December 15, 2023

How Darktrace Halted A DarkGate in MS Teams

Discover how Darktrace thwarted DarkGate malware in Microsoft Teams. Stay informed on the latest cybersecurity measures and protect your business.

Written by

Natalia Sánchez Rocafort

Cyber Security Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Natalia Sánchez Rocafort

Cyber Security Analyst

Dec 2023

Securing Microsoft Teams and SharePoint

Given the prevalence of the Microsoft Teams and Microsoft SharePoint platforms in the workplace in recent years, it is essential that organizations stay vigilant to the threat posed by applications vital to hybrid and remote work and prioritize the security and cyber hygiene of these services. For just as the use of these platforms has increased exponentially with the rise of remote and hybrid working, so too has the malicious use of them to deliver malware to unassuming users.

Researchers across the threat landscape have begun to observe these legitimate services being leveraged by malicious actors as an initial access method. Microsoft Teams can easily be exploited to send targeted phishing messages to individuals within an organization, while appearing legitimate and safe. Although the exact contents of these messages may vary, the messages frequently use social engineering techniques to lure users to click on a SharePoint link embedded into the message. Interacting with the malicious link will then download a payload [1].

Darktrace observed one such malicious attempt to use Microsoft Teams and SharePoint in September 2023, when a device was observed downloading DarkGate, a commercial trojan that is known to deploy other strains of malware, also referred to as a commodity loader [2], after clicking on SharePoint link. Fortunately for the customer, Darktrace’s suite of products was perfectly poised to identify the initial signs of suspicious activity and Darktrace RESPOND™ was able to immediately halt the advancement of the attack.

DarkGate Attack Overview

On September 8, 2023, Darktrace DETECT™ observed around 30 internal devices on a customer network making unusual SSL connections to an external SharePoint site which contained the name of a person, 'XXXXXXXX-my.sharepoint[.]com' (107.136[.]8, 13.107.138[.]8). The organization did not have any employees who went by this name and prior to this activity, no internal devices had been seen contacting the endpoint.

At first glance, this initial attack vector would have appeared subtle and seemingly trustworthy to users. Malicious actors likely sent various users a phishing message via Microsoft Teams that contained the spoofed SharePoint link to the personalized SharePoint link ''XXXXXXXX-my.sharepoint[.]com'.

Figure 1: Advanced Search query showing a sudden spike in connections to ''XXXXXXXX -my.sharepoint[.]com'.

Darktrace observed around 10 devices downloading approximately 1 MB of data during their connections to the Sharepoint endpoint. Darktrace DETECT observed some of the devices making subsequent HTTP GET requests to a range of anomalous URIs. The devices utilized multiple user-agents for these connections, including ‘curl’, a command line tool that allows individuals to request and transfer data from a specific URL. The connections were made to the IP 5.188.87[.]58, an endpoint that has been flagged as an indicator of compromise (IoC) for DarkGate malware by multiple open-source intelligence (OSINT) sources [3], commonly associated with HTTP GET requests:

GET request over port 2351 with the User-Agent header 'Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)' and the target URI '/bfyxraav' to 5.188.87[.]58
GET request over port 2351 with the user-agent header 'curl' and the target URI '/' to 5.188.87[.]58
GET request over port 2351 with the user-agent header 'curl/8.0.1' and the target URI '/msibfyxraav' to 5.188.87[.]58

The HTTP GET requests made with the user-agent header 'curl' and the target URI '/' to 5.188.87[.]58 were responded to with a filename called 'Autoit3.exe'. The other requests received script files with names ending in '.au3, such as 'xkwtvq.au3', 'otxynh.au3', and 'dcthbq.au3'. DarkGate malware has been known to make use of legitimate AutoIt files, and typically runs multiple AutoIt scripts (‘.au3’) [4].

Following these unusual file downloads, the devices proceeded to make hundreds of HTTP POST requests to the target URI '/' using the user-agent header 'Mozilla/4.0 (compatible; Synapse)' to 5.188.87[.]58. The contents of these requests, along with the contents of the responses, appear to be heavily obfuscated.

Figure 2: Example of obfuscated response, as shown in a packet capture downloaded from Darktrace.

While Microsoft’s Safe Attachments and Safe Links settings were unable to detect this camouflaged malicious activity, Darktrace DETECT observed the unusual over-the-network connectivity that occurred. While Darktrace DETECT identified multiple internal devices engaging in this anomalous behavior throughout the course of the compromise, the activity observed on one device in particular best showcases the overall kill chain of this attack.

The device in question was observed using two different user agents (curl/8.0.1 and Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)) when connecting to the endpoint 5.188.87[.]58 and target URI ‘/bfyxraav’. Additionally, Darktrace DETECT recognized that it was unusual for this device to be making these HTTP connections via destination port 2351.

