August 2, 2023

Darktrace's Detection of Ransomware & Syssphinx

Read how Darktrace identified an attack technique by the threat group, Syssphinx. Learn how Darktrace's quick identification process can spot a threat.

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Adam Potter

Senior Cyber Analyst

Aug 2023

Introduction

As the threat of costly cyber-attacks continues represent a real concern to security teams across the threat landscape, more and more organizations are strengthening their defenses with additional security tools to identify attacks and protect their networks. As a result, malicious actors are being forced to adapt their tactics, modify existing variants of malicious software, or utilize entirely new variants.

Symantec recently released an article about Syssphinx, the financially motivated cyber threat group previously known for their point-of-sale attacks. Syssphinx attempts to deploy ransomware on customer networks via a modified version of their ‘Sardonic’ backdoor. Such activity highlights the ability of threat actors to alter the composition and presentation of payloads, tools, and tactics.

Darktrace recently detected some of the same indicators suggesting a likely Syssphinx compromise within the network of a customer trialing the Darktrace DETECT™ and RESPOND™ products. Despite the potential for variations in the construction of backdoors and payloads used by the group, Darktrace’s anomaly-based approach to threat detection allowed it to stitch together a detailed account of compromise activity and identify the malicious activity prior to disruptive events on the customer’s network.

What is Syssphinx?

Syssphinx is a notorious cyber threat entity known for its financially motivated compromises. Also referred to as FIN8, Syssphinx has been observed as early as 2016 and is largely known to target private sector entities in the retail, hospitality, insurance, IT, and financial sectors.^[1]

Although Syssphinx primarily began focusing on point-of-sale style attacks, the activity associated with the group has more recently incorporated ransomware variants into their intrusions in a potential bid to further extract funds from target organizations.^[2]

Syssphinx Sardonic Backdoor

Given this gradual opportunistic incorporation of ransomware, it should not be surprising that Syssphinx has slowly expanded its repertoire of tools. When primarily performing point-of-sale compromises, the group was known for its use of point-of-sale specific malwares including BadHatch, PoSlurp/PunchTrack, and PowerSniff/PunchBuggy/ShellTea.^[3]

However, in a seeming response to updates in detection systems while using previous indicators of compromise (IoCs), Syssphinx began to modify its BadHatch malware. This resulted in the use of a C++ derived backdoor known as “Sardonic”, which has the ability to aggregate host credentials, spawn additional command sessions, and deliver payloads to compromised devices via dynamic-link library (DLL).^[4],[5]

Analysis of the latest version of Sardonic reveals further changes to the malware to elude detection. These shifts include the implementation of the backdoor in the C programming language, and additional over-the-network communication obfuscation techniques.[6]

During the post-exploitation phase, the group tends to rely on “living-off-the-land” tactics, whereby an attacker utilizes tools already present within the organization’s digital environment to avoid detection. Syssphinx seems to utilize system-native tools such as PowerShell and the Windows Management Instrumentation (WMI) interface.^[7] It is also not uncommon to see Windows-based vulnerability exploits employed on compromised devices. This has been observed by researchers who have examined previous iterations of Syssphinx backdoors.^[8] Syssphinx also appears to exhibit elements of strategic patience and discipline in its operations, with significant time gaps in operations noted by researchers. During this time, it appears likely that updates and tweaks were applied to Syssphinx payloads.

Compromise Details

In late April 2023, Darktrace identified an active compromise on the network of a prospective customer who was trialing Darktrace DETECT+RESPOND. The customer, a retailer in EMEA with hundreds of tracked devices, reached out to the Darktrace Analyst team via the Ask the Expert (ATE) service for support and further investigation, following the encryption of their server and backup data storage in an apparent ransomware attack. Although the encryption events fell outside Darktrace’s purview due to a limited set up of trial appliances, Darktrace was able to directly track early stages of the compromise before exfiltration and encryption events began. If a full deployment had been set up and RESPOND functionality had been configured in autonomous response mode, Darktrace may have helped mitigate such encryption events and would have aided in the early identification of this ransomware attack.

