Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Matthew Wainwright
CISO, Middletown Rhode Island
Share
United States Municipalities & Cyber Risk
Carried out in the shadows with ones and zeros, there’s a new age of attack against public authorities and critical public services up and down the United States. Municipalities are regularly infiltrated by criminals and hostile nation states – in many cases, they are held to ransom and blackmailed until they pay a hefty cost. And, the perpetrators will likely never be brought to justice.
Earlier this month, news broke that hackers had tampered with a water treatment facility in Florida. In doing so, the cyber-criminals were able to remotely control a computer to change the chemical levels of the water supply, increasing the amount of sodium hydroxide before a supervisor was able to catch the act in real time and revert the changes.
The attack on the City of Oldsmar is not the first of its kind. Last year, Israel’s water management facilities, specifically its agricultural water pumps, were hit by two cyber-attacks: one in Upper Galilee and one in the central province of Mateh Yehuda. The attacks were played down, but reports claimed that hackers did attempt to alter water chlorine levels before being detected and stopped.
Cyber-attacks exist in the digital space, but today they can have a real and tangible effect on the physical world. I worry that we face a ticking time bomb.
Defending Critical Infrastructure from Cyber Attacks
This isn’t because defenders of critical national infrastructure aren’t good at their jobs – it’s because the challenge we face is incredibly vast and complex; it is no longer a problem that humans can deal with alone.
It’s a rule of thumb in cyber security that the more sensitive your system, the less you want it to touch the Internet. However, ‘air-gapping’ – a security measure used to ensure a secure network is physically isolated from unsecured networks – is now widely accepted to be neither fool proof against today’s constantly-mutating hacker, nor a practical option.
Rapid digital transformation of critical national infrastructure in recent years means that there is now a path for attackers to run from spoof emails in an employee’s inbox right through to critical gas compressors and turbines. Importantly, this path doesn’t even need to be direct for the attack to succeed – in February last year a US Gas Pipeline was shut down for two days because of a ransomware attack that only managed to spread as far as the control panels used by operators to monitor the process. But by taking these systems offline, the attackers forced the operators to deliberately shut down the process to preserve safety.
In the case of the Florida attack, an obvious move gave the game away and, thankfully, none of the 15,000 residents were harmed. But incidents like this keep defenders of critical national infrastructure awake at night – I know, because they used to be my biggest concern too.
Critical Infrastructure Threat Trends
Over the last 12 months, we have seen a sharp rise in sophisticated, stealthy attackers that slip under the radar unnoticed. What will happen the next time an attacker breaks into critical systems, but there is no obvious move that gives them away, to warn security teams of foul play before it's too late?
We can’t put the brakes on digital transformation across heavy industry – nor would we want to since economies flounder if they are not constantly accelerating. But it’s time for a fundamental shift in how we think about the cyber challenge. No city or local government is immune to similar attacks and this is not a one-off.
The future of OT security for critical national infrastructure
The next generation of attacks we face requires next generation security solutions, which have the intelligence to act swiftly on behalf of humans. Over the last decade, I have learned that simply trying to stop attackers from getting in is futile – that only just about works for low-level attacks. Building taller walls is no longer enough against sophisticated attacks like those deployed against critical national infrastructure. Today, artificial intelligence is so advanced that it is capable of spotting the early warning signs of sophisticated attacks as they emerge and stopping them before they escalate – crucially, identifying the subtle indicators that are often imperceivable to the human eye.
Critical environments cannot afford to fail. An operational outage of even a few seconds when public safety is at stake is not tolerable. There isn’t the option of reverting to pen and paper and muddling along. We need to build in cyber resilience so these systems are able to resist and fight back against cyber-attacks.
Now that industrial environments cannot simply be air-gapped to keep them safe, we need to invest in artificial intelligence systems that can work in the background to automatically and dynamically block attacks that bleed from IT and defend critical systems 24/7.
Attackers, both criminal and state-sponsored, will continue to see critical national infrastructure as an attractive target – but today we have advanced technology available to us that can stop their attempts in their tracks. All we have to do is embrace it.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Darktrace Advances Incident Investigation and AI-Agent Security with OpenAI Daybreak Models
Earlier this year, Darktrace joined OpenAI’s Daybreak Defense Network to explore how their cyber capabilities can be integrated within Darktrace products and services to transform how security teams move from signal to action.
At the heart of this work is Darktrace's behavioral understanding of customer environments and identification of complex security incidents, combined with OpenAI models that can add context to help explain why an incident matters and its potential impact on the business. By bringing these capabilities into defensive workflows security teams already use, the goal is to give defenders not just greater visibility, but the context and guidance they need to act with confidence.
Since joining the program, we've been working with OpenAI to explore how these capabilities can address specific security challenges for defenders.
