April 4, 2022

Explore Internet-Facing System Vulnerabilities

Read about 2021's top four incidents and how Darktrace's advanced threat detection technology identified and mitigated vulnerabilities. Learn more.

Written by

Sam Lister

Specialist Security Researcher

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Sam Lister

Specialist Security Researcher

Apr 2022

By virtue of their exposure, Internet-facing systems (i.e., systems which have ports open/exposed to the wider Internet) are particularly susceptible to compromise. Attackers typically compromise Internet-facing systems by exploiting zero-day vulnerabilities in applications they run. During 2021, critical zero-day vulnerabilities in the following applications were publicly disclosed:

Microsoft Exchange
Confluence
GitLab
Log4j-using applications

Internet-facing systems running these applications were consequently heavily targeted by attackers. In this post, we will provide examples of compromises of these systems observed by Darktrace’s SOC team in 2021. As will become clear, successful exploitation of weaknesses in Internet-facing systems inevitably results in such systems doing things which they do not normally do. Rather than focusing on identifying attempts to exploit these weaknesses, Darktrace focuses on identifying the unusual behaviors which inevitably ensue. The purpose of this post is to highlight the effectiveness of this approach.

Exchange server compromise

In January, researchers from the cyber security company DEVCORE reported a series of critical vulnerabilities in Microsoft Exchange which they dubbed ‘ProxyLogon’.^[1] ProxyLogon consists of a server-side request forgery (SSRF) vulnerability (CVE-2021-26855) and a remote code execution (RCE) vulnerability (CVE-2021-27065). Attackers were observed exploiting these vulnerabilities in the wild from as early as January 6.^[2] In April, DEVCORE researchers reported another series of critical vulnerabilities in Microsoft Exchange which they dubbed ‘ProxyShell’.^[3] ProxyShell consists of a pre-authentication path confusion vulnerability (CVE-2021-34473), a privilege elevation vulnerability (CVE-2021-34523), and a post-authentication RCE vulnerability (CVE-2021-31207). Attackers were first observed exploiting these vulnerabilities in the wild in August.^[4] In many cases, attackers exploited the ProxyShell and ProxyLogon vulnerabilities in order to create web shells on the targeted Exchange servers. The presence of these web shells provided attackers with the means to remotely execute commands on the compromised servers.

In early August 2021, by exploiting the ProxyShell vulnerabilities, an attacker gained the rights to remotely execute PowerShell commands on an Internet-facing Exchange server within the network of a US-based transportation company. The attacker subsequently executed a number of PowerShell commands on the server. One of these commands caused the server to make a 28-minute-long SSL connection to a highly unusual external endpoint. Within a couple of hours, the attacker managed to strengthen their foothold within the network by installing AnyDesk and CobaltStrike on several internal devices. In mid-August, the attacker got the devices on which they had installed Cobalt Strike to conduct network reconnaissance and to transfer terabytes of data to the cloud storage service, MEGA. At the end of August, the attacker got the devices on which they had installed AnyDesk to execute Conti ransomware and to spread executable files and script files to further internal devices.

In this example, the attacker’s exploitation of ProxyShell immediately resulted in the Exchange Server making a long SSL connection to an unusual external endpoint. This connection caused the model Device / Long Agent Connection to New Endpoint to breach. The subsequent reconnaissance, lateral movement, C2, external data transfer, and encryption behavior brought about by the attacker were also picked up by Darktrace’s models.

A non-exhaustive list of the models that breached as a result of the behavior brought about by the attacker:

Device / Long Agent Connection to New Endpoint
Device / ICMP Address Scan
Anomalous Connection / SMB Enumeration
Anomalous Server Activity / Outgoing from Server
Compromise / Beacon to Young Endpoint
Anomalous Server Activity / Rare External from Server
Compromise / Fast Beaconing to DGA
Compromise / SSL or HTTP Beacon
Compromise / Sustained SSL or HTTP Increase
Compromise / Beacon for 4 Days
Anomalous Connection / Multiple HTTP POSTs to Rare Hostname
Unusual Activity / Enhanced Unusual External Data Transfer
Anomalous Connection / Data Sent to Rare Domain
Anomalous Connection / Uncommon 1 GiB Outbound
Compliance / SMB Drive Write
Anomalous File / Internal / Additional Extension Appended to SMB File
Anomalous Connection / Suspicious Read Write Ratio
Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB
Anomalous Connection / Sustained MIME Type Conversion
Unusual Activity / Anomalous SMB Move & Write
Unusual Activity / Unusual Internal Data Volume as Client or Server
Device / Suspicious File Writes to Multiple Hidden SMB Shares
Compromise / Ransomware / Suspicious SMB Activity
Anomalous File / Internal / Unusual SMB Script Write
Anomalous File / Internal / Masqueraded Executable SMB Write
Device / SMB Lateral Movement
Device / Multiple Lateral Movement Model Breaches

