The cyber security industry has tried to stem the tide by stopping ransomware at the network border, which can help detect some known ransomware threats. The problem is that ransomware is constantly evolving and mutating, with new strains popping up every day.
At Darktrace, our technology detects ransomware without prior knowledge, a vital capability since no matter how strong the network border is, these types of threats inevitably find a way inside.
Let’s take a look at how Darktrace’s unsupervised machine learning detected and responded to a real ransomware attack at a large financial services organization. As with most ransomware, it all started with a phishing email.
Darktrace first noticed anomalous behavior when an employee checked his personal webmail on a corporate laptop. The device started making HTTP requests to a rare external domain:Thu Nov 17, 20:20:22 192.168.103.106 connected to webmail.northrock.bm [80]
The employee opened what he believed to be a Word document, but was actually a malicious .zip file containing a ransomware payload. The device then connected to a second rare external domain. It was not until the next day that OSINT vendors identified the domain as malicious:Thu Nov 17, 20:20:55 192.168.103.106 connected to www.inhabitantap[.]top [80]
Darktrace then observed the device downloading a suspicious .exe file from the anomalous domain:File Transfer (EXE) — FileTransfer::Exe file found with filetype (application/x-dosexec) [80] SHA1: 7099508c86c3b40268a4039afa5aabafb6f36d90
At this point, the ransomware executable had already bypassed multiple perimeter security protocols on the device. The ransomware then began to search for available SMB shares. Unlike the encryption of data on individual devices, SMB encryption jeopardizes data across the entire corporate network. Darktrace highlighted this activity as a major deviation from normal:20:26:01 | 1 SMB Move Success — share= rename_to=[REDACTED].thor file=[REDACTED].xls [445] An unusual time for this activity | 20:26:01 | 1 SMB Read Success — share= file=[REDACTED].xls [445] | An unusual time for this activity
Nine seconds after the start of the SMB encryption activities, Darktrace raised an alert signifying that the anomaly required further investigation. As the behavior persisted over the next 24 seconds, Darktrace continually revised its understanding of the deviation as it progressed into a serious threat.
At this point, Darktrace’s Enterprise Immune System determined that the threat required an immediate response, but the security team had gone home for the weekend and wasn’t on site to manually remediate the situation. The Enterprise Immune System stepped in and automatically interrupted all attempts to write encrypted files to network file shares. In so doing, Darktrace neutralized the threat 33 seconds after the malicious activity began.
SMB write successes are observed as the device encrypts files on the network share (shown in gray). The green spikes represent the ‘significance’ of the activity as understood by Darktrace. This pattern of SMB activity represented a major deviation from the device’s normal behavior.
At every stage of the attack, the Enterprise Immune System continuously monitored the situation and raised alerts of increasing severity. Despite the speed with which the attack unfolded, and despite multiple endpoint solutions failing to identify the executable, the Enterprise Immune System identified the device’s behavior as highly anomalous, and in a matter of seconds, it destroyed the threat.
To learn more about the threats Darktrace finds, check out our Threat Use Cases page which details how external attackers changed data on a biometric scanner and attempted to take control of an industrial power station.
Like this and want more?
Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newsletter
Like this and want more?
Stay up to date on the latest industry news and insights.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Andrew Tsonchev
VP of Technology
Andrew is a technical expert on cyber security and advises Darktrace’s strategic customers on advanced threat defense, AI and autonomous response. He has a background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. His comments on cyber security and the threat to critical national infrastructure have been reported in international media, including CNBC and the BBC World.
Decrypting the Matrix: How Darktrace Uncovered a KOK08 Ransomware Attack
What is Matrix Ransomware?
Matrix is a ransomware family that first emerged in December 2016, mainly targeting small to medium-sized organizations across the globe in countries including the US, Belgium, Germany, Canada and the UK [1]. Although the reported number of Matrix ransomware attacks has remained relatively low in recent years, it has demonstrated ongoing development and gradual improvements to its tactics, techniques, and procedures (TTPs).
How does Matrix Ransomware work?
