April 4, 2022

Explore Internet-Facing System Vulnerabilities

Read about 2021's top four incidents and how Darktrace's advanced threat detection technology identified and mitigated vulnerabilities. Learn more.

Written by

Sam Lister

SOC Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Sam Lister

SOC Analyst

Apr 2022

By virtue of their exposure, Internet-facing systems (i.e., systems which have ports open/exposed to the wider Internet) are particularly susceptible to compromise. Attackers typically compromise Internet-facing systems by exploiting zero-day vulnerabilities in applications they run. During 2021, critical zero-day vulnerabilities in the following applications were publicly disclosed:

Microsoft Exchange
Confluence
GitLab
Log4j-using applications

Internet-facing systems running these applications were consequently heavily targeted by attackers. In this post, we will provide examples of compromises of these systems observed by Darktrace’s SOC team in 2021. As will become clear, successful exploitation of weaknesses in Internet-facing systems inevitably results in such systems doing things which they do not normally do. Rather than focusing on identifying attempts to exploit these weaknesses, Darktrace focuses on identifying the unusual behaviors which inevitably ensue. The purpose of this post is to highlight the effectiveness of this approach.

Exchange server compromise

In January, researchers from the cyber security company DEVCORE reported a series of critical vulnerabilities in Microsoft Exchange which they dubbed ‘ProxyLogon’.^[1] ProxyLogon consists of a server-side request forgery (SSRF) vulnerability (CVE-2021-26855) and a remote code execution (RCE) vulnerability (CVE-2021-27065). Attackers were observed exploiting these vulnerabilities in the wild from as early as January 6.^[2] In April, DEVCORE researchers reported another series of critical vulnerabilities in Microsoft Exchange which they dubbed ‘ProxyShell’.^[3] ProxyShell consists of a pre-authentication path confusion vulnerability (CVE-2021-34473), a privilege elevation vulnerability (CVE-2021-34523), and a post-authentication RCE vulnerability (CVE-2021-31207). Attackers were first observed exploiting these vulnerabilities in the wild in August.^[4] In many cases, attackers exploited the ProxyShell and ProxyLogon vulnerabilities in order to create web shells on the targeted Exchange servers. The presence of these web shells provided attackers with the means to remotely execute commands on the compromised servers.

In early August 2021, by exploiting the ProxyShell vulnerabilities, an attacker gained the rights to remotely execute PowerShell commands on an Internet-facing Exchange server within the network of a US-based transportation company. The attacker subsequently executed a number of PowerShell commands on the server. One of these commands caused the server to make a 28-minute-long SSL connection to a highly unusual external endpoint. Within a couple of hours, the attacker managed to strengthen their foothold within the network by installing AnyDesk and CobaltStrike on several internal devices. In mid-August, the attacker got the devices on which they had installed Cobalt Strike to conduct network reconnaissance and to transfer terabytes of data to the cloud storage service, MEGA. At the end of August, the attacker got the devices on which they had installed AnyDesk to execute Conti ransomware and to spread executable files and script files to further internal devices.

In this example, the attacker’s exploitation of ProxyShell immediately resulted in the Exchange Server making a long SSL connection to an unusual external endpoint. This connection caused the model Device / Long Agent Connection to New Endpoint to breach. The subsequent reconnaissance, lateral movement, C2, external data transfer, and encryption behavior brought about by the attacker were also picked up by Darktrace’s models.

