Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Jamie Woodland
Head of Technology at Community Housing Limited
Share
04
Mar 2024
About Community Housing Limited
Community Housing Limited is a non-profit organization based in Australia that focuses on providing affordable, long-term housing and creating employment opportunities where possible. We give people the security of having a home so that they can focus on other essential pathways. As such, we are responsible for sensitive information on our clients.
As part of our commitment to strengthening our cyber security, we sought to simplify and unify our incident response plans and equip our engineers and desktop support teams with all the information we need at our fingertips.
Why Community Housing Limited chose Darktrace
Our team hoped to achieve a response procedure that allowed us to have oversight over any potential security risks, even cases that don’t overtly seem like a security risk. For example, an incident could start as a payroll issue and end up in the hands of HR, instead of surfacing as a security problem. In this case, our security team has no way of knowing the real number of events or how the threat had actually started and played out, making incident response and mitigation even more challenging.
AI-generated playbooks save time during incident response
I wanted to reduce the time and resources it took our security team to appropriately respond to a threat. Darktrace automates several steps of the recovery process to accelerate the rate of incident response by using AI that learns the granular details of the specific organization, building a dynamic understanding of the devices, connections, and user behaviors that make up the normal “pattern of life.”
The AI then uses this understanding to create bespoke, AI-generated incident response playbooks that leverage an evolving understanding of our organization to determine recovery steps that are tailored not only to the specific incident but also to our unique environment.
For my security team, this means having access to all the information we need to respond to a threat. When running through an incident, rather than going to different places to synthesize relevant information, which takes up valuable resources and time, we can speed up its remediation with Darktrace.
The playbooks created by Darktrace help lower the technical skills required to respond to incidents by elevating the workload of the staff, tripling our capacity for incident response.
Realistic attack simulations upskill teams while saving resources
We have differing levels of experience on the team which means some members know exactly what to do during incident response while others are slower and need more guidance. Thus, we have to either outsource skilled security professionals or add a security solution that could lower the technical skills bar.
You don’t want to be second guessing and searching for the right move – it’s urgent – there should be certainty. Our goal with running attack simulations is to test and train our team's response capabilities in a “realistic” scenario. But this takes considerable time to plan and execute or can be expensive if outsourced, which can be a challenge for organizations short on resources.
Darktrace provides AI-assisted incident response and cyber-attack simulation using AI that understands the organization to run simulations that effectively map onto the real digital environment and the assets within it, providing training for actual incidents.
It is one thing to sit together in a meeting and discuss various outcomes of a cyber-attack, talking through the best response strategies. It is a huge benefit being able to run attack simulations that emulate real-world scenarios.
Our team can now see how an incident would play out over several days to resemble a real-world scenario or it can play through the simulation quickly to ascertain outcomes immediately. It then uses these insights to strengthen its technology, processes, and training.
AI-Powered Incident Response
Darktrace helps my security team save resources and upskill staff using AI to generate bespoke playbooks and run realistic simulations. Its real-time understanding of our business ensures incident preparedness and incident response are tailored to not only the specific threat in question, but also to the contextual infrastructure of the organization.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption
Núclea prevented a highly targeted phishing attack exploiting trusted relationships—avoiding financial loss, data exposure, and disruption. Darktrace stopped the threat at the point of risk, protecting business continuity and strengthening resilience across the financial ecosystem.
Defend What You Trust: Stories from the Front Lines of Modern Cyber Defense
Security leaders from global organizations across industries sat down with us to share their own front-line experiences and real-world perspectives on how modern attacks unfold, where hidden risks emerge, and how AI is reshaping the way organizations think about the role of security.
AI-powered security for a rapidly growing grocery enterprise
By combining AI-driven detection and autonomous response, this leading grocery holding group has built a security model that delivers continuous protection, accelerates growth, and empowers a small, highly efficient team to safeguard a complex retail ecosystem.
Botnet Behind the Camera: Mirai Katana Activity on a Video Recording Device
Key takeaways
Darktrace identified a camera device infected with the Mirai/Katana botnet in a sports-sector customer environment, showing how exposed IoT devices can become active participants in wider attack chains.