In earlier versions, Matrix utilized spam email campaigns, exploited Windows shortcuts, and deployed RIG exploit kits to gain initial access to target networks. However, as the threat landscape changed so did Matrix’s approach. Since 2018, Matrix has primarily shifted to brute-force attacks, targeting weak credentials on Windows machines accessible through firewalls. Attackers often exploit common and default credentials, such as “admin”, “password123”, or other unchanged default settings, particularly on systems with Remote Desktop Protocol (RDP) enabled [2] [3].
Darktrace observation of Matrix Ransomware tactics
In May 2024, Darktrace observed an instance of KOK08 ransomware, a specific strain used by Matrix actors, in which some of these ongoing developments and evolutions were observed. Darktrace detected activity indicative of internal reconnaissance, lateral movement, data encryption and exfiltration, with the affected customer later confirming that credentials used for Virtual Private Network (VPN) access had been compromised and used as the initial attack vector.
Another significant tactic observed by Darktrace in this case was the exfiltration of data following encryption, a hallmark of double extortion. This method is employed by attacks to increase pressure on the targeted organization, demanding ransom not only for the decryption of files but also threatening to release the stolen data if their demands are not met. These stakes are particularly high for public sector entities, like the customer in question, as the exposure of sensitive information could result in severe reputational damage and legal consequences, making the pressure to comply even more intense.
Darktrace’s Coverage of Matrix Ransomware
Internal Reconnaissance and Lateral Movement
On May 23, 2024, Darktrace / NETWORK identified a device on the customer’s network making an unusually large number of internal connections to multiple internal devices. Darktrace recognized that this unusual behavior was indicative of internal scanning activity. The connectivity observed around the time of the incident indicated that the Nmap attack and reconnaissance tool was used, as evidenced by the presence of the URI “/nice ports, /Trinity.txt.bak”.
Although Nmap is a crucial tool for legitimate network administration and troubleshooting, it can also be exploited by malicious actors during the reconnaissance phase of the attack. This is a prime example of a ‘living off the land’ (LOTL) technique, where attackers use legitimate, pre-installed tools to carry out their objectives covertly. Despite this, Darktrace’s Self-Learning AI had been continually monitoring devices across the customers network and was able to identify this activity as a deviation from the device’s typical behavior patterns.
Figure 1: The ‘Device / Attack and Recon Tools’ model alert identifying the active usage of the attack and recon tool, Nmap.
Figure 2: Cyber AI Analyst Investigation into the ‘Scanning of Multiple Devices' incident.
Darktrace subsequently observed a significant number of connection attempts using the RDP protocol on port 3389. As RDP typically requires authentication, multiple connection attempts like this often suggest the use of incorrect username and password combinations.
Given the unusual nature of the observed activity, Darktrace’s Autonomous Response capability would typically have intervened, taking actions such as blocking affected devices from making internal connections on a specific port or restricting connections to a particular device. However, Darktrace was not configured to take autonomous action on the customer’s network, and thus their security team would have had to manually apply any mitigative measures.
Later that day, the same device was observed attempting to connect to another internal location via port 445. This included binding to the server service (srvsvc) endpoint via DCE/RPC with the “NetrShareEnum” operation, which was likely being used to list available SMB shares on a device.
Over the following two days, it became clear that the attackers had compromised additional devices and were actively engaging in lateral movement. Darktrace detected two more devices conducting network scans using Nmap, while other devices were observed making extensive WMI requests to internal systems over DCE/RPC. Darktrace recognized that this activity likely represented a coordinated effort to map the customer’s network and identity further internal devices for exploitation.
Beyond identifying the individual events of the reconnaissance and lateral movement phases of this attack’s kill chain, Darktrace’s Cyber AI Analyst was able to connect and consolidate these activities into one comprehensive incident. This not only provided the customer with an overview of the attack, but also enabled them to track the attack’s progression with clarity.
Furthermore, Cyber AI Analyst added additional incidents and affected devices to the investigation in real-time as the attack unfolded. This dynamic capability ensured that the customer was always informed of the full scope of the attack. The streamlined incident consolidation and real-time updates saved valuable time and resources, enabling quicker, more informed decision-making during a critical response window.
Figure 3: Cyber AI Analyst timeline showing an overview of the scanning related activity, while also connecting the suspicious lateral movement activity.
