October 30, 2024

Post-Exploitation Activities on Fortinet Devices: A Network-Based Analysis

This blog explores recent findings from Darktrace's Threat Research team on active exploitation campaigns targeting Fortinet appliances. This analysis focuses on the September 2024 exploitation of FortiManager via CVE-2024-47575, alongside related malicious activity observed in June 2024.

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Adam Potter

Senior Cyber Analyst

Oct 2024

Introduction: Uncovering active exploitation of Fortinet vulnerabilities

As part of the Darktrace Threat Research team's routine analysis of October's Patch Tuesday vulnerabilities, the team began searching for signs of active exploitation of a critical vulnerability (CVE-2024-23113) affecting the FortiGate to FortiManager (FGFM) protocol.^[1]

Although the investigation was prompted by an update regarding CVE 2024-23113, results of the inquiry yielded evidence of widespread exploitation of Fortinet devices in both June and September 2024 potentially via multiple vulnerabilities including CVE 2024-47575. Analysts identified two clusters of activity involving overlapping indicators of compromise (IoCs), likely constituting unique campaigns targeting Fortinet appliances.

This blog will first highlight the finding and analysis of the network-based indicators of FortiManager post-exploitation activity in September, likely involving CVE 2024-47575. The article will then briefly detail a similar pattern of malicious activity observed in June 2024 that involved similar IoCs that potentially comprises a distinct campaign targeting Fortinet perimeter devices.

Fortinet CVE Disclosures

FortiManager devices allow network administrators to manage Fortinet devices on organizations’ networks.^[2] One such subset of devices managed through this method are Fortinet firewalls known as FortiGate. These manager and firewall devices communicate with each other via a custom protocol known as FortiGate to FortiManager (FGFM), whereby devices can perform reachability tests and configuration-related actions and reporting.^[3] By default, FortiManager devices operate this protocol via port 541.^[4]

Fortinet Product Security Incident Response Team released multiple announcements revealing vulnerabilities within the daemon responsible for implementing operability of the FGFM service. Specifically, CVE 2024-23113 enables attackers to potentially perform arbitrary remote command execution through the use of a specially crafted format string to a FortiGate device running the “fgfm daemon”.^[5][6] Similarly, the exploitation of CVE 2024-47575 could also allow remote command execution due to a missing authentication mechanism when targeting specifically FortiManager devices.^[7][8] Given how prolific both FortiGate and FortiManager devices are within the global IT security ecosystem, Darktrace analysts hypothesized that there may have been specific targeting of such devices within the customer base using these vulnerabilities throughout mid to late 2024.

Campaign Analysis

In light of these vulnerability disclosures, Darktrace’s Threat Research team began searching for signs of active exploitation by investigating file download, lateral movement or tooling activity from devices that had previously received suspicious connections on port 541. The team first noticed increases in suspicious activity involving Fortinet devices particularly in mid-September 2024. Further analysis revealed a similar series of activities involving some overlapping devices identified in June 2024. Analysis of these activity clusters revealed a pattern of malicious activity against likely FortiManager devices, including initial exploitation, payload retrieval, and exfiltration of probable configuration data.

Below is an overview of malicious activity we have observed by sector and region:

Sector and region affected by malicious activity on fortigate devices — *The sectors of affected customers listed above are categorized according to the United Kingdom’s Standard Industrial Classification (SIC).*

Initial Exploitation of FortiManager Devices

Across many of the observed cases in September, activity began with the initial exploitation of FortiManager devices via incoming connectivity over TLS/SSL. Such activity was detected due to the rarity of the receiving devices accepting connections from external sources, particularly over destination port 541. Within nearly all investigated incidents, connectivity began with the source IP, 45.32.41[.]202, establishing an SSL session with likely FortiManager devices. Device types were determined through a combination of the devices’ hostnames and the noted TLS certificate issuer for such encrypted connections.