The compromise involved suspicious Wget behavior, file downloads from rare external IPs, unusual incoming HTTP connections to video recorder management interfaces, and large outbound data transfers to infrastructure associated with botnet activity.
The incident highlights the importance of extending visibility and response beyond traditional endpoints, as unmanaged or overlooked connected devices can be exploited for command-and-control, malware delivery, and data exfiltration.
Mirai and the Katana variant
Mirai is a botnet that first emerged in August 2016 and is well known for launching large-scale distributed-denial-of-service (DDoS) attacks, typically targeting exposed Internet of Things (IoT) devices. It identifies vulnerable IoT devices ,often by abusing default credentials or exposed services, and recruiting them into a remotely controlled botnet that can be used in DDoS campaigns [1].
Katana, one of the many variants that arose after Mirai’s source code was released publicly, was first observed in late 2020 and has been seen using more advanced capabilities, including custom command-and-control (C2), persistence mechanisms, and DDoS functionality [2].
In March 2026, research from the Nokia Deepfield Emergency Response Team (ERT) identified Katana as a Mirai-derived DDoS botnet targeting Android-based TV set-top boxes through exposed Android Debug Bridge (ADB) access. Observed capabilities included custom C2, runtime domain rotation, multiple DDoS methods, and an on-device compiled kernel rootkit used for persistence and stealth [3].
Darktrace’s detection of Mirai Botnet activity on a camera device
In early 2026, Darktrace identified a Network/Digital Video Recorder (NVR/DVR) on the network of a sports-sector customer that had been infected with the Mirai Katana botnet and subsequently used to exfiltrate data from the customer’s environment. Seemingly related follow-up activity was observed on the same device several months later.
In both instances, the Darktrace Security Operations Centre (SOC) alerted the customer as part of the Managed Threat Detection (MTD) service. However, as Darktrace’s Autonomous Response capability was not fully enabled on the affected device, Darktrace was unable to proactively block the suspicious activity or prevent the compromise from continuing and recurring.
The initial compromise appears to have occurred when the affected device was seen using Wget to download Linux-based Executable and Linkable Format (ELF) files from a rare external IP, 195.177.94[.]105, which had not previously been observed in the customer’s network. Further analysis downloaded file hashes identified files related to the Mirai botnet.
Figure 1: Darktrace’s Real-Time AI Analyst investigation into the unusual outbound connection where the ELF files were downloaded.
Within a few hours, Darktrace detected the device uploading close to 3GB of data to another external IP, 50.7.49[.]4:3017 (ASN AS30058 FDCSERVERS), suggesting that the activity was likely routed via a virtual private server (VPS) hosted by FDC Servers [2]. Attackers often abuse VPS infrastructure from legitimate cloud providers to blend in with legitimate traffic and evade IP reputation and geolocation-based detections.
Figure 2: Darktrace’s detection of the unusual data upload activity by the affected camera device.
Darktrace continued to observe similar data transfers to multiple rare endpoints including 171.225.223[.]53, 95.161.128[.]62, 61.7.209[.]88, 95.161.128[.]62, which have been linked to Mirai by open-source intelligence (OSINT).
Figure 3: Darktrace’s detection of spikes in unusual external data transfer activity from the camera device.
Exploitation continued
Several months later, Darktrace identified the same exfiltration pattern on the device again, this time with stronger indications of associations with Mirai Katana botnet infection.
The device received incoming HTTP connections from 129.121.114[.]124, an external IP known to be associated with the Katana botnet IP [3]. The connections targeted the ‘/dvr/cmd’ path using the root username and user agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246.
The ‘/dvr/cmd’ path appears to be associated with the affected device’s web management functionality. This API endpoint has historically been targeted by Mirai and other IoT botnets through the exploitation of critical command injection vulnerabilities and automated botnet exploitation [4].
Figure 4: Darktrace’s detection of HTTP connectivity from the external IP associated with Mirai Katana Botnet.
