Introduction: Darktrace’s threat research

Defenders must understand the threat landscape in order to protect against it. They can do that with threat intelligence.

Darktrace approaches threat intelligence with a unique perspective. Unlike traditional security vendors that rely on established patterns from past incidents, it uses a strategy that is rooted in the belief that identifying behavioral anomalies is crucial for identifying both known and novel threats.

For Darktrace analysts and researchers, the incidents detected by the AI solution mark the beginning of a deeper investigation, aiming to connect mitigated threats to wider trends from across the threat landscape. Through hindsight analysis, the Darktrace Threat Research team has highlighted numerous threats, including zero-day, n-day, and other novel attacks, showcasing their evolving nature and Darktrace’s ability to identify them.

In 2024, the Threat Research team observed major trends around vulnerabilities in internet-facing systems, new and re-emerging ransomware strains, and sophisticated email attacks. Read on to discover some of our key insights into the current cybersecurity threat landscape.

Multiple campaigns target vulnerabilities in internet-facing systems

It is increasingly common for threat actors to identify and exploit newly discovered vulnerabilities in widely used services and applications, and in some cases, these vulnerability exploitations occur within hours of disclosure.

In 2024, the most significant campaigns observed involved the ongoing exploitation of zero-day and n-day vulnerabilities in edge and perimeter network technologies. In fact, in the first half of the year, 40% of all identified campaign activity came from the exploitation of internet-facing devices. Some of the most common exploitations involved Ivanti Connect Secure (CS) and Ivanti Policy Secure (PS) appliances, Palo Alto Network (PAN-OS) firewall devices, and Fortinet appliances.

Darktrace helps security teams identify suspicious behavior quickly, as demonstrated with the critical vulnerability in PAN-OS firewall devices. The vulnerability was publicly disclosed on April 11, 2024, yet with anomaly-based detection, Darktrace’s Threat Research team was able to identify a range of suspicious behavior related to exploitation of this vulnerability, including command-and-control (C2) connectivity, data exfiltration, and brute-forcing activity, as early as March 26.

That means that Darktrace and our Threat Research team detected this Common Vulnerabilities and Exposure (CVE) exploitation 16 days before the vulnerability was disclosed. Addressing critical vulnerabilities quickly massively benefits security, as teams can reduce their effectiveness by slowing malicious operations and forcing attackers to pursue more costly and time-consuming methods.

Persistent ransomware threats continue to evolve

The continued adoption of the Ransomware-as-a-Service (RaaS) model provides even less experienced threat actors with the tools needed to carry out disruptive attacks, significantly lowering the barrier to entry.

The Threat Research team tracked both novel and re-emerging strains of ransomware across the customer fleet, including Akira, LockBit, and Lynx. Within these ransomware attempts and incidents, there were notable trends in attackers’ techniques: using phishing emails as an attack vector, exploiting legitimate tools to mask C2 communication, and exfiltrating data to cloud storage services.

Read the Annual 2024 Threat Report for the complete list of prominent ransomware actors and their commonly used techniques.

Onslaught of email threats continues

With a majority of attacks originating from email, it is crucial that organizations secure the inboxes and beyond.

Between December 21, 2023, and December 18, 2024, Darktrace / EMAIL detected over 30.4 million phishing emails across the fleet. Of these, 70% successfully bypassed Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification checks and 55% passed through all other existing layers of customer email security.

The abuse of legitimate services and senders continued to be a significant method for threat actors throughout 2024. By leveraging trusted platforms and domains, malicious actors can bypass traditional security measures and increase the likelihood of their phishing attempts being successful.

This past year, there was a substantial use of legitimately authenticated senders and previously established domains, with 96% of phishing emails detected by Darktrace / EMAIL utilizing existing domains rather than registering new ones.

These are not the only types of email attacks we observed. Darktrace detected over 2.7 million emails with multistage payloads.

While most traditional cybersecurity solutions struggle to cover multiple vectors and recognize each stage of complex attacks as part of wider malicious activity, Darktrace can detect and respond across email, identities, network, and cloud.

