October 14, 2024

How Triada Affects Banking and Communication Apps

Explore the intricacies of the Triada Trojan and its targeting of communication and banking apps. Learn how to safeguard against this threat.

Written by

Justin Torres

Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Justin Torres

Cyber Analyst

Oct 2024

The rise of android malware

Recently, there has been a significant increase in malware strains targeting mobile devices, with a growing number of Android-based malware families, such as banking trojans, which aim to steal sensitive banking information from organizations and individuals worldwide.

These malware families attempt to access users’ accounts to steal online banking credentials and cookies, bypass multi-factor authentication (MFA), and conduct automatic transactions to steal funds [1]. They often masquerade as legitimate software or communications from social media platforms to compromise devices. Once installed, they use tactics such as keylogging, dumping cached credentials, and searching the file system for stored passwords to steal credentials, take over accounts, and potentially perform identity theft [1].

One recent example is the Antidot Trojan, which infects devices by disguising itself as an update page for Google Play. It establishes a command-and-control (C2) channel with a server, allowing malicious actors to execute commands and collect sensitive data [2].

Despite these malware’s ability to evade detection by standard security software, for example, by changing their code [3], Darktrace recently detected another Android malware family, Triada, communicating with a C2 server and exfiltrating data.

Triada: Background and tactics

First surfacing in 2016, Triada is a modular mobile trojan known to target banking and financial applications, as well as popular communication applications like WhatsApp, Facebook, and Google Mail [4]. It has been deployed as a backdoor on devices such as CTV boxes, smartphones, and tablets during the supply chain process [5]. Triada can also be delivered via drive-by downloads, phishing campaigns, smaller trojans like Leech, Ztorg, and Gopro, or more recently, as a malicious module in applications such as unofficial versions of WhatsApp, YoWhatsApp, and FM WhatsApp [6] [7].

How does Triada work?

Once downloaded onto a user’s device, Triada collects information about the system, such as the device’s model, OS version, SD card space, and list of installed applications, and sends this information to a C2 server. The server then responds with a configuration file containing the device’s personal identification number and settings, including the list of modules to be installed.

After a device has been successfully infected by Triada, malicious actors can monitor and intercept incoming and outgoing texts (including two-factor authentication messages), steal login credentials and credit card information from financial applications, divert in-application purchases to themselves, create fake messaging and email accounts, install additional malicious applications, infect devices with ransomware, and take control of the camera and microphone [4] [7].

For devices infected by unofficial versions of WhatsApp, which are downloaded from third-party app stores [9] and from mobile applications such as Snaptube and Vidmate , Triada collects unique device identifiers, information, and keys required for legitimate WhatsApp to work and sends them to a remote server to register the device [7] [12]. The server then responds by sending a link to the Triada payload, which is downloaded and launched. This payload will also download additional malicious modules, sign into WhatsApp accounts on the target’s phone, and request the same permissions as the legitimate WhatsApp application, such as access to SMS messages. If granted, a malicious actor can sign the user up for paid subscriptions without their knowledge. Triada then collects information about the user’s device and mobile operator and sends it to the C2 server [9] [12].

How does Triada avoid detection?

Triada evades detection by modifying the Zygote process, which serves as a template for every application in the Android OS. This enables the malware to become part of every application launched on a device [3]. It also substitutes system functions and conceals modules from the list of running processes and installed apps, ensuring that the system does not raise the alarm [3]. Additionally, as Triada connects to a C2 server on the first boot, infected devices remain compromised even after a factory reset [4].

Triada attack overview

Across multiple customer deployments, devices were observed making a large number of connections to a range of hostnames, primarily over encrypted SSL and HTTPS protocols. These hostnames had never previously been observed on the customers’ networks and appear to be algorithmically generated. Examples include “68u91.66foh90o[.]com”, “92n7au[.]uhabq9[.]com”, “9yrh7.mea5ms[.]com”, and “is5jg.3zweuj[.]com”.