A non-exhaustive list of the models that breached as a result of the behavior brought about by the attacker:

Device / Long Agent Connection to New Endpoint
Device / ICMP Address Scan
Anomalous Connection / SMB Enumeration
Anomalous Server Activity / Outgoing from Server
Compromise / Beacon to Young Endpoint
Anomalous Server Activity / Rare External from Server
Compromise / Fast Beaconing to DGA
Compromise / SSL or HTTP Beacon
Compromise / Sustained SSL or HTTP Increase
Compromise / Beacon for 4 Days
Anomalous Connection / Multiple HTTP POSTs to Rare Hostname
Unusual Activity / Enhanced Unusual External Data Transfer
Anomalous Connection / Data Sent to Rare Domain
Anomalous Connection / Uncommon 1 GiB Outbound
Compliance / SMB Drive Write
Anomalous File / Internal / Additional Extension Appended to SMB File
Anomalous Connection / Suspicious Read Write Ratio
Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB
Anomalous Connection / Sustained MIME Type Conversion
Unusual Activity / Anomalous SMB Move & Write
Unusual Activity / Unusual Internal Data Volume as Client or Server
Device / Suspicious File Writes to Multiple Hidden SMB Shares
Compromise / Ransomware / Suspicious SMB Activity
Anomalous File / Internal / Unusual SMB Script Write
Anomalous File / Internal / Masqueraded Executable SMB Write
Device / SMB Lateral Movement
Device / Multiple Lateral Movement Model Breaches

Confluence server compromise

Atlassian’s Confluence is an application which provides the means for building collaborative, virtual workspaces. In the era of remote working, the value of such an application is undeniable. The public disclosure of a critical remote code execution (RCE) vulnerability (CVE-2021-26084) in Confluence in August 2021 thus provided a prime opportunity for attackers to cause havoc. The vulnerability, which arises from the use of Object-Graph Navigation Language (OGNL) in Confluence’s tag system, provides attackers with the means to remotely execute code on vulnerable Confluence server by sending a crafted HTTP request containing a malicious parameter.^[5] Attackers were first observed exploiting this vulnerability towards the end of August, and in the majority of cases, attackers exploited the vulnerability in order to install crypto-mining tools onto vulnerable servers.^[6]

At the beginning of September 2021, an attacker was observed exploiting CVE-2021-26084 in order to install the crypto-mining tool, XMRig, as well as a shell script, onto an Internet-facing Confluence server within the network of an EMEA-based television and broadcasting company. Within a couple of hours, the attacker installed files associated with the crypto-mining malware, Kinsing, onto the server. The Kinsing-infected server then immediately began to communicate over HTTP with the attacker’s C2 infrastructure. Around the time of this activity, the server was observed using the MinerGate crypto-mining protocol, indicating that the server had begun to mine cryptocurrency.

In this example, the attacker’s exploitation of CVE-2021-26084 immediately resulted in the Confluence server making an HTTP GET request with an unusual user-agent string (one associated with curl in this case) to a rare external IP. This behavior caused the models Device / New User Agent, Anomalous Connection / New User Agent to IP Without Hostname, and Anomalous File / Script from Rare Location to breach. The subsequent file downloads, C2 traffic and crypto-mining activity also resulted in several models breaching.

A non-exhaustive list of the models which breached as a result of the unusual behavior brought about by the attacker:

Device / New User Agent
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / Script from Rare Location
Anomalous File / EXE from Rare External Location
Anomalous File / Internet Facing System File Download
Device / Initial Breach Chain Compromise
Anomalous Connection / Posting HTTP to IP Without Hostname
Compliance / Crypto Currency Mining Activity
Compromise / High Priority Crypto Currency Mining
Device / Internet Facing Device with High Priority Alert

GitLab server compromise

GitLab is an application providing services ranging from project planning to source code management. Back in April 2021, a critical RCE vulnerability (CVE-2021-22205) in GitLab was publicly reported by a cyber security researcher via the bug bounty platform, HackerOne.^[7] The vulnerability, which arises from GitLab’s use of ExifTool for removing metadata from image files, ^[8] enables attackers to remotely execute code on vulnerable GitLab servers by uploading specially crafted image files.^[9] Attackers were first observed exploiting CVE-2021-22205 in the wild in June/July.^[10] A surge in exploitations of the vulnerability was observed at the end of October, with attackers exploiting the flaw in order to assemble botnets.^[11] Darktrace observed a significant number of cases in which attackers exploited the vulnerability in order to install crypto-mining tools onto vulnerable GitLab servers.

