Blog
/
/
January 6, 2021

Darktrace Insights On SolarWinds Hack

Learn how Darktrace analyzed the SolarWinds hack without signatures. Understand the techniques used to identify and mitigate this major cyber threat.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
06
Jan 2021

For a high-level explanation of the SolarWinds hack, watch our video below.

The SUNBURST malware attacks against SolarWinds have heightened companies’ concerns about the risk to their digital environments. Malware installed during software updates in March 2020 has allowed advanced attackers to gain unauthorized access to files that may include customer data and intellectual property.

Darktrace does not use SolarWinds, and its operations remain unaffected by this breach. However, SolarWinds is an IT discovery tool that is used by a significant number of Darktrace customers. In what follows, we explore a set of Darktrace detections that highlight and alert security teams to the types of behaviors related to this breach.

This is not an example of a SolarWinds compromise, but examples of anomalous behaviors we can expect to see from this type of breach. These examples stress the value of self-learning Cyber AI capable of understanding the evolving normal ‘patterns of life’ within an enterprise – as opposed to a signature-based approach that looks at historical data to predict today’s threat.

As Darktrace detects device activity patterns rather than known malicious signatures, detecting use of these techniques will fall into the scope of Darktrace’s capabilities without further need for configuration. The technology automatically clusters devices into ‘peer groups’, allowing it to detect cases of an individual device behaving unusually. Using a self-learning approach is the best possible mechanism to catch an attacker who gains access into your systems using a degree of stealth so as to not trigger signature-based detection.

A number of these models may fire in combination with other models in order to make a strong detection over a time-series – and this is exactly where Darktrace’s autonomous incident triage capability, Cyber AI Analyst, plays a crucial role in investigating the alerts on behalf of security teams. Cyber AI Analyst saves critical time for security teams, and its results should be treated with a high priority during this period of vigilance.

How SolarWinds was detected with AI

We want to focus on the most sophisticated details of the hands-on intrusion that in many cases followed the initial automated attack. This post-exploitation part of the attack is much more varied and stealthy. These stages are also near-impossible to predict, as they are driven by the attacker’s intentions and goals for each individual victim at this stage – making the use of signatures, threat intelligence or static use cases virtually useless.

While the automated, initial malware execution is a critical initial step to understand, the behavior was pre-configured for the malware and included the download of further payloads and the connection to domain-generation-algorithm (DGA) based subdomains of avsvmcloud[.]com. These automated first stages of the attack have been sufficiently researched in depth by the community. This post is not aiming to add anything to these findings, but instead takes a look at the potential post-infection activities.

Malware / C2 domains

The threat-actor set the hostnames on their later-stage command and control (C2) infrastructure to match a legitimate hostname found within the victim’s environment. This allowed the adversary to blend into the environment, avoid suspicion, and evade detection. They further used C2 servers in geopolitical proximity to their victims, further circumventing static geo-based trusts lists. Darktrace is unaffected by this type of tradecraft as it does not have implicit, pre-defined trust of any geo-locations.

This would be very likely to trigger the following Darktrace Cyber AI models. The models were not specifically designed to detect SolarWinds modifications but have been in place for years – they are designed to detect the subtle but significant attacker activities occurring within an organization’s network.

  • Compromise / Agent Beacon to New Endpoint
  • Compromise / SSL Beaconing to New Endpoint
  • Compromise / HTTP Beaconing to New Endpoint*

*The implant uses SSL, but may be identified as HTTP if using a proxy.

Lateral movement using different credentials

Once the attacker gained access to the network with compromised credentials, they moved laterally using multiple different credentials. The credentials used for lateral movement were always different from those used for remote access.

This very likely would trigger the following Cyber AI models:

  • User / Multiple Uncommon New Credentials on Device
Figure 1: Example breach event log showing anomalous (new) logins from a single device, with multiple user credentials
  • User / New Admin Credentials on Client
Figure 2: Example breach event log showing anomalous admin login

Temporary file replacement and temporary task modification

The attacker used a temporary file replacement technique to remotely execute utilities: they replaced a legitimate utility with theirs, executed their payload, and then restored the legitimate original file. They similarly manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. They routinely removed their tools – including the removal of backdoors once legitimate remote access was achieved.