Initial Intrusion and Establishment of Command and Control (C2) Infrastructure

As noted by security researchers, Syssphinx largely relies on social engineering and phishing emails to deliver its backdoor payloads. As there were no Darktrace/Email™ products deployed for this customer, it would be difficult to directly observe the exact time and manner of initial payload delivery related to this compromise. This is compounded by the fact that the customer had only recently began using Darktrace’s products during their trial period. Given the penchant for patience and delay by Syssphinx, it is possible that the intrusion began well before Darktrace had visibility of the organization’s network.

However, beginning on April 30, 2023, at 07:17:31 UTC, Darktrace observed the domain controller dc01.corp.XXXX making repeated SSL connections to the endpoint 173-44-141-47[.]nip[.]io. In addition to the multiple open-source intelligence (OSINT) flags for this endpoint, the construction of the domain parallels that of the initial domain used to deliver a backdoor, as noted by Symantec in their analysis (37-10-71-215[.]nip[.]io). This activity likely represented the initial beaconing being performed by the compromised device. Additionally, an elevated level of incoming external data over port 443 was observed during this time, which may be associated with the delivery of the Sardonic backdoor payload. Given the unusual use of port 443 to perform SSH connections later seen in the kill chain of this attack, this activity could also parallel the employment of embedded backdoor payloads seen in the latest iteration of the Sardonic backdoor noted by Symantec.

Figure 1: Graph of the incoming external data surrounding the time of the initial establishment of command and control communication for the domain controller. As seen in the graph, the spike in incoming external data during this time may parallel the delivery of Syssphinx Sardonic backdoor.

Regardless, the domain controller proceeded to make repeated connections over port 443 to the noted domain.

Figure 2: Breach event log for the domain controller making repeated connections over port 443 to the rare external destination endpoint in constitute the establishment of C2 communication.

Internal Reconnaissance/Privilege Escalation

Following the establishment of C2 communication, Darktrace detected numerous elements of internal reconnaissance. On Apr 30, 2023, at 22:06:26 UTC, the desktop device desktop_02.corp.XXXX proceeded to perform more than 100 DRSGetNCChanges requests to the aforementioned domain controller. These commands, which are typically implemented over the RPC protocol on the DRSUAPI interface, are frequently utilized in Active Directory sync attacks to copy Active Directory information from domain controllers. Such activity, when not performed by new domain controllers to sync Active Directory contents, can indicate malicious domain or user enumeration, credential compromise or Active Directory enumeration.

Although the affected device made these requests to the previously noted domain controller, which was already compromised, such activity may have further enabled the compromise by allowing the threat actor to transfer these details to a more easily manageable device.

The device performing these DRSGetNCChanges requests would later be seen performing lateral movement activity and making connections to malicious endpoints.

Figure 3: Breach log highlighting the DRS operations performed by the corporate device to the destination domain controller. Such activity is rarely authorized for devices not tagged as administrative or as domain controllers.

Execution and Lateral Movement

At 23:09:53 UTC on April 30, 2023, the original domain server proceeded to make multiple uncommon WMI calls to a destination server on the same subnet (server01.corp.XXXX). Specifically, the device was observed making multiple RPC calls to IWbem endpoints on the server, which included login and ExecMethod (method execution) commands on the destination device. This destination device later proceeded to conduct additional beaconing activity to C2 endpoints and exfiltrate data.

Figure 4: Breach log for the domain controller performing WMI commands to the destination server during the lateral movement phase of the breach.

Similarly, beginning on May 1, 2023, at 00:11:09 UTC, the device desktop_02.corp.XXXX made multiple WMI requests to two additional devices, one server and one desktop, within the same subnet as the original domain controller. During this time, desktop_02.corp.XXXX also utilized SMBv1, an outdated and typically non-compliant version communication protocol, to write the file rclone.exe to the same two destination devices. Rclone.exe, and its accompanying bat file, is a command-line tool developed by IT provider Rclone, to perform file management tasks. During this time, Darktrace also observed the device reading and deleting an unexpected numeric file on the ADMIN$ of the destination server, which may represent additional defense evasion techniques and tool staging.

Figure 5: Event log highlighting the writing of rclone.exe using the outdated SMBv1 communication protocol.

Figure 6: SMB logs indicating the reading and deletion of numeric string files on ADMIN$ shares of the destination devices during the time of the rclone.exe SMB writes. Such activity may be associated with tool staging and could indicate potential defense evasion techniques.