On October 29, an attacker successfully exploited CVE-2021-22205 on an Internet-facing GitLab server within the network of a UK-based education provider. The organization was trialing Darktrace when this incident occurred. The attacker installed several executable files and shell scripts onto the server by exploiting the vulnerability. The attacker communicated with the compromised server (using unusual ports) for several days, before making the server transfer large volumes of data externally and download the crypto-mining tool, XMRig, as well as the botnet malware, Mirai. The server was consequently observed making connections to the crypto-mining pool, C3Pool.

In this example, the attacker’s exploitation of the vulnerability in GitLab immediately resulted in the server making an HTTP GET request with an unusual user-agent string (one associated with Wget in this case) to a rare external IP. The models Anomalous Connection / New User Agent to IP Without Hostname and Anomalous File / EXE from Rare External Location breached as a result of this behavior. The attacker’s subsequent activity on the server over the next few days resulted in frequent model breaches.

A non-exhaustive list of the models which breached as a result of the attacker’s activity on the server:

Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / EXE from Rare External Location
Anomalous File / Multiple EXE from Rare External Locations
Anomalous File / Internet Facing Device with High Priority Alert
Anomalous File / Script from Rare Location
Anomalous Connection / Application Protocol on Uncommon Port
Anomalous Connection / Anomalous SSL without SNI to New External
Device / Initial Breach Chain Compromise
Unusual Activity / Unusual External Data to New IPs
Anomalous Server Activity / Outgoing from Server
Device / Large Number of Model Breaches from Critical Network Device
Anomalous Connection / Data Sent to Rare Domain
Compromise / Suspicious File and C2
Unusual Activity / Enhanced Unusual External Data Transfer
Compliance / Crypto Currency Mining Activity
Compliance / High Priority Crypto Currency Mining
Anomalous File / Zip or Gzip from Rare External Location
Compromise / Monero Mining
Device / Internet Facing Device with High Priority Alert
Anomalous Server Activity / Rare External from Server
Compromise / Slow Beaconing Activity To External Rare
Compromise / Beaconing Activity To External Rare
Compromise / HTTP Beaconing to Rare Destination
Compromise / High Volume of Connections with Beacon Score
Anomalous File / Numeric Exe Download

Log4j server compromise

On December 9 2021, a critical RCE vulnerability (dubbed ‘Log4Shell’) in version 2 of Apache’s Log4j was publicly disclosed by researchers at LunaSec.^[12] As a logging library present in potentially millions of Java applications,^[13] Log4j constitutes an obscured, yet ubiquitous feature of the digital world. The vulnerability (CVE-2021-44228), which arises from Log4j’s Java Naming and Directory Interface (JNDI) Lookup feature, enables an attacker to make a vulnerable server download and execute a malicious Java class file. To exploit the vulnerability, all the attacker must do is submit a specially crafted JNDI lookup request to the server. The fact that Log4j is present in so many applications and that the exploitation of this vulnerability is so simple, Log4Shell has been dubbed the ‘most critical vulnerability of the last decade’.^[14] Attackers have been exploiting Log4Shell in the wild since at least December 1.^[15] Since then, attackers have been observed exploiting the vulnerability to install crypto-mining tools, Cobalt Strike, and RATs onto vulnerable servers.^[16]

On December 10, one day after the public disclosure of Log4Shell, an attacker successfully exploited the vulnerability on a vulnerable Internet-facing server within the network of a US-based architecture company. By exploiting the vulnerability, the attacker managed to get the server to download and execute a Java class file named ‘Exploit69ogQNSQYz.class’. Executing the code in this file caused the server to download a shell script file and a file related to the Kinsing crypto-mining malware. The Kinsing-infected server then went on to communicate over HTTP with a C2 server. Since the customer was using the Proactive Threat Notification (PTN) service, they were immediately alerted to this activity, and the server was subsequently quarantined, preventing crypto-mining activity from taking place.