This would be very likely to trigger the following Cyber AI models:

  • Anomalous Connection / New or Uncommon Service Control
Figure 3: Example breach showing uncommon service control
  • Anomalous Connection / High Volume of New or Uncommon Service Control
Figure 4: Example breach showing 10 uncommon service controls
  • Device / AT Service Scheduled Task
Figure 5: Breach event log shows new AT service scheduled task activity
  • Device / Multiple RPC Requests for Unknown Services
Figure 6: Breach shows multiple binds to unknown RPC services
  • Device / Anomalous SMB Followed By Multiple Model Breaches
Figure 7: Breach shows unusual SMB activity, combined with slow beaconing
  • Device / Suspicious File Writes to Multiple Hidden SMB Shares
Figure 8: Breach shows device writing .bat file to temp folder on another device
  • Unusual Activity / Anomalous SMB to New or Unusual Locations
Figure 9: Breach shows new access to SAMR, combined with SMB Reads and Kerberos login failures
  • Unusual Activity / Sustained Anomalous SMB Activity
Figure 10: Breach shows significant deviation in SMB activity from device

SolarWinds breach remembered

By understanding where credentials are used and which devices talk to each other, Cyber AI has an unprecedented and dynamic understanding of business systems. This empowers it to alert security teams to enterprise changes that could indicate cyber risk in real time.

These alerts demonstrate how AI learns ‘normal’ for the unique digital environment surrounding it, and then alerts operators to deviations, including those that are directly relevant to the SUNBURST compromise. It further provides insights into how the attacker exploited those networks that did not have the appropriate visibility and detection capabilities.

On top of these alerts, Cyber AI Analyst will also be automatically correlating these detections over time to identify patterns, generating comprehensive and intuitive incident summaries and significantly reducing triage time. Reviewing Cyber AI Analyst alerts should be given high priority over the next several weeks.


Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO

More in this series

No items found.

Blog

/

Network

/

October 23, 2025

Darktrace Redefines NDR: Industry-First Autonomous Threat Investigation from Network to Endpoint with Agentic AI

autonomous investigations, endpoint, ndr, network detection and responseDefault blog imageDefault blog image

Darktrace delivers the next evolution of unified and proactive NDR

Darktrace Network Endpoint eXtended Telemetry (NEXT) is revolutionizing NDR with the industry’s first mixed-telemetry agent using Self-Learning AI.  

The combined context of native network and endpoint process data significantly reduces incident triage and investigation times for threats spanning both domains. Our business-centric approach learns what normal looks like for each endpoint, and now uses process context to extend our ability to identify novel threats that existing EDR/XDR tools often  miss.

Summary of what’s new:

  • Native endpoint process telemetry combined with NDR, bridging the EDR gap
  • Self-Learning AI on the endpoint to stop novel threats missed by EDR
  • Sophisticated Agentic AI to automate SecOps investigations across all major IT domains
  • AI-native, real-time threat detection, investigation, and response (TDIR) for cross-domain activity throughout the enterprise

Why is this an important next step in NDR?

Security analysts are buried under a flood of alerts that lack the context needed to separate genuine threats from noise. The root problem is that most security tools only see one slice of the environment. IT and OT networks, endpoints, and cloud systems are monitored in isolation, with little correlation between them.

As a result, investigations are highly manual. Analysts are forced to pivot between siloed point-products, each providing only a fragment of the incident. This slows response, creates blind spots, and limits the team’s ability to understand and contain threats effectively.

In many cases, the high degree of skill it takes to pivot tools and conduct investigations leads even the most experienced analysts closer to burnout, especially when they are already exhausted by the quantity of alerts. Ultimately, the human personnel managing these systems are using their skills to accommodate for the lack of synergy between tools they are using in their security stack, rather than developing the higher-value expertise needed to anticipate, prevent, and respond to emerging threats.