Confluence server compromise

Atlassian’s Confluence is an application which provides the means for building collaborative, virtual workspaces. In the era of remote working, the value of such an application is undeniable. The public disclosure of a critical remote code execution (RCE) vulnerability (CVE-2021-26084) in Confluence in August 2021 thus provided a prime opportunity for attackers to cause havoc. The vulnerability, which arises from the use of Object-Graph Navigation Language (OGNL) in Confluence’s tag system, provides attackers with the means to remotely execute code on vulnerable Confluence server by sending a crafted HTTP request containing a malicious parameter.^[5] Attackers were first observed exploiting this vulnerability towards the end of August, and in the majority of cases, attackers exploited the vulnerability in order to install crypto-mining tools onto vulnerable servers.^[6]

At the beginning of September 2021, an attacker was observed exploiting CVE-2021-26084 in order to install the crypto-mining tool, XMRig, as well as a shell script, onto an Internet-facing Confluence server within the network of an EMEA-based television and broadcasting company. Within a couple of hours, the attacker installed files associated with the crypto-mining malware, Kinsing, onto the server. The Kinsing-infected server then immediately began to communicate over HTTP with the attacker’s C2 infrastructure. Around the time of this activity, the server was observed using the MinerGate crypto-mining protocol, indicating that the server had begun to mine cryptocurrency.

In this example, the attacker’s exploitation of CVE-2021-26084 immediately resulted in the Confluence server making an HTTP GET request with an unusual user-agent string (one associated with curl in this case) to a rare external IP. This behavior caused the models Device / New User Agent, Anomalous Connection / New User Agent to IP Without Hostname, and Anomalous File / Script from Rare Location to breach. The subsequent file downloads, C2 traffic and crypto-mining activity also resulted in several models breaching.

A non-exhaustive list of the models which breached as a result of the unusual behavior brought about by the attacker:

Device / New User Agent
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / Script from Rare Location
Anomalous File / EXE from Rare External Location
Anomalous File / Internet Facing System File Download
Device / Initial Breach Chain Compromise
Anomalous Connection / Posting HTTP to IP Without Hostname
Compliance / Crypto Currency Mining Activity
Compromise / High Priority Crypto Currency Mining
Device / Internet Facing Device with High Priority Alert

GitLab server compromise

GitLab is an application providing services ranging from project planning to source code management. Back in April 2021, a critical RCE vulnerability (CVE-2021-22205) in GitLab was publicly reported by a cyber security researcher via the bug bounty platform, HackerOne.^[7] The vulnerability, which arises from GitLab’s use of ExifTool for removing metadata from image files, ^[8] enables attackers to remotely execute code on vulnerable GitLab servers by uploading specially crafted image files.^[9] Attackers were first observed exploiting CVE-2021-22205 in the wild in June/July.^[10] A surge in exploitations of the vulnerability was observed at the end of October, with attackers exploiting the flaw in order to assemble botnets.^[11] Darktrace observed a significant number of cases in which attackers exploited the vulnerability in order to install crypto-mining tools onto vulnerable GitLab servers.

On October 29, an attacker successfully exploited CVE-2021-22205 on an Internet-facing GitLab server within the network of a UK-based education provider. The organization was trialing Darktrace when this incident occurred. The attacker installed several executable files and shell scripts onto the server by exploiting the vulnerability. The attacker communicated with the compromised server (using unusual ports) for several days, before making the server transfer large volumes of data externally and download the crypto-mining tool, XMRig, as well as the botnet malware, Mirai. The server was consequently observed making connections to the crypto-mining pool, C3Pool.