Conclusion

The Darktrace Threat Research team continues to monitor the ever-evolving threat landscape. Major patterns over the last year have revealed the importance of fast-acting, anomaly-based detection like Darktrace provides.

For example, response speed is essential when campaigns target vulnerabilities in internet-facing systems, and these vulnerabilities can be exploited by attackers within hours of their disclosure if not even before that.

Similarly, anomaly-based detection can identify hard to find threats like ransomware attacks that increasingly use living-off-the-land techniques and legitimate tools to hide malicious activity. A similar pattern can be found in the realm of email security, where attacks are also getting harder to spot, especially as they frequently exploit trusted senders, use redirects via legitimate services, and craft attacks that bypass DMARC and other layers of email security.

As attacks appear with greater complexity, speed, and camouflage, defenders must have timely detection and containment capabilities to handle all emerging threats. These hard-to-spot attacks can be identified and stopped by Darktrace.

Download the full report

Discover the latest threat landscape trends and recommendations from the Darktrace Threat Research team.

What are APTs?

An Advanced Persistent Threat (APT) describes an adversary with sophisticated levels of expertise and significant resources, with the ability to carry out targeted cyber campaigns. These campaigns may penetrate an organization and remain undetected for long periods, allowing attackers to gather intelligence or cause damage over time.

Over the last few decades, the term APT has evolved from being almost exclusively associated with nation-state actors to a broader definition that includes highly skilled, well-resourced threat groups. While still distinct from mass, opportunistic cybercrime or "spray and pray" attacks, APT now refers to the elite tier of adversaries, whether state-sponsored or not, who demonstrate advanced capabilities, persistence, and a clear strategic focus. This shift reflects the growing sophistication of cyber threats, where non-state actors can now rival nation-states in executing covert, methodical intrusions to achieve long-term objectives.

These attacks are resource-intensive for threat actors to execute, but the potential rewards—ranging from financial gain to sensitive data theft—can be significant. In 2020, Business Email Compromise (BEC) attacks netted cybercriminals over $1.8 billion.¹

And recently, the advent of AI has helped to automate launching these attacks, lowering the barriers to entry and making it more efficient to orchestrate the kind of attack that might previously have taken weeks to create. Research shows that AI can do 90% of a threat actor’s work² – reducing time-to-target by automating tasks rapidly and avoiding errors in phishing communications. Email remains the most popular vector for initiating these sophisticated attacks, making it a critical battleground for cyber defense.

What makes APTs so successful?

The success of Advanced Persistent Threats (APTs) lies in their precision, persistence, and ability to exploit human and technical vulnerabilities. These attacks are carefully tailored to specific targets, using techniques like social engineering and spear phishing to gain initial access.

Once inside, attackers move laterally through networks, often remaining undetected for months or even years, silently gathering intelligence or preparing for a decisive strike. Alternatively, they might linger inside an account within the M365 environment, which could be even more valuable in terms of gathering information – in 2023 the average time to identify a breach in 2023 was 204 days.³‍

The subtle and long-term outlook nature of APTs makes them highly effective, as traditional security measures often fail to identify the subtle signs of compromise.

How Darktrace’s approach is designed to catch the most advanced threats

Luckily for our customers, Darktrace’s AI approach is uniquely equipped to detect and neutralize APTs. Unlike the majority of email security solutions that rely on static rules and signatures, or that train their AI on previous known-bad attack patterns, Darktrace leverages Self-Learning AI that baselines normal patterns of behavior within an organization, to immediately detect unusual activity that may signal an APT in progress.  

But in the modern era of email threats, no email security solution can guarantee 100% effectiveness. Because attackers operate with great sophistication, carefully adapting their tactics to evade detection – whether by altering attachments, leveraging compromised accounts, or moving laterally across an organization – a siloed security approach risks missing these subtle, multi-domain threats. That’s why a robust defense-in-depth strategy is essential to mitigate APTs.