Figure 1: External Sites Summary Graph showing the rarity of the hostname “92n7au[.]uhabq9[.]com” on a customer network.

Most of the IP addresses associated with these hostnames belong to an ASN associated with the cloud provider Alibaba (i.e., AS45102 Alibaba US Technology Co., Ltd). These connections were made over a range of high number ports over 1000, most commonly over 30000 such as 32091, which Darktrace recognized as extremely unusual for the SSL and HTTPS protocols.

Figure 2: Screenshot of a Model Alert Event log showing a device connecting to the endpoint “is5jg[.]3zweuj[.]com” over port 32091.

On several customer deployments, devices were seen exfiltrating data to hostnames which also appeared to be algorithmically generated. This occurred via HTTP POST requests containing unusual URI strings that were made without a prior GET request, indicating that the infected device was using a hardcoded list of C2 servers.

Figure 3: Screenshot of a Model Alert Event Log showing the device posting the string “i8xps1” to the hostname “72zf6.rxqfd[.]com.

Figure 4: Screenshot of a Model Alert Event Log showing the device posting the string “sqyjyadwwq” to the hostname “9yrh7.mea5ms[.]com”.

These connections correspond with reports that devices affected by Triada communicate with the C2 server to transmit their information and receive instructions for installing the payload.

A number of these endpoints have communicating files associated with the unofficial WhatsApp versions YoWhatsApp and FM WhatsApp [11] [12] [13] . This could indicate that the devices connecting to these endpoints were infected via malicious modules in the unofficial versions of WhatsApp, as reported by open-source intelligence (OSINT) [10] [12]. It could also mean that the infected devices are using these connections to download additional files from the C2 server, which could infect systems with additional malicious modules related to Triada.

Moreover, on certain customer deployments, shortly before or after connecting to algorithmically generated hostnames with communicating files linked to YoWhatsApp and FM WhatsApp, devices were also seen connecting to multiple endpoints associated with WhatsApp and Facebook.

Figure 5: Screenshot from a device’s event log showing connections to endpoints associated with WhatsApp shortly after it connected to “9yrh7.mea5ms[.]com”.

These surrounding connections indicate that Triada is attempting to sign in to the users’ WhatsApp accounts on their mobile devices to request permissions such as access to text messages. Additionally, Triada sends information about users’ devices and mobile operators to the C2 server.

The connections made to the algorithmically generated hostnames over SSL and HTTPS protocols, along with the HTTP POST requests, triggered multiple Darktrace models to alert. These models include those that detect connections to potentially algorithmically generated hostnames, connections over ports that are highly unusual for the protocol used, unusual connectivity over the SSL protocol, and HTTP POSTs to endpoints that Darktrace has determined to be rare for the network.

Conclusion

Recently, the use of Android-based malware families, aimed at stealing banking and login credentials, has become a popular trend among threat actors. They use this information to perform identity theft and steal funds from victims worldwide.

Across affected customers, multiple devices were observed connecting to a range of likely algorithmically generated hostnames over SSL and HTTPS protocols. These devices were also seen sending data out of the network to various hostnames via HTTP POST requests without first making a GET request. The URIs in these requests appeared to be algorithmically generated, suggesting the exfiltration of sensitive network data to multiple Triada C2 servers.

This activity highlights the sophisticated methods used by malware like Triada to evade detection and exfiltrate data. It underscores the importance of advanced security measures and anomaly-based detection systems to identify and mitigate such mobile threats, protecting sensitive information and maintaining network integrity.

Credit to: Justin Torres (Senior Cyber Security Analyst) and Charlotte Thompson (Cyber Security Analyst).

