Blog
/
/
May 23, 2023

Darktrace’s Detection of a Hive Ransomware-as-Service

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
23
May 2023
This blog investigates a new strain of ransomware, Hive, a ransomware-as-a-service. Darktrace was able to provide full visibility over the attacks.

Update: On January 26, 2023, the Hive ransomware group was dismantled and servers associated with the sale of the ransomware were taken offline following an investigation by the FBI, German law enforcement and the National Crime Agency (NCA). The activity detailed in this blog took place in 2022, whilst the group was still active.

RaaS in Cyber Security

The threat of ransomware continues to be a constant concern for security teams across the cyber threat landscape. With the growing popularity of Ransomware-as-a-Service (RaaS), it is becoming more and more accessible for even inexperienced would-be attackers. As a result of this low barrier to entry, the volume of ransomware attacks is expected to increase significantly.

What’s more, RaaS is a highly tailorable market in which buyers can choose from varied kits and features to use in their ransomware deployments meaning attacks will rarely behave the same. To effectively detect and safeguard against these differentiations, it is crucial to implement security measures that put the emphasis on detecting anomalies and focusing on deviations in expected behavior, rather than relying on depreciated indicators of compromise (IoC) lists or playbooks that focus on attack chains unable to keep pace with the increasing speed of ransomware evolution.

In early 2022, Darktrace DETECT/Network™ identified several instances of Hive ransomware on the networks of multiple customers. Using its anomaly-based detection, Darktrace was able to successfully detect the attacks and multiple stages of the kill chain, including command and control (C2) activity, lateral movement, data exfiltration, and ultimately data encryption and the writing of ransom notes.

Hive Ransomware 

Hive ransomware is a relatively new strain that was first observed in the wild in June 2021. It is known to target a variety of industries including healthcare, energy providers, and retailers, and has reportedly attacked over 1,500 organizations, collecting more than USD 100m in ransom payments [1].

Hive is distributed via a RaaS model where its developers update and maintain the code, in return for a percentage of the eventual ransom payment, while users (or affiliates) are given the tools to carry out attacks using a highly sophisticated and complex malware they would otherwise be unable to use. Hive uses typical tactics, techniques and procedures (TTPs) associated with ransomware, though they do vary depending on the Hive affiliate carrying out the attack.

In most cases a double extortion attack is carried out, whereby data is first exfiltrated and then encrypted before a ransom demand is made. This gives attackers extra leverage as victims are at risk of having their sensitive data leaked to the public on websites such as the ‘HiveLeaks’ TOR website.

Attack Timeline

Owing to the highly customizable nature of RaaS, the tactics and methods employed by Hive actors are expected to differ on a case-by-case basis. Nonetheless in the majority of Hive ransomware incidents identified on Darktrace customer environments, Darktrace DETECT observed the following general attack stages and features. This is possibly indicative of the attacks originating from the same threat actor(s) or from a widely sold batch with a particular configuration to a variety of actors.

Figure 1: A typical timeline of a Hive attack observed by Darktrace.

Initial Access 

Although Hive actors are known to gain initial access to networks through multiple different vectors, the two primary methods reported by security researchers are the exploitation of Microsoft Exchange vulnerabilities, or the distribution of phishing emails with malicious attachments [2][3].

In the early stages of one Hive ransomware attack observed on the network of a Darktrace customer, for example, Darktrace detected a device connecting to the rare external location 23.81.246[.]84, with a PowerShell user agent via HTTP. During this connection, the device attempted to download an executable file named “file.exe”. It is possible that the file was initially accessed and delivered via a phishing email; however, as Darktrace/Email was not enabled at the time of the attack, this was outside of Darktrace’s purview. Fortunately, the connection failed the proxy authentication was thus blocked as seen in the packet capture (PCAP) in Figure 2. 

Shortly after this attempted download, the same device started to receive a high volume of incoming SSL connections from a rare external endpoint, namely 146.70.87[.]132. Darktrace logged that this endpoint was using an SSL certificate signed by Go Daddy CA, an easily obtainable and accessible SSL certificate, and that the increase in incoming SSL connections from this endpoint was unusual behavior for this device. 

It is likely that this highly anomalous activity detected by Darktrace indicates when the ransomware attack began, likely initial payload download.  

Darktrace DETECT models:

  • Anomalous Connection / Powershell to Rare External
  • Anomalous Server Activity / New Internet Facing System
Figure 2: PCAP of the HTTP connection to the rare endpoint 23.81.246[.]84 showing the failed proxy authentication.

