The IT Nerd

 Darktrace, today announced the launch of Darktrace / Forensic Acquisition & Investigation™, the industry’s first truly automated cloud forensics solution. The solution provides security teams immediate access to forensic-level data, equipping them with critical context to investigate threats quickly and thoroughly across hybrid, multi-cloud and on-premises environments. When paired with the newly enhanced Darktrace / CLOUD™, organizations gain a complete cloud security solution that combines posture management with real-time detection, response and forensic investigation – potentially reducing investigation times from days to mere minutes.  

Cloud adoption has outpaced security operations, creating blind spots that adversaries are quick to exploit. Nearly 90% of organizations report suffering damage before they can contain cloud incidents, and 65% say investigations take three to five days longer in the cloud compared to on-premises environments, according to a survey of 300 cloud security decision makers. Traditional log-based alerts miss behaviors such as lateral movement or privilege escalation, while evidence from ephemeral assets like containers and serverless functions often disappears before it can be collected — leaving security teams struggling to respond effectively. 

At the same time, attacks against cloud workloads are increasingly aggressive. New analysis of Darktrace’s Cloudypot honeypots reveals that attacks on tools like Jupyter Notebooks often arrive in sudden bursts, generating high volumes of attacks in a short period of time from a small group of persistent attackers. These findings highlight that when adversaries target the cloud, they strike quickly and at scale, leaving defenders little time to investigate before critical evidence disappears. 

Introducing Darktrace / Forensic Acquisition & Investigation 

Darktrace / Forensic Acquisition & Investigation is an automated forensic investigation solution designed for the speed and complexity of modern cloud environments. It captures and analyzes host-level evidence — including disk, memory, and logs — at the exact moment a threat is detected, even from short-lived assets such as containers or serverless workloads. These investigations can be triggered by Darktrace or by detections from existing cloud security tools.  

Unlike point solutions that depend on manual snapshots or agents, Darktrace collects evidence directly through cloud APIs, ensuring investigations begin instantly, and critical data from ephemeral workloads is never lost. By preserving volatile data and reconstructing attacker behavior in real time, the solution adds critical context to everyday investigations, enabling security teams to understand root causes quickly and shorten investigation times from days to mere minutes — a critical advantage as over 40% of organizations report suffering significant damage from cloud alerts that were never investigated at all.  

This solution represents the evolution of capabilities gained through Darktrace’s acquisition of Cado Security earlier this year, alongside continued research and development investment to expand and advance Darktrace’s cloud security portfolio. 

Key capabilities of the Darktrace / Forensic Acquisition & Investigation solution include: 

• Automated hybrid forensic capture: Collects host-level data, including disks, memory, logs, and artifacts the moment an alert is raised across on-premises, AWS, Azure, GCP and SaaS environments.  
• Ephemeral data capture: Preserves evidence from short-lived workloads including AWS ECS, Kubernetes, and distro-less or no-shell containers, retaining critical data so that it can be investigated. 
• Automated investigation with complete timelines: Automatically reconstructs attacker behavior into unified timelines, distilling massive volumes of events into the most significant insights providing rapid clarity and root cause in minutes without manual correlation. 
• Scalable response and reporting: Supports parallel investigations across multiple systems and automatically generates exportable reports to help reduce analyst workload and assist with compliance burdens. 
• Rapid deployment and seamless integration: Offers flexible SaaS or on-premises deployment, and integrates with existing SIEM, XDR, CNAPP, EDR, NDR, and cloud-native tools so that any alert can trigger immediate forensic capture and investigation. 

Darktrace / Forensic Acquisition & Investigation can be deployed as a standalone product, giving new customers immediate access to automated cloud forensics to support SOC and incident response teams in their day-to-day management of cloud security threats, or integrated across the Darktrace ActiveAI Security Platform for end-to-end investigations and response across an organization’s entire digital estate. It is particularly powerful when paired with Darktrace / CLOUD, where the two solutions bring real-time cloud detection and response and forensic-level investigation together in a single workflow. 

Unifying Cloud Detection, Response, and Forensic Investigation with Darktrace / CLOUD 

Customers can now add Darktrace / Forensic Acquisition & Investigation capabilities to Darktrace’s leading cloud detection and response (CDR) product. With Darktrace / CLOUD, security teams benefit from:  

• Autonomous detection and response: Self-Learning AI continuously monitors cloud environments to spot both known and novel threats and automatically contain them at machine speed. 
• Dynamic cloud visibility: Live mapping of assets, services, and architectures to reveal blind spots, track attacker movement, and provide real-time context. 
• Proactive risk management: Automated posture checks and attack path modeling that surface misconfigurations and exposures before attackers can exploit them. 

When adding Darktrace / Forensic Acquisition & Investigation to Darktrace / CLOUD, the solutions work together seamlessly to detect threats as they emerge and preserve the forensic evidence needed to investigate them. As Darktrace / CLOUD detects and blocks suspicious cloud activity, Darktrace / Forensic Acquisition & Investigation will capture disk, memory, and log data from the affected asset, allowing teams to immediately contain threats while preserving the critical evidence needed to investigate and remediate the incident.  

Alongside this integration, Darktrace has strengthened its core cloud capabilities to make investigations even faster and more intuitive. Enhancements include more intuitive cloud architecture diagrams that make complex environments easier to interpret, along with expanded detection of advanced attacker techniques such as lateral movement, command-and-control, and privilege escalation. 