Many organizations have attempted to overcome this challenge by implementing XDR solutions. But, XDR does not cover NDR related use cases. This is especially true in OT/CPS environments where it is not possible to install an agent on devices.

XDR is an Endpoint-focused tool that cannot see the full picture of threats moving laterally across the network, targeting unmanaged devices, or blending into legitimate traffic. While XDR is still a strong tool in the arsenal, attackers are noticing where the gaps are:

  • A CISA Red Team assessment found that one U.S. critical infrastructure organization suffered prolonged compromise because it overly relied on host‑based EDR and lacked sufficient network-layer defenses.  

Bottom line: Without native network detection and response (NDR), critical incidents slip through undetected.

Not all NDR tools are built the same

When it comes to NDR, the details matter. Here are a few reasons why not all NDR solutions are created equal:

  • Most NDR solutions depend on EDR/XDR integrations to ingest endpoint alerts, which are raised based on activity that is already known to be malicious
  • They can’t investigate beyond what the EDR already flags, lacking process-level context in network investigations
  • Almost no NDR solutions have a native endpoint agent to extend NDR visibility to remote worker devices

This reliance on EDR leaves critical gaps in network coverage, since EDRs themselves don’t provide network-level visibility.

The NEXT evolution of NDR

Darktrace Network Endpoint eXtended Telemetry (NEXT) is revolutionizing NDR with the industry’s first mixed-telemetry agent using Self-Learning AI.  

The combined context of native network and endpoint process data significantly reduces incident triage and investigation times for threats spanning both domains, our business-centric approach with new data also extends our ability to identify novel threats that existing EDR/XDR may miss.

Darktrace / ENDPOINT agents are now able to utilize new Network Endpoint eXtended Telemetry (NEXT) capabilities. This combines full network visibility with native endpoint process data, enabling autonomous investigations that trace threats from initial network activity all the way to the root cause at the endpoint, without manual correlation or tool switching. This bridges the gap between NDR and the endpoint, while adding value to existing EDR investments.

Darktrace natively shows the endpoint process context in relation to network events, complete with parent/child process relationships, adding immediate context to network investigations without needing to pivot to your EDR.
Figure 1: Darktrace natively shows the endpoint process context in relation to network events, complete with parent/child process relationships, adding immediate context to network investigations without needing to pivot to your EDR.

Leveraging this data in investigations

This additional context is then leveraged by Cyber AI Analyst, a sophisticated agentic AI system that autonomously performs end-to-end investigations of all relevant alerts and prioritizes incidents. With the new endpoint process visibility, Cyber AI Analyst now incorporates process context into its decision-making, which improves detection accuracy, filters out benign activity, and enhances incident narratives with process-level insights.

This makes Darktrace the first NDR to natively investigate threats across network and endpoint telemetry with an autonomous, agentic AI analyst. And with our Self-Learning AI, Darktrace continuously evolves by understanding what’s normal for each unique environment, now adding process data to extend visibility and range of detections. This enables Darktrace to detect and contain novel threats, including zero-days, insider threats, and emerging attack techniques, up to 8 days before public disclosure.

This is more than a solution to a visibility problem. It’s a fundamental evolution in how threats are detected, investigated, and stopped. By applying agentic AI, Darktrace empowers security teams to move from reactive alert triage to proactive, autonomous defense, surfacing and blocking threats that others simply can’t see.

An excerpt from a Darktrace Cyber AI Analyst incident, showing the inclusion of native endpoint process context alongside other network events.
Figure 2: An excerpt from a Darktrace Cyber AI Analyst incident, showing the inclusion of native endpoint process context alongside other network events.