In this example, the attacker’s exploitation of the zero-day vulnerability immediately resulted in the vulnerable server making an HTTP GET request with an unusual user-agent string (one associated with Java in this case) to a rare external IP. The models Anomalous Connection / Callback on Web Facing Device and Anomalous Connection / New User Agent to IP Without Hostname breached as a result of this behavior. The device’s subsequent file downloads and C2 activity caused several Darktrace models to breach.

A non-exhaustive list of the models which breached as a result of the unusual behavior brought about by the attacker:

Anomalous Connection / Callback on Web Facing Device
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / Internet Facing System File Download
Anomalous File / Script from Rare External Location
Device / Initial Breach Chain Compromise
Anomalous Connection / Posting HTTP to IP Without Hostname

Round-up

It is inevitable that attackers will attempt to exploit zero-day vulnerabilities in applications running on Internet-facing devices. Whilst identifying these attempts is useful, the fact that attackers regularly exploit new zero-days makes the task of identifying attempts to exploit them akin to a game of whack-a-mole. Whilst it is uncertain which zero-day vulnerability attackers will exploit next, what is certain is that their exploitation of it will bring about unusual behavior. No matter the vulnerability, whether it be a vulnerability in Microsoft Exchange, Confluence, GitLab, or Log4j, Darktrace will identify the unusual behaviors which inevitably result from its exploitation. By identifying unusual behaviors displayed by Internet-facing devices, Darktrace thus makes it almost impossible for attackers to successfully exploit zero-day vulnerabilities without being detected.

For Darktrace customers who want to find out more about detecting potential compromises of internet-facing devices, refer here for an exclusive supplement to this blog.

Thanks to Andy Lawrence for his contributions.

Footnotes

1. https://devco.re/blog/2021/08/06/a-new-attack-surface-on-MS-exchange-part-1-ProxyLogon/

2. https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

3. https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell

4. https://www.rapid7.com/blog/post/2021/08/12/proxyshell-more-widespread-exploitation-of-microsoft-exchange-servers/

5. https://www.kaspersky.co.uk/blog/confluence-server-cve-2021-26084/23376/

6. https://www.bleepingcomputer.com/news/security/atlassian-confluence-flaw-actively-exploited-to-install-cryptominers/

7. https://hackerone.com/reports/1154542

8. https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/

9.https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/

10. https://www.rapid7.com/blog/post/2021/11/01/gitlab-unauthenticated-remote-code-execution-cve-2021-22205-exploited-in-the-wild/

11. https://www.hackmageddon.com/2021/12/16/1-15-november-2021-cyber-attacks-timeline/

12. https://www.lunasec.io/docs/blog/log4j-zero-day/

13. https://www.csoonline.com/article/3644472/apache-log4j-vulnerability-actively-exploited-impacting-millions-of-java-based-apps.html

14. https://www.theguardian.com/technology/2021/dec/10/software-flaw-most-critical-vulnerability-log-4-shell

15. https://www.rapid7.com/blog/post/2021/12/15/the-everypersons-guide-to-log4shell-cve-2021-44228/

16. https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/

Written by

Sam Lister

SOC Analyst

Inside the SOC

Written by

Sam Lister

SOC Analyst

•

April 4, 2025

Pallavi Singh

Product Marketing Manager, OT Security & Compliance

Director of Product Management, Cado

Watch the NIS2 Webinar

Blog

Email

April 14, 2025

Email bombing exposed: Darktrace’s email defense in action

picture of a computer screen showing a password login

What is email bombing?

An email bomb attack, also known as a "spam bomb," is a cyberattack where a large volume of emails—ranging from as few as 100 to as many as several thousand—are sent to victims within a short period.

How does email bombing work?

Email bombing is a tactic that typically aims to disrupt operations and conceal malicious emails, potentially setting the stage for further social engineering attacks. Parallels can be drawn to the use of Domain Generation Algorithm (DGA) endpoints in Command-and-Control (C2) communications, where an attacker generates new and seemingly random domains in order to mask their malicious connections and evade detection.