Due to the encrypted nature of the connection, it was not possible to ascertain the exploit used in the analyzed cases. However, given the similarity of activities targeting FortiManager devices and research conducted by outside firms, attackers likely utilized CVE 2024-47575.^[9] For example, the source IP initiating the SSL sessions also has been referenced by Mandiant as engaging in CVE 2024-47575 exploitation. In addition to a consistent source IP for the connections, a similar JA3 hash was noted across multiple examined accounts, suggesting a similarity in source process for the activity.

In most cases observed by Darktrace, the incoming connectivity was followed by an outgoing connection on port 443 to the IP 45.32.41[.]202. Uncommon reception of encrypted connections over port 541, followed by the initiation of outgoing SSL connections to the same endpoint would suggest probable successful exploitation of FortiManager CVEs during this time.

Figure 1: Model alert logs highlighting the incoming connectivity over port 541 to the FortiManager devices followed by outgoing connection to the external IP.

Payload Retrieval

Investigated devices commonly retrieved some form of additional content after incoming connectivity over port 541. Darktrace’s Threat Research team noted how affected devices would make HTTP GET requests to the initial exploitation IP for the URI: /dom.js. This URI, suggestive of JavaScript content retrieval, was then validated by the HTTP response content type. Although Darktrace could see the HTTP content of the connections, usage of destination port 443 featured prominently during these HTTP requests, suggesting an attempt at encryption of the session payload details.

‍

Figure 2: Advanced Search HTTP log to the exploitation IP noting the retrieval of JavaScript content using the curl user agent.

‍

Figure 3: Cyber AI Analyst investigation into the initial exploitation activity. This incident emphasizes the rare external connectivity over port 443 requesting JavaScript content following the incoming connections over port 541.

The operators of the campaign also appear to have used a consistent user agent for payload retrieval: curl 8.4.0. Usage of an earlier version of the curl (version 7 .86.0) was only observed in one instance. The incorporation of curl utility to establish HTTP connections therefore suggests interaction with command-line utilities on the inspected Fortinet hosts. Command-line interaction also adds validity to the usage of exploits such as CVE 2024-47575 which enable unauthenticated remote command execution. Moreover, given the egress of data seen by the devices receiving this JavaScript content, Darktrace analysts concluded that this payload likely resulted in the configuration aggregation activity noted by external researchers.

Data Exfiltration

Nearly all devices investigated during the September time period performed some form of data exfiltration using the HTTP protocol. Most frequently, devices would initiate these HTTP requests using the same curl user agent already observed during web callback activity. Again, usage of this tool heavily suggests interaction with the command-line interface and therefore command execution.

The affected device typically made an HTTP POST request to one or both of the following two rare external IPs: 104.238.141[.]143 and 158.247.199[.]37. One of the noted IPs, 104.238.141[.]143, features prominently within external research conducted by Mandiant during this time. These HTTP POST requests nearly always sent data to the /file endpoint on the destination IPs. Analyzed connections frequently noted an HTTP mime type suggestive of compressed archive content. Some investigations also revealed specific filenames for the data sent externally: “.tm”. HTTP POST requests occurred without a specified hostname. This would suggest the IP address may have already been cached locally on the device from a running process or the IP address was hardcoded into the details of unwarranted code running on the system. Moreover, many such POSTs occurred without a GET request, which can indicate exfiltration activity.

Figure 4: Model alert logs noting both the connection to the IP 158.247.199[.]37 over port 443 without a hostname, and the unusual activity metric describing how the request was made without a prior HTTP GET request. Such activity can indicate malicious data exfiltration.

Interestingly, in many investigations, analysts noticed a lag period between the initial access and exploitation, and the exfiltration of data via HTTP. Such a pause, sometimes over several hours to over a day, could reflect the time needed to aggregate data locally on the host or as a strategic pause in activity to avoid detection. While not present within every compromise activity logs inspected, the delay could represent slight adjustments in behavior during the campaign by the threat actor.

Figure 5: Advanced search logs showing both the payload retrieval and exfiltration activity, emphasizing the gap in time between payload retrieval and exfiltration via HTTP POST request.