In this example, the attacker’s exploitation of the vulnerability in GitLab immediately resulted in the server making an HTTP GET request with an unusual user-agent string (one associated with Wget in this case) to a rare external IP. The models Anomalous Connection / New User Agent to IP Without Hostname and Anomalous File / EXE from Rare External Location breached as a result of this behavior. The attacker’s subsequent activity on the server over the next few days resulted in frequent model breaches.

A non-exhaustive list of the models which breached as a result of the attacker’s activity on the server:

Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / EXE from Rare External Location
Anomalous File / Multiple EXE from Rare External Locations
Anomalous File / Internet Facing Device with High Priority Alert
Anomalous File / Script from Rare Location
Anomalous Connection / Application Protocol on Uncommon Port
Anomalous Connection / Anomalous SSL without SNI to New External
Device / Initial Breach Chain Compromise
Unusual Activity / Unusual External Data to New IPs
Anomalous Server Activity / Outgoing from Server
Device / Large Number of Model Breaches from Critical Network Device
Anomalous Connection / Data Sent to Rare Domain
Compromise / Suspicious File and C2
Unusual Activity / Enhanced Unusual External Data Transfer
Compliance / Crypto Currency Mining Activity
Compliance / High Priority Crypto Currency Mining
Anomalous File / Zip or Gzip from Rare External Location
Compromise / Monero Mining
Device / Internet Facing Device with High Priority Alert
Anomalous Server Activity / Rare External from Server
Compromise / Slow Beaconing Activity To External Rare
Compromise / Beaconing Activity To External Rare
Compromise / HTTP Beaconing to Rare Destination
Compromise / High Volume of Connections with Beacon Score
Anomalous File / Numeric Exe Download

Log4j server compromise

On December 9 2021, a critical RCE vulnerability (dubbed ‘Log4Shell’) in version 2 of Apache’s Log4j was publicly disclosed by researchers at LunaSec.^[12] As a logging library present in potentially millions of Java applications,^[13] Log4j constitutes an obscured, yet ubiquitous feature of the digital world. The vulnerability (CVE-2021-44228), which arises from Log4j’s Java Naming and Directory Interface (JNDI) Lookup feature, enables an attacker to make a vulnerable server download and execute a malicious Java class file. To exploit the vulnerability, all the attacker must do is submit a specially crafted JNDI lookup request to the server. The fact that Log4j is present in so many applications and that the exploitation of this vulnerability is so simple, Log4Shell has been dubbed the ‘most critical vulnerability of the last decade’.^[14] Attackers have been exploiting Log4Shell in the wild since at least December 1.^[15] Since then, attackers have been observed exploiting the vulnerability to install crypto-mining tools, Cobalt Strike, and RATs onto vulnerable servers.^[16]

On December 10, one day after the public disclosure of Log4Shell, an attacker successfully exploited the vulnerability on a vulnerable Internet-facing server within the network of a US-based architecture company. By exploiting the vulnerability, the attacker managed to get the server to download and execute a Java class file named ‘Exploit69ogQNSQYz.class’. Executing the code in this file caused the server to download a shell script file and a file related to the Kinsing crypto-mining malware. The Kinsing-infected server then went on to communicate over HTTP with a C2 server. Since the customer was using the Proactive Threat Notification (PTN) service, they were immediately alerted to this activity, and the server was subsequently quarantined, preventing crypto-mining activity from taking place.

In this example, the attacker’s exploitation of the zero-day vulnerability immediately resulted in the vulnerable server making an HTTP GET request with an unusual user-agent string (one associated with Java in this case) to a rare external IP. The models Anomalous Connection / Callback on Web Facing Device and Anomalous Connection / New User Agent to IP Without Hostname breached as a result of this behavior. The device’s subsequent file downloads and C2 activity caused several Darktrace models to breach.

A non-exhaustive list of the models which breached as a result of the unusual behavior brought about by the attacker:

Anomalous Connection / Callback on Web Facing Device
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / Internet Facing System File Download
Anomalous File / Script from Rare External Location
Device / Initial Breach Chain Compromise
Anomalous Connection / Posting HTTP to IP Without Hostname

Round-up

It is inevitable that attackers will attempt to exploit zero-day vulnerabilities in applications running on Internet-facing devices. Whilst identifying these attempts is useful, the fact that attackers regularly exploit new zero-days makes the task of identifying attempts to exploit them akin to a game of whack-a-mole. Whilst it is uncertain which zero-day vulnerability attackers will exploit next, what is certain is that their exploitation of it will bring about unusual behavior. No matter the vulnerability, whether it be a vulnerability in Microsoft Exchange, Confluence, GitLab, or Log4j, Darktrace will identify the unusual behaviors which inevitably result from its exploitation. By identifying unusual behaviors displayed by Internet-facing devices, Darktrace thus makes it almost impossible for attackers to successfully exploit zero-day vulnerabilities without being detected.