Given that the net loader sample analyzed by Symantec injects the backdoor into a WmiPrvSE.exe process, the use of WMI operations is not unexpected. Employment of WMI also correlates with the previously mentioned “living-off-the-land” tactics, as WMI services are commonly used for regular network and system administration purposes. Moreover, the staging of rclone.exe, a legitimate file management tool, for data exfiltration underscores attempts to blend into existing and expected network traffic and remain undetected on the customer’s network.

Data Exfiltration and Impact

Initial stages of data exfiltration actually began prior to some of the lateral movement events described above. On April 30, 2023, 23:09:47 the device server01.corp.XXXX, transferred nearly 11 GB of data to 173.44[.]141[.]47, as well as to the rare external IP address 170.130[.]55[.]77, which appears to have served as the main exfiltration destination during this compromise. Furthermore, the host made repeated connections to the same external IP associated with the initial suspicious beaconing activity (173.44[.]141[.]47) over SSL.

While the data exfiltration event unfolded, the device, server01.corp.XXXX, made multiple HTTP requests to 37.10[.]71[.]215, which featured URIs requesting the rclone.exe and rclone.bat files. This IP address was directly involved in the sample analyzed by Symantec. Furthermore, one of the devices that received the SMB file writes of rclone.exe and the WMI commands from desktop_02.corp.XXXX also performed SSL beaconing to endpoints associated with the compromise.

Between 01:20:45 - 03:31:41 UTC on May 1, 2023, a Darktrace detected a series of devices on the network performing a repeated pattern of activity, namely external connectivity followed by suspicious file downloads and external data transfer operations. Specifically, each affected device made multiple HTTP requests to 37.10[.]71[.]215 for rclone files. The devices proceeded to download the executable and/or binary files, and then transfer large amounts of data to the aforementioned endpoints, 170.130[.]55[.]77 and or 173-44-141-47[.]nip[.]io. Although the devices involved in data exfiltration utilized port 443 as a destination port, the connections actually used the SSH protocol. Darktrace recognized this behavior as unusual as port 443 is typically associated with the SSL protocol, while port 22 is reserved for SSH. Therefore, this activity may represent the threat actor’s attempts to remain undetected by security tools.

This unexpected use of SSH over port 443 also correlates with the descriptions of the new Sardonic backdoor according to threat researchers. Further beaconing and exfiltration activity was performed by an additional host one day later whereby the device made suspicious repeated connections to the aforementioned external hosts.

Figure 7: Connection details highlighting the use of port 443 for SSH connections during the exfiltration events.

In total, nine separate devices were involved in this pattern of activity. Five of these devices were labeled as ‘administrative’ devices according to their hostnames. Over the course of the entire exfiltration event, the attackers exfiltrated almost 61 GB of data from the organization’s environment.

Figure 8: Graph showing the levels of external data transfer from a breach device for one day on either side of the breach time. There is a large spike in such activity during the time of the breach that underscores the exfiltration events.

In addition to the individual anomaly detections by DETECT, Darktrace’s Cyber AI Analyst™ launched an autonomous investigation into the unusual behavior carried out by affected devices, connecting and collating multiple security events into one AI Analyst Incident. AI Analyst ensures that Darktrace can recognize and link the individual steps of a wider attack, rather than just identifying isolated incidents. While traditional security tools may mistake individual breaches as standalone activity, Darktrace’s AI allows it to provide unparalleled visibility over emerging attacks and their kill chains. Furthermore, Cyber AI Analyst’s instant autonomous investigations help to save customer security teams invaluable time in triaging incidents in comparison with human teams who would have to commit precious time and resources to conduct similar pattern analysis.

In this specific case, AI Analyst identified 44 separate security events from 18 different devices and was able to tie them together into one incident. The events that made up this AI Analyst Incident included:

Possible SSL Command and Control
Possible HTTP Command and Control
Unusual Repeated Connections
Suspicious Directory Replication ServiceActivity
Device / New or Uncommon WMI Activity
SMB Write of Suspicious File
Suspicious File Download
Unusual External Data Transfer
Unusual External Data Transfer to MultipleRelated Endpoints

Figure 9: Cyber AI Incident log highlighting multiple unusual anomalies and connecting them into one incident.