Appendices

Darktrace Model Detections

Model Alert Coverage

Anomalous Connection / Application Protocol on Uncommon Port

Anomalous Connection / Multiple Connections to New External TCP Port

Anomalous Connection / Multiple HTTP POSTS to Rare Hostname

Anomalous Connections / Multiple Failed Connections to Rare Endpoint

Anomalous Connection / Suspicious Expired SSL

Compromise / DGA Beacon

Compromise / Domain Fluxing

Compromise / Fast Beaconing to DGA

Compromise / Sustained SSL or HTTP Increase

Compromise / Unusual Connections to Rare Lets Encrypt

Unusual Activity / Unusual External Activity

‍

AI Analyst Incident Coverage

Unusual Repeated Connections to Multiple Endpoints

Possible SSL Command and Control

Unusual Repeated Connections

List of Indicators of Compromise (IoCs)

Ioc – Type - Description

is5jg[.]3zweuj[.]com - Hostname - Triada C2 Endpoint
68u91[.]66foh90o[.]com - Hostname - Triada C2 Endpoint
9yrh7[.]mea5ms[.]com - Hostname - Triada C2 Endpoint
92n7au[.]uhabq9[.]com - Hostname - Triada C2 Endpoint
4a5x2[.]fs4ah[.]com - Hostname - Triada C2 Endpoint
jmll4[.]66foh90o[.]com - Hostname - Triada C2 Endpoint
mrswd[.]wo87sf[.]com - Hostname - Triada C2 Endpoint
lptkw[.]s4xx6[.]com - Hostname - Triada C2 Endpoint
ya27fw[.]k6zix6[.]com - Hostname - Triada C2 Endpoint
w0g25[.]66foh90o[.]com - Hostname - Triada C2 Endpoint
kivr8[.]wd6vy[.]com - Hostname - Triada C2 Endpoint
iuwe64[.]ct8pc6[.]com - Hostname - Triada C2 Endpoint
qefgn[.]8z0le[.]com - Hostname - Triada C2 Endpoint
a6y0x[.]xu0h7[.]com - Hostname - Triada C2 Endpoint
wewjyw[.]qb6ges[.]com - Hostname - Triada C2 Endpoint
vx9dle[.]n0qq3z[.]com - Hostname - Triada C2 Endpoint
72zf6[.]rxqfd[.]com - Hostname - Triada C2 Endpoint
dwq[.]fsdw4f[.]com - Hostname - Triada C2 Endpoint
tqq6g[.]66foh90o[.]com - Hostname - Triada C2 Endpoint
1rma1[.]4f8uq[.]com - Hostname - Triada C2 Endpoint
0fdwa[.]7j3gj[.]com - Hostname - Triada C2 Endpoint
5a7en[.]1e42t[.]com - Hostname - Triada C2 Endpoint
gmcp4[.]1e42t[.]com - Hostname - Triada C2 Endpoint
g7190[.]rt14v[.]com - Hostname - Triada C2 Endpoint
goyvi[.]2l2wa[.]com - Hostname - Triada C2 Endpoint
zq6kk[.]ca0qf[.]com - Hostname - Triada C2 Endpoint
sv83k[.]bn3avv[.]com - Hostname - Triada C2 Endpoint