For Darktrace customers who want to find out more about detecting potential compromises of internet-facing devices, refer here for an exclusive supplement to this blog.

Thanks to Andy Lawrence for his contributions.

Footnotes

1. https://devco.re/blog/2021/08/06/a-new-attack-surface-on-MS-exchange-part-1-ProxyLogon/

2. https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

3. https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell

4. https://www.rapid7.com/blog/post/2021/08/12/proxyshell-more-widespread-exploitation-of-microsoft-exchange-servers/

5. https://www.kaspersky.co.uk/blog/confluence-server-cve-2021-26084/23376/

6. https://www.bleepingcomputer.com/news/security/atlassian-confluence-flaw-actively-exploited-to-install-cryptominers/

7. https://hackerone.com/reports/1154542

8. https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/

9.https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/

10. https://www.rapid7.com/blog/post/2021/11/01/gitlab-unauthenticated-remote-code-execution-cve-2021-22205-exploited-in-the-wild/

11. https://www.hackmageddon.com/2021/12/16/1-15-november-2021-cyber-attacks-timeline/

12. https://www.lunasec.io/docs/blog/log4j-zero-day/

13. https://www.csoonline.com/article/3644472/apache-log4j-vulnerability-actively-exploited-impacting-millions-of-java-based-apps.html

14. https://www.theguardian.com/technology/2021/dec/10/software-flaw-most-critical-vulnerability-log-4-shell

15. https://www.rapid7.com/blog/post/2021/12/15/the-everypersons-guide-to-log4shell-cve-2021-44228/

16. https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/

執筆者

Sam Lister

Specialist Security Researcher

Inside the SOC

Written by

Sam Lister

Specialist Security Researcher

•

January 14, 2026

Nathaniel Jones

VP, Security & AI Strategy, Field CISO

•

January 13, 2026

Adam Stevens

Senior Director of Product, Cloud | Darktrace

Watch the NIS2 Webinar

Blog

January 15, 2026

React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and How Threat Actors Moved So Quickly

Introduction

Last month’s disclosure of CVE 2025-55812, known as React2Shell, provided a reminder of how quickly modern threat actors can operationalize newly disclosed vulnerabilities, particularly in cloud-hosted environments.

The vulnerability was discovered on December 3, 2025, with a patch made available on the same day. Within 30 hours of the patch, a publicly available proof-of-concept emerged that could be used to exploit any vulnerable server. This short timeline meant many systems remained unpatched when attackers began actively exploiting the vulnerability.

Darktrace researchers rapidly deployed a new honeypot to monitor exploitation of CVE 2025-55812 in the wild.

Within two minutes of deployment, Darktrace observed opportunistic attackers exploiting this unauthenticated remote code execution flaw in React Server Components, leveraging a single crafted request to gain control of exposed Next.js servers. Exploitation quickly progressed from reconnaissance to scripted payload delivery, HTTP beaconing, and cryptomining, underscoring how automation and pre‑positioned infrastructure by threat actors now compress the window between disclosure and active exploitation to mere hours.

For cloud‑native organizations, particularly those in the financial sector, where Darktrace observed the greatest impact, React2Shell highlights the growing disconnect between patch availability and attacker timelines, increasing the likelihood that even short delays in remediation can result in real‑world compromise.‍

Cloud insights

In contrast to traditional enterprise networks built around layered controls, cloud architectures are often intentionally internet-accessible by default. When vulnerabilities emerge in common application frameworks such as React and Next.js, attackers face minimal friction. No phishing campaign, no credential theft, and no lateral movement are required; only an exposed service and exploitable condition.

The activity Darktrace observed during the React2shell intrusions reflects techniques that are familiar yet highly effective in cloud-based attacks. Attackers quickly pivot from an exposed internet-facing application to abusing the underlying cloud infrastructure, using automated exploitation to deploy secondary payloads at scale and ultimately act on their objectives, whether monetizing access through cryptomining or to burying themselves deeper in the environment for sustained persistence.

