Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Tony Jarvis
VP, Field CISO
Share
22
Mar 2022
In the lead-up to the 2020 US election, Microsoft and its partners attempted to bring down the pernicious Trickbot malware and reduce election tampering attempts. These efforts were successful, to an extent: the takedown effectively eliminated 94% of Trickbot’s infrastructure and massively reduced its influence in late 2020.
Malware rarely stays dead, however. We discussed previously how the arrests which followed REvil’s widespread attacks in 2021 have done little to disrupt that group’s Ransomware-as-a-Service operation, and how Ryuk ransomware fell into new hands after being abandoned by its creators.
Trickbot has seen a resurrection of even greater proportions. By June 2021, when Darktrace detected a Trickbot intrusion in one of its customer environments, the malware was far from a forgotten, ineffectual strain. It had instead become the most prevalent malware in the world.
It was only due to a last-minute activation of Darktrace’s Autonomous Response that this customer was able to avoid falling victim to a successful ransomware attack. Because it can take action at any stage of an attack, Autonomous Response could interrupt Trickbot even after it had taken root within the digital environment, and successfully prevent the execution of ransomware.
Trickbot takes root
The intrusion took place at a public administration organization in the EMEA region. Prior to Darktrace’s deployment, a single internal domain controller had been compromised by Trickbot, which then lay dormant for at least a month. By the time the malware began to take action, however, Darktrace’s AI had been deployed. Despite entering a compromised environment, the AI was able to differentiate between benign and malicious activity and immediately detect the threat, though at this point Autonomous Response was configured to not take any action without human confirmation.
Darktrace detected the compromised domain controller uploading a malicious DLL file – very likely Trickbot itself – to approximately 280 devices in the organization over SMB, and then using Windows Management Instrumentation (WMI) to configure and execute it. Despite Trickbot’s age and infamy, tools dependent on threat intelligence remained silent at this stage.
Figure 1: Timeline of the attack
How attackers resurrected Trickbot
Trickbot’s modular nature makes it a perfect gateway for a host of criminal activities, and keeps the malware itself adaptable and therefore hard to defend against. The action coordinated by Microsoft successfully took down the known IP addresses of multiple Trickbot command and control (C2) servers and temporarily prevented Trickbot operators from purchasing or leasing new ones. But it did not take long for the Trickbot infrastructure to be rebuilt, and in May and June of 2021 it was again deemed the most prevalent malware in a Global Threat Index.
Trickbot’s ability to evolve and circumvent existing OSINT was demonstrated in this attack, as Darktrace noticed 160 of the 280 compromised devices it had detected beginning to connect to a host of new C2 endpoints. None of these had OSINT associating them with malicious activity, but Darktrace considered the activity highly unusual in the context of previous behavior, and the security team were notified of this potential high-severity incident via a Proactive Threat Notification (PTN).
The attackers laid low for over a month, before the compromised devices were detected downloading masqueraded executable files and conducting anomalous scanning activity. These files were likely Ryuk ransomware payloads. By spacing out these stages of the attack, the threat actors made it harder for human teams to connect the dots and reveal the full scope of the threat.
Darktrace’s Cyber AI Analyst, which investigates and triages threats across entire digital environments, was able to piece these disparate events into a single attack narrative, however, and deliver a further PTN. Due to the severity of the situation, the customer submitted to Darktrace’s Ask the Expert (ATE) service to receive assistance with their threat response.
Figure 2: Cyber AI Analyst investigates suspicious executable files being spread to multiple internal devices
Autonomous Response shuts down a late-stage attack
Having understood the scale of the threat they now faced, the team activated Autonomous Response to take autonomous action to contain the threat. If Autonomous Response had been in place from the beginning, it would have stopped this attack in its earliest stages, while it was restricted to a single compromised domain controller. Crucially, however, Autonomous Response can take action at any stage of a ransomware attack.
Even at this late stage, it was able to halt the attackers and prevent Ryuk from being executed on the network. The AI blocked a chain of malicious activities including SMB enumeration, networking scanning, and suspicious outbound connections in seconds, disrupting the attack while enforcing normal business operations to ensure that the rest of the company’s work could continue uninterrupted.