Had Darktrace RESPOND been enabled in autonomous response mode on the network of this prospective customer, it would have been able to take rapid mitigative action to block the malicious external connections used for C2 communication and subsequent data exfiltration, ideally halting the attack at this stage. As previously discussed, the limited network configuration of this trial customer meant that the encryption events unfortunately took place outside of Darktrace’s scope. When fully configured on a customer environment, Darktrace DETECT can identify such encryption attempts as soon as they occur. Darktrace RESPOND, in turn, would be able to immediately intervene by applying preventative actions like blocking internal connections that may represent file encryption, or limiting potentially compromised devices to a previously established pattern of life, ensuring they cannot carry out any suspicious activity.

Conclusion

Despite the limitations posed by the customer’s trial configuration, Darktrace demonstrated its ability to detect malicious activity associated with Syssphinx and track it across multiple stages of the kill chain.

Darktrace’s ability to identify the early stages of a compromise and various steps of the kill chain, highlights the necessity for machine learning-enabled, anomaly-based detection. In the face of threats such as Syssphinx, that exhibit the propensity to recast backdoor payloads and incorporate on “living-off-the-land” tactics, signatures and rules-based detection may not prove as effective. While Syssphinx and other threat groups will continue to adopt new tools, methods, and techniques, Darktrace’s Self-Learning AI is uniquely positioned to meet the challenge of such threats.

Appendix

DETECT Model Breaches Observed

• Anomalous Server Activity / Anomalous External Activity from Critical Network Device

• Anomalous Connection / Anomalous DRSGetNCChanges Operation

• Device / New or Uncommon WMI Activity

• Compliance / SMB Drive Write

• Anomalous Connection / Data Sent to Rare Domain

• Anomalous Connection / Uncommon 1 GiB Outbound

• Unusual Activity / Unusual External Data Transfer

• Unusual Activity / Unusual External Data to New Endpoints

• Compliance / SSH to Rare External Destination

• Anomalous Connection / Unusual SMB Version 1 Connectivity

• Anomalous File / EXE from Rare External Location

• Anomalous File / Script from Rare External Location

• Compromise / Suspicious File and C2

• Device / Initial Breach Chain Compromise

‍

AI Analyst Incidents Observed

• Possible SSL Command and Control

• Possible HTTP Command and Control

• Unusual Repeated Connections

• Suspicious Directory Replication Service Activity

• Device / New or Uncommon WMI Activity

• SMB Write of Suspicious File

• Suspicious File Download

• Unusual External Data Transfer

• Unusual External Data Transfer to Multiple Related Endpoints

IoCs

IoC - Type - Description

37.10[.]71[.]215 – IP – C2 + payload endpoint

173-44-141-47[.]nip[.]io – Hostname – C2 – payload

173.44[.]141[.]47 – IP – C2 + potential payload

170.130[.]55[.]77 – IP – Data exfiltration endpoint

Rclone.exe – Exe File – Common data tool

Rclone.bat – Script file – Common data tool

MITRE ATT&CK Mapping

Command and Control

T1071 - Application Layer Protocol

T1071.001 – Web protocols

T1573 – Encrypted channels

T1573.001 – Symmetric encryption

T1573.002 – Asymmetric encryption

T1571 – Non-standard port

T1105 – Ingress tool transfer

Execution

T1047 – Windows Management Instrumentation

Credential Access‍

T1003 – OS Credential Dumping

T1003.006 – DCSync

Lateral Movement

T1570 – Lateral Tool Transfer

T1021 - Remote Services

T1021.002 - SMB/Windows Admin Shares

T1021.006 – Windows Remote Management

Exfiltration

T1048 - Exfiltration Over Alternative Protocol

T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol

T1048.002 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol

T1041 - Exfiltration Over C2 Channel

References

^[1] https://cyberscoop.com/syssphinx-cybercrime-ransomware/

^[2] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor

^[3] https://www.bleepingcomputer.com/news/security/fin8-deploys-alphv-ransomware-using-sardonic-malware-variant/

^[4] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor

^[5] https://thehackernews.com/2023/07/fin8-group-using-modified-sardonic.html

^[6] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor

^[7] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor

^[8] https://www.mandiant.com/resources/blog/windows-zero-day-payment-cards

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Written by

Adam Potter

Senior Cyber Analyst

The Darktrace Community

Watch the NIS2 Webinar

Blog

June 9, 2026

Always On, Always Defending: Inside the AI-Driven SOC

Today’s SOC: A system under pressure

The SOC has been described as the:

Control center for security systems management
Operations center for log analysis and alert response
Command center for network monitoring and investigation

But the CISO at a manufacturer of industrial power solutions says today’s SOC is far more dynamic:

“The SOC is an active player in a never-ending chess match where the pieces are always moving, the rules are constantly changing, and we’re continuously adjusting our tactical and strategic approaches to keep up.”

