While increased public focus and funding are urgently needed, they are only the first steps in achieving stronger security for critical infrastructure. For these efforts to be successful, the Biden administration needs to turn its focus to cutting-edge capabilities and direct its funding toward sophisticated technologies that can achieve these ends.
Focusing on achieving the right security capabilities
For years, the security community for operational technology (OT) and Industrial Control Systems (ICS) has put a strong emphasis on mapping and patching common vulnerabilities and exposures (CVEs). While this vulnerability tracking is often necessary, mapping and patching vulnerabilities alone is not a sufficient strategy to arm organizations against attacks.
First, known vulnerabilities simply do not represent all risks, as attackers frequently leverage unknown vulnerabilities called zero-days and misuse legitimate operations in ways that cannot be trivially recognized as malicious. This is particularly true for control system environments, with one-third of ICS flaws designated as zero-days when disclosed.
Devices with zero or few known vulnerabilities may also simply lack specific research into them, rather than being more secure. For example, millions of devices are put at risk by a recently discovered vulnerability in control systems used in building systems — including heating and air conditioning — and this also affects PLCs widely used in manufacturing and energy utilities.
Rather than merely tracking and patching CVEs, Biden’s recent National Security Memorandum realigns OT security to place focus onto the right security goals. The memorandum candidly addresses the problem with vulnerability tracking and other legacy security approaches, as this document affirms that “we cannot address threats we cannot see.”
Investing in the right security technologies
The memorandum specifically focuses on “facilitating deployment of technologies and systems that provide threat visibility, indications, detection, and warnings, and that facilitate response capabilities” for ICS and OT. The next step in achieving these aims is to identify the technologies that can provide these capabilities.
By learning a sense of ‘self’ from scratch for every human, device, and the whole ecosystem of an organization, Self-Learning AI autonomously implements machine-speed detection, investigations, and response. This solution is particularly effective at stopping ransomware before operation disruption, which would have allowed Colonial Pipeline to avoid manual shutdowns.
AI is also uniquely capable of thwarting insider threats. It could have immediately identified the threat in the Florida water facility incident, as its understanding of the ‘pattern of life’ for every user, device, and all the connections between them would have illuminated the insider’s subtle unusual behavior.
The sensitivity and essential nature of critical infrastructure demand the most sophisticated technologies for robust cyber defense. Fortunately, Self-Learning AI technology is already available and currently used by all 16 critical infrastructure sectors designated by CISA. As the threat continues to grow, and the Biden administration’s efforts are pursued more aggressively, Self-Learning AI stands ready to safeguard the systems that our society relies on.
Like this and want more?
Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newsletter
Enjoying the blog?
Sign up to receive the latest news and insights from the Darktrace newsletter – delivered directly to your inbox
Thanks for signing up!
Look out for your first newsletter, coming soon.
Oops! Something went wrong while submitting the form.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Oakley Cox
Director of Product
Oakley is a Product Manager within the Darktrace R&D team. He collaborates with global customers, including all critical infrastructure sectors and Government agencies, to ensure Darktrace/OT remains the first in class solution for OT Cyber Security. He draws on 7 years’ experience as a Cyber Security Consultant to organizations across EMEA, APAC and ANZ. His research into cyber-physical security has been published by Cyber Security journals and by CISA. Oakley has a Doctorate (PhD) from the University of Oxford.
Fighting the Real Enemy: The Importance of Responsible Vulnerability Disclosure Between Email Security Vendors
Part of being a cybersecurity vendor is recognizing our responsibility to the security community – while vendor competition exists, it pales in comparison to the threat of our shared adversary: malicious threat actors.
Darktrace is proud to be contributing to the shared mission of fighting attackers; without goodwill among defenders that task is made more difficult for everyone. Through collaboration, we can advance security standards across the board and make the world a safer place.
With that in mind, Darktrace recently observed an exploitation capability latent in a competing email security vendor’s link rewriting infrastructure, which posed a risk to organizations. Following identification, Darktrace was able to report it to the vendor following their disclosure process. We’ll explore the vulnerability, the potential impact it may have had, how it could have been resolved, and the steps Darktrace took to raise it with the vendor.
Please note that the following vulnerability we’re about to expose has already been resolved, so there is no risk of it being exploited by others. While keeping this vendor anonymous, we also want to thank them for their cordial response and swift remediation of the issue.
For more information about vulnerability disclosure best practices, refer to the UK National Cyber Security Center’s Vulnerability Disclosure Toolkit.
Details of the vulnerability
Let’s take a look at the weakness Darktrace identified in the link rewriting infrastructure.
In January 2025, Darktrace observed that links generated by a URL rewriting infrastructure could be re-engineered by a malicious actor to point to a URL of their choosing. In this way, a threat actor could effectively use the vendor’s domain to create a malicious domain under their control.