9sae7h[.]ct8pc6[.]com - Hostname - Triada C2 Endpoint
jpygmk[.]qt7tqr[.]com - Hostname - Triada C2 Endpoint
av2wg[.]rt14v[.]com - Hostname - Triada C2 Endpoint
ugbrg[.]osz1p[.]com - Hostname - Triada C2 Endpoint
hw2dm[.]wtws9k[.]com - Hostname - Triada C2 Endpoint
kj9atb[.]hai8j1[.]com - Hostname - Triada C2 Endpoint
pls9b[.]b0vb3[.]com - Hostname - Triada C2 Endpoint
8rweau[.]j7e7r[.]com - Hostname - Triada C2 Endpoint
wkc5kn[.]j7e7r[.]com - Hostname - Triada C2 Endpoint
v58pq[.]mpvflv[.]com - Hostname - Triada C2 Endpoint
zmai4k[.]huqp3e[.]com - Hostname - Triada C2 Endpoint
eajgum[.]huqp3e[.]com - Hostname - Triada C2 Endpoint
mxl9zg[.]kv0pzv[.]com - Hostname - Triada C2 Endpoint
ad1x7[.]mea5ms[.]com - Hostname - Triada C2 Endpoint
ixhtb[.]s9gxw8[.]com - Hostname - Triada C2 Endpoint
vg1ne[.]uhabq9[.]com - Hostname - Triada C2 Endpoint
q5gd0[.]birxpk[.]com - Hostname - Triada C2 Endpoint
dycsw[.]h99n6[.]com - Hostname - Triada C2 Endpoint
a3miu[.]h99n6[.]com - Hostname - Triada C2 Endpoint
qru62[.]5qwu8b5[.]com - Hostname - Triada C2 Endpoint
3eox8[.]abxkoop[.]com - Hostname - Triada C2 Endpoint
0kttj[.]bddld[.]com - Hostname - Triada C2 Endpoint
gjhdr[.]xikuj[.]com - Hostname - Triada C2 Endpoint
zq6kk[.]wm0hd[.]com - Hostname - Triada C2 Endpoint
8.222.219[.]234 - IP Address - Triada C2 Endpoint
8.222.244[.]205 - IP Address - Triada C2 Endpoint
8.222.243[.]182 - IP Address - Triada C2 Endpoint
8.222.240[.]127 - IP Address - Triada C2 Endpoint
8.219.123[.]139 - IP Address - Triada C2 Endpoint
8.219.196[.]124 - IP Address - Triada C2 Endpoint
8.222.217[.]73 - IP Address - Triada C2 Endpoint
8.222.251[.]253 - IP Address - Triada C2 Endpoint
8.222.194[.]254 - IP Address - Triada C2 Endpoint
8.222.251[.]34 - IP Address - Triada C2 Endpoint
8.222.216[.]105 - IP Address - Triada C2 Endpoint
47.245.83[.]167 - IP Address - Triada C2 Endpoint
198.200.54[.]56 - IP Address - Triada C2 Endpoint
47.236.113[.]126 - IP Address - Triada C2 Endpoint
47.241.47[.]128 - IP Address - Triada C2 Endpoint
/iyuljwdhxk - URI - Triada C2 URI
/gvuhlbzknh - URI - Triada C2 URI
/sqyjyadwwq - URI - Triada C2 URI
/cncyz3 - URI - Triada C2 URI
/42k0zk - URI - Triada C2 URI
/75kdl5 - URI - Triada C2 URI
/i8xps1 - URI - Triada C2 URI
/84gcjmo - URI - Triada C2 URI
/fkhiwf - URI - Triada C2 URI