HTTP and file identification details identified during this time also directly correspond to research conducted by Mandiant. Not only do we see overlap in IPs identified as receiving the posted data (104.238.141[.]143) we also directly observed an overlap in filenames for the locally aggregated configuration data. Moreover, the gzip mime type identified in multiple customer investigations also corresponds directly to exfiltration activity noted by Mandiant researchers.

Figure 6: Advanced search logs noting the filename and URL of the posted data to one of the exfiltration IPs. The .tm filename corresponds to the locally stored file on affected FortiManager devices analyzed by external researchers.

Activity detected in June 2024

Common indicators

Analysts identified a similar pattern of activity between June 23 and June 25. Activity in this period involved incoming connections from the aforementioned IP 45.32.41[.]202 on either port 541 or port 443 followed by an outgoing connection to the source. This behavior was then followed by HTTP POSTs to the previously mentioned IP address 158.247.199[.]37 in addition to the novel IP: 195.85.114[.]78 using same URI ‘/file’ noted above. Given the commonalties in indicators, time period, and observed behaviors, this grouping of exploitation attempts appears to align closely with the campaign described by Mandiant and may represent exploitation of CVE 2024-47575 in June 2024. The customers targeted in June fall into the same regions and sectors as seen those in the September campaign.

Deviations in behavior

Notably, Darktrace detected a different set of actions during the same June timeframe despite featuring the same infrastructure. This activity involved an initial incoming connection from 158.247.199[.]37 to an internal device on either port 541 or port 443. This was then followed by an outgoing HTTP connection to 158.247.199[.]37 on port 443 with a URI containing varying external IPs. Upon further review, analysts noticed the IPs listed may be the public IPs of the targeted victim, suggesting a potential form device registration by the threat actor or exploit validation. While the time period and infrastructure closely align with the previous campaign described, the difference in activity may suggest another threat actor sharing infrastructure or the same threat actor carrying out a different campaign at the same time. Although the IP 45.32.41[.]202 was contacted, paralleling activity seen in September, analysts did notice a different payload received from the external host, a shell script with the filename ver.sh.

‍

Figure 7: AI Analyst timeline noting the suspicious HTTP behavior from a FortiManager device involving the IP 158.247.199[.] 37.

Darktrace's depth of detection and investigation

Darktrace detected spikes in anomalous behavior from Fortinet devices within the customer base between September 22 and 23, 2024. Following an in-depth investigation into affected accounts and hosts, Darktrace identified a clear pattern where one, or multiple, threat actors leveraged CVEs affecting likely FortiManager devices to execute commands on the host, retrieve malicious content, and exfiltrate sensitive data. During this investigation, analysts then identified possibly related activity in June 2024 highlighted above.

The gathering and exfiltration of configuration data from network security management or other perimeter hosts is a technique that can enable future access by threat actors. This parallels activity previously discussed by Darktrace focused on externally facing devices, such as Palo Alto Networks firewall devices. Malicious entities could utilize stolen configuration data and potentially stored passwords/hashes to gain initial access in the future, irrespective of the state of device patching. This data can also be potentially sold by initial access brokers on illicit sites. Moreover, groups can leverage this information to establish persistence mechanisms within devices and host networks to enable more impactful compromise activity.

Uncover threat pattens before they strike your network

Network and endpoint management services are essential tools for network administrators and will remain a critical part of IT infrastructure. However, these devices are often configured as internet-facing systems, which can unintentionally expose organizations networks' to attacks. Internet exposure provides malicious groups with novel entry routes into target environments. Although threat actors can swap vulnerabilities to access target networks, the exploitation process leaves behind unusual traffic patterns, making their presence detectable with the right network detection tools.

By detecting the unusual patterns of network traffic which inevitably ensue from exploitation of novel vulnerabilities, Darktrace’s anomaly-based detection and response approach can continue to identify and inhibit such intrusion activities irrespective of exploit used. Eulogizing the principle of least privilege, configuration and asset management, and maintaining the CIA Triad across security operations will continue to help security teams boost their defense posture. ‍

See how anomaly-based detection can enhance your security operations—schedule a personalized demo today.