The problem we're solving
Attackers continue to change how they operate, including by using AI to increase the speed and scale of some techniques. Security teams are already managing a large volume of alerts, and the question isn't just what's happening, but how it could affect the organization. Even when an incident is fully investigated and correlated, technical severity alone doesn't tell a security team how much it actually matters to the business. That same challenge extends to internal AI adoption. As organizations adopt more AI systems and agents, security teams need visibility into their behavior, access and activity, along with the broader business context needed to identify and investigate potential risk.
Darktrace's Adaptive AI™ builds a detailed, organization-specific picture of what's normal for each environment, and uses that picture to investigate threats and identify complex security activity across domains. OpenAI's models can build on Darktrace's correlated, technically prioritized incidents by adding context that can help defenders understand what may be at stake.
What we're building
Our work is focused on two areas: supporting security investigation and response, and helping defenders identify risky behavior across enterprise AI systems and agents.
The first aligns Darktrace's behavioral understanding with OpenAI models to support security investigation and prioritization. Darktrace's Adaptive AI continuously learns the unique patterns of normal behavior within each customer it protects, creating a deep, organization-specific understanding of its digital estate. When unusual activity emerges, OpenAI's models can draw on that context to help analysts investigate the incident, understand its significance and assess potential business consequences — reducing the need to manually assemble context from fragmented signals.
Second, we are exploring how these capabilities can support AI-agent and runtime security through Darktrace / SECURE AI™. OpenAI’s Daybreak models can build on the detections and visibility Darktrace / SECURE AI provides, connecting signals across a customer's environment and help defenders identify potentially risky behavior involving AI systems and agents. Activity that might appear isolated can instead be connected with related signals, helping defenders investigate the broader context and determine appropriate remediation.
Darktrace brings deep cybersecurity expertise, an evolving understanding of each customer's environment, and AI-driven identification of threats across the digital estate. Through the Daybreak Defense Network, Darktrace is exploring how OpenAI models can augment those capabilities in defensive security workflows — supporting incident investigation and response and improving visibility into AI-agent and runtime risk.
These capabilities are still in development, and we're excited to continue building on this work.
To learn more about how Darktrace continues to innovate to meet today's most pressing security challenges, register for our upcoming launch broadcast here.
Botnet Behind the Camera: Mirai Katana Activity on a Video Recording Device
Key takeaways
Darktrace identified a camera device infected with the Mirai/Katana botnet in a sports-sector customer environment, showing how exposed IoT devices can become active participants in wider attack chains.
The compromise involved suspicious Wget behavior, file downloads from rare external IPs, unusual incoming HTTP connections to video recorder management interfaces, and large outbound data transfers to infrastructure associated with botnet activity.
The incident highlights the importance of extending visibility and response beyond traditional endpoints, as unmanaged or overlooked connected devices can be exploited for command-and-control, malware delivery, and data exfiltration.
Mirai and the Katana variant
Mirai is a botnet that first emerged in August 2016 and is well known for launching large-scale distributed-denial-of-service (DDoS) attacks, typically targeting exposed Internet of Things (IoT) devices. It identifies vulnerable IoT devices ,often by abusing default credentials or exposed services, and recruiting them into a remotely controlled botnet that can be used in DDoS campaigns [1].
Katana, one of the many variants that arose after Mirai’s source code was released publicly, was first observed in late 2020 and has been seen using more advanced capabilities, including custom command-and-control (C2), persistence mechanisms, and DDoS functionality [2].
In March 2026, research from the Nokia Deepfield Emergency Response Team (ERT) identified Katana as a Mirai-derived DDoS botnet targeting Android-based TV set-top boxes through exposed Android Debug Bridge (ADB) access. Observed capabilities included custom C2, runtime domain rotation, multiple DDoS methods, and an on-device compiled kernel rootkit used for persistence and stealth [3].
Darktrace’s detection of Mirai Botnet activity on a camera device
In early 2026, Darktrace identified a Network/Digital Video Recorder (NVR/DVR) on the network of a sports-sector customer that had been infected with the Mirai Katana botnet and subsequently used to exfiltrate data from the customer’s environment. Seemingly related follow-up activity was observed on the same device several months later.
In both instances, the Darktrace Security Operations Centre (SOC) alerted the customer as part of the Managed Threat Detection (MTD) service. However, as Darktrace’s Autonomous Response capability was not fully enabled on the affected device, Darktrace was unable to proactively block the suspicious activity or prevent the compromise from continuing and recurring.
The initial compromise appears to have occurred when the affected device was seen using Wget to download Linux-based Executable and Linkable Format (ELF) files from a rare external IP, 195.177.94[.]105, which had not previously been observed in the customer’s network. Further analysis downloaded file hashes identified files related to the Mirai botnet.