With their C2 communications and lateral movement efforts disrupted, the attackers were unable to execute Ryuk, and the attack came to an end just in time. It is likely that this last-minute activation of Autonomous Response avoided widespread data encryption and possibly exfiltration, as well as the numerous costs which follow a successful ransomware attack even if a ransom is paid.
Deploying Autonomous Response before it’s too late
Despite only being activated once the attack had taken root, Darktrace was still able to distinguish malicious activity from normal business operations and stop the threat without causing disruption. Next time an attack strikes, this organization will be prepared with Autonomous Response in fully autonomous mode from the outset, ready to take action at the first sign of an emerging threat and minimize their remediation efforts.
The journey to fully autonomous security requires organizations to build trust in AI’s accuracy and decision-making. What this journey looks like for each individual organization will differ, but the need for technology that can autonomously respond to emerging threats is not a lesson any organization ought to learn the hard way.
Thanks to Darktrace analyst Sam Lister for his insights on the above threat find.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
When Trust Becomes the Attack Surface: Supply-Chain Attacks in an Era of Automation and Implicit Trust
Software supply-chain attacks dominate the threat landscape in 2026, as adversaries exploit trusted build systems, CI/CD pipelines, and management tools to gain access to target environments. This blog examines Axios, Trivy and Quest Kace compromises observed in the Darktrace customer base, highlighting the need for anomaly detection, assumed breach and continuous visibility.
How a Compromised eScan Update Enabled Multi‑Stage Malware and Blockchain C2
A malicious eScan software update triggered a supply chain compromise that deployed multi‑stage malware and used blockchain‑based domains for resilient C2 communications. Darktrace identified rare, anomalous network activity across customer environments, helping organizations uncover the attack chain and strengthen defenses against increasingly sophisticated supply chain threats.
How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience
Darktrace's latest threat research reveals how Chinese-nexus cyber operations have evolved from isolated intrusions into long-term strategic positioning, with attackers prioritizing persistent access to critical infrastructure and digital ecosystems to gain lasting operational and economic advantage.
The Next Step After Mythos: Defending in a World Where Compromise is Expected
Is Anthropic’s Mythos a turning point for cybersecurity?
Anthropic’s recent announcements around their Mythos model, alongside the launch of Project Glasswing, have generated significant interest across the cybersecurity industry.
The closed-source nature of the Mythos model has understandably attracted a degree of skepticism around some of the claims being made. Additionally, Project Glasswing was initially positioned as a way for software vendors to accelerate the proactive discovery of vulnerabilities in their own code; however, much of the attention has focused on the potential for AI to identify exploitable vulnerabilities for those with malicious intent.
Putting questions around the veracity of those claims to one side – which, for what it’s worth, do appear to be at least partially endorsed by independent bodies such as the UK’s AI Security Institute – this should not be viewed as a critical turning point for the industry. Rather, it reflects the natural direction of travel.
How Mythos affects cybersecurity teams
At Darktrace, extolling the virtues of AI within cybersecurity is understandably close to our hearts. However, taking a step back from the hype, we’d like to consider what developments like this mean for security teams.
Whether it’s Mythos or another model yet to be released, it’s worth remembering that there is no fundamental difference between an AI discovered vulnerability and one discovered by a human. The change is in the paceof discovery and, some may argue, the lower the barrier to entry.
In the hands of a software developer, this is unquestionably positive. Faster discovery enables earlier remediation and more proactive security. But in the hands of an attacker, the same capability will likely lead to a greater number of exploitable vulnerabilities being used in the wild and, critically, vulnerabilities that are not yet known to either the vendor or the end user.
That said, attackers have always been able to find exploitable vulnerabilities and use them undetected for extended periods of time. The use of AI does not fundamentally change this reality, but it does make the process faster and, unfortunately, more likely to occur at scale.
While tools such as Darktrace / Attack Surface Management and / Proactive Exposure Management can help security teams prioritize where to patch, the emergence of AI-driven vulnerability discovery reinforces an important point: patching alone is not a sufficient control against modern cyber-attacks.