Credit to Adam Potter (Senior Cyber Analyst), Emma Foulger (Principal Cyber Analyst), Nahisha Nobregas (Senior Cyber Analyst), Hyeongyung Yeom (Principal Cyber Analyst & Analyst Team Lead, East Asia), Sam Lister (Senior Cyber Analyst)

Appendix

Model Alerts

Anomalous Connection / Posting HTTP to IP without Hostname
Anomalous Connection / Callback on Web Facing Device
Anomalous Server Activity / New Internet Facing Server
Anomalous Server Activity / Outgoing from Server

Cyber AI Analyst Incidents

Possible HTTP Command and Control
Possible HTTP Command and Control to Multiple Endpoints

IoCs

Indicator – Type - Description

104.238.141[.]143 - IP Address - C2 infrastructure

158.247.199[.]37 - IP Address - C2 infrastructure

45.32.41[.]202 - IP Address - C2 infrastructure

104.238.141[.]143/file – URL - C2 infrastructure

158.247.199[.]37/file - URL - C2 infrastructure

45.32.41[.]202/dom.js – URL - C2 infrastructure

.tm – Filename - Gzip file

MITRE Attack Framework

Initial Access:
T1190 Exploiting Public-Facing Application
Execution:
T1059 Command and Scripting Interpreter (Sub-Techniques: T1059.004 Unix Shell, T1059.008 Network Device CLI)
Discovery:
T1083 File and System Discovery
T1057 Process Discovery
Collection:
T1005 Data From Local System
Command and Control:
T1071 Application Layer Protocols (Sub-Technique:
T1071.001 Web Protocols)
T1573 Encrypted Channel
T1573.001 Symmetric Cryptography
T1571 Non-Standard Port
T1105 Ingress Tool Transfer
T1572 Protocol Tunnelling
Exfiltration:
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

‍

References

{1} https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575/‍

{2} https://docs.fortinet.com/document/fortimanager/6.4.0/ports-and-protocols/606094/fortigate-fortimanager-protocol#:~:text=The%20FortiGate%2DFortiManager%20(FGFM),by%20using%20the%20FGFM%20protocol.

{3)https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/373486/fgfm-fortigate-to-fortimanager-protocol
{4} https://www.fortiguard.com/psirt/FG-IR-24-029
{5} https://www.fortiguard.com/psirt/FG-IR-24-423
{6}https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortimanager.pdf

{7} https://doublepulsar.com/burning-zero-days-fortijump-fortimanager-vulnerability-used-by-nation-state-in-espionage-via-msps-c79abec59773

{8} https://darktrace.com/blog/post-exploitation-activities-on-pan-os-devices-a-network-based-analysis

Written by

Adam Potter

Senior Cyber Analyst

Inside the SOC

Written by

Adam Potter

Senior Cyber Analyst

The Darktrace Community

Watch the NIS2 Webinar

Blog

June 9, 2026

Always On, Always Defending: Inside the AI-Driven SOC

Today’s SOC: A system under pressure

The SOC has been described as the:

Control center for security systems management
Operations center for log analysis and alert response
Command center for network monitoring and investigation

But the CISO at a manufacturer of industrial power solutions says today’s SOC is far more dynamic:

“The SOC is an active player in a never-ending chess match where the pieces are always moving, the rules are constantly changing, and we’re continuously adjusting our tactical and strategic approaches to keep up.”

This has created a balancing act for cybersecurity professionals:

Support expanding digital estates to fuel innovation…or risk limiting business growth
Stop advanced cyberattacks at scale…or risk severe financial and reputational impacts

But balancing these responsibilities is increasingly difficult. Attackers are operating at machine speed and scale using sophisticated, adaptive techniques that overwhelm teams and bypass legacy defenses. At the same time, more than half of cybersecurity teams are understaffed, and 65% have unfilled cybersecurity positions (ISACA).

