Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
David Masson
VP, Field CISO
Share
25
Feb 2020
Security analysts investigate threats by finding patterns, forming hypotheses, reaching conclusions, and sharing their findings with the rest of the business. These are labor-intensive steps that take not only time, but years of training and expertise. And as operational technology (OT) becomes further integrated with the corporate network, and as threat-actors continue to advance their methods of attack, the emergence of a cyber security skills gap in the OT world becomes more and more evident.
The trend towards interconnected IT and OT environments is matched in equal measure by converging security teams. CISOs have assumed responsibility for the security of ICS environments without necessarily possessing specialized OT skills. Similarly, OT engineers are often handed security roles involving IT without sufficient training. As a result, a knowledge gap is emerging, with organizations struggling to find experts with the necessary skills in both operational technology and traditional IT.
However, developments in artificial intelligence are being leveraged to fill this skills shortage, and technology exists today that can stitch together related security events across OT and IT into a single incident — generating a meaningful, natural-language summary of the suspicious activity.
Darktrace’s Cyber AI Analyst for OT combines the skill of human expertise with the speed and scale of AI, empowering it to conduct expert investigations into hundreds of parallel threads simultaneously. This groundbreaking technology is the result of over 3 years of research and development at Darktrace’s R&D Center in Cambridge, UK — harnessing supervised machine learning to replicate the actions of expert OT and IT analysts. Every time a security alert is triggered, Cyber AI Analyst automatically pulls together a full incident report, drawing upon multiple related alerts and useful surrounding context to complete the picture.
Cyber AI Analyst for OT has domain knowledge from both OT and IT “baked in” to ensure that it can do a lot of the interpretation. An IT SOC can receive the specialized and detailed OT information relating to an incident, but also the higher-level abstractions and meaning to help them triage. Equally, OT engineers can, for example, be presented with a complete timeline of a zero-day ransomware infection as it emerges, without needing to know how to investigate file-sharing activity or command and control beaconing. Cyber AI Analyst for OT therefore not only saves security teams crucial time, but bridges the skills gap that increasingly widens as OT and IT environments continue to converge.
Investigating a ‘Triton 2.0’ attack
Cyber AI Analyst presents its findings in Darktrace’s graphical user interface, the Threat Visualizer. We can view an example of this by looking at a Triton-style cyber-attack captured within a customer environment.
Figure 1: Three models are breached by a desktop device
The threat tray above shows three individual alerts pertaining to a particular device — expdev127.scada.local, a desktop belonging to a domain administrator. Working in real time in the background, Cyber AI Analyst for OT now stitches together these multiple alerts into a single security incident, and then surfaces this incident in a high-level narrative, displaying all stages of the attack lifecycle on a single timeline.
Figure 2: The Threat Visualizer surfaces a timeline of the suspicious events
We can see that over the span of three hours, Darktrace identified a suspicious file download, possible command and control traffic, and a chain of administrative connections it deemed worthy of investigation. The Threat Visualizer then surfaced this series of suspicious connections, showing how the malware penetrated from the upper parts of the control system through to a workstation that can interact with PLCs.
Figure 3: A graphical representation of the RDP communication
Since the initial compromise infected a domain administrator’s desktop, the primary ‘hop’ of remote desktop to the local domain controller illustrated here is not unusual at all — the usage of legitimate administrative RDP credentials is commonplace from this device. However, as the incident unfolds, Cyber AI Analyst subsequently recognizes that this is related to more suspicious events, and is able to go back and include these events in a single narrative.
The malware then makes a second hop — also via RDP — to an engineering workstation and finally reprograms a related PLC, all the while retaining the remote access chain. As with the Triton attack that targeted various power plants in 2017, this attack relied on commonplace administration sessions to transfer tools, and for remote command/program execution. The Threat Visualizer shows us the destination port, as well as the application protocol used to deliver the final stage of the attack.
Figure 4: Further details of the reprogramming
Cyber AI Analyst converts the initial alerts into this incident report in real time, and the security team enter the fray armed with a much clearer and broader description of the incident, far sooner than if they had needed to perform these steps themselves. In this case, Cyber AI Analyst eventually includes seven alerts of different suspicious activities within this one incident, as well as multiple details that did not create alerts themselves but are strongly related and could have been omitted by an inexperienced analyst.
