Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Dan Fein
VP, Product
Share
12
Aug 2020
In March 2020, we documented the rise of Fearware: a type of email attack that involves exploiting a collective sense of fear and urgency in order to coax recipients into clicking on a malicious attachment or link. In the following weeks we saw over 130,000 new email domains registered to perform COVID-19 phishing. Five months on, this activity has unfortunately become the norm for cyber-criminals, who continue to take advantage of the pandemic in their attacks.
In recent weeks, Darktrace’s AI has identified cyber adversaries pivoting from claiming to offer urgent health-related advice or localized infection data, to impersonating relief funds in a particularly malevolent attempt to damage already struggling small businesses.
Figure 1: An interactive snapshot of Antigena Email’s user interface
A small business that had deployed Antigena Email was recently hit with a series of 10 spoofing emails claiming to be from the US Small Business Administration (SBA) about COVID-19 relief funds.
Note how the sender domain actually appears as sba.gov, just as it would in the recipient’s email client. This is possibly due to well-known and inherent weaknesses in Simple Mail Transfer Protocol (SMTP). In reality, the email originated from a mail server in Japan, and the link directs users to a compromised Brazilian domain which is unrelated to the SBA.
Figure 2: The fake login page
The above screenshot displays the fake login page that users are directed to after clicking the link. The page uses the logo of SBA and is formatted in the same style as legitimate pages from the genuine SBA website, such as the ‘forgotten password’ page below.
Figure 3: A screenshot from the legitimate SBA website
This Darktrace customer was a small business and may have been seeking funds. If this was the case, it could have easily fallen victim to this malicious attack targeting already vulnerable organizations. This attack shows how cyber-criminals continue to be creative and timely with their social engineering methods – and will stop at nothing in pursuit of their goals.
Antigena Email sits behind gateway tools, and so like every other threat that it detects and neutralizes, this email went undetected by the email provider’s built-in security tools or other gateway tools in place. Darktrace’s AI detected the rare link based on its understanding of normal communication patterns for the business, and recognized this as a spoofing attempt, preventing the message from ever reaching the inbox and protecting this vulnerable business from damage.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
AIは今や攻撃サイクルの複数のポイントに存在しています。Daybreakは脆弱性の発見と修正にモデルを適用しています。Darktrace Signal Labsは信頼される企業内AIエージェントがどのように悪用されうるかを、管理された環境内で実証しました。JPCERT/CCは最近のインシデントにおけるAI支援による脆弱性探索およびAPI攻撃を確認しました。Microsoft社は実際の攻撃でStorm-0940がARTEXを使用していることを報告しました [4][7][8][9]。
[3] Cyber Security Agency of Singapore, https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/
[4] OpenAI, Daybreak: Tools for securing every organization in the world, 22 June 2026. https://openai.com/index/daybreak-securing-the-world/
[5] OpenAI Developers, Scaling cyber defenders with Daybreak, 21 August 2026. https://developers.openai.com/blog/scaling-cyber-defenders-with-daybreak
[6] OpenAI, Cloudflare links vulnerability discovery to defense with OpenAI, 21 October 2026. https://openai.com/index/cloudflare-cyber/
[7] Darktrace Signal Labs, Shared Memories as a Covert C2 Channel, draft research supplied for review.
[8] JPCERT/CC, Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques, 21 October 2026. https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html
[9] Microsoft Security Research and Microsoft Threat Intelligence, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, 21 October 2026. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
[10] Darktrace, Advancing the Use of Frontier AI in Cybersecurity: Darktrace Joins the OpenAI Daybreak Cyber Partner Program to Explore Defensive AI Integrations, 22 June 2026. https://www.darktrace.com/blog/advancing-the-use-of-frontier-ai-in-cybersecurity-darktrace-joins-the-openai-daybreak-cyber-partner-program-to-explore-defensive-ai-integrations