C2 Beaconing 

Following the successful initial access, Hive actors begin to establish their C2 infrastructure on infected networks through numerous connections to C2 servers, and the download of additional stagers. 

On customer networks infected by Hive ransomware, Darktrace identified devices initiating a high volume of connections to multiple rare endpoints. This very likely represented C2 beaconing to the attacker’s infrastructure. In one particular example, further open-source intelligence (OSINT) investigation revealed that these endpoints were associated with Cobalt Strike.

Darktrace DETECT models:

  • Anomalous Connection / Multiple Connections to New External TCP
  • Anomalous Server Activity / Anomalous External Activity from Critical Network Device
  • Compromise / High Volume of Connections with Beacon Score
  • Compromise / Sustained SSL or HTTP Increase
  • Compromise / Suspicious HTTP Beacons to Dotted Quad 
  • Compromise / SSL or HTTP Beacon
  • Device / Lateral Movement and C2 Activity

Internal Reconnaissance, Lateral Movement and Privilege Escalation

After C2 infrastructure has been established, Hive actors typically begin to uninstall antivirus products in an attempt to remain undetected on the network [3]. They also perform internal reconnaissance to look for vulnerabilities and open channels and attempt to move laterally throughout the network.

Amid the C2 connections, Darktrace was able to detect network scanning activity associated with the attack when a device on one customer network was observed initiating an unusually high volume of connections to other internal devices. A critical network device was also seen writing an executable file “mimikatz.exe” via SMB which appears to be the Mimikatz attack tool commonly used for credential harvesting. 

There were also several detections of lateral movement attempts via RDP and DCE-RPC where the attackers successfully authenticated using an “Administrator” credential. In one instance, a device was also observed performing ITaskScheduler activity. This service is used to remotely control tasks running on machines and is commonly observed as part of malicious lateral movement activity. Darktrace DETECT understood that the above activity represented a deviation from the devices’ normal pattern of behavior and the following models were breached:

Darktrace DETECT models:

  • Anomalous Connection / Anomalous DRSGetNCChanges Operation
  • Anomalous Connection / New or Uncommon Service Control
  • Anomalous Connection / Unusual Admin RDP Session
  • Anomalous Connection / Unusual SMB Version 1 Connectivity
  • Compliance / SMB Drive Write
  • Device / Anomalous ITaskScheduler Activity
  • Device / Attack and Recon Tools
  • Device / Attack and Recon Tools In SMB
  • Device / EXE Files Distributed to Multiple Devices
  • Device / Suspicious Network Scan Activity
  • Device / Increase in New RPC Services
  • User / New Admin Credentials on Server

Data Exfiltration

At this stage of the attack, Hive actors have been known to carry out data exfiltration activity on infected networks using a variety of different methods. The Cybersecurity & Infrastructure Security Agency (CISA) reported that “Hive actors exfiltrate data likely using a combination of Rclone and the cloud storage service Mega[.]nz” [4]. Darktrace DETECT identified an example of this when a device on one customer network was observed making HTTP connections to endpoints related to Mega, including “w.apa.mega.co[.]nz”, with the user agent “rclone/v1.57.0” with at least 3 GiB of data being transferred externally (Figure 3). The same device was also observed transferring at least 3.6 GiB of data via SSL to the rare external IP, 158.51.85[.]157.

Figure 3: A summary of a device’s external connections to multiple endpoints and the respective amounts of data exfiltrated to Mega storage endpoints.

In another case, a device was observed uploading over 16 GiB of data to a rare external endpoint 93.115.27[.]71 over SSH. The endpoint in question was seen in earlier beaconing activity suggesting that this was likely an exfiltration event. 

However, Hive ransomware, like any other RaaS kit, can differ greatly in its techniques and features, and it is important to note that data exfiltration may not always be present in a Hive ransomware attack. In one incident detected by Darktrace, there were no signs of any data leaving the customer environment, indicating data exfiltration was not part of the Hive actor’s objectives.

Darktrace DETECT models:

  • Anomalous Connection / Data Sent to Rare Domain
  • Anomalous Connection / Lots of New Connections
  • Anomalous Connection / Multiple HTTP POSTs to Rare Hostname
  • Anomalous Connection / Suspicious Self-Signed SSL
  • Anomalous Connection / Uncommon 1 GiB Outbound
  • Device / New User Agent and New IP
  • Unusual Activity / Unusual External Data to New Endpoints
  • Unusual Activity / Unusual External Data Transfer
  • Unusual Activity / Enhanced Unusual External Data Transfer

Ransomware Deployment

In the final stage of a typical Hive ransomware attack, the ransomware payload is deployed and begins to encrypt files on infected devices. On one customer network, Darktrace detected several devices connecting to domain controllers (DC) to read a file named “xxx.exe”. Several sources have linked this file name with the Hive ransomware payload [5].