Rethinking defense for a world where compromise is expected
Rather than assuming vulnerabilities can simply be patched away, defenders are better served by working from the assumption that their software is already vulnerable - and always will be -and build their security strategy accordingly.
Under that assumption, defenders should expect initial access, particularly across internet exposed assets, to become easier for attackers. What matters then is how quickly that foothold is detected, contained, and prevented from expanding.
For defenders, this places renewed emphasis on a few core capabilities:
Secure-by-design architectures and blast radius reduction, particularly around identity, MFA, segmentation, and Zero Trust principles
Early, scalable detection and containment, favoring behavioral and context-driven signals over signatures alone
Operational resilience, with the expectation of more frequent early-stage incidents that must be managed without burning out teams
How Darktrace helps organizations proactively defend against cyber threats
At Darktrace, we support security teams across all three of these critical capabilities through a multi-layered AI approach. Our Self-Learning AI learns what’s normal for your organization, enabling real-time threat detection, behavioural prediction, incident investigation and autonomous response. - all while empowering your security team with visibility and control.To learn more about Darktrace’s application of AI to cybersecurity download our White Paper here.
Reducing blast radius through visibility and control
Secure-by-design principles depend on understanding how users, devices, and systems behave. By learning the normal patterns of identity and network activity, Darktrace helps teams identify when access is being misused or when activity begins to move beyond expected boundaries. This makes it possible to detect and contain lateral movement early, limiting how far an attacker can progress even after initial access.
Detecting and containing threats at the earliest stage
As AI accelerates vulnerability discovery, defenders need to identify exploitation before it is formally recognized. Darktrace’s behavioral understanding approach enables detection of subtle deviations from normal activity, including those linked to previously unknown vulnerabilities.
A key example of this is our research on identifying cyber threats before public CVE disclosures, demonstrating that assessing activity against what is normal for a specific environment, rather than relying on predefined indicators of compromise, enables detection of intrusions exploiting previously unknown vulnerabilities days or even weeks before details become publicly available.
Additionally, our Autonomous Response capability provides fast, targeted containment focused on the most concerning events, while allowing normal business operations to continue. This has consistently shown that even when attackers use techniques never seen before, Darktrace’s Autonomous Response can contain threats before they have a chance to escalate.
Scaling response without increasing operational burden
As early-stage incidents become more frequent, the ability to investigate and respond efficiently becomes critical. Darktrace’s Cyber AI Analyst’s AI-driven investigation capabilities automatically correlate activity across the environment, prioritizing the most significant threats and reducing the need for manual triage. This allows security teams to respond faster and more consistently, without increasing workload or burnout.
What effective defense looks like in an AI-accelerated landscape
Developments like Mythos highlight a reality that has been building for some time: the window between exposure and exploitation is shrinking, and in many cases, it may disappear entirely. In that environment, relying on patching alone becomes increasingly reactive, leaving little room to respond once access has been established.
The more durable approach is to assume that compromise will occur and focus on controlling what happens next. That means identifying early signs of misuse, containing threats before they spread, and maintaining visibility across the environment so that isolated signals can be understood in context.
AI plays a role on both sides of this equation. While it enables attackers to move faster, it also gives defenders the ability to detect subtle changes in behavior, prioritize what matters, and respond in real time. The advantage will not come from adopting AI in isolation, but from applying it in a way that reduces the gap between detection and action.
AI may be accelerating parts of the attack lifecycle, but the fundamentals of defense, detection, and containment still apply. If anything, they matter more than ever – and AI is just as powerful a tool for defenders as it is for attackers.
When Trust Becomes the Attack Surface: Supply-Chain Attacks in an Era of Automation and Implicit Trust
Software supply-chain attacks in 2026
Software supply-chain attacks now represent the primary threat shaping the 2026 security landscape. Rather than relying on exploits at the perimeter, attackers are targeting the connective tissue of modern engineering environments: package managers, CI/CD automation, developer systems, and even the security tools organizations inherently trust.
These incidents are not isolated cases of poisoned code. They reflect a structural shift toward abusing trusted automation and identity at ecosystem scale, where compromise propagates through systems designed for speed, not scrutiny. Ephemeral build runners, regardless of provider, represent high‑trust, low‑visibility execution zones.