“The SOC is hitting its breaking point,” admits the VP of IT at a U.S.-based risk management services provider.”

“That’s the hard reality,” affirms a Chief Digital and Technology Officer at a North American financial services organization. “SOC teams are drowning in alerts, wasting time researching the most benign incidents while missing critical threats.”

Traditional tools lack the context and autonomous reasoning needed to determine which ones are truly dangerous, requiring analysts to manually review and respond. But with thousands of alerts hitting SOCs daily, the task exceeds human capacity, with recent industry research revealing that 40% to 42% of security alerts now go uninvestigated.

“Our old governance models of throwing bodies at it, that’s not going to work,” says the Group CIO of a multinational holding company. “Attackers move at machine speed, and our defenses have to operate at the same pace. Using AI for cybersecurity is the only way to do that.”

Why AI is essential

AI is about speed, scale, and context.

SOC teams are still expected to find the proverbial “needle in a haystack”, but the haystack keeps growing. As digital infrastructures expand and threat actors use AI to rapidly scale attacks and exploit vulnerabilities, success isn’t about keeping up but changing the approach.

This is where AI comes in, enabling security teams to operate at machine speed and scale by:

Analyzing vast amounts of data and correlating signals across domains within seconds
Detecting possible threats in real time and taking immediate action to mitigate risk
Prioritizing threats by severity and uncovering contextual details for rapid triage

The power of AI isn’t theoretical; it is transforming how today’s businesses operate.

The Chief Digital and Technology Officer at a financial services firm says within a single month of using Darktrace, the solution tracked billions of network events, autonomously investigated tens of millions of those incidents, and added the equivalent of 1,000 analyst hours of investigation. It also found threats that bypassed traditional tools, autonomously responding to contain or disrupt the threat on over 30,000 emails, including 18,000 the firm’s native email filter missed.

When Darktrace says it “takes action on a threat,” it generally means its platform can move beyond just detecting suspicious activity and automatically respond to contain or disrupt the threat—such as isolating a device, slowing or blocking suspicious network traffic, disabling risky user activity, or triggering security workflows—depending on how the system is configured.

AI isn’t about displacing humans.

AI is a powerful tool for handling large-scale data analysis, pattern detection, and repetitive tasks, but it cannot replace human critical thinking. By removing mindless work that does not require judgment, AI frees analysts to focus on what humans do best: applying reasoning, context, and sound decision-making to complex threats.

“AI is a workforce maximizer,” says the Chief Digital and Technology Officer. “It augments our team by monitoring and detecting threats at a scale beyond human capacity while providing the critical context we need to make faster, more confident decisions.

Rather than replacing people, AI is changing how security professionals work. Analysts can reclaim time previously spent on tedious, manual triage to focus on higher priorities and proactive initiatives like advanced threat hunting, strategic risk management, and security enablement and training.

“Aside from risk mitigation, our biggest ROI is in efficiency,” says the Head of Security at global business services provider. “What used to take 90% of our investigation time is now handled automatically, so we can focus on the final 10%, which requires critical thinking."

For SOC teams under pressure, the impact can be transformative, with security leaders reporting significant real-world outcomes using Darktrace Self-Learning AI^TM, including:

Phishing emails reduced by 99%
1 million+ emails autonomously analyzed each month, with no email-based incidents reported
Potential threats autonomously neutralized in under four seconds, on average
99% of investigations conducted autonomously, surfacing only the high-priority 1% of threats for analyst review

How AI optimizes the SOC

To protect the modern enterprise, you absolutely need the right tools,” says CTO at leading European fashion brand. “Without them you’re a victim. With them, you’re a defender. AI and the machine speed detect/response it enables makes it the most critical tool.”

Replacing chaos with clarity and control

It’s important to note that different AI solutions address different needs. Companies should clearly understand their specific use case and select the solution that best aligns with their goals, requirements, and operational needs.