The near future of ICS attacks
Cyber-attacks on ICS are continuously evolving, with adversaries using the latest open-source technologies to launch evasive and machine-speed campaigns globally. While many organizations are turning to AI to face the scale, complexity, and speed of the cyber-threats they face in their IT and OT environments, we can also expect that these threat-actors will also start to use AI to achieve their objectives.
The threat-actors behind Triton blended mainstream IT attack techniques with specialized OT payloads and backed both up with strong operational discipline. The future addition of AI into such malware will allow it to achieve more inside a target network without persistent human oversight — and therefore dramatically decrease its chances of detection.
By combining both IT and OT analyst domain knowledge whilst operating at machine speed with a computer’s unwavering attention to detail, Cyber AI Analyst for OT will prove crucial for security teams by saving them vital time and filling in for any gaps in domain knowledge.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Darktrace Named the Only 2025 Gartner® Peer Insights™ Customers’ Choice for Network Detection and Response
Darktrace: The only Customers’ Choice for NDR in 2025
In a year defined by rapid change across the threat landscape, recognition from those who use and rely on security technology every day means the most.
That’s why we’re proud to share that Darktrace has been named the only Customers’ Choice in the 2025 Gartner® Peer Insights™ Voice of the Customer for Network Detection and Response (NDR).
Out of 11 leading NDR vendors evaluated, Darktrace stood alone as the sole Customers’ Choice, a recognition that we feel reflects not just our innovation, but the trust and satisfaction of the customers who secure their networks with Darktrace every day.
What the Gartner® Peer Insights™ Voice of the Customer means
“Voice of the Customer” is a document that synthesizes Gartner Peer Insights reviews into insights for buyers of technology and services. This aggregated peer perspective, along with the individual detailed reviews, is complementary to Gartner expert research and can play a key role in your buying process. Peers are verified reviewers of a technology product or service, who not only rate the offering, but also provide valuable feedback to consider before making a purchase decision. Vendors placed in the upper-right “Customers’ Choice” quadrant of the “Voice of the Customer” have scores that meet or exceed the market average for both axes (User Interest and Adoption, and Overall Experience).It’s not just a rating. We feel it’s a reflection of genuine customer sentiment and success in the field.
In our view, Customers consistently highlight Darktrace’s ability to:
Detect and respond to unknown threats in real time
Deliver unmatched visibility across IT, OT, and cloud environments
Automate investigations and responses through AI-driven insights
We believe this recognition reinforces what our customers already know: that Darktrace helps them see, understand, and stop attacks others miss.
A rare double: recognized by customers and analysts alike
This distinction follows another major recogniton. Darktrace’s placement as a Leader in the Gartner® Magic Quadrant™ for Network Detection and Response earlier this year.
That makes Darktrace the only vendor to achieve both:
A Leader status in the Gartner Magic Quadrant for NDR, and
A Customers’ Choice in Gartner Peer Insights 2025
It’s a rare double that we feel reflects both industry leadership and customer trust, two perspectives that, together, define what great cybersecurity looks like.
A Customers’ Choice across the network and the inbox
To us, this recognition also builds on Darktrace’s momentum across multiple domains. Earlier this year, Darktrace was also named a Customers’ Choice for Email Security Platforms in the Gartner® Peer Insights™ report.
With more than 1,000 verified reviews across Network Detection and Response, Email Security Platforms, and Cyber Physical Systems (CPS), we at Darktrace are proud to be trusted across the full attack surface, from the inbox to the industrial network.
Thank you to our customers
We’re deeply grateful to every customer who shared their experience with Darktrace on Gartner Peer Insights. Your insights drive our innovation and continue to shape how we protect complex, dynamic environments across the world.
Gartner® Peer Insights™ content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
Magic Quadrant and Peer Insights are registered trademarks of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.
Gartner, Voice of the Customer for Network Detection and Response, By Peer Community Contributor, 30 October 2025
Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace
What is DragonForce?
DragonForce is a Ransomware-as-a-Service (RaaS) platform that emerged in late 2023, offering broad-scale capabilities and infrastructure to threat actors. Recently, DragonForce has been linked to attacks targeting the UK retail sector, resulting in several high-profile cases [1][2]. Moreover, the group launched an affiliate program offering a revenue share of roughly 20%, significantly lower than commissions reported across other RaaS platforms [3].