MITRE ATT&CK Mapping

Technique Name - Tactic - ID - Sub-Technique of

Data Obfuscation - COMMAND AND CONTROL - T1001

Non-Standard Port - COMMAND AND CONTROL - T1571

Standard Application Layer Protocol - COMMAND AND CONTROL ICS - T0869

Non-Application Layer Protocol - COMMAND AND CONTROL - T1095

Masquerading - EVASION ICS - T0849

Man in the Browser - COLLECTION - T1185

Web Protocols - COMMAND AND CONTROL - T1071.001 -T1071

External Proxy - COMMAND AND CONTROL - T1090.002 - T1090

Domain Generation Algorithms - COMMAND AND CONTROL - T1568.002 - T1568

Web Services - RESOURCE DEVELOPMENT - T1583.006 - T1583

DNS - COMMAND AND CONTROL - T1071.004 - T1071

Fast Flux DNS - COMMAND AND CONTROL - T1568.001 - T1568

One-Way Communication - COMMAND AND CONTROL - T1102.003 - T1102

Digital Certificates - RESOURCE DEVELOPMENT - T1587.003 - T1587

References

[1] https://www.checkpoint.com/cyber-hub/cyber-security/what-is-trojan/what-is-a-banking-trojan/

[2] https://cyberfraudcentre.com/the-rise-of-the-antidot-android-banking-trojan-a-comprehensive-guide

[3] https://www.zimperium.com/glossary/banking-trojans/

[4] https://www.geeksforgeeks.org/what-is-triada-malware/

[5] https://www.infosecurity-magazine.com/news/malware-infected-devices-retailers/

[6] https://www.pcrisk.com/removal-guides/24926-triada-trojan-android

[7] https://securelist.com/malicious-whatsapp-mod-distributed-through-legitimate-apps/107690/

[8] https://securityboulevard.com/2024/02/impact-of-badbox-and-peachpit-malware-on-android-devices/

[9] https://threatpost.com/custom-whatsapp-build-malware/168892/

[10] https://securelist.com/triada-trojan-in-whatsapp-mod/103679/

[11] https://www.virustotal.com/gui/domain/is5jg.3zweuj.com/relations

[12] https://www.virustotal.com/gui/domain/92n7au.uhabq9.com/relations

[13] https://www.virustotal.com/gui/domain/68u91.66foh90o.com/relations

Written by

Justin Torres

Cyber Analyst

Inside the SOC

Written by

Justin Torres

Cyber Analyst

Malware Research Lead

•

May 26, 2026

Jamie Bali

Technical Author (AI) Developer

Watch the NIS2 Webinar

Blog

Email

May 26, 2026

Journey of a Threat: How Multi-Layered AI Works in Darktrace / EMAIL

Darktrace / EMAIL is an implementation of the Darktrace methodology – a multi-layered AI system built into a single product. As with other Darktrace products, Darktrace / EMAIL learns the expected behaviours of an organization and its employees to identify novel threats and anomalous activity.

The diagram below represents the architecture of Darktrace / EMAIL’s multi-layered AI: a structured visualization of how intelligence is built, step by step, from raw data to actionable insight. Each layer plays a distinct role, feeding into the next: collecting data, understanding behaviour, analysing intent, making decisions, and presenting clear outcomes.

It all starts with an email

In this blog, we’ll follow a malicious email as it passes through the Darktrace / EMAIL system, showing exactly what happens as it travels through each layer of the pyramid, from basic data extraction to AI-powered metric creation, and finally deciding on any autonomous actions.

Let’s take this example email. As an end-user, you can see that this is an obvious extortion attempt where an adversary is threatening legal action if money isn’t paid within 24 hours, but how does Darktrace figure that out?

Part 1: Data Gathering

Processing of an email begins on point-of-transit for all inbound, outbound, or lateral emails. The first step is to extract information directly. This includes taking information from the headers (such as sending and receiving addresses, sender IP address, routing, and authentication protocols), as well as extraction of raw HTML and CSS data from the email itself.

This directly extracted information only allows for immediate surface level analysis, such as identifying signature-based attacks (known malicious addresses / domains), but is insufficient for identifying novel threats, complex attacks, or potential email or vendor compromise. This is where Darktrace’s AI analysis shines.

In this example, the SPF, DKIM, and DMARC authentication all passed successfully, showing that even malicious emails can still bypass these signature-based checks. Even with this success, Darktrace will continue to analyse the email.

Diving deeper into the technical information, we can see further information extracted from the headers, including aggregations from the header information, historical calculations such as the frequency and volume of emails to and from a particular domain, and much more.

Part 2: Social Graphing

Social Graphing involves the analysis of sending and receiving behaviours of different mailboxes to create peer-groups. Mailboxes who often send and receive to and from the same mailboxes, or exhibit other correlated behaviours, will be clustered together using a collection of unsupervised AI clustering systems. These groups may represent uses in the same teams who perform similar activity, groups of external facing mailboxes which often receive unsolicited emails, or groups of VIP users (such as C-suite or executives).