Continued innovation in detection and response

Darktrace also continues to invest in our core NDR capabilities, delivering enhancements and innovations to solve modern network security challenges. In the latest release, Darktrace / NETWORK has been enhanced to increase detection efficacy and performance. This includes increased protocol detection fidelity and new support for custom port mappings, plus expanded visibility into HTTP traffic to support more targeted threat hunting across a wider range of application layer activity. In addition, vSensor performance has been upgraded for tunnel protocols such as Geneve.

We have also released enhancements to Autonomous Response, which is already trusted by thousands of organizations to contain threats at the earliest stages without causing business disruption. This includes enhanced support for highly complex and segmented networks, plus the ability to extend Autonomous Response actions to more areas with additional firewall integration support. This enables faster and more effective response to network threats, and continues Darktrace’s proven ability to contain zero-day threats up to 8 days before public disclosure.

Providing seamless operations with the new Darktrace ActiveAI Security Portal

As part of Darktrace’s commitment to breaking down silos across the cyber defense lifecycle, this release also introduces major platform enhancements that tackle often-overlooked operational gaps specifically around user access, permissions, and integration workflows. With the launch of the new Darktrace ActiveAI Security Portal, organizations can now manage security at scale across diverse environments, making it ideal for large enterprises, MSSPs, and partners overseeing multiple tenants. These updates ensure that visibility, control, and scalability extend beyond detection and response and into how teams manage and interact with the platform itself.

Committed to innovation

These updates are part of the broader Darktrace release, which also included:

1. Major innovations in cloud security with the launch of the industry’s first fully automated cloud forensics solution, reinforcing Darktrace’s leadership in AI-native security.

2. Innovations to our suite of Exposure Management & Attack Surface Management products including:

  • Exploit Prediction Assessment: Continuously validates whether top-priority exposures are actually exploitable in your environment without waiting for patch cycles or formal pen tests.  
  • Deep & Dark Web Monitoring: Extends visibility across millions of sources in the deep and dark web to detect leaked credentials linked to your confirmed domains.
  • Confidence Score: our newly developed AI classification platform will compare newly discovered assets to assets that are known to belong to your organization. The more these newly discovered assets look similar to assets that belong to your organization, the higher the score will be.
  • No-Telemetry Endpoint: Collects installed software data and maps it to known CVEs—without network traffic—providing device-level vulnerability context and operational relevance.
  • Cost-Benefit Analysis for Patching: Calculates ROI by comparing patching effort with potential exploit impact, factoring in headcount time, device count, patch difficulty, and automation availability.

Visit these blogs to learn more about updates:

As attackers exploit gaps between tools, the Darktrace ActiveAI Security Platform delivers unified detection, automated investigation, and autonomous response across cloud, endpoint, email, network, and OT. With full-stack visibility and AI-native workflows, Darktrace empowers security teams to detect, understand, and stop novel threats before they escalate.

Join our Live Launch Event

When? 

December 9, 2025

What will be covered?

Join our live broadcast to experience how Darktrace is eliminating blind spots for detection and response across your complete enterprise with new innovations in Agentic AI across our ActiveAI Security platform. Industry leaders from IDC will join Darktrace customers to discuss challenges in cross-domain security, with a live walkthrough reshaping the future of Network Detection & Response, Endpoint Detection & Response, Email Security, and SecOps in novel threat detection and autonomous investigations.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response

Blog

/

/

October 20, 2025

Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion

salt typhoonDefault blog imageDefault blog image

What is Salt Typhoon?

Salt Typhoon represents one of the most persistent and sophisticated cyber threats targeting global critical infrastructure today. Believed to be linked to state-sponsored actors from the People’s Republic of China (PRC), this advanced persistent threat (APT) group has executed a series of high-impact campaigns against telecommunications providers, energy networks, and government systems—most notably across the United States.