As a result, Darktrace’s Cyber AI Analyst™ launched an autonomous investigation into the suspicious activity and was able to connect the unusual external connections together, viewing them as one beaconing incident as opposed to isolated series of connections.

Figure 3: Cyber AI Analyst investigation summarizing the unusual repeated connections made to 5.188.87[.]58 via destination port 2351.

Darktrace then observed the device downloading the ‘Autoit3.exe’ file. Darktrace RESPOND took swift mitigative action by blocking similar connections to this endpoint, preventing the device from downloading any additional suspicious files.

Figure 4: Suspicious ‘Autoit3.exe’ downloaded by the source device from the malicious external endpoint.

Just one millisecond later, Darktrace observed the device making suspicious HTTP GET requests to URIs including ‘/msibfyxraav’. Darktrace recognized that the device had carried out several suspicious actions within a relatively short period of time, breaching multiple DETECT models, indicating that it may have been compromised. As a result, RESPOND took action against the offending device by preventing it from communicating externally [blocking all outbound connections] for a period of one hour, allowing the customer’s security team precious time to address the issue.

It should be noted that, at this point, had the customer subscribed to Darktrace’s Proactive Threat Notification (PTN) service, the Darktrace Security Operations Center (SOC) would have investigated these incidents in greater detail, and likely would have sent a notification directly to the customer to inform them of the suspicious activity.

Additionally, AI Analyst collated various distinct events and suggested that these stages were linked as part of an attack. This type of augmented understanding of events calculated at machine speed is extremely valuable since it likely would have taken a human analyst hours to link all the facets of the incident together.

Figure 5: AI Analyst investigation showcasing the use of the ‘curl’ user agent to connect to the target URI ‘/msibfyxraav’.

Figure 6: Darktrace RESPOND moved to mitigate any following connections by blocking all outgoing traffic for 1 hour.

Following this, an automated investigation was launched by Microsoft Defender for Endpoint. Darktrace is designed to coordinate with multiple third-party security tools, allowing for information on ongoing incidents to be seamlessly exchanged between Darktrace and other security tools. In this instance, Microsoft Defender identified a ‘low severity’ incident on the device, this automatically triggered a corresponding alert within DETECT, presented on the Darktrace Threat Visuallizer.

The described activity occurred within milliseconds. At each step of the attack, Darktrace RESPOND took action either by enforcing expected patterns of life [normality] on the affected device, blocking connections to suspicious endpoints for a specified amount of time, and/or blocking all outgoing traffic from the device. All the relevant activity was detected and promptly stopped for this device, and other compromised devices, thus containing the compromise and providing the security team invaluable remediation time.

Figure 7: Overview of the compromise activity, all of which took place within a matter of miliseconds.

Darktrace identified similar activity on other devices in this customer’s network, as well as across Darktrace’s fleet around the same time in early September.

On a different customer environment, Darktrace DETECT observed more than 25 ‘.au3’ files being downloaded; this activity can be seen in Figure 9.

Figure 8: High volume of file downloads following GET request and 'curl' commands.

Figure 9 provides more details of this activity, including the source and destination IP addresses (5.188.87[.]58), the destination port, the HTTP method used and the MIME/content-type of the file

Figure 9: Additional information of the anomalous connections.

A compromised server in another customer deployment was seen establishing unusual connections to the external IP address 80.66.88[.]145 – an endpoint that has been associated with DarkGate by OSINT sources [5]. This activity was identified by Darktrace/DETECT as a new connection for the device via an unusual destination port, 2840. As the device in question was a critical server, Darktrace DETECT treated it with suspicion and generated an ‘Anomalous External Activity from Critical Network Device’ model breach.

Figure 10: Model breach and model breach event log for suspicious connections to additional endpoint.

Conclusion

While Microsoft Teams and SharePoint are extremely prominent tools that are essential to the business operations of many organizations, they can also be used to compromise via living off the land, even at initial intrusion. Any Microsoft Teams user within a corporate setting could be targeted by a malicious actor, as such SharePoint links from unknown senders should always be treated with caution and should not automatically be considered as secure or legitimate, even when operating within legitimate Microsoft infrastructure.

Malicious actors can leverage these commonly used platforms as a means to carry out their cyber-attacks, therefore organizations must take appropriate measures to protect and secure their digital environments. As demonstrated here, threat actors can attempt to deploy malware, like DarkGate, by targeting users with spoofed Microsoft Teams messages. By masking malicious links as legitimate SharePoint links, these attempts can easily convince targets and bypass traditional security tools and even Microsoft’s own Safe Links and Safe Attachments security capabilities.