Social graphing is an essential component of Darktrace’s pattern of life analysis. This clustering allows Darktrace to understand the responsibilities of individuals – for example, behaviours which are anomalous for one group of users may be completely expected of another group.

In our example, the email was sent to 3 different users within the organization. As part of the social graphing, an “Association Anomaly” is calculated which indicates the likelihood that these users would receive emails from this user or domain, based on historical patterns.

Part 3: Metric Calculation

Metrics are calculated for every email, representing more complex characteristics of an email which can’t be directly extracted. Darktrace / EMAIL features over 1000 unique metrics, calculated both algorithmically and using an ensemble of AI systems.

Algorithmically calculated (non-AI) metrics include further historical calculations, and counts of features such as code blocks, and hidden text, to name a few.

AI-driven metrics include Inducement Classification which uses Natural Language Processing to identify potential phishing, solicitation, or extortion attempts; Named Entity Recognition to identify PII and other sensitive data within an email to support Data Loss Prevention; and many more.

We can follow our example email through this process and view the outcome of these metric calculations. Looking at the language metrics for this email, we can see that our email has reported a high extortion inducement, along with identification of banking information and language indicating urgency.

Part 4: Evaluation and Combination Engine (models)

Once all metrics have been calculated for an email, it gets sent to an evaluation and combination engine where the metrics are compared against blocks of logic to determine if an email contains a threat. One key model which alerted for this example message was a model to tag and block extortion attempts.

Since our example email has a high inducement score for extortion, along the presence of a bitcoin wallet address in the message, this model alerts. When a model in the engine is activated, actions are taken – in this case adding a tag to the email to flag it as extortion in the console and hold the email to prevent it from reaching the end-user mailbox.

Part 5: Meta-Modelling and Actions

Once the models have been run, the actions are taken against the email. If the email hasn’t been blocked or held, this is the point where it will reach the end-user's mailbox.

In the Darktrace / EMAIL UI, all actions models which alerted for an email and actions taken as a result can be seen. At the top of this page, you can see the alert indicating an extortion attempt along with the action to hold the message.

Alongside this, a meta-classifier is used to calculate an overall anomaly score for each email, based on how much the email differs from the pattern of life for the user. The score of the email is boosted by any actions that have taken place.

Part 6: Campaign Clustering

All emails are passed through the Darktrace / EMAIL campaign clustering system. This system creates clusters based on related features within the emails to identify groups of emails with the same sender or intent.

In our case, the email was identified as part of a campaign, alongside other emails which were also identified as extortion attempts against a small group of recipients.

Email campaigns may have additional actions applied to them if the campaign is deemed malicious, and in this case, you can see that the autonomous response was to hold all emails in the campaign. This means that if an email manages to avoid being blocked in the evaluation and combination engine but gets identified as part of the campaign, the hold action will be applied to it retroactively.

Part 7: Cyber AI Analyst

Darktrace’s Cyber AI Analyst presents key information and anomaly indicators for each email, such as further information about authentication, specific metrics, or other identified anomalies and mismatches.

Cyber AI Analyst can also utilize data from Darktrace / EMAIL to enhance its investigation of incidents from other Darktrace products, correlating relevant information to build a fuller picture. More information about the Cyber AI Analyst is available in the Darktrace AI Arsenal.

Part 8: Data Presentation (UI)

Once all processing has taken place against the email, it is presented in the Darktrace / EMAIL UI. Here, members of the SOC team can investigate incidents and anomalies, interact with malicious emails to see why they were blocked, and much more.

Our email stands out here with its 100 anomaly score. Every email which passes through a Darktrace / EMAIL will undergo the same thorough and rigorous analysis to identify potential risks, apply autonomous actions where required, and will ultimately be assigned a score to be displayed here. By providing a single overall score in the UI, rather than presenting emails in full, Darktrace / EMAIL allows SOC teams to more easily identify which emails are most important to investigate, increasing efficiency and reducing alert fatigue.