In another example, Darktrace DETECT observed multiple devices downloading the executable files “nua64.exe” and “nua64.dll” from a rare external location, 194.156.90[.]25. OSINT investigation revealed that the files are associated with Hive ransomware.

Figure 4: Security vendor analysis of the malicious file hash [6] associated with Hive ransomware. 

Shortly after the download of this executable, multiple devices were observed performing an unusual amount of file encryption, appending randomly generated strings of characters to file extensions. 

Although it has been reported that earlier versions of Hive ransomware encrypted files with a “.hive” extension [7], Darktrace observed across multiple customers that encrypted files had extensions that were partially-randomized, but consistently 20 characters long, matching the regular expression “[a-zA-Z0-9\-\_]{8}[\-\_]{1}[A-Za-z0-9\-\_]{11}”.

Figure 5: Device Event Log showing SMB reads and writes of encrypted files with a randomly generated extension of 20 characters. 

Following the successful encryption of files, Hive proceeds to drop a ransom note, named “HOW_TO_DECRYPT.txt”, into each affected directory. Typically, the ransom note will contain a link to Hive’s “sales department” and, in the event that exfiltration took place, a link to the “HiveLeaks” site, where attackers threaten to publish exfiltrated data if their demands are not met (Figure 6).  In cases of Hive ransomware detected by Darktrace, multiple devices were observed attempting to contact “HiveLeaks” TOR domains, suggesting that endpoint users had followed links provided to them in ransom notes.

Figure 6: Sample of a Hive ransom note [4].

Examples of file extensions:

  • 36C-AT9-_wm82GvBoCPC
  • 36C-AT9--y6Z1G-RFHDT
  • 36C-AT9-_x2x7FctFJ_q
  • 36C-AT9-_zK16HRC3QiL
  • 8KAIgoDP-wkQ5gnYGhrd
  • kPemi_iF_11GRoa9vb29
  • kPemi_iF_0RERIS1m7x8
  • kPemi_iF_7u7e5zp6enp
  • kPemi_iF_y4u7pB3d3f3
  • U-9Xb0-k__T0U9NJPz-_
  • U-9Xb0-k_6SkA8Njo5pa
  • zm4RoSR1_5HMd_r4a5a9 

Darktrace DETECT models:

  • Anomalous Connection / SMB Enumeration
  • Anomalous Connection / Sustained MIME Type Conversion
  • Anomalous Connection / Unusual Admin SMB Session
  • Anomalous File / Internal / Additional Extension Appended to SMB File
  • Compliance / SMB Drive Write
  • Compromise / Ransomware / Suspicious SMB Activity
  • Compromise / Ransomware / Ransom or Offensive Words Written to SMB
  • Compromise / Ransomware / Possible Ransom Note Write
  • Compromise / High Priority Tor2Web
  • Compromise / Tor2Web
  • Device / EXE Files Distributed to Multiple Devices

Conclusion

As Hive ransomware attacks are carried out by different affiliates using varying deployment kits, the tactics employed tend to vary and new IoCs are regularly identified. Furthermore, in 2022 a new variant of Hive was written using the Rust programming language. This represented a major upgrade to Hive, improving its defense evasion techniques and making it even harder to detect [8]. 

Hive is just one of many RaaS offerings currently on the market, and this market is only expected to grow in usage and diversity of presentations.  As ransomware becomes more accessible and easier to deploy it is essential for organizations to adopt efficient security measures to identify ransomware at the earliest possible stage. 

Darktrace DETECT’s Self-Learning AI understands customer networks and learns the expected patterns of behavior across an organization’s digital estate. Using its anomaly-based detection Darktrace is able to identify emerging threats through the detection of unusual or unexpected behavior, without relying on rules and signatures, or known IoCs. 

Credit to: Emily Megan Lim, Cyber Analyst, Hyeongyung Yeom, Senior Cyber Analyst & Analyst Team Lead.