This has created a balancing act for cybersecurity professionals:

Support expanding digital estates to fuel innovation…or risk limiting business growth
Stop advanced cyberattacks at scale…or risk severe financial and reputational impacts

But balancing these responsibilities is increasingly difficult. Attackers are operating at machine speed and scale using sophisticated, adaptive techniques that overwhelm teams and bypass legacy defenses. At the same time, more than half of cybersecurity teams are understaffed, and 65% have unfilled cybersecurity positions (ISACA).

“The SOC is hitting its breaking point,” admits the VP of IT at a U.S.-based risk management services provider.”

“That’s the hard reality,” affirms a Chief Digital and Technology Officer at a North American financial services organization. “SOC teams are drowning in alerts, wasting time researching the most benign incidents while missing critical threats.”

Traditional tools lack the context and autonomous reasoning needed to determine which ones are truly dangerous, requiring analysts to manually review and respond. But with thousands of alerts hitting SOCs daily, the task exceeds human capacity, with recent industry research revealing that 40% to 42% of security alerts now go uninvestigated.

“Our old governance models of throwing bodies at it, that’s not going to work,” says the Group CIO of a multinational holding company. “Attackers move at machine speed, and our defenses have to operate at the same pace. Using AI for cybersecurity is the only way to do that.”

Why AI is essential

AI is about speed, scale, and context.

SOC teams are still expected to find the proverbial “needle in a haystack”, but the haystack keeps growing. As digital infrastructures expand and threat actors use AI to rapidly scale attacks and exploit vulnerabilities, success isn’t about keeping up but changing the approach.

This is where AI comes in, enabling security teams to operate at machine speed and scale by:

Analyzing vast amounts of data and correlating signals across domains within seconds
Detecting possible threats in real time and taking immediate action to mitigate risk
Prioritizing threats by severity and uncovering contextual details for rapid triage

The power of AI isn’t theoretical; it is transforming how today’s businesses operate.

The Chief Digital and Technology Officer at a financial services firm says within a single month of using Darktrace, the solution tracked billions of network events, autonomously investigated tens of millions of those incidents, and added the equivalent of 1,000 analyst hours of investigation. It also found threats that bypassed traditional tools, autonomously responding to contain or disrupt the threat on over 30,000 emails, including 18,000 the firm’s native email filter missed.

When Darktrace says it “takes action on a threat,” it generally means its platform can move beyond just detecting suspicious activity and automatically respond to contain or disrupt the threat—such as isolating a device, slowing or blocking suspicious network traffic, disabling risky user activity, or triggering security workflows—depending on how the system is configured.

AI isn’t about displacing humans.

AI is a powerful tool for handling large-scale data analysis, pattern detection, and repetitive tasks, but it cannot replace human critical thinking. By removing mindless work that does not require judgment, AI frees analysts to focus on what humans do best: applying reasoning, context, and sound decision-making to complex threats.

“AI is a workforce maximizer,” says the Chief Digital and Technology Officer. “It augments our team by monitoring and detecting threats at a scale beyond human capacity while providing the critical context we need to make faster, more confident decisions.

Rather than replacing people, AI is changing how security professionals work. Analysts can reclaim time previously spent on tedious, manual triage to focus on higher priorities and proactive initiatives like advanced threat hunting, strategic risk management, and security enablement and training.

“Aside from risk mitigation, our biggest ROI is in efficiency,” says the Head of Security at global business services provider. “What used to take 90% of our investigation time is now handled automatically, so we can focus on the final 10%, which requires critical thinking."