When the chain of events of an attack escalates within milliseconds, organizations must rely on AI-driven tools that can quickly identify and automatically respond to suspicious events without latency. As such, the value of Darktrace DETECT and Darktrace RESPOND cannot be overstated. Given the efficacy and efficiency of Darktrace’s detection and autonomous response capabilities, a more severe network compromise in the form of the DarkGate commodity loader was ultimately averted.

Credit to Natalia Sánchez Rocafort, Cyber Security Analyst, Zoe Tilsiter.

Appendices

Darktrace DETECT Model Detections

[Model Breach: Device / Initial Breach Chain Compromise 100% –– Breach URI: /#modelbreach/114039 ] (Enhanced Monitoring)· [Model Breach: Device / Initial Breach Chain Compromise 100% –– Breach URI: /#modelbreach/114124 ] (Enhanced Monitoring)
[Model Breach: Device / New User Agent and New IP 62% –– Breach URI: /#modelbreach/114030 ]
[Model Breach: Anomalous Connection / Application Protocol on Uncommon Port 46% –– Breach URI: /#modelbreach/114031 ]
[Model Breach: Anomalous Connection / New User Agent to IP Without Hostname 62% –– Breach URI: /#modelbreach/114032 ]
[Model Breach: Device / New User Agent 32% –– Breach URI: /#modelbreach/114035 ]
[Model Breach: Device / Three Or More New User Agents 31% –– Breach URI: /#modelbreach/114036 ]
[Model Breach: Anomalous Server Activity / Anomalous External Activity from Critical Network Device 62% –– Breach URI: /#modelbreach/612173 ]
[Model Breach: Anomalous File / EXE from Rare External Location 61% –– Breach URI: /#modelbreach/114037 ]
[Model Breach: Anomalous Connection / Multiple Connections to New External TCP Port 61% –– Breach URI: /#modelbreach/114042 ]
[Model Breach: Security Integration / Integration Ransomware Detected 100% –– Breach URI: /#modelbreach/114049 ]
[Model Breach: Compromise / Beaconing Activity To External Rare 62% –– Breach URI: /#modelbreach/114059 ]
[Model Breach: Compromise / HTTP Beaconing to New Endpoint 30% –– Breach URI: /#modelbreach/114067 ]
[Model Breach: Security Integration / C2 Activity and Integration Detection 100% –– Breach URI: /#modelbreach/114069 ]
[Model Breach: Anomalous File / EXE from Rare External Location 55% –– Breach URI: /#modelbreach/114077 ]
[Model Breach: Compromise / High Volume of Connections with Beacon Score 66% –– Breach URI: /#modelbreach/114260 ]
[Model Breach: Security Integration / Low Severity Integration Detection 59% –– Breach URI: /#modelbreach/114293 ]
[Model Breach: Security Integration / Low Severity Integration Detection 33% –– Breach URI: /#modelbreach/114462 ]
[Model Breach: Security Integration / Integration Ransomware Detected 100% –– Breach URI: /#modelbreach/114109 ]· [Model Breach: Device / Three Or More New User Agents 31% –– Breach URI: /#modelbreach/114118 ]· [Model Breach: Anomalous Connection / Application Protocol on Uncommon Port 46% –– Breach URI: /#modelbreach/114113 ] · [Model Breach: Anomalous Connection / New User Agent to IP Without Hostname 62% –– Breach URI: /#modelbreach/114114 ]· [Model Breach: Device / New User Agent 32% –– Breach URI: /#modelbreach/114117 ]· [Model Breach: Anomalous File / EXE from Rare External Location 61% –– Breach URI: /#modelbreach/114122 ]· [Model Breach: Security Integration / Low Severity Integration Detection 54% –– Breach URI: /#modelbreach/114310 ]
[Model Breach: Security Integration / Integration Ransomware Detected 65% –– Breach URI: /#modelbreach/114662 ]Darktrace/Respond Model Breaches
[Model Breach: Antigena / Network::External Threat::Antigena Suspicious File Block 61% –– Breach URI: /#modelbreach/114033 ]
[Model Breach: Antigena / Network::External Threat::Antigena File then New Outbound Block 100% –– Breach URI: /#modelbreach/114038 ]
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Enhanced Monitoring from Client Block 100% –– Breach URI: /#modelbreach/114040 ]
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Significant Anomaly from Client Block 87% –– Breach URI: /#modelbreach/114041 ]
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Controlled and Model Breach 87% –– Breach URI: /#modelbreach/114043 ]
[Model Breach: Antigena / Network::External Threat::Antigena Ransomware Block 100% –– Breach URI: /#modelbreach/114052 ]
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Significant Security Integration and Network Activity Block 87% –– Breach URI: /#modelbreach/114070 ]
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Breaches Over Time Block 87% –– Breach URI: /#modelbreach/114071 ]
[Model Breach: Antigena / Network::External Threat::Antigena Suspicious Activity Block 87% –– Breach URI: /#modelbreach/114072 ]
[Model Breach: Antigena / Network::External Threat::Antigena Suspicious File Block 53% –– Breach URI: /#modelbreach/114079 ]
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Breaches Over Time Block 64% –– Breach URI: /#modelbreach/114539 ]
[Model Breach: Antigena / Network::External Threat::Antigena Ransomware Block 66% –– Breach URI: /#modelbreach/114667 ]
[Model Breach: Antigena / Network::External Threat::Antigena Suspicious Activity Block 79% –– Breach URI: /#modelbreach/114684 ]·
[Model Breach: Antigena / Network::External Threat::Antigena Ransomware Block 100% –– Breach URI: /#modelbreach/114110 ]·
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Significant Anomaly from Client Block 87% –– Breach URI: /#modelbreach/114111 ]·
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Controlled and Model Breach 87% –– Breach URI: /#modelbreach/114115 ]·
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Breaches Over Time Block 87% –– Breach URI: /#modelbreach/114116 ]·
[Model Breach: Antigena / Network::External Threat::Antigena Suspicious File Block 61% –– Breach URI: /#modelbreach/114121 ]·
[Model Breach: Antigena / Network::External Threat::Antigena File then New Outbound Block 100% –– Breach URI: /#modelbreach/114123 ]·
[Model Breach: Antigena / Network::Significant Anomaly::Antigena Enhanced Monitoring from Client Block 100% –– Breach URI: /#modelbreach/114125 ]