In an email bomb attack, threat actors typically sign up their targeted recipients to a large number of email subscription services, flooding their inboxes with indirectly subscribed content [1].

Multiple threat actors have been observed utilizing this tactic, including the Ransomware-as-a-Service (RaaS) group Black Basta, also known as Storm-1811 [1] [2].

Darktrace detection of email bombing attack

In early 2025, Darktrace detected an email bomb attack where malicious actors flooded a customer's inbox while also employing social engineering techniques, specifically voice phishing (vishing). The end goal appeared to be infiltrating the customer's network by exploiting legitimate administrative tools for malicious purposes.

The emails in these attacks often bypass traditional email security tools because they are not technically classified as spam, due to the assumption that the recipient has subscribed to the service. Darktrace / EMAIL's behavioral analysis identified the mass of unusual, albeit not inherently malicious, emails that were sent to this user as part of this email bombing attack.

Email bombing attack overview

In February 2025, Darktrace observed an email bombing attack where a user received over 150 emails from 107 unique domains in under five minutes. Each of these emails bypassed a widely used and reputable Security Email Gateway (SEG) but were detected by Darktrace / EMAIL.

Figure 1: Graph showing the unusual spike in unusual emails observed by Darktrace / EMAIL.

The emails varied in senders, topics, and even languages, with several identified as being in German and Spanish. The most common theme in the subject line of these emails was account registration, indicating that the attacker used the victim’s address to sign up to various newsletters and subscriptions, prompting confirmation emails. Such confirmation emails are generally considered both important and low risk by email filters, meaning most traditional security tools would allow them without hesitation.

Additionally, many of the emails were sent using reputable marketing tools, such as Mailchimp’s Mandrill platform, which was used to send almost half of the observed emails, further adding to their legitimacy.

Figure 2: Darktrace / EMAIL’s detection of an email being sent using the Mandrill platform.

Figure 3: Darktrace / EMAIL’s detection of a large number of unusual emails sent during a short period of time.

While the individual emails detected were typically benign, such as the newsletter from a legitimate UK airport shown in Figure 3, the harmful aspect was the swarm effect caused by receiving many emails within a short period of time.

Traditional security tools, which analyze emails individually, often struggle to identify email bombing incidents. However, Darktrace / EMAIL recognized the unusual volume of new domain communication as suspicious. Had Darktrace / EMAIL been enabled in Autonomous Response mode, it would have automatically held any suspicious emails, preventing them from landing in the recipient’s inbox.

Figure 4: Example of Darktrace / EMAIL’s response to an email bombing attack taken from another customer environment.

Following the initial email bombing, the malicious actor made multiple attempts to engage the recipient in a call using Microsoft Teams, while spoofing the organizations IT department in order to establish a sense of trust and urgency – following the spike in unusual emails the user accepted the Teams call. It was later confirmed by the customer that the attacker had also targeted over 10 additional internal users with email bombing attacks and fake IT calls.

The customer also confirmed that malicious actor successfully convinced the user to divulge their credentials with them using the Microsoft Quick Assist remote management tool. While such remote management tools are typically used for legitimate administrative purposes, malicious actors can exploit them to move laterally between systems or maintain access on target networks. When these tools have been previously observed in the network, attackers may use them to pursue their goals while evading detection, commonly known as Living-off-the-Land (LOTL).

Subsequent investigation by Darktrace’s Security Operations Centre (SOC) revealed that the recipient's device began scanning and performing reconnaissance activities shortly following the Teams call, suggesting that the user inadvertently exposed their credentials, leading to the device's compromise.

Darktrace’s Cyber AI Analyst was able to identify these activities and group them together into one incident, while also highlighting the most important stages of the attack.

Figure 5: Cyber AI Analyst investigation showing the initiation of the reconnaissance/scanning activities.

