL connections to a rare external Self-Signed endpoint, 185.49.126[.]50.

Following these initial connections, the device was observed making a significantly higher number of connections to the same endpoint 185.49.126[.]50 via port 6606 over an extended period. This pattern suggested beaconing activity and triggered the 'Compromise/Beaconing Activity to External Rare' model alert.

Further analysis of the original source code, available publicly, outlines the default ports used by AsyncRAT clients for command-and-control (C2) communications [6]. It reveals that port 6606 is the default port for creating a new AsyncRAT client. Darktrace identified both the Certificate Issuer and the Certificate Subject as "CN=AsyncRAT Server". This SSL certificate encrypts the packets between the compromised system and the server. These indicators of compromise (IoCs) detected by Darktrace further suggest that the device was successfully connecting to a server associated with AsyncRAT.

Model alert in Darktrace / NETWORK displaying the Digital Certificate attributes, IP address and port number associated with AsyncRAT.
Figure 2: Model alert in Darktrace / NETWORK displaying the Digital Certificate attributes, IP address and port number associated with AsyncRAT.
Darktrace’s detection of repeated connections to the suspicious IP address 185.49.126[.]50 over port 6606, indicative of beaconing behavior.
Figure 3: Darktrace’s detection of repeated connections to the suspicious IP address 185.49.126[.]50 over port 6606, indicative of beaconing behavior.
Darktrace's Autonomous Response actions blocking the suspicious IP address,185.49.126[.]50.
Figure 4: Darktrace's Autonomous Response actions blocking the suspicious IP address,185.49.126[.]50.

A few days later, the same device was detected making numerous connections to a different IP address, 195.26.255[.]81 (AS40021 NL-811-40021), via various ports including 2106, 6606, 7707, and 8808. Notably, ports 7707 and 8808 are also default ports specified in the original AsyncRAT source code [6].

Darktrace’s detection of connections to the suspicious endpoint 195.26.255[.]81, where the default ports (6606, 7707, and 8808) for AsyncRAT were observed.
Figure 5: Darktrace’s detection of connections to the suspicious endpoint 195.26.255[.]81, where the default ports (6606, 7707, and 8808) for AsyncRAT were observed.

Similar to the activity observed with the first endpoint, 185.49.126[.]50, the Certificate Issuer for the connections to 195.26.255[.]81 was identified as "CN=AsyncRAT Server". Further OSINT investigation confirmed associations between the IP address 195.26.255[.]81 and AsyncRAT [7].

Darktrace's detection of a connection to the suspicious IP address 195.26.255[.]81 and the domain name identified under the common name (CN) of a certificate as AsyncRAT Server
Figure 6: Darktrace's detection of a connection to the suspicious IP address 195.26.255[.]81 and the domain name identified under the common name (CN) of a certificate as AsyncRAT Server.

Once again, Darktrace's Autonomous Response acted swiftly, blocking the connections to 195.26.255[.]81 throughout the observed AsyncRAT activity.

Figure 7: Darktrace's Autonomous Response actions were applied against the suspicious IP address 195.26.255[.]81.

A day later, Darktrace again alerted to further suspicious activity from the device. This time, connections to the suspicious endpoint 'kashuub[.]com' and IP address 191.96.207[.]246 via port 8041 were observed. Further analysis of port 8041 suggests it is commonly associated with ScreenConnect or Xcorpeon ASIC Carrier Ethernet Transport [8]. ScreenConnect has been observed in recent campaign’s where AsyncRAT has been utilized [9]. Additionally, one of the ASN’s observed, namely ‘ASN Oxide Group Limited’, was seen in both connections to kashuub[.]com and 185.49.126[.]50.

This could suggest a parallel between the two endpoints, indicating they might be hosting AsyncRAT C2 servers, as inferred from our previous analysis of the endpoint 185.49.126[.]50 and its association with AsyncRAT [5]. OSINT reporting suggests that the “kashuub[.]com” endpoint may be associated with ScreenConnect scam domains, further supporting the assumption that the endpoint could be a C2 server.

Darktrace’s Autonomous Response technology was once again able to support the customer here, blocking connections to “kashuub[.]com”. Ultimately, this intervention halted the compromise and prevented the attack from escalating or any sensitive data from being exfiltrated from the customer’s network into the hands of the threat actors.

Darktrace’s Autonomous Response applied a total of nine actions against the IP address 191.96.207[.]246 and the domain 'kashuub[.]com', successfully blocking the connections.
Figure 8: Darktrace’s Autonomous Response applied a total of nine actions against the IP address 191.96.207[.]246 and the domain 'kashuub[.]com', successfully blocking the connections.