Cloud Case Study

In one incident, opportunistic attackers rapidly exploited an internet-facing Azure virtual machine (VM) running a Next.js application, abusing the React/next.js vulnerability to gain remote command execution within hours of the service becoming exposed. The compromise resulted in the staged deployment of a Go-based remote access trojan (RAT), followed by a series of cryptomining payloads such as XMrig.

Initial Access

Initial access appears to have originated from abused virtual private network (VPN) infrastructure, with the source IP (146.70.192[.]180) later identified as being associated with Surfshark

Figure 1: The IP address above is associated with VPN abuse leveraged for initial exploitation via Surfshark infrastructure.

The use of commercial VPN exit nodes reflects a wider trend of opportunistic attackers leveraging low‑cost infrastructure to gain rapid, anonymous access.

Parent process telemetry later confirmed execution originated from the Next.js server, strongly indicating application-layer compromise rather than SSH brute force, misused credentials, or management-plane abuse.

Payload execution

Shortly after successful exploitation, Darktrace identified a suspicious file and subsequent execution. One of the first payloads retrieved was a binary masquerading as “vim”, a naming convention commonly used to evade casual inspection in Linux environments. This directly ties the payload execution to the compromised Next.js application process, reinforcing the hypothesis of exploit-driven access.

Command-and-Control (C2)

Network flow logs revealed outbound connections back to the same external IP involved in the inbound activity. From a defensive perspective, this pattern is significant as web servers typically receive inbound requests, and any persistent outbound callbacks — especially to the same IP — indicate likely post-exploitation control. In this case, a C2 detection model alert was raised approximately 90 minutes after the first indicators, reflecting the time required for sufficient behavioral evidence to confirm beaconing rather than benign application traffic.

Cryptominers deployment and re-exploitation

Following successful command execution within the compromised Next.js workload, the attackers rapidly transitioned to monetization by deploying cryptomining payloads. Microsoft Defender observed a shell command designed to fetch and execute a binary named “x” via either curl or wget, ensuring successful delivery regardless of which tooling was availability on the Azure VM.

The binary was written to /home/wasiluser/dashboard/x and subsequently executed, with open-source intelligence (OSINT) enrichment strongly suggesting it was a cryptominer consistent with XMRig‑style tooling. Later the same day, additional activity revealed the host downloading a static XMRig binary directly from GitHub and placing it in a hidden cache directory (/home/wasiluser/.cache/.sys/).

The use of trusted infrastructure and legitimate open‑source tooling indicates an opportunistic approach focused on reliability and speed. The repeated deployment of cryptominers strongly suggests re‑exploitation of the same vulnerable web application rather than reliance on traditional persistence mechanisms. This behavior is characteristic of cloud‑focused attacks, where publicly exposed workloads can be repeatedly compromised at scale more easily.

Financial sector spotlight

During the mass exploitation of React2Shell, Darktrace observed targeting by likely North Korean affiliated actors focused on financial organizations in the United Kingdom, Sweden, Spain, Portugal, Nigeria, Kenya, Qatar, and Chile.

The targeting of the financial sector is not unexpected, but the emergence of new Democratic People’s Republic of Korea (DPRK) tooling, including a Beavertail variant and EtherRat, a previously undocumented Linux implant, highlights the need for updated rules and signatures for organizations that rely on them.

EtherRAT uses Ethereum smart contracts for C2 resolution, polling every 500 milliseconds and employing five persistence mechanisms. It downloads its own Node.js runtime from nodejs[.]org and queries nine Ethereum RPC endpoints in parallel, selecting the majority response to determine its C2 URL. EtherRAT also overlaps with the Contagious Interview campaign, which has targeted blockchain developers since early 2025.

Threat actor behavior and speed

Darktrace’s honeypot was exploited just two minutes after coming online, demonstrating how automated scanning, pre-positioned infrastructure and staging, and C2 infrastructure traced back to “bulletproof” hosting reflects a mature, well‑resourced operational chain.

For financial organizations, particularly those operating cloud‑native platforms, digital asset services, or internet‑facing APIs, this activity demonstrates how rapidly geopolitical threat actors can weaponize newly disclosed vulnerabilities, turning short patching delays into strategic opportunities for long‑term access and financial gain. This underscores the need for a behavioral-anomaly-led security posture.