A few days later, Darktrace observed the Wget utility being used to download ELF files, including “/lil”, from the IP 129.121.114[.]124. OSINT reporting has since associated this IP address with the Mirai Katana botnet. Notably, the IP observed earlier in the year, 195.177.94[.]105, had also hosted a file named “lil”, indicating a link between the observed activity.
Over the following days, the device received a sudden spike in connections from multiple rare external endpoints, suggesting a possible successful brute force attack. Darktrace also observed the device exfiltrating just under 4GB of data to another Mirai-associated IP address, 66.92.198[.]194, over ports 3344, 954922, and 80. Finally, the device was seen uploading data to the Mirai botnet IP 5.175.249[.]53 over port138 and exhibited an increase in UDP connections to 34.18.28[.]10 over port 9068.
Following both file download events, Darktrace identified spikes in external data transfers and connection attempts to rare destinations. While Darktrace’s Threat Research team could not confirm with high confidence that this to activity was directly associated with Mirai, it may indicate that Mirai Katana includes data exfiltration functionality.
Darktrace’s threat researchers also identified an internet-facing NTP server belonging to a separate customer receiving incoming connection attempts from the same initially observed IP, 195.177.94[.]105,over the port 123. This suggests that Mirai Katana may not exclusively target IoT devices.
Conclusion
This case demonstrates how threat actors can exploit overlooked IoT and OT devices to support broader malicious objectives. Here, a camera device infected with a botnet was used to exfiltrate data from the customer's environment, showing how peripheral assets can become active participants in an attack chain.
This case also reinforces a challenge many organizations face today: extending security visibility beyond traditional endpoints and servers. Cameras, sensors, and other connected devices often operate with limited monitoring and may fall outside established security processes, despite maintaining network connectivity and access to potentially sensitive environments. This is particularly relevant in the sports sector, where growing reliance on connected cameras, smart stadium technologies, and other IoT devices continues to expand the attack surface, as highlighted in Darktrace's Sports Sector Threat Report.
As botnets like Kata and Mirai continue to evolve, defenders need visibility across unmanaged IoT and edge devices, as well as security solutions that can recognize subtle deviations in device behavior that may indicate an emerging compromise.
Credit to Parvatha Ananthakannan (Cyber Analyst), Signe Zaharka (Principal Analyst)
Edited by Ryan Traill (Content Manager)
Appendices
Darktrace Model Detections
· Anomalous File / EXE from Rare External Location
· Anomalous File / Multiple EXE from Rare External Locations
· Device / Initial Attack Chain Activity
· Unusual Activity / Unusual External Data to New Endpoint
· Anomalous Connection / Data Sent to Rare Domain
· Unusual Activity / Enhanced Unusual External Data Transfer
· Anomalous Connection / Uncommon 1 GiB Outbound
· Device / Significant UDP Increase
· Anomalous Connection / Low and Slow Exfiltration to IP
· Compromise / Large Number of Suspicious Failed Connections
· Compromise / Large Number of Suspicious Successful Connections
AI Agents: Securing the Path from Intent to Action
The UK’s National Cyber Security Centre (NCSC) recently published guidance on managing the cyber risk of agentic AI. While the document is framed as interim advice as more formal guidance is developed, the framing reflects the current state of the industry: organizations are already deploying agents into production environments while standards, controls, and operating models for autonomous systems remain unsettled. Governance is evolving alongside adoption rather than preceding it, a reality which underscores the importance of robust controls.
The NCSC’s guidance recommends aligning controls to an agent's level of autonomy, assigning distinct identities, limiting permissions, constraining access to systems and data, monitoring activity, maintaining human oversight, and preserving the ability to intervene when necessary. Most of these recommendations will sound familiar to security teams. The challenge is not the novelty of the controls. It is the type of system those controls now need to govern.
The shift from model security to agent security
For several years, AI security discussions have focused heavily on models. Can a model be manipulated? Jailbroken? Trusted? Can it expose information it should not? Those questions remain important, but they capture only part of the problem. A model generating text is one thing. A system connected to identities, applications, tools, workflows, and business data is another.