The Axios compromise and the cascading Trivy campaign illustrate how quickly this abuse can move once attacker activity enters build and delivery workflows. This blog provides an overview of the latest supply chain and security tool incidents with Darktrace telemetry and defensive actions to improve organizations defensive cyber posture.
1. Why the Axios Compromise Scaled
On 31 March 2026, attackers hijacked the npm account of Axios’s lead maintainer, publishing malicious versions 1.14.1 and 0.30.4 that silently pulled in a malicious dependency, plain‑crypto‑[email protected]. Axios is a popular HTTP client for node.js and processes 100 million weekly downloads and appears in around 80% of cloud and application environments, making this a high‑leverage breach [1].
The attack chain was simple yet effective:
A compromised maintainer account enabled legitimate‑looking malicious releases.
The poisoned dependency executed Remote Access Trojans (RATs) across Linux, macOS and Windows systems.
The malware beaconed to a remote command-and-control (C2) server every 60 seconds in a loop, awaiting further instructions.
The installer self‑cleaned by deleting malicious artifacts.
All of this matters because a single maintainer compromise was enough to project attacker access into thousands of trusted production environments without exploiting a single vulnerability.
A view from Darktrace
Multiple cases linked with the Axios compromise were identified across Darktrace’s customer base in March 2026, across both Darktrace / NETWORK and Darktrace / CLOUD deployments.
In one Darktrace / CLOUD deployment, an Azure Cloud Asset was observed establishing new external HTTP connectivity to the IP 142.11.206[.]73 on port 8000. Darktrace deemed this activity as highly anomalous for the device based on several factors, including the rarity of the endpoint across the network and the unusual combination of protocol and port for this asset. As a result, the triggering the "Anomalous Connection / Application Protocol on Uncommon Port" model was triggered in Darktrace / CLOUD. Detection was driven by environmental context rather than a known indicator at the time. Subsequent reporting later classified the destination as malicious in relation to the Axios supply‑chain compromise, reinforcing the gap that often exists between initial attacker activity and the availability of actionable intelligence. [5]
Additionally, shortly before this C2 connection, the device was observed communicating with various endpoints associated with the NPM package manager, further reinforcing the association with this attack.
Figure 1: Darktrace’s detection of the unusual external connection to 142.11[.]206[.]73 via port 8000.
Within Axios cases observed within Darktrace / NETWORK customer environments, activity generally focused on the use of newly observed cURL user agents in outbound connections to the C2 URL sfrclak[.]com/6202033, alongside the download of malicious files.
In other cases, Darktrace / NETWORK customers with Microsoft Defender for Endpoint integration received alerts flagging newly observed system executables and process launches associated with C2 communication.
Figure 2: A Security Integration Alert from Microsoft Defender for Endpoint associated with the Axios supply chain attack.
2. Why Trivy bypassed security tooling trust
Between late February and March 22, 2026, the threat group TeamPCP leveraged credentials from a previous incident to insert malicious artifacts across Trivy’s distribution ecosystem, including its CI automation, release binaries, Visual Studio Code extensions, and Docker container images [2].
While public reporting has emphasized GitHub Actions, Darktrace telemetry highlights attacker execution within CI/CD runner environments, including ephemeral build runners. These execution contexts are typically granted broad trust and limited visibility, allowing malicious activity within build automation to blend into expected operational workflows, regardless of provider.
This was a coordinated multi‑phase attack:
75 of 76 of trivy-action tags and all setup‑trivy tags were force‑pushed to deliver a malicious payload.
A malicious binary (v0.69.4) was distributed across all major distribution channels.
Developer machines were compromised, receiving a persistent backdoor and a self-propagating worm.
Secrets were exfiltrated at scale, including SSH keys, Kuberenetes tokens, database passwords, and cloud credentials across Amazon Web Service (AWS), Azure, and Google Cloud Platform (GCP).
Within Darktrace’s customer base, an AWS EC2 instance monitored by Darktrace / CLOUD appeared to have been impacted by the Trivy attack. On March 19, the device was seen connecting to the attacker-controlled C2 server scan[.]aquasecurtiy[.]org (45.148.10[.]212), triggering the model 'Anomalous Server Activity / Outgoing from Server’ in Darktrace / CLOUD.