Credit to Nathaniel Jones (VP, Security & AI Strategy, Field CISO) and Mark Turner (Specialist Security Researcher)

Edited by Ryan Traill (Analyst Content Lead)

Appendices

Indicators of Compromise (IoCs)

146.70.192[.]180 – IP Address – Endpoint Associated with Surfshark

References

https://www.darktrace.com/resources/the-state-of-cybersecurity-in-the-finance-sector

About the author

Nathaniel Jones

VP, Security & AI Strategy, Field CISO

Blog

January 13, 2026

Runtime Is Where Cloud Security Really Counts: The Importance of Detection, Forensics and Real-Time Architecture Awareness

Introduction: Shifting focus from prevention to runtime

Cloud security has spent the last decade focused on prevention; tightening configurations, scanning for vulnerabilities, and enforcing best practices through Cloud Native Application Protection Platforms (CNAPP). These capabilities remain essential, but they are not where cloud attacks happen.

Attacks happen at runtime: the dynamic, ephemeral, constantly changing execution layer where applications run, permissions are granted, identities act, and workloads communicate. This is also the layer where defenders traditionally have the least visibility and the least time to respond.

Today’s threat landscape demands a fundamental shift. Reducing cloud risk now requires moving beyond static posture and CNAPP only approaches and embracing realtime behavioral detection across workloads and identities, paired with the ability to automatically preserve forensic evidence. Defenders need a continuous, real-time understanding of what “normal” looks like in their cloud environments, and AI capable of processing massive data streams to surface deviations that signal emerging attacker behavior.

Runtime: The layer where attacks happen

Runtime is the cloud in motion — containers starting and stopping, serverless functions being called, IAM roles being assumed, workloads auto scaling, and data flowing across hundreds of services. It’s also where attackers:

Weaponize stolen credentials
Escalate privileges
Pivot programmatically
Deploy malicious compute
Manipulate or exfiltrate data

The challenge is complex: runtime evidence is ephemeral. Containers vanish; critical process data disappears in seconds. By the time a human analyst begins investigating, the detail required to understand and respond to the alert, often is already gone. This volatility makes runtime the hardest layer to monitor, and the most important one to secure.

What Darktrace / CLOUD Brings to Runtime Defence

Darktrace / CLOUD is purpose-built for the cloud execution layer. It unifies the capabilities required to detect, contain, and understand attacks as they unfold, not hours or days later. Four elements define its value:

1. Behavioral, real-time detection

The platform learns normal activity across cloud services, identities, workloads, and data flows, then surfaces anomalies that signify real attacker behavior, even when no signature exists.

2. Automated forensic level artifact collection

The moment Darktrace detects a threat, it can automatically capture volatile forensic evidence; disk state, memory, logs, and process context, including from ephemeral resources. This preserves the truth of what happened before workloads terminate and evidence disappears.

3. AI-led investigation

Cyber AI Analyst assembles cloud behaviors into a coherent incident story, correlating identity activity, network flows, and Cloud workload behavior. Analysts no longer need to pivot across dashboards or reconstruct timelines manually.

4. Live architectural awareness

Darktrace continuously maps your cloud environment as it operates; including services, identities, connectivity, and data pathways. This real-time visibility makes anomalies clearer and investigations dramatically faster.

Together, these capabilities form a runtime-first security model.

Why CNAPP alone isn’t enough

CNAPP platforms excel at pre deployment checks all the way down to developer workstations, identifying misconfigurations, concerning permission combinations, vulnerable images, and risky infrastructure choices. But CNAPP’s breadth is also its limitation. CNAPP is about posture. Runtime defense is about behavior.

CNAPP tells you what could go wrong; runtime detection highlights what is going wrong right now.

It cannot preserve ephemeral evidence, correlate active behaviors across domains, or contain unfolding attacks with the precision and speed required during a real incident. Prevention remains essential, but prevention alone cannot stop an attacker who is already operating inside your cloud environment.

Real-world AWS Scenario: Why Runtime Monitoring Wins

A recent incident detected by Darktrace / CLOUD highlights how cloud compromises unfold, and why runtime visibility is non-negotiable. Each step below reflects detections that occur only when monitoring behavior in real time.