Appendices

MITRE AT&CK Mapping

Reconnaissance

T1595.001 – Scanning IP Blocks

T1595.002 – Vulnerability Scanning

Resource Development

T1583.006 – Web Services

Initial Access

T1078 – Valid Accounts

T1190 – Exploit Public-Facing Application

T1200 – Hardware Additions

Execution

T1053.005 – Scheduled Task

T1059.001 – PowerShell

Persistence/Privilege Escalation

T1053.005 – Scheduled Task

T1078 – Valid Accounts

Defense Evasion

T1078 – Valid Accounts

T1207 – Rogue Domain Controller

T1550.002 – Pass the Hash

Discovery

T1018 – Remote System Discovery

T1046 – Network Service Discovery

T1083 – File and Directory Discovery

T1135 – Network Share Discovery

Lateral Movement

T1021.001 – Remote Desktop Protocol

T1021.002 – SMB/Windows Admin Shares

T1021.003 – Distributed Component Object Model

T1080 – Taint Shared Content

T1210 – Exploitation of Remote Services

T1550.002 – Pass the Hash

T1570 – Lateral Tool Transfer

Collection

T1185 – Man in the Browser

Command and Control

T1001 – Data Obfuscation

T1071 – Application Layer Protocol

T1071.001 – Web Protocols

T1090.003 – Multi-hop proxy

T1095 – Non-Application Layer Protocol

T1102.003 – One-Way Communication

T1571 – Non-Standard Port

Exfiltration

T1041 – Exfiltration Over C2 Channel

T1567.002 – Exfiltration to Cloud Storage

Impact

T1486 – Data Encrypted for Impact

T1489 – Service Stop

List of IoCs 

23.81.246[.]84 - IP Address - Likely Malicious File Download Endpoint

146.70.87[.]132 - IP Address - Possible Ransomware Endpoint

5.199.162[.]220 - IP Address - C2 Endpoint

23.227.178[.]65 - IP Address - C2 Endpoint

46.166.161[.]68 - IP Address - C2 Endpoint

46.166.161[.]93 - IP Address - C2 Endpoint

93.115.25[.]139 - IP Address - C2 Endpoint

185.150.1117[.]189 - IP Address - C2 Endpoint

192.53.123[.]202 - IP Address - C2 Endpoint

209.133.223[.]164 - IP Address - Likely C2 Endpoint

cltrixworkspace1[.]com - Domain - C2 Endpoint

vpnupdaters[.]com - Domain - C2 Endpoint

93.115.27[.]71 - IP Address - Possible Exfiltration Endpoint

158.51.85[.]157 - IP Address - Possible Exfiltration Endpoint

w.api.mega.co[.]nz - Domain - Possible Exfiltration Endpoint

*.userstorage.mega.co[.]nz - Domain - Possible Exfiltration Endpoint

741cc67d2e75b6048e96db9d9e2e78bb9a327e87 - SHA1 Hash - Hive Ransomware File

2f9da37641b204ef2645661df9f075005e2295a5 - SHA1 Hash - Likely Hive Ransomware File

hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd[.]onion - TOR Domain - Likely Hive Endpoint

References

[1] https://www.justice.gov/opa/pr/us-department-justice-disrupts-hive-ransomware-variant

[2] https://www.varonis.com/blog/hive-ransomware-analysis

[3] https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-hive 

[4]https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a

[5] https://www.trendmicro.com/en_us/research/22/c/nokoyawa-ransomware-possibly-related-to-hive-.html

[6] https://www.virustotal.com/gui/file/60f6a63e366e6729e97949622abd9de6d7988bba66f85a4ac8a52f99d3cb4764/detection

[7] https://heimdalsecurity.com/blog/what-is-hive-ransomware/

[8] https://www.microsoft.com/en-us/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/ 

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Emily Megan Lim
Cyber Analyst
Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

Network

/

February 7, 2025

RansomHub revisited: New front-runner in the ransomware-as-a-service marketplace

Default blog imageDefault blog image

In a previous Inside the SOC blog, Darktrace investigated RansomHub and its growing impact on the threat landscape due to its use by the ShadowSyndicate threat group. Here, RansomHub is revisited with new insights on this ransomware-as-a-service (RaaS) platform that has rapidly gained traction among threat actors of late.

In recent months, Darktrace’s Threat Research team has noted a significant uptick in potential compromises affecting the fleet, indicating that RansomHub is becoming a preferred tool for cybercriminals.  This article delves into the increasing adoption of RansomHub, the tactics, techniques, and procedures (TTPs) employed by its affiliates, and the broader implications for organizations striving to protect their systems.