Figure 1: Darktrace’s Real-Time AI Analyst investigation into the unusual outbound connection where the ELF files were downloaded.
Within a few hours, Darktrace detected the device uploading close to 3GB of data to another external IP, 50.7.49[.]4:3017 (ASN AS30058 FDCSERVERS), suggesting that the activity was likely routed via a virtual private server (VPS) hosted by FDC Servers [2]. Attackers often abuse VPS infrastructure from legitimate cloud providers to blend in with legitimate traffic and evade IP reputation and geolocation-based detections.
Figure 2: Darktrace’s detection of the unusual data upload activity by the affected camera device.
Darktrace continued to observe similar data transfers to multiple rare endpoints including 171.225.223[.]53, 95.161.128[.]62, 61.7.209[.]88, 95.161.128[.]62, which have been linked to Mirai by open-source intelligence (OSINT).
Figure 3: Darktrace’s detection of spikes in unusual external data transfer activity from the camera device.
Exploitation continued
Several months later, Darktrace identified the same exfiltration pattern on the device again, this time with stronger indications of associations with Mirai Katana botnet infection.
The device received incoming HTTP connections from 129.121.114[.]124, an external IP known to be associated with the Katana botnet IP [3]. The connections targeted the ‘/dvr/cmd’ path using the root username and user agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246.
The ‘/dvr/cmd’ path appears to be associated with the affected device’s web management functionality. This API endpoint has historically been targeted by Mirai and other IoT botnets through the exploitation of critical command injection vulnerabilities and automated botnet exploitation [4].
Figure 4: Darktrace’s detection of HTTP connectivity from the external IP associated with Mirai Katana Botnet.
A few days later, Darktrace observed the Wget utility being used to download ELF files, including “/lil”, from the IP 129.121.114[.]124. OSINT reporting has since associated this IP address with the Mirai Katana botnet. Notably, the IP observed earlier in the year, 195.177.94[.]105, had also hosted a file named “lil”, indicating a link between the observed activity.
Over the following days, the device received a sudden spike in connections from multiple rare external endpoints, suggesting a possible successful brute force attack. Darktrace also observed the device exfiltrating just under 4GB of data to another Mirai-associated IP address, 66.92.198[.]194, over ports 3344, 954922, and 80. Finally, the device was seen uploading data to the Mirai botnet IP 5.175.249[.]53 over port138 and exhibited an increase in UDP connections to 34.18.28[.]10 over port 9068.
Following both file download events, Darktrace identified spikes in external data transfers and connection attempts to rare destinations. While Darktrace’s Threat Research team could not confirm with high confidence that this to activity was directly associated with Mirai, it may indicate that Mirai Katana includes data exfiltration functionality.
Darktrace’s threat researchers also identified an internet-facing NTP server belonging to a separate customer receiving incoming connection attempts from the same initially observed IP, 195.177.94[.]105,over the port 123. This suggests that Mirai Katana may not exclusively target IoT devices.
Conclusion
This case demonstrates how threat actors can exploit overlooked IoT and OT devices to support broader malicious objectives. Here, a camera device infected with a botnet was used to exfiltrate data from the customer's environment, showing how peripheral assets can become active participants in an attack chain.
This case also reinforces a challenge many organizations face today: extending security visibility beyond traditional endpoints and servers. Cameras, sensors, and other connected devices often operate with limited monitoring and may fall outside established security processes, despite maintaining network connectivity and access to potentially sensitive environments. This is particularly relevant in the sports sector, where growing reliance on connected cameras, smart stadium technologies, and other IoT devices continues to expand the attack surface, as highlighted in Darktrace's Sports Sector Threat Report.
As botnets like Kata and Mirai continue to evolve, defenders need visibility across unmanaged IoT and edge devices, as well as security solutions that can recognize subtle deviations in device behavior that may indicate an emerging compromise.
Credit to Parvatha Ananthakannan (Cyber Analyst), Signe Zaharka (Principal Analyst)
Edited by Ryan Traill (Content Manager)
Appendices
Darktrace Model Detections
· Anomalous File / EXE from Rare External Location
· Anomalous File / Multiple EXE from Rare External Locations
· Device / Initial Attack Chain Activity
· Unusual Activity / Unusual External Data to New Endpoint
· Anomalous Connection / Data Sent to Rare Domain
· Unusual Activity / Enhanced Unusual External Data Transfer
· Anomalous Connection / Uncommon 1 GiB Outbound
· Device / Significant UDP Increase
· Anomalous Connection / Low and Slow Exfiltration to IP
· Compromise / Large Number of Suspicious Failed Connections
· Compromise / Large Number of Suspicious Successful Connections