The first network-level activity observed on this device was unusual LDAP reconnaissance of the wider network environment, seemingly attempting to bind to the local directory services. Following successful authentication, the device began querying the LDAP directory for information about user and root entries. Darktrace then observed the attacker performing network reconnaissance, initiating a scan of the customer’s environment and attempting to connect to other internal devices. Finally, the malicious actor proceeded to make several SMB sessions and NTLM authentication attempts to internal devices, all of which failed.

Figure 6: Device event log in Darktrace / NETWORK, showing the large volume of connections attempts over port 445.

Figure 7: Darktrace / NETWORK’s detection of the number of the login attempts via SMB/NTLM.

While Darktrace’s Autonomous Response capability suggested actions to shut down this suspicious internal connectivity, the deployment was configured in Human Confirmation Mode. This meant any actions required human approval, allowing the activities to continue until the customer’s security team intervened. If Darktrace had been set to respond autonomously, it would have blocked connections to port 445 and enforced a “pattern of life” to prevent the device from deviating from expected activities, thus shutting down the suspicious scanning.

Conclusion

Email bombing attacks can pose a serious threat to individuals and organizations by overwhelming inboxes with emails in an attempt to obfuscate potentially malicious activities, like account takeovers or credential theft. While many traditional gateways struggle to keep pace with the volume of these attacks—analyzing individual emails rather than connecting them and often failing to distinguish between legitimate and malicious activity—Darktrace is able to identify and stop these sophisticated attacks without latency.

Thanks to its Self-Learning AI and Autonomous Response capabilities, Darktrace ensures that even seemingly benign email activity is not lost in the noise.

Credit to Maria Geronikolou (Cyber Analyst and SOC Shift Supervisor) and Cameron Boyd (Cyber Security Analyst), Steven Haworth (Senior Director of Threat Modeling), Ryan Traill (Analyst Content Lead)

Appendices

[1] https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/

[2] https://thehackernews.com/2024/12/black-basta-ransomware-evolves-with.html

Darktrace Models Alerts

Internal Reconnaissance

· Device / Suspicious SMB Scanning Activity

· Device / Anonymous NTLM Logins

· Device / Network Scan

· Device / Network Range Scan

· Device / Suspicious Network Scan Activity

· Device / ICMP Address Scan

· Anomalous Connection / Large Volume of LDAP Download

· Device / Suspicious LDAP Search Operation

· Device / Large Number of Model Alerts

About the author

Maria Geronikolou

Cyber Analyst

Blog

Email

April 11, 2025

FedRAMP High-compliant email security protects federal agencies from nation-state attacks

U.S. government building with flag against blue sky

What is FedRAMP High Authority to Operate (ATO)?

Federal Risk and Authorization Management Program (FedRAMP®) High is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment for cloud technologies and federal agencies, ensuring the protection of federal information.

Cybersecurity is paramount in the Defense Industrial Base (DIB), where protecting sensitive information and ensuring operational resilience from the most sophisticated adversaries has national security implications. Organizations within the DIB must comply with strict security standards to work with the U.S. federal government, and FedRAMP High is one of those standards.

Darktrace achieves FedRAMP High ATO across IT, OT, and email

Last week, Darktrace Federal shared that we achieved FedRAMP® High ATO, a significant milestone that recognizes our ability to serve federal customers across IT, OT, and email via secure cloud-native deployments.

Achieving the FedRAMP High ATO indicates that Darktrace Federal has achieved the highest standard for cloud security controls and can handle the U.S. federal government’s most sensitive, unclassified data in cloud environments.

Azure Government email security with FedRAMP High ATO

Darktrace has now released Darktrace Commercial Government Cloud High/Email (DCGC High/Email). This applies our email coverage to systems hosted in Microsoft's Azure Government, which adheres to NIST SP 800-53 controls and other federal standards. DCGC High/Email both meets and exceeds the compliance requirements of the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC), providing organizations with a much-needed email security solution that delivers unparalleled, AI-driven protection against sophisticated cyber threats.