RansomHub overview & background

One notable threat group to have transitioned from ALPHV (BlackCat)-aligned operations to RansomHub-aligned operations is ScatteredSpider [1]. The adoption of RansomHub by ScatteredSpider and other threat actors suggests a possible power shift among threat groups, given the increasing number of cybercriminals adopting it, including those who previously relied on ALPHV’s malware code [2].

ALPHV was a RaaS strain used by cybercriminals to breach Change Healthcare in February 2024 [2]. However, there are claims that the ransom payment never reached the affiliate using ALPHV, leading to a loss of trust in the RaaS. Around the same time, Operation Cronos resulted in the shutdown of LockBit and the abandonment of its affiliates [2]. Consequently, RansomHub emerged as a prominent RaaS successor.

RansomHub targets

The RansomHub ransomware group has been observed targeting various sectors, including critical infrastructure, financial and government services, and the healthcare sector [4]. They use ransomware variants rewritten in GoLang to target both Windows and Linux systems [5]. RansomHub is known for employing double extortion attacks, encrypting data using “Curve25519” encryption [6].

RansomHub tactics and techniques

The attackers leverage phishing attacks and social engineering techniques to lure their victims. Once access is gained, they use sophisticated tools to maintain control over compromised networks and exploit vulnerabilities in systems like Windows, Linux, ESXI, and NAS.

In more recent RansomHub attacks, tools such as Atera and Splashtop have been used to facilitate remote access, while NetScan has been employed to discover and retrieve information about network devices [7].

External researchers have observed that RansomHub uses several legitimate tools, or a tactic known as Living-off-the-Land (LOTL), to carry out their attacks. These tools include:

  • SecretServerSecretStealer: A PowerShell script that allows for the decryption of passwords [1].
  • Ngrok: A legitimate reverse proxy tool that creates a secure tunnel to servers located behind firewalls, used by the group for lateral movement and data exfiltration.
  • Remmina: An open-source remote desktop client for POSIX-based operating systems, enabling threat actors to access remote services [1].

By using these legitimate tools instead of traditional malware, RansomHub can avoid detection and maintain a lower profile during their operations.

Darktrace’s Coverage of RansomHub

Darktrace’s Security Operations Center (SOC) detected several notable cases of likely RansomHub activity across the customer base in recent months. In all instances, threat actors performed network scanning and brute force activities.

During the investigation of a confirmed RansomHub attack in January 2025, the Darktrace Threat Research team identified multiple authentication attempts as attackers tried to retrieve valid credentials. It is plausible that the attackers gained entry to customer environments through their Remote Desktop (RD) web server. Following this, various RDP connections were made to pivot to other devices within the network.

The common element among the cases investigated was that, in most instances, devices were seen performing outgoing connections to splashtop[.]com, a remote access and support software service, after the scanning activity had occurred. On one customer network, following this activity, the same device was seen connecting to the domain agent-api[.]atera[.]com and IP 20.37.139[.]187, which are seemingly linked to Atera, a Remote Monitoring and Management (RMM) tool.

Model Alert Log of an affected device making connections to *atera[.]com.
Figure 1: Model Alert Log of an affected device making connections to *atera[.]com.

In a separate case, a Darktrace observed a device attempting to perform SMB scanning activity, trying to connect to multiple internal devices over port 445. Cyber AI Analyst was able to detect and correlate these individual connections into a single reconnaissance incident.

Similar connections to Remote Monitoring and Management (RMM) tools were also detected in a different customer environment, as alerted by Darktrace’s SOC. Unusual connections to Splashtop and Atera were made from the alerted device. Following this, the same device was observed sending a large volume of data over SSH Rclone to a rare external endpoint on the unusual port 448, triggered multiple models in Darktrace / NETWORK.

Advanced Search graph demonstrating the rarity of the  external IP 38.244.145[.]85  used for data exfiltration.
Figure 2: Advanced Search graph demonstrating the rarity of the  external IP 38.244.145[.]85  used for data exfiltration.
Model Alert Log displaying information related to the suspicious IP, including the port used and its rarity for the network.
Figure 3: Model Alert Log displaying information related to the suspicious IP, including the port used and its rarity for the network.

In the cases observed, data exfiltration occurred alongside the encryption of files likely indicating double extortion tactics. In September 2024, the Darktrace’s Threat Research team identified a 6-digit alphanumeric additional extension similar to “.293ac3”. This case was closely linked to a RansomHub attack, which was also analyzed in a different blog post by Darktrace [8].

Event Log displaying the extension “.293ac3” being appended to encrypted files on an affected customer network.
Figure 4: Event Log displaying the extension “.293ac3” being appended to encrypted files on an affected customer network.