File Encryption
On May 28, 2024, another device was observed connecting to another internal location over the SMB filesharing protocol and accessing multiple files with a suspicious extension that had never previously been observed on the network. This activity was a clear sign of ransomware infection, with the ransomware altering the files by adding the “KOK08@QQ[.]COM” email address at the beginning of the filename, followed by a specific pattern of characters. The string consistently followed a pattern of 8 characters (a mix of uppercase and lowercase letters and numbers), followed by a dash, and then another 8 characters. After this, the “.KOK08” extension was appended to each file [1][4].
Figure 4: Cyber AI Analyst Investigation Process for the 'Possible Encryption of Files over SMB' incident.
Figure 5: Cyber AI Analyst Encryption Information identifying the ransomware encryption activity.
Data Exfiltration
Shortly after the encryption event, another internal device on the network was observed uploading an unusually large amount of data to the rare external endpoint 38.91.107[.]81 via SSH. The timing of this activity strongly suggests that this exfiltration was part of a double extortion strategy. In this scenario, the attacker not only encrypts the target’s files but also threatens to leak the stolen data unless a ransom is paid, leveraging both the need for decryption and the fear of data exposure to maximize pressure on the victim.
The full impact of this double extortion tactic became evident around two months later when another ransomware group claimed possession of the stolen data and threatened to release it publicly. This development suggested that the initial Matrix ransomware attackers had sold the exfiltrated data to a different group, which was now attempting to monetize it further, highlighting the ongoing risk and potential for exploitation long after the initial attack.
Figure 6: External data being transferred from one of the involved internal devices during and after the encryption took place.
Unfortunately, because Darktrace’s Autonomous Response capability was not enabled at the time, the ransomware attack was able to escalate to the point of data encryption and exfiltration. However, Darktrace’s Security Operations Center (SOC) was still able to support the customer through the Security Operations Support service. This allowed the customer to engage directly with Darktrace’s expert analysts, who provided essential guidance for triaging and investigating the incident. The support from Darktrace’s SOC team not only ensured the customer had the necessary information to remediate the attack but also expedited the entire process, allowing their security team to quickly address the issue without diverting significant resources to the investigation.
Conclusion
In this Matrix ransomware attack on a Darktrace customer in the public sector, malicious actors demonstrated an elevated level of sophistication by leveraging compromised VPN credentials to gain initial access to the target network. Once inside, they exploited trusted tools like Nmap for network scanning and lateral movement to infiltrate deeper into the customer’s environment. The culmination of their efforts was the encryption of files, followed by data exfiltration via SSH, suggesting that Matrix actors were employing double extortion tactics where the attackers not only demanded a ransom for decryption but also threatened to leak sensitive information.
Despite the absence of Darktrace’s Autonomous Response at the time, its anomaly-based approach played a crucial role in detecting the subtle anomalies in device behavior across the network that signalled the compromise, even when malicious activity was disguised as legitimate. By analyzing these deviations, Darktrace’s Cyber AI Analyst was able to identify and correlate the various stages of the Matrix ransomware attack, constructing a detailed timeline. This enabled the customer to fully understand the extent of the compromise and equipped them with the insights needed to effectively remediate the attack.
Credit to Christina Kreza (Cyber Analyst) and Ryan Traill (Threat Content Lead)
Appendices
Darktrace Model Detections
· Device / Network Scan
· Device / Attack and Recon Tools
· Device / Possible SMB/NTLM Brute Force
· Device / Suspicious SMB Scanning Activity
· Device / New or Uncommon SMB Named Pipe
· Device / Initial Breach Chain Compromise
· Device / Multiple Lateral Movement Model Breaches
· Device / Large Number of Model Breaches from Critical Network Device
· Device / Multiple C2 Model Breaches
· Device / Lateral Movement and C2 Activity
· Anomalous Connection / SMB Enumeration
· Anomalous Connection / New or Uncommon Service Control
· Anomalous Connection / Multiple Connections to New External TCP Port
· Anomalous Connection / Data Sent to Rare Domain
· Anomalous Connection / Uncommon 1 GiB Outbound
· Unusual Activity / Enhanced Unusual External Data Transfer
Introducing ‘Defend Beyond’: Our promise to customers in the face of evolving threats
There’s a global paradigm shift underway, as we enter the era of AI, that is changing both the way businesses operate and the landscape that they operate within. Our customers are dealing with the impact that AI and automation, as well as the commodification of cybercrime-as-a-service, are having on the threat landscape. Attacks that once took a human weeks or months to propagate can now be done much faster, more effectively, and on a greater scale. Earlier this year, we released our 2024 State of AI Cybersecurity Report which found that 74% of security professionals surveyed agree that AI-powered cyber threats are already having a significant impact on their organizations.