Due to the popularity of this RAT, it is difficult to determine the motive behind the attack; however, from existing knowledge of what the RAT does, we can assume accessing and exfiltrating sensitive customer data may have been a factor.

Conclusion

While some cybercriminals seek stability and simplicity, openly available RATs like AsyncRAT provide the infrastructure and open the door for even the most amateur threat actors to compromise sensitive networks. As the cyber landscape continually shifts, RATs are now being used in all types of attacks.

Darktrace’s suite of AI-driven tools provides organizations with the infrastructure to achieve complete visibility and control over emerging threats within their network environment. Although AsyncRAT’s lack of concealment allowed Darktrace to quickly detect the developing threat and alert on unusual behaviors, it was ultimately Darktrace Autonomous Response's consistent blocking of suspicious connections that prevented a more disruptive attack.

Credit to Isabel Evans (Cyber Analyst), Priya Thapa (Cyber Analyst) and Ryan Traill (Analyst Content Lead)

Appendices

  • Real-time Detection Models
       
    • Compromise / Suspicious SSL Activity
    •  
    • Compromise / Beaconing Activity To      External Rare
    •  
    • Compromise / High Volume of      Connections with Beacon Score
    •  
    • Anomalous Connection / Suspicious      Self-Signed SSL
    •  
    • Compromise / Sustained SSL or HTTP      Increase
    •  
    • Compromise / SSL Beaconing to Rare      Destination
    •  
    • Compromise / Suspicious Beaconing      Behaviour
    •  
    • Compromise / Large Number of      Suspicious Failed Connections
  •  
  • Autonomous     Response Models
       
    • Antigena / Network / Significant      Anomaly / Antigena Controlled and Model Alert
    •  
    • Antigena / Network / Significant      Anomaly / Antigena Enhanced Monitoring from Client Block

List of IoCs

·     185.49.126[.]50 - IP – AsyncRAT C2 Endpoint

·     195.26.255[.]81 – IP - AsyncRAT C2 Endpoint

·      191.96.207[.]246 – IP – Likely AsyncRAT C2 Endpoint

·     CN=AsyncRAT Server - SSL certificate - AsyncRATC2 Infrastructure

·      Kashuub[.]com– Hostname – Likely AsyncRAT C2 Endpoint

MITRE ATT&CK Mapping:

Tactic –Technique – Sub-Technique  

 

Execution– T1053 - Scheduled Task/Job: Scheduled Task

DefenceEvasion – T1497 - Virtualization/Sandbox Evasion: System Checks

Discovery– T1057 – Process Discovery

Discovery– T1082 – System Information Discovery

LateralMovement - T1021.001 - Remote Services: Remote Desktop Protocol

Collection/ Credential Access – T1056 – Input Capture: Keylogging

Collection– T1125 – Video Capture

Commandand Control – T1105 - Ingress Tool Transfer

Commandand Control – T1219 - Remote Access Software

Exfiltration– T1041 - Exfiltration Over C2 Channel

 

References

[1]  https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/

[2] https://intel471.com/blog/china-cybercrime-undergrond-deepmix-tea-horse-road-great-firewall

[3] https://www.attackiq.com/2024/08/01/emulate-asyncrat/

[4] https://www.fortinet.com/blog/threat-research/spear-phishing-campaign-with-new-techniques-aimed-at-aviation-companies

[5] https://www.virustotal.com/gui/ip-address/185.49.126[.]50/community

[6] https://dfir.ch/posts/asyncrat_quasarrat/

[7] https://www.virustotal.com/gui/ip-address/195.26.255[.]81

[8] https://www.speedguide.net/port.php?port=8041

[9] https://www.esentire.com/blog/exploring-the-infection-chain-screenconnects-link-to-asyncrat-deployment

[10] https://scammer.info/t/taking-out-connectwise-sites/153479/518?page=26

Continue reading
About the author
Isabel Evans
Cyber Analyst

Blog

/

/

May 13, 2025

Revolutionizing OT Risk Prioritization with Darktrace 6.3

man in hard hat on tabletDefault blog imageDefault blog image

Powering smarter protection for industrial systems

In industrial environments, security challenges are deeply operational. Whether you’re running a manufacturing line, a power grid, or a semiconductor fabrication facility (fab), you need to know: What risks can truly disrupt my operations, and what should I focus on first?