For SOC teams under pressure, the impact can be transformative, with security leaders reporting significant real-world outcomes using Darktrace Self-Learning AI^TM, including:

Phishing emails reduced by 99%
1 million+ emails autonomously analyzed each month, with no email-based incidents reported
Potential threats autonomously neutralized in under four seconds, on average
99% of investigations conducted autonomously, surfacing only the high-priority 1% of threats for analyst review

How AI optimizes the SOC

To protect the modern enterprise, you absolutely need the right tools,” says CTO at leading European fashion brand. “Without them you’re a victim. With them, you’re a defender. AI and the machine speed detect/response it enables makes it the most critical tool.”

Replacing chaos with clarity and control

It’s important to note that different AI solutions address different needs. Companies should clearly understand their specific use case and select the solution that best aligns with their goals, requirements, and operational needs.

When it comes to choosing cybersecurity in a machine-speed threat landscape, time is the most valuable resource. Organizations require AI that can move from insight to action by:

Learning an organization’s unique behavioral patterners
Correlating signals across domains to detect anomalous activity
Prioritizing events and autonomously responding at scale to the vast majority
Quarantining high-impact threats until the SOC can investigate
Arming analysts with deep, contextual information to accelerate investigations

“Darktrace AI gives us threat detections based on facts, not guesses,” says the Group CIO. “It moves the SOC beyond alert overload to confident, informed decision-making. When Darktrace flags something, we pay attention. False positives are very rare, so we act with speed and confidence without second-guessing.”

Replacing anxiety with confidence and peace of mind

Every missed alert can have real-world consequences.

The strain of maintaining constant vigilance at scale without holistic visibility and automation is taking its toll on security professionals: 66% report increased stress, and nearly half say it’s the reason they’re leaving the field (ISACA).

The CIO at a professional sports organization says that’s not surprising: “If you don’t know what’s going on, anything could be happening. Operating with that level of uncertainty and control is incredibly stressful.”

AI gives SOCs the power to be proactive by unifying telemetry across network, email, identity, and cloud environments to provide a complete picture and a stronger foundation for action. The benefits for analysts, both personally and professionally, are significant:

Achieve greater work-life balance: “Knowing that Darktrace has our backs 24/7 and will take immediate action to stop threats means we can now work normal hours and take vacations without worrying,” says the Chief Digital and Technology Officer.
Feel in control with deeper insights: “It not only stops and quarantines threats but also provides the deep context we need to quickly investigate and respond,” explains the Head of Security.
Gain confidence the business is protected 24/7: “We can sleep at night. With Darktrace I’m confident that even with a small team we can protect the business 24/7,” adds the former retail CIO.

The modern SOC: A system of balance

Elevated to a core pillar of business strategy, the modern SOC is now considered:

The nerve center of cyber risk and proactive defense
The AI-powered command center for operational resilience
The strategic hub for contextual decision-making at scale

The SOC has evolved from a reactive center responsible for managing systems into a proactive, frontline defender and strategic business enabler—integral to innovation and growth.

AI is the key to balancing these responsibilities.

“We can only grow as fast as we can secure the business,” says the Head of Security. “AI gives us the speed, scale, and confidence to do both.”

*Metrics are based on the customer’s interview, data and sourced from its monthly Cyber AI Insights reporting.

About the author

The Darktrace Community

Blog

Proactive Security

June 3, 2026

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

Núclea is a Brazilian data and technology company that supports the country’s financial system by delivering digital services exclusively to banks and financial institutions. Operating in an environment where trust, availability, and data integrity are critical, the company faces a threat landscape that has evolved rapidly—particularly with the rise of AI-driven cyberattacks.

Brazil has experienced a wave of successful cyber incidents targeting financial institutions, many of them enabled by insiders or compromised credentials. The result was a noticeable shift in attacker strategy: instead of focusing on end customers, threat actors began targeting the institutions and platforms that underpin the financial ecosystem itself.

“Attacks became far more directed and contextual,” explains Guilherme, who leads incident response within Núclea’s security platform engineering team. “They weren’t noisy or obviously malicious—they were precise, patient, and designed to blend into normal operations.”

That precision was on full display in January 2026, when Núclea faced one of the most convincing phishing attacks the team had seen.

A real attack, built on trust and context

The attack began with a seemingly routine email.