This Darktrace case study examines a DragonForce-linked RaaS infection within the manufacturing industry. The earliest signs of compromise were observed during working hours in August 2025, where an infected device started performing network scans and attempted to brute-force administrative credentials. After eight days of inactivity, threat actors returned and multiple devices began encrypting files via the SMB protocol using a DragonForce-associated file extension. Ransom notes referencing the group were also dropped, suggesting the threat actor is claiming affiliation with DragonForce, though this has not been confirmed.
Despite Darktrace’s detection of the attack in its early stages, the customer’s deployment did not have Darktrace’s Autonomous Response capability configured, allowing the threat to progress to data exfiltration and file encryption.
Darktrace's Observations
While the initial access vector was not clearly defined in this case study, it was likely achieved through common methods previously employed out by DragonForce affiliates. These include phishing emails leveraging social engineering tactics, exploitation of public-facing applications with known vulnerabilities, web shells, and/or the abuse of remote management tools.
Darktrace’s analysis identified internal devices performing internal network scanning, brute-forcing credentials, and executing unusual Windows Registry operations. Notably, Windows Registry events involving "Schedule\Taskcache\Tasks" contain subkeys for individual tasks, storing GUIDs that can be used to locate and analyze scheduled tasks. Additionally, Control\WMI\Security holds security descriptors for WMI providers and Event Tracing loggers that use non-default security settings respectively.
Furthermore, Darktrace identified data exfiltration activity over SSH, including connections to an ASN associated with a malicious hosting service geolocated in Russia.
1. Network Scan & Brute Force
Darktrace identified anomalous behavior in late August to early September 2025, originating from a source device engaging in internal network scanning followed by brute-force attempts targeting administrator credential, including “administrator”, “Admin”, “rdpadmin”, “ftpadmin”.
Upon further analysis, one of the HTTP connections seen in this activity revealed the use of the user agent string “OpenVAS-VT”, suggesting that the device was using the OpenVAS vulnerability scanner. Subsequently, additional devices began exhibiting network scanning behavior. During this phase, a file named “delete.me” was deleted by multiple devices using SMB protocol. This file is commonly associated with network scanning and penetration testing tool NetScan.
2. Windows Registry Key Update
Following the scanning phase, Darktrace observed the initial device then performing suspicious Winreg operations. This included the use of the ”BaseRegOpenKey” function across multiple registry paths.
Additional operations such as “BaseRegOpenKey” and “BaseRegQueryValue” were also seen around this time. These operations are typically used to retrieve specific registry key values and allow write operations to registry keys.
The registry keys observed included “SYSTEM\CurrentControlSet\Control\WMI\Security” and “Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks”. These keys can be leveraged by malicious actors to update WMI access controls and schedule malicious tasks, respectively, both of which are common techniques for establishing persistence within a compromised system.
3. New Administrator Credential Usage
Darktrace subsequently detected the device using a highly privileged credential, “administrator”, via a successful Kerberos login for the first time. Shortly after, the same credential was used again for a successful SMB session.
These marked the first instances of authentication using the “administrator” credential across the customer’s environment, suggesting potential malicious use of the credential following the earlier brute-force activity.
Figure 1: Darktrace’s detection of administrator credentials being used in Kerberos login events by an infected device.
Figure 2: Darktrace’s detection of administrator credentials being used in SMB sessions by an infected device.
4. Data Exfiltration
Prior to ransomware deployment, several infected devices were observed exfiltrating data to the malicious IP 45.135.232[.]229 via SSH connections [7][8]. This was followed by the device downloading data from other internal devices and transferring an unusually large volume of data to the same external endpoint.
The IP address was first seen on the network on September 2, 2025 - the same date as the observed data exfiltration activity preceding ransomware deployment and encryption.
Further analysis revealed that the endpoint was geolocated in Russia and registered to the malicious hosting provider Proton66. Multiple external researchers have reported malicious activity involving the same Proton66 ASN (AS198953 Proton66 OOO) as far back as April 2025. These activities notably included vulnerability scanning, exploitation attempts, and phishing campaigns, which ultimately led to malware [4][5][6].
Data Exfiltration Endpoint details.