Take the next step

Many email security tools on the market that claim to be AI-driven are in fact bolting AI onto attack-centric approaches, which rely on automating the identification of known threats. These approaches struggle, and will continue to struggle, with adapting to novel, AI-generated threats.

By analyzing every email within its deeply integrated, multi-layered AI system, Darktrace / EMAIL is able to identify the subtle threats that others miss. This depth not only improves detection accuracy, but enables confident, autonomous action, giving security teams clearer insight into AI outcomes and greater control while supporting users.

‍

For a full deep dive into each stage of the AI system, check out the white paper: A Guide to the Multi-Layered AI in Darktrace / EMAIL

Learn more about securing AI in your enterprise.

[related-resource]

About the author

Jamie Bali

Technical Author (AI) Developer

Blog

Network

May 26, 2026

Darktrace named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) For the Second Consecutive Year

Continued recognition in NDR

Darktrace has been recognized as a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR), marking the second consecutive year in the Leaders quadrant.

We believe this consistency reflects sustained ability to execute, adapt, and deliver outcomes as the market evolves.

While we are immensely proud to be recognized by industry analysts as a Leader in NDR, that's just part of the story. Darktrace was also Named the Only 2025 Gartner® Peer Insights™ Customers’ Choice for Network Detection and Response based on direct customer feedback and real-world experience.

We believe the combination of these two signals is important. One reflects how the market is evaluated. The other reflects how technology performs in practice.

Why Darktrace continues to be recognized as a leader

We believe our position as a Leader for the second consecutive year reflects a combination of our sustained ability to execute in NDR, continued AI innovation, and proven delivery of security outcomes for customers and partners worldwide.

We also feel that our leadership in the NDR market is a testament to our unique and multi-layered AI approach, for which we were recognized as No.7 on Fast Company’s Most Innovative AI Companies of 2026 list, plus one of the hottest AI cybersecurity companies in CRN's AI 100.

Adapting to complex, real-world environments

Organizations are no longer protecting a single network perimeter. They are securing a mix of users, devices, applications, and data that move across hybrid environments.

Darktrace has focused on maintaining visibility and detection across these conditions, allowing security teams to understand activity as it scales.

Supporting organizations globally, not just technically

Security outcomes are shaped as much by deployment and support as they are by detection capability.

Darktrace continues to invest in regional presence across 29 countries around the world, helping organizations operationalize NDR in ways that align with local requirements, internal processes, and team structures.

Continuing to push AI beyond detection

AI in cybersecurity is often positioned as a way to improve detection accuracy. But the more important shift is how AI can influence decision-making and response.

Darktrace continues to develop models that learn from both live environments and historical incident data, combining real-time behavioral analysis with insights derived from prior attack patterns.

Using technologies such as the Incident Graph and DIGEST (Darktrace Incident Graph Evaluation for Security Threats), activity is not analyzed in isolation. Instead, relationships between users, devices, connections, and events are mapped over time, allowing the system to reconstruct how an incident is unfolding and how similar incidents have progressed in the past.

By evaluating these patterns, Darktrace can assess the likelihood that an incident will escalate, prioritizing the activity that poses the greatest risk and surfacing the most relevant context for investigation.

This shifts security operations from simply identifying anomalies to understanding their trajectory, helping teams anticipate potential impact and respond earlier with greater precision.

Why NDR is shifting from reactive detection to proactive, AI-driven security

Traditional approaches to NDR have been built around reactively identifying threats once they become clearly visible. That model is increasingly difficult to rely on.

Attackers are no longer operating in ways that stand out. They use valid credentials, trusted tools, and low-and-slow techniques that blend into everyday activity. By the time something looks obviously malicious, the impact is often already underway.

This is the core limitation of reactive detection. It depends on recognizing something that already looks like a threat.

As a result, many of the most consequential incidents today fall into a gap.