List of IoCs

IoC - Type - Description + Confidence

5.188.87[.]58 - IP address - C2 endpoint

80.66.88[.]145 - IP address - C2 endpoint

/bfyxraav - URI - Possible C2 endpoint URI

/msibfyxraav - URI - Possible C2 endpoint URI

Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - User agent - Probable user agent leveraged

curl - User agent - Probable user agent leveraged

curl/8.0.1 - User agent - Probable user agent leveraged

Mozilla/4.0 (compatible; Synapse) - User agent - Probable user agent leveraged

Autoit3.exe - Filename - Exe file

CvUYLoTv.au3

eDVeqcCe.au3

FeLlcFRS.au3

FTEZlGhe.au3

HOrzcEWV.au3

rKlArXHH.au3

SjadeWUz.au3

ZgOLxJQy.au3

zSrxhagw.au3

ALOXitYE.au3

DKRcfZfV.au3

gQZVKzek.au3

JZrvmJXK.au3

kLECCtMw.au3

LEXCjXKl.au3

luqWdAzF.au3

mUBNrGpv.au3

OoCdHeJT.au3

PcEJXfIl.au3

ssElzrDV.au3

TcBwRRnp.au3

TFvAUIgu.au3

xkwtvq.au3

otxynh.au3

dcthbq.au3 - Filenames - Possible exe files delivered in response to curl/8.0.1 GET requests with Target URI '/msibfyxraav

f3a0a85fe2ea4a00b3710ef4833b07a5d766702b263fda88101e0cb804d8c699 - SHA256 file hash - Possible SHA256 hashes of 'Autoit3.exe' files

afa3feea5964846cd436b978faa7d31938e666288ffaa75d6ba75bfe6c12bf61 - SHA256 file hash - Possible SHA256 hashes of 'Autoit3.exe' files

63aeac3b007436fa8b7ea25298362330423b80a4cb9269fd2c3e6ab1b1289208 - SHA256 file hash - Possible SHA256 hashes of 'Autoit3.exe' files

ab6704e836a51555ec32d1ff009a79692fa2d11205f9b4962121bda88ba55486 - SHA256 file hash - Possible SHA256 hashes of 'Autoit3.exe' files

References

1. https://www.truesec.com/hub/blog/darkgate-loader-delivered-via-teams

2. https://feedit.cz/wp-content/uploads/2023/03/YiR2022_onepager_ransomware_loaders.pdf

‍3. https://www.virustotal.com/gui/ip-address/5.188.87[.]58

‍4. https://www.forescout.com/resources/darkgate-loader-malspam-campaign/

‍5. https://otx.alienvault.com/indicator/ip/80.66.88[.]145

執筆者

Natalia Sánchez Rocafort

Cyber Security Analyst

Inside the SOC

Written by

Natalia Sánchez Rocafort

Cyber Security Analyst

•

October 21, 2026

Tara Gould

Malware Research Lead

•

October 22, 2026

Nathaniel Jones

SVP, Global Threat Intelligence

Watch the NIS2 Webinar

Blog

AI

October 26, 2026

PHP脆弱性、ARTEX、そしてサイバー攻撃におけるAIの役割拡大

BCVE-2026-109618およびCVE-2026-109619の公開により、PHPを運用している組織は緊急対応を余儀なくされました。どちらの脆弱性も許可のないリモートコード実行を可能にするものであり、対象はPHPが組み込まれ、サードパーティベンダーにアップデートを依存する製品およびアプライアンスも含まれていました[1]。