On the other hand, we’ve never been more optimistic that the application of AI in cybersecurity is an essential enabler of innovation. That’s why Darktrace has been building a new model for cybersecurity since our founding in 2013. We remain squarely focused on innovating at the crossroads of AI and cybersecurity to better help our customers build resilience and stay one step ahead of changing threats. We’ve seen first-hand how AI can transform security operations by automating alert triage and freeing up valuable human time to focus on proactively hardening defenses.
As we continue this journey in support of our customers, it’s important that our corporate identity keep pace with our ambitions. We know that the world is a dynamic place, and we believe that a proactive approach to security is the best way to help our customers realize their innovation potential in this new era. To achieve this, we’ve refocused our mission to be the essential cybersecurity platform using AI to proactively defend against novel and known threats.
This week, we introduce a bold new brand promise that encapsulates our focus on championing the defenders who protect companies every day, while also pushing beyond the boundaries of conventional thinking to innovate ahead of current challenges. Defend Beyond – our new brand platform -- achieves just that. More than a brand tagline, Defend Beyond embodies the essence of Darktrace’s ability to harness the power of AI to help our customers to stay ahead of constantly changing cyber threats and threat actors. Take a closer look at this promise through our Defend Beyond brand video.
In addition to this redefined corporate positioning, Darktrace has continued to innovate for our customers. In April, we announced the Darktrace ActiveAI Security Platform™ – an industry leading, AI-native offering that can visualize and correlate threats across the entire enterprise, provide more complete visibility to help mitigate risk, and automate time-intensive tasks to support a preventative and proactive approach to delivering cyber resilience. This platform-based approach allows our customers to be on the leading edge of AI in cybersecurity, while also reducing operational costs through security stack consolidation. Finally, as security operations teams struggle to keep up with the sheer volume of alerts, the Darktrace platform delivers industry-leading, investigative AI to automate the triaging of incidents, and further save human time in the process.
This week, we go a step further as we unveil additional changes to our product portfolio including packaging and product naming. After extensive analysis and customer feedback, we’ve taken steps to streamline and simplify our product packaging. Specifically, our flagship products of Darktrace DETECT™ and Darktrace RESPOND™, along with Cyber AI Analyst™, have now been combined and serve as the foundation of the Darktrace ActiveAI Security platform. This approach ensures that customers benefit from the breadth of our real-time detection, autonomous response, and investigative AI capabilities in the easiest approach possible.
These foundational capabilities can be purchased through any one of the Darktrace primary products, which have been renamed as follows to better align to the challenges our customers are seeking to solve:
Darktrace / CLOUD™, delivering cyber resilience through real-time and intelligent multi-cloud security
Darktrace / EMAIL™, stopping sophisticated threats up to 13 days faster through revolutionary email security.
Darktrace / NETWORK™, combatting unknown threats with one of the most advanced Network Detection and Response.
Darktrace / OT™, redefining risk management with one of the most comprehensive solutions, purpose- built for critical infrastructure.
Darktrace / IDENTITY™, unifying visibility and control of identity threats across your entire digital enterprise.
Darktrace / ENDPOINT™, providing advanced threat detection and response across devices, anywhere.
Customers can start their Darktrace journey with any of these primary products, realizing the additive benefits of the platform as their deployment grows. Cross platform products deliver value across the platform while also providing unique capabilities within their specific categories. We have renamed these products to better reflect the functionality of our offerings:
At Darktrace, supporting our 9,700+ customers is the heart of our purpose and mission. We are inspired by the work they do every day to keep their organizations, and the world, moving in the face of constant change. Over the last year, we've continuously innovated across our products, services, and go-to-market strategy to enable them to stay ahead. The new positioning we're unveiling today is designed to simplify the experience for our customers and reflects our bold ambition to enable defenders today and for the future. I hope you join me in celebrating this evolution as we strive to defend beyond.