Endpoint: 45.135.232[.]229
ASN: AS198953 Proton66 OOO
Transport protocol: TCP
Application protocol: SSH
Destination port: 22
Figure 3: Darktrace’s summary of the external IP 45.135.232[.]229, first detected on September 2, 2025. The right-hand side showcases model alerts triggered related to this endpoint including multiple data exfiltration related model alerts.
Further investigation into the endpoint using open-source intelligence (OSINT) revealed that it led to a Microsoft Internet Information Services (IIS) Manager console webpage. This interface is typically used to configure and manage web servers. However, threat actors have been known to exploit similar setups, using fake certificate warnings to trick users into downloading malware, or deploying malicious IIS modules to steal credentials.
Figure 4: Live screenshot of the destination (45.135.232[.]229), captured via OSINT sources, displaying a Microsoft IIS Manager console webpage.
5. Ransomware Encryption & Ransom Note
Multiple devices were later observed connecting to internal devices via SMB and performing a range of actions indicative of file encryption. This suspicious activity prompted Darktrace’s Cyber AI Analyst to launch an autonomous investigation, during which it pieced together associated activity and provided concrete timestamps of events for the customer’s visibility.
During this activity, several devices were seen writing a file named “readme.txt” to multiple locations, including network-accessible webroot paths such as inetpub\ and wwwroot\. This “readme.txt” file, later confirmed to be the ransom note, claimed the threat actors were affiliated with DragonForce.
At the same time, devices were seen performing SMB Move, Write and ReadWrite actions involving files with the “.df_win” extension across other internal devices, suggesting that file encryption was actively occurring.
Figure 5: Darktrace’s detection of SMB events (excluding Read events) where the device was seen moving or writing files with the “.df_win” extension.
Figure 6: Darktrace’s detection of a spike in SMB Write events with the filename “readme.txt” on September 9, indicating the start of file encryption.
Conclusion
The rise of Ransomware-as-a-Service (RaaS) and increased attacker customization is fragmenting tactics, techniques, and procedures (TTPs), making it increasingly difficult for security teams to prepare for and defend against each unique intrusion. RaaS providers like DragonForce further complicate this challenge by enabling a wide range of affiliates, each with varying levels of sophistication [9].
In this instance, Darktrace was able to identify several stages of the attack kill chain, including network scanning, the first-time use of privileged credentials, data exfiltration, and ultimately ransomware encryption. Had the customer enabled Darktrace’s Autonomous Response capability, it would have taken timely action to interrupt the attack in its early stages, preventing the eventual data exfiltration and ransomware detonation.
Credit to Justin Torres, Senior Cyber Analyst, Nathaniel Jones, VP, Security & AI Strategy, FCISO, & Emma Foulger, Global Threat Research Operations Lead.
Darktrace Cyber AI Analyst Coverage/Investigation Events:
· Web Application Vulnerability Scanning of Multiple Devices
· Port Scanning
· Large Volume of SMB Login Failures
· Unusual RDP Connections
· Widespread Web Application Vulnerability Scanning
· Unusual SSH Connections
· Unusual Repeated Connections
· Possible Application Layer Reconnaissance Activity
· Unusual Administrative Connections
· Suspicious Remote WMI Activity
· Extensive Unusual Administrative Connections
· Suspicious Directory Replication Service Activity
· Scanning of Multiple Devices
· Unusual External Data Transfer
· SMB Write of Suspicious File
· Suspicious Remote Service Control Activity
· Access of Probable Unencrypted Password Files
· Internal Download and External Upload
· Possible Encryption of Files over SMB
· SMB Writes of Suspicious Files to Multiple Devices
The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.
Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.
Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.
The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content.
![Darktrace’s summary of the external IP 45.135.232[.]229, first detected on September 2, 2025. The right-hand side showcases model alerts triggered related to this endpoint including multiple data exfiltration related model alerts.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/690baa3e2f4def9f29b1ecae_Screenshot%202025-11-05%20at%2011.48.57%E2%80%AFAM.png)
![Live screenshot of the destination (45.135.232[.]229), captured via OSINT sources, displaying a Microsoft IIS Manager console webpage.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/690baa68a5b7b13fba715069_Screenshot%202025-11-05%20at%2011.49.52%E2%80%AFAM.png)