初期のガイダンスではインターネットに接続されたシステムにパッチを適用し、予期しないコマンド実行やWebroot変更、PHPサーバーからのアウトバウンド接続など、エクスプロイトの成功に関連した振る舞いを監視することに重点が置かれました。

Darktraceは監視中の環境においてスキャニングが広範に発生していることを観測し、これにはPHP脆弱性を標的としたアクティビティに関連すると報告されている数百の個別のIPアドレスが関係していました。スキャニングの量はエクスプロイトの成功を示す証拠の数を著しく上回るものでした。アナリストにとってはこの違いが重要です。スキャニングは露出したインフラへの関心を表すものです。侵害を確認するには、標的とされたシステム上でこれに続く振る舞い、たとえばコマンド実行、ファイル変更、予期しないアウトバウンド接続などの証拠が必要です。

PHPは例外的なケースではありません。その後、Imperva社が脆弱なNode.jsビルドに対するリモートコード実行を悪意あるBrotliデータを通じて実証し、圧縮HTTPレスポンスおよび設定済みリクエストパーサーを通じたコード実行を再現しました。同じ入力はパッチ適用済みのランタイムからは拒否されました。Imperva社はNode2ShellおよびPHP2Shellに対する研究結果を、脆弱性探索とエクスプロイト開発スピードの上昇と結びつけています。[2]

DarktraceはCVE-2026-109618あるいはCVE-2026-109619エクスプロイトの直接的証拠を観測していませんが、10月21日にゼロデイエクスプロイトのアクティビティと一致する過去6か月間で最大の脅威検知を観測し、これは過去のデータと比較して64%上昇を示すものでした。この上昇とPHP脆弱性との関連性は確認されていません。Darktraceの振る舞いベースのアプローチは、特定のエクスプロイトに対して記述されたルールだけに頼ることなく異常なアクティビティを検知するよう設計されています。同様の検知の増加はLog4j脆弱性の公表、およびその他の世界的に重大な脆弱性公表時にも観測されています。

AI支援による脆弱性探索

AIシステムが高い脆弱性探索能力を持つようになるなかで、PHPの脆弱性が発見されました[3]。OpenAIは2026年6月にDaybreakプログラムを発表し、GPT-5.5-CyberおよびCodex Securityをセキュリティ研究者やソフトウェア維持管理者とのパートナーシップと結びつけました。OpenAIはこれらのモデルがブラウザ、ネットワークインフラ、FreeBSDおよびLinuxカーネルの脆弱性の発見およびパッチ作成に適用されていると説明しています。ダークトレースは6月にOpenAI Daybreak Cyber Partner Programに参加し、OpenAIの提供するサイバー能力をDarktrace製品およびサービスにどのように統合できるかを研究しています [4][10]。

OpenAIは8月に、Codex Security Cloudが30,000以上のコードベースにおいて3000万件以上のコミットを分析したと報告しています。OpenAIによると、Cloudflare社はDaybreakを通じてアクセスするモデルを利用して、顧客の承認を受けたコードを調査し、その調査結果をリアルタイムのトラフィックやセキュリティシグナルと組み合わせて、影響を受けたルートがアクティブかどうか、または不審なトラフィックを受信しているかを評価し、顧客によるレビュー対象として緩和策やパッチを提案しているということです[5][6]。

迅速に発見することができても、影響を受けたソフトウェアを特定し、修正をテストし、是正措置を完了するという作業は、依然として防御者が行わなければなりません。PHPの事例は、特に脆弱なランタイムが他の製品に組み込まれている場合に、このギャップが問題となることを明確に示しています。

アタックサーフェスとしての企業AIエージェント

DarktraceSignal Labsは、攻撃者がすでに環境へのアクセス権を取得した後、信頼されたAIエージェントがどのように悪用される可能性があるかについても調査しました。ダークトレースの研究者は管理されたシミュレーション環境において、侵害後のシナリオとして、Claudeプラットフォームのメモリストア機能が悪用され、外部オペレーターと内部のClaude Codeエージェント間にライブC2チャネルを確立できることを実証しました。外部オペレーターは、このC2チャネルを介して、ネットワーク探索、認証情報へのアクセス、データの持ち出しといったタスクをエージェントに動的に割り当てることができました。エージェントのアクティビティの検知は、エージェントハーネスプロセスからのプロセス作成とネットワークトラフィックの相関付け、および予期された動作からの逸脱を特定するためのビヘイビア分析に基づいて行われました。ダークトレースはこのメモリストアを使ったC2テクニックを実際の攻撃で観測したとは主張していません[7]。