Despite this limited historical context, Darktrace assessed this activity as suspicious due to the rarity of the destination endpoint across the wider deployment. This resulted in the triggering of a model alert and the generation of a Cyber AI Analyst incident to further analyze and correlate the attack activity.
TeamPCP’s continued abused of GitHub Actions against security and IT tooling has also been observed more recently in Darktrace’s customer base. On April 22, an AWS asset was seen connecting to the C2 endpoint audit.checkmarx[.]cx (94.154.172[.]43). The timing of this activity suggests a potential link to a malicious Bitwarden package distributed by the threat actor, which was only available for a short timeframe on April 22. [4][3]
Figure 3: A model alert flagging unusual external connectivity from the AWS asset, as seen in Darktrace / CLOUD .
While the Trivy activity originated within build automation, the underlying failure mode mirrors later intrusions observed via management tooling. In both cases, attackers leveraged platforms designed for scale and trust to execute actions that blended into normal operational noise until downstream effects became visible.
Quest KACE: Legacy Risk, Real Impact
The Quest KACE System Management Appliance (SMA) incident reinforces that software risk is not confined to development pipelines alone. High‑trust infrastructure and management platforms are increasingly leveraged by adversaries when left unpatched or exposed to the internet.
Throughout March 2026, attackers exploited CVE 2025-32975 to authentication on outdated, internet-facing KACE appliances, gaining administrative control and pushing remote payloads into enterprise environments. Organizations still running pre-patch versions effectively handed adversaries a turnkey foothold, reaffirming a simple strategic truth: legacy management systems are now part of the supply-chain threat surface, and treating them as “low-risk utilities” is no longer defensible [3].
Within the Darktrace customer base, a potential case was identified in mid-March involving an internet-facing server that exhibited the use of a new user agent alongside unusual file downloads and unexpected external connectivity. Darktrace identified the device downloading file downloads from "216.126.225[.]156/x", "216.126.225[.]156/ct.py" and "216.126.225[.]156/n", using the user agents, "curl/8.5.0" & "Python-urllib/3.9".
The timeframe and IoCs observed point towards likely exploitation of CVE‑2025‑32975. As with earlier incidents, the activity became visible through deviations in expected system behavior rather than through advance knowledge of exploitation or attacker infrastructure. The delay between observed exploitation and its addition to the Known Exploited Vulnerabilities (KEV) catalogue underscores a recurring failure: retrospective validation cannot keep pace with adversaries operating at automation speed.
The strategic pattern: Ecosystem‑scale adversaries
The Axios and Trivy compromises are not anomalies; they are signals of a structural shift in the threat landscape. In this post-trust era, the compromise of a single maintainer, repository token, or CI/CD tag can produce large-scale blast radiuses with downstream victims numbering in the thousands. Attackers are no longer just exploiting vulnerabilities; they are exploiting infrastructure privileges, developer trust relationships, and automated build systems that the industry has generally under secured.
Supply‑chain compromise should now be treated as an assumed breach scenario, not a specialized threat class, particularly across build, integration, and management infrastructure. Organizations must operate under the assumption that compromise will occur within trusted software and automation layers, not solely at the network edge or user endpoint. Defenders should therefore expect compromise to emerge from trusted automation layers before it is labelled, validated, or widely understood.
The future of supply‑chain defense lies in continuous behavioral visibility, autonomous detection across developer and build environments, and real‑time anomaly identification.
As AI increasingly shapes software development and security operations, defenders must assume adversaries will also operate with AI in the loop. The defensive edge will come not from predicting specific compromises, but from continuously interrogating behavior across environments humans can no longer feasibly monitor at scale.
Credit to Nathaniel Jones (VP, Security & AI Strategy, FCISCO), Emma Foulger (Global Threat Research Operations Lead), Justin Torres (Senior Cyber Analyst), Tara Gould (Malware Research Lead)
![Darktrace’s detection of the unusual external connection to 142.11[.]206[.]73 via port 8000.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/69fa6d343ee828935a4a00f5_Screenshot%202026-05-05%20at%203.20.33%E2%80%AFPM.png)