In these ways, DCGC High/Email enhances compliance, security, and operational resilience for government and federally-affiliated customers. Notably, it is crucial for securing contractors and suppliers within DIB, helping those organizations implement necessary cybersecurity practices to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

Adopting DCGC High/Email ensures organizations within the DIB can work with the government without needing to invest extensive time and money into meeting the strict compliance standards.

Building DCGC High/Email to ease DIB work with the government

DCGC High/Email was built to achieve FedRAMP High standards and meet the most rigorous security standards required of our customers. This level of compliance not only allows more organizations than ever to leverage our AI-driven technology, but also ensures that customer data is protected by the highest security measures available.

The DIB has never been more critical to national security, which means they are under constant threats from nation state and cyber criminals. We built DCGC High/Email to FedRAMP High controls to ensure sensitive company and federal government communications are secured at the highest level possible.” – Marcus Fowler, CEO of Darktrace Federal

Evolving threats now necessitate DCGC High/Email

According to Darktrace’s 2025 State of AI Cybersecurity report, more than half (54%) of global government cybersecurity professionals report seeing a significant impact from AI-powered cyber threats.

These aren’t the only types of sophisticated threats. Advanced Persistent Threats (APTs) are launched by nation-states or cyber-criminal groups with the resources to coordinate and achieve long-term objectives.

These attacks are carefully tailored to specific targets, using techniques like social engineering and spear phishing to gain initial access via the inbox. Once inside, attackers move laterally through networks, often remaining undetected for months or even years, silently gathering intelligence or preparing for a decisive strike.

However, the barrier for entry for these threat actors has been lowered immensely, likely related to the observed impact of AI-powered cyber threats. Securing email environments is more important than ever.

Darktrace’s 2025 State of AI Cybersecurity report also found that 89% of government cybersecurity professionals believe AI can help significantly improve their defensive capabilities.

Darktrace's AI-powered defensive tools are uniquely capable of detecting and neutralizing APTs and other sophisticated threats, including ones that enter via the inbox. Our Self-Learning AI continuously adapts to evolving threats, providing real-time protection.

Darktrace builds to secure the DIB to the highest degree

In summary, Darktrace Federal's achievement of FedRAMP High ATO and the introduction of DCGC High/Email mark significant advancements in our ability to protect defense contractors and federal customers against sophisticated threats that other solutions miss.

For a technical review of Darktrace Federal’s Cyber AI Mission Defense™ solution, download an independent evaluation from the Technology Advancement Center here.

[related-resource]

About the author

Marcus Fowler

CEO of Darktrace Federal and SVP of Strategic Engagements and Threats

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Explore Internet-Facing System Vulnerabilities

Explore Internet-Facing System Vulnerabilities

Exchange server compromise

Confluence server compromise

GitLab server compromise

Log4j server compromise

Round-up

Footnotes

Darktrace Named as Market Leader in the 2025 Omdia Market Radar for OT Cybersecurity Platforms

Fusing Vulnerability and Threat Data: Enhancing the Depth of Attack Analysis

Enjoying the blog?

More in this series

Survey Findings: AI Cybersecurity Priorities and Objectives in 2025

Survey findings: How is AI Impacting the SOC?

Survey findings: AI Cyber Threats are a Reality, the People are Acting Now

Blog

Email

April 14, 2025

Email bombing exposed: Darktrace’s email defense in action

What is email bombing?

How does email bombing work?

Darktrace detection of email bombing attack

Email bombing attack overview

Conclusion

Appendices

Darktrace Models Alerts

Internal Reconnaissance

Blog

Email

April 11, 2025

FedRAMP High-compliant email security protects federal agencies from nation-state attacks

What is FedRAMP High Authority to Operate (ATO)?

Darktrace achieves FedRAMP High ATO across IT, OT, and email

Azure Government email security with FedRAMP High ATO

Building DCGC High/Email to ease DIB work with the government

Evolving threats now necessitate DCGC High/Email

Darktrace builds to secure the DIB to the highest degree