When it comes to choosing cybersecurity in a machine-speed threat landscape, time is the most valuable resource. Organizations require AI that can move from insight to action by:

Learning an organization’s unique behavioral patterners
Correlating signals across domains to detect anomalous activity
Prioritizing events and autonomously responding at scale to the vast majority
Quarantining high-impact threats until the SOC can investigate
Arming analysts with deep, contextual information to accelerate investigations

“Darktrace AI gives us threat detections based on facts, not guesses,” says the Group CIO. “It moves the SOC beyond alert overload to confident, informed decision-making. When Darktrace flags something, we pay attention. False positives are very rare, so we act with speed and confidence without second-guessing.”

Replacing anxiety with confidence and peace of mind

Every missed alert can have real-world consequences.

The strain of maintaining constant vigilance at scale without holistic visibility and automation is taking its toll on security professionals: 66% report increased stress, and nearly half say it’s the reason they’re leaving the field (ISACA).

The CIO at a professional sports organization says that’s not surprising: “If you don’t know what’s going on, anything could be happening. Operating with that level of uncertainty and control is incredibly stressful.”

AI gives SOCs the power to be proactive by unifying telemetry across network, email, identity, and cloud environments to provide a complete picture and a stronger foundation for action. The benefits for analysts, both personally and professionally, are significant:

Achieve greater work-life balance: “Knowing that Darktrace has our backs 24/7 and will take immediate action to stop threats means we can now work normal hours and take vacations without worrying,” says the Chief Digital and Technology Officer.
Feel in control with deeper insights: “It not only stops and quarantines threats but also provides the deep context we need to quickly investigate and respond,” explains the Head of Security.
Gain confidence the business is protected 24/7: “We can sleep at night. With Darktrace I’m confident that even with a small team we can protect the business 24/7,” adds the former retail CIO.

The modern SOC: A system of balance

Elevated to a core pillar of business strategy, the modern SOC is now considered:

The nerve center of cyber risk and proactive defense
The AI-powered command center for operational resilience
The strategic hub for contextual decision-making at scale

The SOC has evolved from a reactive center responsible for managing systems into a proactive, frontline defender and strategic business enabler—integral to innovation and growth.

AI is the key to balancing these responsibilities.

“We can only grow as fast as we can secure the business,” says the Head of Security. “AI gives us the speed, scale, and confidence to do both.”

*Metrics are based on the customer’s interview, data and sourced from its monthly Cyber AI Insights reporting.

About the author

The Darktrace Community

Blog

Proactive Security

June 3, 2026

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

Núclea is a Brazilian data and technology company that supports the country’s financial system by delivering digital services exclusively to banks and financial institutions. Operating in an environment where trust, availability, and data integrity are critical, the company faces a threat landscape that has evolved rapidly—particularly with the rise of AI-driven cyberattacks.

Brazil has experienced a wave of successful cyber incidents targeting financial institutions, many of them enabled by insiders or compromised credentials. The result was a noticeable shift in attacker strategy: instead of focusing on end customers, threat actors began targeting the institutions and platforms that underpin the financial ecosystem itself.

“Attacks became far more directed and contextual,” explains Guilherme, who leads incident response within Núclea’s security platform engineering team. “They weren’t noisy or obviously malicious—they were precise, patient, and designed to blend into normal operations.”

That precision was on full display in January 2026, when Núclea faced one of the most convincing phishing attacks the team had seen.

A real attack, built on trust and context

The attack began with a seemingly routine email.

It was sent from a real Brazilian government institution, using legitimate infrastructure and valid credentials that were later confirmed to have been compromised. Núclea had an established, ongoing relationship with this organization, and the email’s language, tone, and subject matter aligned perfectly with the type of communication the recipient team handled every day.

Attached to the email was a PDF document containing content that looked entirely legitimate.

The problem? A single URL embedded inside that PDF.

“The message itself was correct. The sender was real. The context was familiar. Even the document content made sense,” Guilherme explains. “There was just one small element that didn’t belong.”