Conclusion

RansomHub exemplifies the evolving RaaS ecosystem, where threat actors capitalize on ready-made platforms to launch sophisticated attacks with ease. The activities observed highlight its growing popularity among cybercriminals. The analysis showed that the different attacks investigated followed a similar pattern of activity.

First, attackers perform reconnaissance activities, including widespread scanning from multiple devices and reverse DNS sweeps. They then use high-privileged credentials to pivot among devices and establish remote connections using RMM tools such as Atera. A common element among most attacks that reached the data encryption stage is the use of a 6-digit alphanumeric extension.

In all cases, Darktrace alerted on the unusual activities observed, creating not only model alerts but also Cyber AI Analyst incidents. Both Darktrace Security Operations Support and Darktrace Managed Threat Detection services provided 24/7 assistance to clients affected by RansomHub. The analyst team continued investigating these incidents, gathering data and IoCs seen in the RansomHub incidents, providing valuable insight and guidance throughout the process.

As RansomHub continues to gain traction, it serves as a stark reminder of the need for robust cybersecurity measures, proactive threat intelligence, and continued vigilance.

Credit to Maria Geronikolou (Cyber Analyst) and Nahisha Nobregas (Senior Cyber Analyst)

Appendices

Darktrace Model Detections

Network Reconnaissance

o   Device / Network Scan

o   Device / ICMP Address Scan

o   Device / RDP Scan

o   Device / Anomalous LDAP Root Searches

o   Anomalous Connection / SMB Enumeration

o   Device / Spike in LDAP Activity

o   Device / Suspicious Network Scan Activity

Lateral Movement

o   Device / Multiple Lateral Movement Model Alerts

o   Device / Increase in New RPC Services

o   Device / New or Uncommon WMI Activity

o   Device / Possible SMB/NTLM Brute Force

o   Device / SMB Session Brute Force (Non-Admin)

o   Device / Anomalous NTLM Brute Force

o   Compliance / Default Credential Usage

o   Compliance / Outgoing NTLM Request from DC

C2 Activity

o   Anomalous Server Activity / Outgoing from Server

o   Anomalous Connection / Multiple Connections to New External TCP Port

o   Unusual Activity / Unusual External Activity

o   Compliance / Remote Management Tool On Server

Data Exfiltration

o   Unusual Activity / Enhanced Unusual External Data Transfer

o   Anomalous Connection / Outbound SSH to Unusual Port

o   Compliance / SSH to Rare External Destination

o   Unusual Activity / Unusual External Data to New Endpoint

o   Unusual Activity / Unusual External Data Transfer

o   Attack Path Modelling / Unusual Data Transfer on Critical Attack Path

o   Compliance / Possible Unencrypted Password File On Server

Autonomous Response Models

-       Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

-       Antigena/Network/Insider Threat/Antigena SMB Enumeration Block

-       Antigena / Network / Significant Anomaly / Antigena Alerts Over Time Block

-       Antigena / Network / Significant Anomaly / Antigena Controlled and Model Alert

List of Indicators of Compromise (IoCs)

o   38.244.145[.]85

o   20.37.139[.]187 agent-api.atera[.]com

o   108.157.150[.]120 ps.atera[.]com

o   st-v3-univ-srs-win-3720[.]api[.]splashtop[.]com

MITRE ATT&CK Mapping

  • RECONNAISSANCE T1592.004
  • RECONNAISSANCE T1595.002
  • DISCOVERY T1046
  • DISCOVERY T1083
  • DISCOVERY T1135
  • DISCOVERY T1018
  • INITIAL ACCESS T1190
  • CREDENTIAL ACCESS T1110
  • LATERAL MOVEMENT T1210
  • COMMAND AND CONTROL T1001
  • EXFILTRATION T1041
  • EXFILTRATION T1567.002

References

[1] https://www.guidepointsecurity.com/blog/worldwide-web-an-analysis-of-tactics-and-techniques-attributed-to-scattered-spider/

[2] https://www.theregister.com/2024/07/16/scattered_spider_ransom/

[3] https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/

[4] https://thehackernews.com/2024/09/ransomhub-ransomware-group-targets-210.html

[5] https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomhub

[6] https://areteir.com/article/malware-spotlight-ransomhub-ransomware/
[7] https://www.security.com/threat-intelligence/ransomhub-knight-ransomware

[8] https://darktrace.com/blog/ransomhub-ransomware-darktraces-investigation-of-the-newest-tool-in-shadowsyndicates-arsenal

Continue reading
About the author
Maria Geronikolou
Cyber Analyst

Blog

/

Network

/

February 6, 2025

Reimagining Your SOC: Unlocking a Proactive State of Security

Default blog imageDefault blog image

Part 1: How to Achieve Proactive Network Security

Part 2: Overcoming Alert Fatigue with AI-Led Investigations  

While the success of a SOC team is often measured through incident management effectiveness (E.g MTTD, MTTR), a true measure of maturity is the reduction of annual security incidents.