日本で観測されたAI支援による攻撃

日本で観測された証拠は、研究用環境を超えて、実際の脆弱性探索と攻撃にAIが使用されていることを示しています。10月21日、JPCERT/CCは最近の日本国内の組織に対する不正アクセスインシデントについての調査結果を発表しました。JPCERT/CCは攻撃者がAIを使って既知の脆弱性をスキャンしAPIを通じて攻撃を実行していることを確認したと報告しています。JPCERT/CCによると、攻撃インフラを調査した結果、Androidアプリケーションの分析、APIの探索、サーバーサイドリクエストフォージェリを含む脆弱性テストの痕跡が確認され、また、この攻撃インフラは日本国外のユーザー向けサービスも標的としていました[8]。

JPCERT/CCはこの公開資料の中ではARTEXを特定していません。ARTEXに対するアトリビューションは、Microsoft社によるStorm-0940の分析を含む、別の調査に基づいています。

攻撃オペレーションにおけるAI

Microsoft社は、ARTEXを限定的な人間の介入でアクティビティを自動化できる、オープンソースのマルチエージェント型ペネトレーションテストシステムと説明しています。Microsoft社は、2021年から活動している中国政府と連携した攻撃者と評価しているStorm-0940が、数百の組織に対してARTEXを使用したと報告し、ConnectWiseのサプライチェーン侵害がStorm-0940によるものであるとしました[9]。

Microsoft社は、ARTEXがスキャン、偵察、パスワードスプレー、OAuthアプリケーションの悪用を加速させていることを確認しました。ARTEXに駆動されたいくつかの攻撃オペレーションは、最初の標的設定から3時間未満で特権クラウドアクセスに到達しました。ConnectWiseの侵害後、Storm-0940は最大で毎分2,900回の頻度で、2,250を超えるテナントへの認証を試みました[9]。

ダークトレースの脅威調査チームは、後にこのキャンペーンとの関連が判明したインフラに関するアクティビティを、Darktraceテレメトリー内で発見しました。10月13日、Darktraceは、Microsoftが後にConnectWiseの顧客環境でサインインおよびMicrosoft Graphのアクティビティを実行していたと特定したアドレスの1つである144.172.64[.]128に関連する認証アクティビティの失敗を記録しました。Darktraceの分析では、約20分間に65回の認証失敗が確認されました。

図1：2026年10月13日、144.172.64[.]128が関与した認証失敗イベントを示すDarktrace Advanced Searchの結果（顧客を特定できる情報は削除済み）。

Darktraceのテレメトリーは、後にこのキャンペーンとの関連が確認されたインフラから、認証の失敗が繰り返し発生していたことを明らかにしています。これはARTEXの実行や侵害の成功を立証するものではありません。観測時点では、Microsoft社による後のアトリビューションについての情報はありませんでした。つまり、アナリストが把握していたのは振る舞いそのものでした。短時間に同一の送信元から認証に繰り返し失敗したということ、および関連するアイデンティティ、アプリケーション、ネットワークティビティについてのデータです。

Microsoft社は、10月10日から14日にかけて、8組織の327アカウントを対象とした、より広範なパスワードスプレー攻撃を報告しました。151,000件を超えるログオン失敗が記録され、なかでも11月10日には111,000件を超えていましたが、このキャンペーンによる認証成功、トークン発行、Graph呼び出し、ディレクトリ変更はいずれもありませんでした。また、Microsoftは、Storm-0940による標的化の大半が成功しなかったとも報告しています[9]。

攻撃者が認証を突破したケースでは、Microsoft社はサービスプリンシパルによるサインインに続いて、Graphおよびディレクトリ操作が行われたことを確認しました。アクティビティには、偵察、アプリケーション認証情報の変更、権限の変更を試みる行為が含まれていました。Microsoft社はサービスプリンシパルによるサインインとGraphアクティビティ、ディレクトリ変更およびリソースアクセスを相関づけることを推奨しています[9]。

アトリビューションの前に振る舞い

PHPとARTEXの事例は、異なる情報から始まっています。PHPの防御担当者は、どのソフトウェアに緊急の対策が必要かを把握していたものの、当初はエクスプロイトついての情報が限られていました。それでも、プロセスの実行、ファイルの変更、外部への通信は、侵害の証拠となったでしょう。

PHPとARTEXの観測結果は、量と影響範囲の違いも示しています。DarktraceはPHPの脆弱性公開時期に広範なスキャンを観測しました。一方ARTEX関連のインフラでは認証アクティビティが集中して発生していました。どちらの観察結果も、それ単独では侵害を実証するものではなく、いずれのケースにおいても、最初のやり取りに続く振る舞いを調べることが調査上の手がかりとなります。