It was sent from a real Brazilian government institution, using legitimate infrastructure and valid credentials that were later confirmed to have been compromised. Núclea had an established, ongoing relationship with this organization, and the email’s language, tone, and subject matter aligned perfectly with the type of communication the recipient team handled every day.

Attached to the email was a PDF document containing content that looked entirely legitimate.

The problem? A single URL embedded inside that PDF.

“The message itself was correct. The sender was real. The context was familiar. Even the document content made sense,” Guilherme explains. “There was just one small element that didn’t belong.”

That small detail was enough to initiate a full attack chain.

What the attackers were trying to do

If clicked, the URL would have downloaded a malicious payload designed to:

Collect information about the user and device
Identify where the system was located within the financial ecosystem
Install remote access tools to maintain control
Deploy an infostealer to extract sensitive data
Execute anti-forensic scripts to erase traces of the intrusion

In other words, it was a carefully engineered operation designed for persistence and stealth, not immediate disruption.

The attack also employed urgency—a classic social engineering technique. When the link didn’t open as expected, employees requested assistance from the security team, insisting the document was important and needed to be accessed quickly.

This is precisely the kind of scenario where traditional security tools struggle: almost everything about the interaction is legitimate.

Where Darktrace made the difference

Instead of blocking the entire message or relying on known indicators of compromise, Darktrace focused on behavioral context.

Darktrace recognized:

That the sending organization was normally trusted
That the communication pattern matched historical behavior
That the PDF content itself was not suspicious

But it also identified that the URL embedded within the document deviated from established behavioral patterns.

Rather than disrupting business operations, Darktrace took precise action: it rewrote the URL, preventing the malicious download while leaving the rest of the email untouched.

“When we analyzed it afterward, it became clear how dangerous the attack would have been,” says Guilherme. “But it never progressed—because Darktrace acted at exactly the right point.”

Subsequent forensic analysis confirmed the payload’s malicious intent. The attack never succeeded.

Precision over disruption

For Núclea, this incident reinforced a critical lesson: modern attacks don’t always look malicious—they hide within normal activity.

“What stands out to me is the precision,” Guilherme says. “Darktrace doesn’t rely on big, obvious signals. It’s effective in situations that fall outside the standard patterns we all know.”

Building resilience in a high trust ecosystem

For Núclea, cybersecurity is not just a defensive measure—it’s a business enabler.

Availability failures or successful breaches in the financial ecosystem can have immediate, large-scale consequences, from financial loss to reputational damage. Preventing those outcomes protects not just Núclea, but its partners and customers as well.

“Cyber resilience means keeping the business running—even under attack,” Guilherme explains. “And that requires people, processes, and technology working together.”

As AI continues to accelerate both attacks and defenses, the role of security is evolving. Precision, behavioral understanding, and intelligent automation are no longer optional—they’re essential.

“The easy days were yesterday,” Guilherme says. “The challenges ahead are bigger. We need to be prepared—internally and with partners that help us build resilience.”

‍

About the author

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Darktrace's Detection of Ransomware & Syssphinx

Darktrace's Detection of Ransomware & Syssphinx

Introduction

What is Syssphinx?

Syssphinx Sardonic Backdoor

Compromise Details

Initial Intrusion and Establishment of Command and Control (C2) Infrastructure

Internal Reconnaissance/Privilege Escalation

Execution and Lateral Movement

Data Exfiltration and Impact

Conclusion

Appendix

IoCs

MITRE ATT&CK Mapping

References

When Open Source Is Weaponized: Analysis of a Trojanized 7 Zip Installer

Always On, Always Defending: Inside the AI-Driven SOC

Enjoying the blog?

More in this series

Darktrace named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) For the Second Consecutive Year

When Open Source Is Weaponized: Analysis of a Trojanized 7 Zip Installer

Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

Blog

June 9, 2026

Always On, Always Defending: Inside the AI-Driven SOC

Today’s SOC: A system under pressure

Why AI is essential

AI is about speed, scale, and context.

AI isn’t about displacing humans.

How AI optimizes the SOC

Replacing chaos with clarity and control

Replacing anxiety with confidence and peace of mind

The modern SOC: A system of balance

Blog

Proactive Security

June 3, 2026

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

A real attack, built on trust and context

What the attackers were trying to do

Where Darktrace made the difference

Precision over disruption