1. External Credential Use

Detection: Unusual external source for credential use: An attacker logs into a cloud account from a never-before-seen location, the earliest sign of account takeover.

2. AWS CLI Pivot

Detection: Unusual CLI activity: The attacker switches to programmatic access, issuing commands from a suspicious host to gain automation and stealth.

3. Credential Manipulation

Detection: Rare password reset: They reset or assign new passwords to establish persistence and bypass existing security controls.

4. Cloud Reconnaissance

Detection: Burst of resource discovery: The attacker enumerates buckets, roles, and services to map high value assets and plan next steps.

5. Privilege Escalation

Detection: Anomalous IAM update: Unauthorized policy updates or role changes grant the attacker elevated access or a backdoor.

6. Malicious Compute Deployment

Detection: Unusual EC2/Lambda/ECS creation: The attacker deploys compute resources for mining, lateral movement, or staging further tools.

7. Data Access or Tampering

Detection: Unusual S3 modifications: They alter S3 permissions or objects, often a prelude to data exfiltration or corruption.

Only some of these actions would appear in a posture scan, crucially after the fact.
Every one of these runtime detections is visible only through real-time behavioral monitoring while the attack is in progress.

The future of cloud security Is runtime-first

Cloud defense can no longer revolve solely around prevention. Modern attacks unfold in runtime, across a fast-changing mesh of workloads, services, and — critically — identities. To reduce risk, organizations must be able to detect, understand, and contain malicious activity as it happens, before ephemeral evidence disappears and before attacker's pivot across identity layers.

Darktrace / CLOUD delivers this shift by turning runtime, the most volatile and consequential layer in the cloud, into a fully defensible control point through unified visibility across behavior, workloads, and identities. It does this by providing:

Real-time behavior detection across workloads and identity activity ‍
Autonomous response actions for rapid containment ‍
Automated forensic level artifact preservation the moment events occur ‍
AI-driven investigation that separates weak signals from true attacker patterns ‍
Live cloud environment insight to understand context and impact instantly

Cloud security must evolve from securing what might go wrong to continuously understanding what is happening; in runtime, across identities, and at the speed attackers operate. Unifying runtime and identity visibility is how defenders regain the advantage.

[related-resource]

About the author

Adam Stevens

Senior Director of Product, Cloud | Darktrace

あなたのデータ × DarktraceのAI

唯一無二のDarktrace AIで、ネットワークセキュリティを次の次元へ

デモを予約

Check out this article by Darktrace: Explore Internet-Facing System Vulnerabilities

Explore Internet-Facing System Vulnerabilities

Exchange server compromise

Confluence server compromise

GitLab server compromise

Log4j server compromise

Round-up

Footnotes

React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and How Threat Actors Moved So Quickly

Runtime Is Where Cloud Security Really Counts: The Importance of Detection, Forensics and Real-Time Architecture Awareness

ブログをお楽しみ頂けましたか？

More in this series

今年の展望：2026年に注目すべきAIサイバーセキュリティのトレンド

Protecting the Experience: How a global hospitality brand stays resilient with Darktrace

How a Major Civil Engineering Company Reduced MTTR across Network, Email and the Cloud with Darktrace

Blog

January 15, 2026

React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and How Threat Actors Moved So Quickly

Introduction

Cloud insights

Cloud Case Study

Initial Access

Payload execution

Command-and-Control (C2)

Cryptominers deployment and re-exploitation

Financial sector spotlight

Read more finance‑sector insights in Darktrace’s white paper, The State of Cyber Security in the Finance Sector.

Threat actor behavior and speed

Appendices

Blog

January 13, 2026

Runtime Is Where Cloud Security Really Counts: The Importance of Detection, Forensics and Real-Time Architecture Awareness

Introduction: Shifting focus from prevention to runtime

Runtime: The layer where attacks happen

What Darktrace / CLOUD Brings to Runtime Defence

1. Behavioral, real-time detection

2. Automated forensic level artifact collection

3. AI-led investigation

4. Live architectural awareness

Why CNAPP alone isn’t enough

Real-world AWS Scenario: Why Runtime Monitoring Wins

1. External Credential Use

2. AWS CLI Pivot

3. Credential Manipulation

4. Cloud Reconnaissance

5. Privilege Escalation

6. Malicious Compute Deployment

7. Data Access or Tampering

The future of cloud security Is runtime-first