DarktraceのARTEX関連の検知は、認証関連の振る舞いから始まりました。Microsoft社が攻撃インフラのアトリビューションを公表したのはその8日後でした。アトリビューションはコンテキストを提供するものではありましたが、環境内で最初に記録された事象を変更するものではありませんでした。

AIは今や攻撃サイクルの複数のポイントに存在しています。Daybreakは脆弱性の発見と修正にモデルを適用しています。Darktrace Signal Labsは信頼される企業内AIエージェントがどのように悪用されうるかを、管理された環境内で実証しました。JPCERT/CCは最近のインシデントにおけるAI支援による脆弱性探索およびAPI攻撃を確認しました。Microsoft社は実際の攻撃でStorm-0940がARTEXを使用していることを報告しました [4][7][8][9]。

Microsoft社の研究結果はまた、攻撃の規模と影響は別に評価しなければならないことも示しています。ARTEXを使った1つのキャンペーンは151,000回以上のログオン失敗を生成し、アクセスに至らなかったものの、他のキャンペーンでは3時間未満で特権クラウドアクセスに到達した例もありました。セキュリティチームは大量の試行アクティビティと、認証を突破し権限の変更やリソースアクセスへと進むものを区別しなければなりません。

これらのケースを評価するのに必要な証拠は、これまでに良く知られているものです。つまり認証記録、プロセス実行、アプリケーションやディレクトリの変更、ファイルアクティビティやネットワーク通信です。AIはこれらの振る舞いの発生頻度を増大させます。防御者はこのような状況下でもそれらのシーケンスと影響を判断しなければならないのです。

担当：Emma Foulger、Sam Lister、Dylan Evans、Moishe Tajtelbaum

参考資料

[1] NCSC-NL, php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619), 21 October 2026. https://github.com/NCSC-NL/php2shell

[2] Imperva, https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/

[3] Cyber Security Agency of Singapore, https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/

[4] OpenAI, Daybreak: Tools for securing every organization in the world, 22 June 2026. https://openai.com/index/daybreak-securing-the-world/

[5] OpenAI Developers, Scaling cyber defenders with Daybreak, 21 August 2026. https://developers.openai.com/blog/scaling-cyber-defenders-with-daybreak

[6] OpenAI, Cloudflare links vulnerability discovery to defense with OpenAI, 21 October 2026. https://openai.com/index/cloudflare-cyber/

[7] Darktrace Signal Labs, Shared Memories as a Covert C2 Channel, draft research supplied for review.

[8] JPCERT/CC, Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques, 21 October 2026. https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html

[9] Microsoft Security Research and Microsoft Threat Intelligence, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, 21 October 2026. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/

[10] Darktrace, Advancing the Use of Frontier AI in Cybersecurity: Darktrace Joins the OpenAI Daybreak Cyber Partner Program to Explore Defensive AI Integrations, 22 June 2026. https://www.darktrace.com/blog/advancing-the-use-of-frontier-ai-in-cybersecurity-darktrace-joins-the-openai-daybreak-cyber-partner-program-to-explore-defensive-ai-integrations

About the author

Nathaniel Jones

SVP, Global Threat Intelligence

Blog

OT

October 23, 2026

Beyond the Fridge: Exposed Industrial Control Systems

Introduction

In October 2026, hundreds of supermarkets across France were reportedly affected by a cyberattack targeting their refrigeration systems. According to public reports, the attackers gained access to internet-connected controllers and modified their settings, forcing refrigeration units into high and extremely low temperatures and causing significant disruption. Total losses have been reported to reach several million euros.

The incident drew attention to the security of industrial refrigeration systems, particularly older devices with exposed management interfaces and known vulnerabilities.

The exact details of how the attackers gained access have not been confirmed, however it is speculated that the public-facing web server could be accessed with the username “admin” and password being the current date. Researchers from Claroty’s Team82 identified a vulnerability in Danfoss AK-SM 8xxA Series in 2025, “CVE-2025-41450", allowing for administrative access using a time-based “code-of-the-day" for authentication [1].

Default credentials, outdated firmware and publicly accessible administrative interfaces have been an issue for years. And yet these systems continue to appear in internet scans and require little sophistication to gain admin access. A simple search of internet-connected devices shows a range of exposed devices from Programmable Logic Controllers (PLCs) and remote gateways, to, yes, more fridges.

Darktrace malware researchers identified hundreds of IoT and OT devices publicly exposed on the internet, many of which are configured with no authentication, weak credentials, or default credentials. As shown in Figure 1, an exposed Copeland XWEB web interface, used to manage Dixell equipment, including refrigerators, can provide the ability to remotely control connected devices.

‍

Figure 1: Copeland XWEB interface used to control systems including refrigerators and air conditioning.