Teams need the right tools to shift from reactive defense, constantly putting out fires, to proactively thinking about their security posture. However, most OT teams are stuck using IT-centric tools that don’t speak the language of industrial systems, are consistently overwhelmed with static CVE lists, and offer no understanding of OT-specific protocols. The result? Compliance gaps, siloed insights, and risk models that don’t reflect real-world exposure, making risk prioritization seem like a luxury.

Darktrace / OT 6.3 was built in direct response to these challenges. Developed in close collaboration with OT operators and engineers, this release introduces powerful upgrades that deliver the context, visibility, and automation security teams need, without adding complexity. It’s everything OT defenders need to protect critical operations in one platform that understands the language of industrial systems.

additions to darktrace / ot 6/3

Contextual risk modeling with smarter Risk Scoring

Darktrace / OT 6.3 introduces major upgrades to OT Risk Management, helping teams move beyond generic CVE lists with AI-driven risk scoring and attack path modeling.

By factoring in real-world exploitability, asset criticality, and operational context, this release delivers a more accurate view of what truly puts critical systems at risk.

The platform now integrates:

  • CISA’s Known Exploited Vulnerabilities (KEV) database
  • End-of-life status for legacy OT devices
  • Firewall misconfiguration analysis
  • Incident response plan alignment

Most OT environments are flooded with vulnerability data that lacks context. CVE scores often misrepresent risk by ignoring how threats move through the environment or whether assets are even reachable. Firewalls are frequently misconfigured or undocumented, and EOL (End of Life) devices, some of the most vulnerable, often go untracked.

Legacy tools treat these inputs in isolation. Darktrace unifies them, showing teams exactly which attack paths adversaries could exploit, mapped to the MITRE ATT&CK framework, with visibility into where legacy tech increases exposure.

The result: teams can finally focus on the risks that matter most to uptime, safety, and resilience without wasting resources on noise.

Automating compliance with dynamic IEC-62443 reporting

Darktrace / OT now includes a purpose-built IEC-62443-3-3 compliance module, giving industrial teams real-time visibility into their alignment with regulatory standards. No spreadsheets required!

Industrial environments are among the most heavily regulated. However, for many OT teams, staying compliant is still a manual, time-consuming process.

Darktrace / OT introduces a dedicated IEC-62443-3-3 module designed specifically for industrial environments. Security and operations teams can now map their security posture to IEC standards in real time, directly within the platform. The module automatically gathers evidence across all four security levels, flags non-compliance, and generates structured reports to support audit preparation, all in just a few clicks.Most organizations rely on spreadsheets or static tools to track compliance, without clear visibility into which controls meet standards like IEC-62443. The result is hidden gaps, resource-heavy audits, and slow remediation cycles.

Even dedicated compliance tools are often built for IT, require complex setup, and overlook the unique devices found in OT environments. This leaves teams stuck with fragmented reporting and limited assurance that their controls are actually aligned with regulatory expectations.

By automating compliance tracking, surfacing what matters most, and being purpose built for industrial environments, Darktrace / OT empowers organizations to reduce audit fatigue, eliminate blind spots, and focus resources where they’re needed most.

Expanding protocol visibility with deep insights for specialized OT operations

Darktrace has expanded its Deep Packet Inspection (DPI) capabilities to support five industry-specific protocols, across healthcare, semiconductor manufacturing, and ABB control systems.

The new protocols build on existing capabilities across all OT industry verticals and protocol types to ensure the Darktrace Self-Learning AI TM can learn intelligently about even more assets in complex industrial environments. By enabling native, AI-driven inspection of these protocols, Darktrace can identify both security threats and operational issues without relying on additional appliances or complex integrations.

Most security platforms lack native support for industry-specific protocols, creating critical visibility gaps in customer environments like healthcare, semiconductor manufacturing, and ABB-heavy industrial automation. Without deep protocol awareness, organizations struggle to accurately identify specialized OT and IoT assets, detect malicious activity concealed within proprietary protocol traffic, and generate reliable device risk profiles due to insufficient telemetry.

These blind spots result in incomplete asset inventories, and ultimately, flawed risk posture assessments which over-index for CVE patching and legacy equipment.

By combining protocol-aware detection with full-stack visibility across IT, OT, and IoT, Darktrace’s AI can correlate anomalies across domains. For example, connecting an anomaly from a Medical IoT (MIoT) device with suspicious behavior in IT systems, providing actionable, contextual insights other solutions often miss.

Conclusion

Together, these capabilities take OT security beyond alert noise and basic CVE matching, delivering continuous compliance, protocol-aware visibility, and actionable, prioritized risk insights, all inside a single, unified platform built for the realities of industrial environments.

[related-resource]

Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance
Your data. Our AI.
Elevate your network security with Darktrace AI