Organizations face an increasing number of alerts each year, yet the best SOC teams place focus on proactive operations which don’t reduce the threshold for what becomes an incident but targets the source risks that prevent them entirely.

Freeing up time to focus on cyber risk management is a challenge in and of itself, we cover this in the previous two blogs in this series (see above). However, when the time comes to manage risk, there are several challenges that are unique when compared to detection & response functions within cybersecurity.

Why do cyber risks matter?

While the volume of reported CVEs is increasing at an alarming rate[1], determining the criticality of each vulnerability is becoming increasingly challenging, especially when the likelihood and impact may be different for each organization. Yet vulnerabilities have stood as an important signpost in traditional security and mitigation strategies. Now, without clear prioritization, potentially severe risks may go unreported, leaving organizations exposed to significant threats.

Vulnerabilities also represent just one area of potential risks. Cyberattacks are no longer confined to a single technology type. They now traverse various platforms, including cloud services, email systems, and networks. As technology infrastructure continues to expand, so does the attack surface, making comprehensive visibility across all technology types essential for reducing risk and preventing multi-vector attacks.

However, achieving this visibility is increasingly difficult as infrastructure grows and the cyber risk market remains oversaturated. This visibility challenge extends beyond technology to include personnel and individual cyber hygiene which can still exacerbate broader cyberattacks whether malicious or not.

Organizations must adopt a holistic approach to preventative security. This includes improving visibility across all technology types, addressing human risks, and mobilizing swiftly against emerging security gaps.

“By 2026, 60% of cybersecurity functions will implement business-impact-focused risk assessment methods, aligning cybersecurity strategies with organizational objectives.” [2]

The costs of a fragmented approach

siloed preventative security measures or technologies
Figure 1: Organizations may have a combination of siloed preventative security measures or technologies in place

Unlike other security tools (like SIEM, NDR or SOAR) which contain an established set of capabilities, cyber risk reduction has not traditionally been defined by a single market, rather a variety of products and practices that each provide their own value and are overwhelming if too many are adopted. Just some examples include:

  • Threat and Vulnerability management: Leverages threat intelligence, CVEs and asset management; however, leaves teams with significant patching workflows, ignores business & human factors and is reliant on the speed of teams to keep up with each passing update.  
  • Continuous Controls Monitoring (CCM): Automatically audits the effectiveness of security controls based on industry frameworks but requires careful prioritization and human calculations to set-up effectively. Focuses solely on mobilization.
  • Breach and Attack Simulation (BAS): Automates security posture testing through mock scenarios but require previous prioritization and might not tell you how your specific technologies can be mitigated to reduce that risk.
  • Posture Management technologies: Siloed approaches across Cloud, SaaS, Data Security and even Gen AI that reactively assess misconfigurations and suggest improvements but with only industry frameworks to validate the importance of the risks.
  • Red teaming & Penetration testing: Required by several regulations including (GDPR, HIPPA, PCI, DSS), many organizations hire 'red teams' to perform real breaches in trusted conditions. Penetration tests reveal many flaws, but are not continuous, requiring third-party input and producing long to-do lists with input of broader business risk dependent on the cost of the service.
  • Third-party auditors: Organizations also use third-party auditors to identify assets with vulnerabilities, grade compliance, and recommend improvements. At best, these exercises become tick-box exercises for companies to stay in compliance with the responsibility still on the client to perform further discovery and actioning.

Many of these individual solutions on the market offer simple enhancement, or an automated version of an existing human security task. Ultimately, they lack an understanding of the most critical assets at your organization and are limited in scope, only working in a specific technology area or with the data you provide.

Even when these strategies are complete, implementation of the results require resources, coordination, and buy-in from IT, cybersecurity, and compliance departments. Given the nature of modern business structures, this can be labor and time intensive as responsibilities are shared by organizational segmentation spread across IT, governance, risk and compliance (GRC), and security teams.

Prioritize your true cyber risk with a CTEM approach

Organizations with robust security programs benefit from well-defined policies, standards, key risk indicators (KRIs), and operational metrics, making it easier to measure and report cyber risk accurately.