Real-world threat finds: Darktrace / EMAIL in action

Let’s take a look at some real-world scenarios where Darktrace / EMAIL stopped tactics associated with APT campaigns in their tracks – from adversary-in-the-middle attacks to suspicious lateral movement.

1: How Darktrace disrupted an adversary-in-the-middle attack by identifying abnormal login redirects and blocking credential exfiltration

In October 2024, Darktrace detected an adversary-in-the-middle (AiTM) attack targeting a Darktrace customer. The attack began with a phishing email from a seemingly legitimate Dropbox address, which contained multiple link payloads inviting the recipient to access a file. Other solutions would have struggled to catch this attack, as the initial AitM attack was launched through delivering a malicious URL through a trusted vendor or service. Once compromised, the threat actor could have laid low on the target account, gathering reconnaissance, without detection from the email security solution.  

Darktrace / EMAIL identified the abnormal login redirects and flagged the suspicious activity. Darktrace / IDENTITY then detected unusual login patterns and blocked credential exfiltration attempts, effectively disrupting the attack and preventing the adversary from gaining unauthorized access. Read more.

2: How Darktrace stopped lateral movement to block NTLM hash theft

In early 2024, Darktrace detected an attack by the TA577 threat group, which aimed to steal NTLM hashes to gain unauthorized access to systems. The attack began with phishing emails containing ZIP files that connected to malicious infrastructure.  

A traditional email security solution would have likely missed this attack by focusing too heavily on analyzing the zip file payloads or relying on reputation analysis to understand whether the infrastructure was registered as bad before this activity was a recognized IoC.

Because it correlates activity across domains, Darktrace identified unusual lateral movement within the network and promptly blocked the attempts to steal NTLM hashes, effectively preventing the attackers from accessing sensitive credentials and securing the network. Read more.

3: How Darktrace prevented the WarmCookie backdoor deployment embedded in phishing emails

In mid-2024, Darktrace identified a phishing campaign targeting organizations with emails impersonating recruitment firms. These emails contained malicious links that, when clicked, deployed the WarmCookie backdoor.  

These emails are difficult to detect, as they use social engineering tactics to manipulate users into engaging with emails and following the embedded malicious links – but if a security solution is not analysing content and context, these could be allowed through.

In several observed cases across customer environments, Darktrace detected and blocked the suspicious behavior associated with WarmCookie that had already managed to evade customers’ native email security. By using behavioral analysis to correlate anomalous activity across the digital estate, Darktrace was able to identify the backdoor malware strain and notify customers. Read more.

Conclusion

These threat examples highlight a key principle of the Darktrace approach – that a backwards-facing approach grounded in threat intelligence will always be one step behind.

Most threat actors operate in campaigns, carefully crafting attacks and testing them across multiple targets. Once a campaign is identified, good defenders and traditional security solutions quickly update their defenses with new threat intelligence, rules, and signatures. However, APTs have the resources to rapidly adapt – spinning up new infrastructure, modifying payloads and altering their attack footprint to evade detection.

This is where Darktrace / EMAIL excels. Only by analyzing each user, message and interaction can an email security solution hope to catch the types of highly-sophisticated attacks that have the potential to cause major reputational and financial damage. Darktrace / EMAIL ensures that even the most subtle threats are detected and blocked with autonomous response, before causing impact – helping organizations remain one step ahead of increasingly adaptive threat actors.

Download the Darktrace / EMAIL Solution Brief

Discover the most advanced cloud-native AI email security solution to protect your domain and brand while preventing phishing, novel social engineering, business email compromise, account takeover, and data loss.

• Gain up to 13 days of earlier threat detection and maximize ROI on your current email security
• Experience 20-25% more threat blocking power with Darktrace / EMAIL
• Stop the 58% of threats bypassing traditional email security

‍

References

[1] FBI Internet Crime Report 2020

[2] https://www.optiv.com/insights/discover/blog/future-security-automation-how-ai-machine-learning-and-automation-are

[3] IBM Cost of a Data Breach Report 2023

‍