Active since at least 2019, the group—also tracked as Earth Estries, GhostEmperor, and UNC2286—has demonstrated advanced capabilities in exploiting edge devices, maintaining deep persistence, and exfiltrating sensitive data across more than 80 countries. While much of the public reporting has focused on U.S. targets, Salt Typhoon’s operations have extended into Europe, the Middle East, and Africa (EMEA) where it has targeted telecoms, government entities, and technology firms. Its use of custom malware and exploitation of high-impact vulnerabilities (e.g., Ivanti, Fortinet, Cisco) underscores the strategic nature of its campaigns, which blend intelligence collection with geopolitical influence [1].

Leveraging zero-day exploits, obfuscation techniques, and lateral movement strategies, Salt Typhoon has demonstrated an alarming ability to evade detection and maintain long-term access to sensitive environments. The group’s operations have exposed lawful intercept systems, compromised metadata for millions of users, and disrupted essential services, prompting coordinated responses from intelligence agencies and private-sector partners worldwide. As organizations reassess their threat models, Salt Typhoon serves as a stark reminder of the evolving nature of nation-state cyber operations and the urgent need for proactive defense strategies.

Darktrace’s coverage

In this case, Darktrace observed activity in a European telecommunications organisation consistent with Salt Typhoon’s known tactics, techniques and procedures (TTPs), including dynamic-link library (DLL) sideloading and abuse of legitimate software for stealth and execution.

Initial access

The intrusion likely began with exploitation of a Citrix NetScaler Gateway appliance in the first week of July 2025. From there, the actor pivoted to Citrix Virtual Delivery Agent (VDA) hosts in the client’s Machine Creation Services (MCS) subnet. Initial access activities in the intrusion originated from an endpoint potentially associated with the SoftEther VPN service, suggesting infrastructure obfuscation from the outset.

Tooling

Darktrace subsequently observed the threat actor delivering a backdoor assessed with high confidence to be SNAPPYBEE (also known as Deed RAT) [2][3] to multiple Citrix VDA hosts. The backdoor was delivered to these internal endpoints as a DLL alongside legitimate executable files for antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This pattern of activity indicates that the attacker relied on DLL side-loading via legitimate antivirus software to execute their payloads. Salt Typhoon and similar groups have a history of employing this technique [4][5], enabling them to execute payloads under the guise of trusted software and bypassing traditional security controls.

Command-and-Control (C2)

The backdoor delivered by the threat actor leveraged LightNode VPS endpoints for C2, communicating over both HTTP and an unidentified TCP-based protocol. This dual-channel setup is consistent with Salt Typhoon’s known use of non-standard and layered protocols to evade detection. The HTTP communications displayed by the backdoor included POST requests with an Internet Explorer User-Agent header and Target URI patterns such as “/17ABE7F017ABE7F0”. One of the C2 hosts contacted by compromised endpoints was aar.gandhibludtric[.]com (38.54.63[.]75), a domain recently linked to Salt Typhoon [6].

Detection timeline

Darktrace produced high confidence detections in response to the early stages of the intrusion, with both the initial tooling and C2 activities being strongly covered by both investigations by Darktrace Cyber AI AnalystTM investigations and Darktrace models. Despite the sophistication of the threat actor, the intrusion activity identified and remediated before escalating beyond these early stages of the attack, with Darktrace’s timely high-confidence detections likely playing a key role in neutralizing the threat.

Cyber AI Analyst observations

Darktrace’s Cyber AI Analyst autonomously investigated the model alerts generated by Darktrace during the early stages of the intrusion. Through its investigations, Cyber AI Analyst discovered the initial tooling and C2 events and pieced them together into unified incidents representing the attacker’s progression.

Cyber AI Analyst weaved together separate events from the intrusion into broader incidents summarizing the attacker’s progression.
Figure 1: Cyber AI Analyst weaved together separate events from the intrusion into broader incidents summarizing the attacker’s progression.