Implementing a framework like Gartner’s CTEM (Continuous Threat Exposure Management) can help governance by defining the most relevant risks to each organization and which specific solutions meet your improvement needs.

This five-step approach—scoping, discovery, prioritization, validation, and mobilization—encourages focused management cycles, better delegation of responsibilities and a firm emphasis on validating potential risks through technological methods like attack path modeling or breach and attack simulation to add credibility.

Implementing CTEM requires expertise and structure. This begins with an exposure management solution developed uniquely alongside a core threat detection and response offering, to provide visibility of an organization’s most critical risks, whilst linking directly to their incident-based workflows.

“By 2026, organizations prioritizing their security investments, based on a continuous threat exposure management program, will realize a two-third reduction in breaches.” [3]

Achieving a proactive security posture across the whole estate

Unlike conventional tools that focus on isolated risks, Darktrace / Proactive Exposure Management breaks down traditional barriers. Teams can define risk scopes with full, prioritized visibility of the critical risks between: IT/OT networks, email, Active Directory, cloud resources, operational groups, (or even the external attack surface by integrating with Darktrace / Attack Surface Management).

Our innovative, AI-led risk discovery provides a view that mirrors actual attacker methodologies. It does this through advanced algorithms that determine risk based on business importance, rather than traditional device-type prioritization. By implementing a sophisticated damage assessment methodology, security teams don’t just prioritize via severity but instead, the inherent impact, damage, weakness and external exposure of an asset or user.

These calculations also revolutionize vulnerability management by combining industry standard CVE measurements with that organization-specific context to ensure patch management efforts are efficient, rather than an endless list.

Darktrace also integrates MITRE ATT&CK framework mappings to connect all risks through attack path modeling. This offers validation to our AI’s scoring by presenting real world incident scenarios that could occur across your technologies, and the actionable mitigations to mobilize against them.

For those human choke points, security may also deploy targeted phishing engagements. These send real but harmless email ‘attacks’ to test employee susceptibility, strengthening your ability to identify weak points in your security posture, while informing broader governance strategies.

Combining risk with live detection and response

Together, each of these capabilities let teams take the best steps towards reducing risk and the volume of incidents they face. However, getting proactive also sharpens your ability to handle live threats if they occur.  

During real incidents Darktrace users can quickly evaluate the potential impact of affected assets, create their own risk detections based on internal policies, strengthen their autonomous response along critical attack paths, or even see the possible stage of the next attack.

By continually ingesting risk information into live triage workflows, security teams will develop a proactive-first mindset, prioritizing the assets and alerts that have the most impact to the business. This lets them utilize their resource in the most efficient way, freeing up even more time for risk management, mitigation and ensuring continuity for the business.

Whether your organization is laying the foundation for a cybersecurity program or enhancing an advanced one, Darktrace’s self-learning AI adapts to your needs:

  • Foundational stage: For organizations establishing visibility and automating detection and response.
  • Integrated stage: For teams expanding coverage across domains and consolidating tools for simplicity.
  • Proactive stage: For mature security programs enhancing posture with vulnerability management and risk prioritization.

The Darktrace ActiveAI Security Platform empowers security teams to adopt a preventative defense strategy by using Cyber AI Analyst and autonomous response to fuel quicker triage, incident handling and give time back for proactive efforts designed around business impact. The platform encapsulates the critical capabilities that help organizations be proactive and stay ahead of evolving threats.

darktrace proactive exposure management solution brief reduce risk cyber risk

Download the solution brief

Maximize security visibility and reduce risk:

  • Unify risk exposure across all technologies with AI-driven scoring for CVEs, human communications, and architectures.
  • Gain cost and ROI insights on CVE risks, breach costs, patch latency, and blind spots.
  • Strengthen employee awareness with targeted phishing simulations and training.
  • Align proactive and reactive security by assessing device compromises and prevention strategies.
  • Reduce risk with tailored guidance that delivers maximum impact with minimal effort.

Take control of your security posture today. Download here!

References

[1] https://nvd.nist.gov/vuln/search, Search all, Statistics, Total matches By Year 2023 against 2024

[2] https://www.gartner.com/en/documents/5598859

[3] https://www.gartner.com/en/articles/gartner-top-10-strategic-technology-trends-for-2024

Continue reading
About the author
Gabriel Few-Wiegratz
Product Marketing Manager, Exposure Management and Incident Readiness
Your data. Our AI.
Elevate your network security with Darktrace AI