That small detail was enough to initiate a full attack chain.

What the attackers were trying to do

If clicked, the URL would have downloaded a malicious payload designed to:

Collect information about the user and device
Identify where the system was located within the financial ecosystem
Install remote access tools to maintain control
Deploy an infostealer to extract sensitive data
Execute anti-forensic scripts to erase traces of the intrusion

In other words, it was a carefully engineered operation designed for persistence and stealth, not immediate disruption.

The attack also employed urgency—a classic social engineering technique. When the link didn’t open as expected, employees requested assistance from the security team, insisting the document was important and needed to be accessed quickly.

This is precisely the kind of scenario where traditional security tools struggle: almost everything about the interaction is legitimate.

Where Darktrace made the difference

Instead of blocking the entire message or relying on known indicators of compromise, Darktrace focused on behavioral context.

Darktrace recognized:

That the sending organization was normally trusted
That the communication pattern matched historical behavior
That the PDF content itself was not suspicious

But it also identified that the URL embedded within the document deviated from established behavioral patterns.

Rather than disrupting business operations, Darktrace took precise action: it rewrote the URL, preventing the malicious download while leaving the rest of the email untouched.

“When we analyzed it afterward, it became clear how dangerous the attack would have been,” says Guilherme. “But it never progressed—because Darktrace acted at exactly the right point.”

Subsequent forensic analysis confirmed the payload’s malicious intent. The attack never succeeded.

Precision over disruption

For Núclea, this incident reinforced a critical lesson: modern attacks don’t always look malicious—they hide within normal activity.

“What stands out to me is the precision,” Guilherme says. “Darktrace doesn’t rely on big, obvious signals. It’s effective in situations that fall outside the standard patterns we all know.”

Building resilience in a high trust ecosystem

For Núclea, cybersecurity is not just a defensive measure—it’s a business enabler.

Availability failures or successful breaches in the financial ecosystem can have immediate, large-scale consequences, from financial loss to reputational damage. Preventing those outcomes protects not just Núclea, but its partners and customers as well.

“Cyber resilience means keeping the business running—even under attack,” Guilherme explains. “And that requires people, processes, and technology working together.”

As AI continues to accelerate both attacks and defenses, the role of security is evolving. Precision, behavioral understanding, and intelligent automation are no longer optional—they’re essential.

“The easy days were yesterday,” Guilherme says. “The challenges ahead are bigger. We need to be prepared—internally and with partners that help us build resilience.”

‍

About the author

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Post-Exploitation Activities on Fortinet Devices: A Network-Based Analysis

Post-Exploitation Activities on Fortinet Devices: A Network-Based Analysis

Introduction: Uncovering active exploitation of Fortinet vulnerabilities

Fortinet CVE Disclosures

Campaign Analysis

Initial Exploitation of FortiManager Devices

Payload Retrieval

Data Exfiltration

Activity detected in June 2024

Common indicators

Deviations in behavior

Darktrace's depth of detection and investigation

Uncover threat pattens before they strike your network

Appendix

Model Alerts

Cyber AI Analyst Incidents

IoCs

MITRE Attack Framework

References

When Open Source Is Weaponized: Analysis of a Trojanized 7 Zip Installer

Always On, Always Defending: Inside the AI-Driven SOC

Enjoying the blog?

More in this series

Darktrace named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) For the Second Consecutive Year

When Open Source Is Weaponized: Analysis of a Trojanized 7 Zip Installer

Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

Blog

June 9, 2026

Always On, Always Defending: Inside the AI-Driven SOC

Today’s SOC: A system under pressure

Why AI is essential

AI is about speed, scale, and context.

AI isn’t about displacing humans.

How AI optimizes the SOC

Replacing chaos with clarity and control

Replacing anxiety with confidence and peace of mind

The modern SOC: A system of balance

Blog

Proactive Security

June 3, 2026

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

A real attack, built on trust and context

What the attackers were trying to do

Where Darktrace made the difference

Precision over disruption