Conclusion

Based on overlaps in TTPs, staging patterns, infrastructure, and malware, Darktrace assesses with moderate confidence that the observed activity was consistent with Salt Typhoon/Earth Estries (ALA GhostEmperor/UNC2286). Salt Typhoon continues to challenge defenders with its stealth, persistence, and abuse of legitimate tools. As attackers increasingly blend into normal operations, detecting behavioral anomalies becomes essential for identifying subtle deviations and correlating disparate signals. The evolving nature of Salt Typhoon’s tradecraft, and its ability to repurpose trusted software and infrastructure, ensures it will remain difficult to detect using conventional methods alone. This intrusion highlights the importance of proactive defense, where anomaly-based detections, not just signature matching, play a critical role in surfacing early-stage activity.

Credit to Nathaniel Jones (VP, Security & AI Strategy, FCISO), Sam Lister (Specialist Security Researcher), Emma Foulger (Global Threat Research Operations Lead), Adam Potter (Senior Cyber Analyst)

Edited by Ryan Traill (Analyst Content Lead)

Appendices

Indicators of Compromise (IoCs)

IoC-Type-Description + Confidence

89.31.121[.]101 – IP Address – Possible C2 server

hxxp://89.31.121[.]101:443/WINMM.dll - URI – Likely SNAPPYBEE download

b5367820cd32640a2d5e4c3a3c1ceedbbb715be2 - SHA1 – Likely SNAPPYBEE download

hxxp://89.31.121[.]101:443/NortonLog.txt - URI - Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/123.txt - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/123.tar - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/pdc.exe - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443//Dialog.dat - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/fltLib.dll - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/DisplayDialog.exe - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/DgApi.dll - URI - Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/dbindex.dat - URI - Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/1.txt - URI - Possible DLL side-loading activity

hxxp://89.31.121[.]101:443/imfsbDll.dll – Likely DLL side-loading activity

hxxp://89.31.121[.]101:443/imfsbSvc.exe - URI – Likely DLL side-loading activity

aar.gandhibludtric[.]com – Hostname – Likely C2 server

38.54.63[.]75 – IP – Likely C2 server

156.244.28[.]153 – IP – Possible C2 server

hxxp://156.244.28[.]153/17ABE7F017ABE7F0 - URI – Possible C2 activity

MITRE TTPs

Technique | Description

T1190 | Exploit Public-Facing Application - Citrix NetScaler Gateway compromise

T1105 | Ingress Tool Transfer – Delivery of backdoor to internal hosts

T1665 | Hide Infrastructure – Use of SoftEther VPN for C2

T1574.001 | Hijack Execution Flow: DLL – Execution of backdoor through DLL side-loading

T1095 | Non-Application Layer Protocol – Unidentified application-layer protocol for C2 traffic

T1071.001| Web Protocols – HTTP-based C2 traffic

T1571| Non-Standard Port – Port 443 for unencrypted HTTP traffic

Darktrace Model Alerts during intrusion

Anomalous File::Internal::Script from Rare Internal Location

Anomalous File::EXE from Rare External Location

Anomalous File::Multiple EXE from Rare External Locations

Anomalous Connection::Possible Callback URL

Antigena::Network::External Threat::Antigena Suspicious File Block

Antigena::Network::Significant Anomaly::Antigena Significant Server Anomaly Block

Antigena::Network::Significant Anomaly::Antigena Controlled and Model Alert

Antigena::Network::Significant Anomaly::Antigena Alerts Over Time Block

Antigena::Network::External Threat::Antigena File then New Outbound Block  

References

[1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a

[2] https://www.trendmicro.com/en_gb/research/24/k/earth-estries.html

[3] https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/k/earth-estries/IOC_list-EarthEstries.txt

[4] https://www.trendmicro.com/en_gb/research/24/k/breaking-down-earth-estries-persistent-ttps-in-prolonged-cyber-o.html

[5] https://lab52.io/blog/deedrat-backdoor-enhanced-by-chinese-apts-with-advanced-capabilities/

[6] https://www.silentpush.com/blog/salt-typhoon-2025/

The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.

Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.

Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.

The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content.

Continue reading
About the author
Nathaniel Jones
VP, Security & AI Strategy, Field CISO
Your data. Our AI.
Elevate your network security with Darktrace AI