Because a majority of security vendors default to trust from known-safe domains, using one of these links as the payload greatly enhances the likelihood of that email being allow-listed to bypass email security, network URL filtering, and other such security tools, to reach the inbox. This issue meant any adversary could have abused the vendor’s safelink structure to deliver a malicious phishing link payload to any organization. It is likely this exploitation capability could have been found and abused at scale if not addressed.
The problem with said vendor’s link rewriting process was in using standard base-64 encoding instead of randomized encoding, so that anyone could replace the value of the parameter “b=” which contains a base64-encoded form of the original link with a base64-encoded form of a URL of their choosing.
This also posed issues from a privacy perspective. If, for example the encoded link was a SharePoint file, all the included folder names would be available for anyone to see in plaintext.
Fig 1: Example of a phishing attack caught by Darktrace that uses another email security solution’s compromised safelink
How the vulnerability was resolved
The solution for developers is to ensure the use of randomized encoding when developing link rewriting infrastructure to close the possibility of safelinks being deciphered and re-engineered by malicious actors.
Once Darktrace found this link issue we followed the vendor’s disclosure process to report the potential risk to customers and the wider community, while also conducting a review to ensure that Darktrace customers and their supply chains remained safe. We continued to follow up with the company directly to ensure that the vulnerability was fixed.
This instance highlights the importance of vendors having clear and visible vulnerability disclosure processes (such as RFC9116) and being available to listen to the security community in case of disclosures of this nature.
Why Darktrace was obliged to disclose this vulnerability
Here, Darktrace had two responsibilities: to the security community and to our customers.
As a company whose mission is to protect organizations today and for an ever-changing future, we will never stand by if there is a known risk. If attackers had used the safelinks to create new attacks, any organization could have been exposed due to the inherent trust in this vendor’s links within services that distribute or maintain global whitelists, harm which could have been multiplied by the interlinked nature of supply chains.
This means that not only the vendor’s customers were exposed, but any organization with their safelink in a whitelist was also exposed to this vulnerability. For Darktrace customers, an attack using this link would have been detected and stopped across various service offerings, and a secondary escalation by our Cyber AI Analyst would ensure security teams were aware. Even so, Darktrace has a responsibility to these customers to do everything in its power to minimize their exposure to risk, even if it comes from within their own security stack.
Darktrace / EMAIL doesn’t approach links from a binary perspective – as safe, or unsafe – instead every link is analyzed for hundreds of metrics including the content and context in which it was delivered. Because every user’s normal behavior is baselined, Darktrace can immediately detect anomalies in link-sharing patterns that may point to a threat. Furthermore, our advanced link analysis includes metrics on how links perform within a browser and in-depth visual analysis, to detect even well-disguised payloads.
None of Darktrace’s customers were compromised as a result of this vulnerability. But should a customer have clicked on a similar malicious link, that’s where a platform approach to security comes in. Detecting threats that traverse domains is one strength of the Darktrace ActiveAI Security Platform. Our AI correlates data from across the digital estate to spot suspicious activity in the network, endpoint or cloud that may have originated from a malicious email. Darktrace’s Cyber AI Analyst then performs triage and investigation of alerts to raise those of high importance to an incident, allowing for human-analyst validation and escalation.
As demonstrated by finding this vulnerability in another vendor, Darktrace’s R&D teams are always thinking like an attacker as they develop our products, to allow us to remain one step ahead for our customers.
Conclusion
We hope this example can be useful to developers working on link rewriting infrastructure, or to vendors figuring out how to proceed with a disclosure to another vendor. We’re pleased to have been able to collaborate with said vendor in this instance, and hope that it serves to illustrate the importance of defenders working together towards the common goal of keeping organizations safe from hostile cyber actors.
New Threat on the Prowl: Investigating Lynx Ransomware
What is Lynx ransomware?
In mid-2024, a new ransomware actor named Lynx emerged in the threat landscape. This Ransomware-as-a-Service (RaaS) strain is known to target organizations in the finance, architecture, and manufacturing sectors [1] [2]. However, Darktrace’s Threat Research teams also identified Lynx incidents affecting energy and retail organizations in the Middle East and Asia-Pacific (APAC) regions. Despite being a relatively new actor, Lynx’s malware shares large portions of its source code with the INC ransomware variant, suggesting that the group may have acquired and repurposed the readily available INC code to develop its own strain [2].
What techniques does Lynx ransomware group use?
Lynx employs several common attack vectors, including phishing emails which result in the download and installation of ransomware onto systems upon user interaction. The group poses a sophisticated double extortion threat to organizations, exfiltrating sensitive data prior to encryption [1]. This tactic allows threat actors to pressure their targets by threatening to release sensitive information publicly or sell it if the ransom is not paid. The group has also been known to gradually release small batches of sensitive information (i.e., “drip” data) to increase pressure.