The difference becomes clearer when comparing a chatbot that answers questions with an agent that can retrieve customer records, update tickets, invoke tools, trigger workflows, and interact with external systems. The underlying model may be identical. Its access is not. The security question begins to shift from what the model knows to what the system can do.
The same theme appears in the Five Eyes statement released earlier this year, describing AI as a force multiplier that is accelerating both offensive and defensive cyber operations. The NCSC guidance explores what that reality looks like when autonomous systems begin operating inside enterprise environments.
Securing AI agents in operation
The NCSC spends relatively little time debating model behavior and considerably more time discussing identity, permissions, monitoring, oversight, containment, and response. Agents are treated as participants within an environment rather than isolated pieces of technology.
That's broadly consistent with how we think about the problem at Darktrace.
An agent should not be treated as an extension of a user account. It develops its own behavioral patterns. It accesses systems, interacts with data, invokes tools, and moves across workflows in ways that can be observed independently. Understanding what an agent is permitted to do matters. Understanding how it actually behaves once deployed, and whether that behavior aligns with business intent, matters just as much.
Identity provides an obvious example. The NCSC recommends assigning distinct identities to agents rather than allowing them to disappear into surrounding human or service accounts. Most importantly, assigning agents distinct identities enables independent behavioral monitoring.
Development assumptions vs. real-world behavior
The same principle extends to monitoring. NCSC guidance places agent activity within normal security operations rather than treating it as a separate AI governance function. Many of the controls described are put in place before an agent begins operating. Sandboxing, credential design, approval workflows and human oversight all reflect judgments about how the system is expected to behave and what risks it is likely to create.
Actual use may challenge those assumptions. Access patterns change. Workflows expand. Systems begin interacting with resources they have never touched before. Processes that appeared reasonable during design behave differently in production. Human oversight requirements may turn out to be either excessive or inadequate once the system is operating at scale and operating within the context of unique business processes.
The Five Eyes statement points to a similar issue: organizations need confidence that controls continue to work as intended once systems are exposed to real users, data, tools and operational pressures. Often, the question is not whether an agent is technically allowed to perform an action, but whether its behavior remains consistent with the role it was intended to play.
Monitoring and governance of AI agents go hand-in-hand
This problem is exactly why monitoring and governance should be treated as part of the same process. Governance sets the initial parameters for deployment, while monitoring provides evidence about whether those parameters remain appropriate. That evidence should, in turn, inform changes to permissions, controls and oversight.
This matters increasingly as autonomous systems are integrated into business processes. The relevant risk is shaped not only by the model or agent itself, but by what it can access, what actions it can take, and how its behavior changes in practice.
Developing continuous oversight of AI agent behavior
The implication is clear: governance cannot end at deployment. Organizations need a way to understand how agents behave after deployment, test whether controls remain appropriate, and adjust them as conditions change. That requires visibility not just into technical activity, but into whether that activity makes sense in the context of the business process the agent is intended to support.
This is where business-centric behavioral security can become critical. Risk does not emerge from the model itself: it emerges from the actions an autonomous system takes within the enterprise and the downstream consequences of those actions.
An agent can operate exactly as intended and still create risk if it accesses sensitive information in an unexpected context, exercises permissions in ways that create unintended exposure, or influences business processes in ways that were not anticipated during design and review.
Traditional governance vs. behavioral security
Traditional governance frameworks provide assurance at a point in time. Behavioral security can provide ongoing visibility into how autonomous systems interact with the organization they are meant to serve. Rather than focusing exclusively on model performance or policy compliance, organizations need to understand whether an agent's behavior aligns with business intent, operational expectations, and acceptable risk tolerances as conditions change.
As enterprises move from isolated AI deployments to interconnected ecosystems of agents, visibility into behavior becomes as important as visibility into code. Governance determines what an autonomous system is permitted to do. Behavioral analytics helps determine what it is doing, what business outcomes it is producing, and whether those outcomes remain aligned with the organization's objectives.
.avif)