Insider activity, compromised credentials, and novel attacks rarely trigger traditional alerts because they do not follow known patterns. On the surface, they often appear legitimate, making them difficult to distinguish from normal behavior without deeper context.

This is why we believe this Gartner recognition reflects a broader shift in NDR toward autonomous, proactive and pre‑emptive security operations.

By understanding normal behavior within an environment, it is possible to identify subtle deviations rather than waiting for confirmation of threats as they are taking place.

Darktrace’s Self-Learning AI is designed for behavioral understanding. By continuously learning each organization’s normal patterns, it can detect deviations in real time, enabling a proactive and pre-emptive model of NDR where security teams can respond to early signs of risk as they emerge, reducing the window in which attacks can develop.

In multiple cases, this behavioral approach has led to early threat detection where Darktrace identified completely unknown threats, including pre-CVE zero-day activity. By detecting subtle behavioral changes before vulnerabilities were publicly disclosed or widely understood, organizations can mitigate threats before they do damage.

This shift is subtle but important. Modern NDR solutions must shift from a system that explains what happened to one that helps prevent threats from developing in the first place, and Darktrace is proud to be at the forefront of this shift - helping organizations build and maintain a state of proactive network resilience.

Continuing to innovate at the forefront of NDR

In our view, recognition as a Leader reflects where the market is today. Continuing to innovate defines what comes next.

As businesses evolve, new technologies like AI tools and agents introduce new security risks and challenges; security teams need more than simple detection. They need a complete understanding of risk as it develops, the ability to investigate it in context, and to contain threats at machine speed.

Darktrace / NETWORK is built to deliver across that full spectrum. Its Self-Learning AI continuously adapts to each organization’s environment, identifying subtle behavioral changes that signal emerging threats. Integrated investigation and autonomous response reduce the time between detection and action, allowing teams to move with greater speed and confidence.

This combination enables organizations to detect and contain known, unknown, and insider threats as they develop, while also strengthening resilience over time.

As a two-time Leader in the Gartner® Magic Quadrant™ for NDR and the only 2025 Gartner® Peer Insights™ Customers’ Choice, we feel Darktrace continues to evolve its platform to meet the demands of modern environments, delivering a more complete and adaptive approach to network security.

‍

[related-resource]

^{Disclaimer: The 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) ,The 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR), Thomas Lintemuth, Charanpal Bhogal, Nahim Fazal, 18 May 2026.}

^{Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.}

^{GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.}

About the author

Mikey Anderson

Product Marketing Manager, Network Detection & Response

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: How Triada Affects Banking and Communication Apps

How Triada Affects Banking and Communication Apps

The rise of android malware

Triada: Background and tactics

How does Triada work?

How does Triada avoid detection?

Triada attack overview

Conclusion

Appendices

Darktrace Model Detections

List of Indicators of Compromise (IoCs)

MITRE ATT&CK Mapping

References

Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

Journey of a Threat: How Multi-Layered AI Works in Darktrace / EMAIL

Enjoying the blog?

More in this series

Darktrace named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) For the Second Consecutive Year

When Open Source Is Weaponized: Analysis of a Trojanized 7 Zip Installer

Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

Blog

Email

May 26, 2026

Journey of a Threat: How Multi-Layered AI Works in Darktrace / EMAIL

It all starts with an email

Part 1: Data Gathering

Part 2: Social Graphing

Part 3: Metric Calculation

Part 4: Evaluation and Combination Engine (models)

Part 5: Meta-Modelling and Actions

Part 6: Campaign Clustering

Part 7: Cyber AI Analyst

Part 8: Data Presentation (UI)

Take the next step

Blog

Network

May 26, 2026

Darktrace named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) For the Second Consecutive Year

Continued recognition in NDR

Why Darktrace continues to be recognized as a leader

Adapting to complex, real-world environments

Supporting organizations globally, not just technically

Continuing to push AI beyond detection

Why NDR is shifting from reactive detection to proactive, AI-driven security

Continuing to innovate at the forefront of NDR