Once executed, the malware encrypts files and appends the extension ‘.LYNX’ to all encrypted files. It eventually drops a Base64 encoded text file as a ransom note (i.e., README.txt) [1]. Should initial file encryption attempts fail, the operators have been known to employ privilege escalation techniques to ensure full impact [2].
In the Annual Threat Report 2024, Darktrace’s Threat Research team identified Lynx ransomware as one of the top five most significant threats, impacting both its customers and the broader threat landscape.
Darktrace Coverage of Lynx Ransomware
In cases of Lynx ransomware observed across the Darktrace customer base, Darktrace / NETWORK identified and suggested Autonomous Response actions to contain network compromises from the onset of activity.
Detection of lateral movement
One such Lynx compromise occurred in December 2024 when Darktrace observed multiple indicators of lateral movement on a customer network. The lateral movement activity started with a high volume of attempted binds to the service control endpoint of various destination devices, suggesting SMB file share enumeration. This activity also included repeated attempts to establish internal connections over destination port 445, as well as other privileged ports. Spikes in failed internal connectivity, such as those exhibited by the device in question, can indicate network scanning. Elements of the internal connectivity also suggested the use of the attack and reconnaissance tool, Nmap.
Indicators of compromised administrative credentials
Although an initial access point could not be confirmed, the widespread use of administrative credentials throughout the lateral movement process demonstrated the likely compromise of such privileged usernames and passwords. The operators of the malware frequently used both 'admin' and 'administrator' credentials throughout the incident, suggesting that attackers may have leveraged compromised default administrative credentials to gain access and escalate privileges. These credentials were observed on numerous devices across the network, triggering Darktrace models that detect unusual use of administrative usernames via methods like NTLM and Kerberos.
Data exfiltration
The lateral movement and reconnaissance behavior was then followed by unusual internal and external data transfers. One such device exhibited an unusual spike in internal data download activity, downloading around 150 GiB over port 3260 from internal network devices. The device then proceeded to upload large volumes of data to the external AWS S3 storage bucket: wt-prod-euwest1-storm.s3.eu-west-1.amazonaws[.]com. Usage of external cloud storage providers is a common tactic to avoid detection of exfiltration, given the added level of legitimacy afforded by cloud service provider domains.
Furthermore, Darktrace observed the device exhibiting behavior suggesting the use of the remote management tool AnyDesk when it made outbound TCP connections to hostnames such as:
relay-48ce591e[.]net[.]anydesk[.]com
relay-c9990d24[.]net[.]anydesk[.]com
relay-da1ad7b4[.]net[.]anydesk[.]com
Tools like AnyDesk can be used for legitimate administrative purposes. However, such tools are also commonly leveraged by threat actors to enable remote access and further compromise activity. The activity observed from the noted device during this time suggests the tool was used by the ransomware operators to advance their compromise goals.
The observed activity culminated in the encryption of thousands of files with the '.Lynx' extension. Darktrace detected devices performing uncommon SMB write and move operations on the drives of destination network devices, featuring the appending of the Lynx extension to local host files. Darktrace also identified similar levels of SMB read and write sizes originating from certain devices. Parallel volumes of SMB read and write activity strongly suggest encryption, as the malware opens, reads, and then encrypts local files on the hosted SMB disk share. This encryption activity frequently highlighted the use of the seemingly-default credential: "Administrator".
In this instance, Darktrace’s Autonomous Response capability was configured to only take action upon human confirmation, meaning the customer’s security team had to manually apply any suggested actions. Had the deployment been fully autonomous, Darktrace would have blocked connectivity to and from the affected devices, giving the customer additional time to contain the attack and enforce existing network behavior patterns while the IT team responded accordingly.
Conclusion
As reported by Darktrace’s Threat Research team in the Annual Threat Report 2024, both new and old ransomware strains were prominent across the threat landscape last year. Due to the continually improving security postures of organizations, ransomware actors are forced to constantly evolve and adopt new tactics to successfully carry out their attacks.
The Lynx group’s use of INC source code, for example, suggests a growing accessibility for threat actors to launch new ransomware strains based on existing code – reducing the cost, resources, and expertise required to build new malware and carry out an attack. This decreased barrier to entry will surely lead to an increased number of ransomware incidents, with attacks not being limited to experienced threat actors.
While Darktrace expects ransomware strains like Lynx to remain prominent in the threat landscape in 2025 and beyond, Darktrace’s ability to identify and respond to emerging ransomware incidents – as demonstrated here – ensures that customers can safeguard their networks and resume normal business operations as quickly as possible, even in an increasingly complex threat landscape.
Credit to Justin Torres (Senior Cyber Analyst) and Adam Potter (Senior Cyber Analyst).
Get the latest insights on emerging cyber threats
Attackers are adapting, are you ready? This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.
Identity-based attacks: How attackers are bypassing traditional defenses
Zero-day exploitation: The rise of previously unknown vulnerabilities
AI-driven threats: How adversaries are leveraging AI to outmaneuver security controls