However, it’s not only fridges; web management interfaces for industrial controls are also publicly accessible, often protected only by weak credentials. Figure 2 shows an example of a publicly exposed WAGO interface. The WAGO management interface is a configuration and administration panel for controllers. Through it, a logged-in user can view device details and diagnostics, manage user accounts and passwords, update firmware, back up or restore the full configuration, set the clock, and manage SD card storage. While it typically doesn’t manage switch outputs or read live process values, someone with access could still disrupt operation by changing network or Modbus settings, loading bad firmware or configurations, or by resetting passwords and enabling insecure services.

‍

‍

The issue extends beyond management interfaces. During our research, we identified publicly accessible web interfaces belonging to PLCs, including Rockwell Automation Allen-Bradley devices. In each case, the risk arises from how the devices have been deployed and configured, not from a flaw in the vendors’ products.

‍

Figure 3: Web interface for Allen-Bradley CompactLogix controller.

‍

Figure 3 shows the web interface of an Allen-Bradley CompactLogix controller. Unlike the previous examples, this interface provides a view into the controller's operation, including running tasks, network connections, memory usage and diagnostic information. Rockwell Automation's CompactLogix controllers are commonly used to automate industrial processes, from manufacturing and packaging lines to water treatment and material handling systems. Depending on their configuration, these controllers can operate motors, pumps, valves and other physical equipment.

Although in this example the interface shown does not provide direct control over the PLC's logic, it exposes information about the model, firmware, network layout, and connections, which is useful reconnaissance for a bigger attack.

The concern is not necessarily that every exposed interface allows an attacker to immediately manipulate industrial processes. However, these devices are accessible from the public internet in the first place, providing information about systems that may be responsible for controlling physical equipment.

The attacks on refrigeration systems in France highlight the consequences of poorly secured industrial devices. As demonstrated throughout this research, publicly accessible management interfaces are not limited to refrigeration controllers but extend to PLCs and other systems used to manage industrial equipment.

Finding these devices requires little effort. Internet scanners make it possible to identify publicly exposed interfaces quickly, and in some cases these interfaces rely on publicly documented default credentials or have no authentication at all. As attackers increasingly use AI tools, such attacks may be identified and carried out faster and at a greater scale.

The consequences of this access depend on the device and the functionality exposed. While some interfaces provide little more than diagnostic information, others allow users to modify configurations, disrupt communications, or change settings that affect physical equipment. In industrial environments, this can result in operational downtime, damaged equipment and financial losses.

Weak passwords, default credentials and exposed administrative interfaces are not new security issues. Yet their continued presence on internet-connected industrial systems demonstrates how easily preventable weaknesses can leave physical operations vulnerable to attack.

Exposed devices often come from third-party suppliers and contractors, who frequently install refrigeration controllers, gateways and PLCs without the organization ever being aware they are connected to the internet. Asset visibility remains an important foundation, but organizations should assume that some unknown assets and services will exist. Effective security therefore also depends on continuous monitoring, anomaly detection, network segmentation and rapid response, so that risky exposure and unusual activity can be identified and addressed before it becomes disruptive.

Darktrace helps security teams gain visibility across IT and OT and respond to risks: https://www.darktrace.com/products/operational-technology.

Copeland, Dixell, WAGO, Rockwell Automation, Allen-Bradley and CompactLogix are trademarks of their respective owners. Their use here is for identification only and does not imply any affiliation with or endorsement by those owners.

References

1. https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers

‍

About the author

Tara Gould

Malware Research Lead

あなたのデータ × DarktraceのAI

唯一無二のDarktrace AIで、ネットワークセキュリティを次の次元へ

デモを予約

Check out this article by Darktrace: How Darktrace Halted A DarkGate in MS Teams

How Darktrace Halted A DarkGate in MS Teams

Securing Microsoft Teams and SharePoint

DarkGate Attack Overview

Conclusion

Appendices

Darktrace DETECT Model Detections

List of IoCs

References

Beyond the Fridge: Exposed Industrial Control Systems

PHP脆弱性、ARTEX、そしてサイバー攻撃におけるAIの役割拡大

ブログをお楽しみ頂けましたか？

More in this series

From VPS to Phishing: How Darktrace Uncovered SaaS Hijacks through Virtual Infrastructure Abuse

Defending the Cloud: Stopping Cyber Threats in Azure and AWS with Darktrace

Top Eight Threats to SaaS Security and How to Combat Them

Blog

AI

October 26, 2026

PHP脆弱性、ARTEX、そしてサイバー攻撃におけるAIの役割拡大

AI支援による脆弱性探索

アタックサーフェスとしての企業AIエージェント

日本で観測されたAI支援による攻撃

攻撃オペレーションにおけるAI

アトリビューションの前に振る舞い

参考資料

Blog

OT

October 23, 2026

Beyond the Fridge: Exposed Industrial Control Systems

Introduction

References