When uniting threat detection, response, and automated forensics in one platform, security teams can shift cloud investigations from reactive and fragmented to fast, automated, and context-rich — enabling organizations to harness the benefits of the cloud while effectively mitigating risks. 

Availability  

Darktrace / Forensic Acquisition & Investigation, the integrations across the Darktrace ActiveAI Security Platform and new features in Darktrace / CLOUD are available now.  

• Author: Keanna Grelicha, Cyber Analyst
• Author: Tara Gould, Threat Research Lead
• Summary: Cryptojacking attacks are rising as threat actors exploit hard-to-detect cryptomining malware. Learn how Darktrace detected and contained a cryptojacking attempt in its early stages using Autonomous Response, with expert analysis of the malware itself revealing insights into a novel cryptomining strain.
• Blog Category: On the Case: Incident Analysis

What is Cryptojacking?

Cryptojacking remains one of the most persistent cyber threats in the digital age, showing no signs of slowing down. It involves the unauthorized use of a computer or device’s processing power to mine cryptocurrencies, often without the owner’s consent or knowledge, using cryptojacking scripts or cryptocurrency mining (cryptomining) malware [1]. Unlike other widespread attacks such as ransomware, which disrupt operations and block access to data, cryptomining malware steals and drains computing and energy resources for mining to reduce attacker’s personal costs and increase “profits” earned from mining [1]. The impact on targeted organizations can be significant, ranging from data privacy concerns and reduced productivity to higher energy bills.

As cryptocurrency continues to grow in popularity, as seen with the ongoing high valuation of the global cryptocurrency market capitalization (almost USD 4 trillion at time of writing), threat actors will continue to view cryptomining as a profitable venture [2]. As a result, illicit cryptominers are being used to steal processing power via supply chain attacks or browser injections, as seen in a recent cryptojacking campaign using JavaScript [3][4].

Therefore, security teams should maintain awareness of this ongoing threat, as what is often dismissed as a ‘compliance issue’ can escalate into more severe compromises and lead to prolonged exposure of critical resources.

While having a security team capable of detecting and analyzing hijacking attempts is essential, emerging threats in today’s landscape often demand more than manual intervention.

In July 2025, Darktrace detected and contained an attempted cryptojacking incident on the network of a customer in the retail and e-commerce industry, when a threat actor attempted to use a PowerShell script to download and run NBMiner directly in memory.

In addition to highlighting Darktrace’s successful detection of the malicious activity and the role of Autonomous Response in halting the attack, this blog will also include novel insights from Darktrace’s threat researchers on the cryptominer payload, showing how the attack chain was initiated through the execution of a PowerShell-based payload.

Darktrace’s Coverage of Cryptojacking via PowerShell

The initial compromise was detected on July 22, when Darktrace / NETWORK observed the use of a new PowerShell user agent during a connection to an external endpoint, indicating an attempt at remote code execution.

Specifically, the targeted desktop device established a connection to the rare endpoint, 45.141.87[.]195, over destination port 8000 using HTTP as the application-layer protocol. Within this connection, Darktrace observed the presence of a PowerShell script in the URI, specifically ‘/infect.ps1’.

Darktrace’s analysis of this endpoint (45.141.87[.]195[:]8000/infect.ps1) and the payload it downloaded indicated it was a dropper used to deliver an obfuscated AutoIt loader. This attribution was further supported by open-source intelligence (OSINT) reporting [5]. The loader likely then injected NBMiner into a legitimate process on the customer’s environment – the first documented case of NBMiner being dropped in this way.

Figure 1: Darktrace’s detection of a device making an HTTP connection with new PowerShell user agent, indicating PowerShell abuse for command-and-control (C2) communications.

Script files are often used by malicious actors for malware distribution. In cryptojacking attacks specifically, scripts are used to download and install cryptomining software, which then attempts to connect to cryptomining pools to begin mining operations [6].

Inside the Payload: Technical Analysis of the Malicious Script and Cryptomining Loader

To confidently establish that the malicious script file dropped an AutoIt loader used to deliver the NBMiner cryptominer, Darktrace’s threat researchers reverse engineered the payload. Analysis of the file ‘infect.ps1’ revealed further insights, ultimately linking it to the execution of a cryptominer loader.

Figure 2: Screenshot of the ‘infect.ps1’ PowerShell script observed in the attack.

The ‘infect.ps1’ script is a heavily obfuscated PowerShell script that contains multiple variables of Base64 and XOR encoded data. The first data blob is XOR’d with a value of 97, after decoding, the data is a binary and stored in APPDATA/local/knzbsrgw.exe. The binary is AutoIT.exe, the legitimate executable of the AutoIt programming language. The script also performs a check for the existence of the registry key HKCU:\\Software\LordNet.

The second data blob ($cylcejlrqbgejqryxpck) is written to APPDATA\rauuq, where it will later be read and XOR decoded. The third data blob ($tlswqbblxmmr)decodes to an obfuscated AutoIt script, which is written to %LOCALAPPDATA%\qmsxehehhnnwioojlyegmdssiswak. To ensure persistence, a shortcut file named xxyntxsmitwgruxuwqzypomkhxhml.lnk is created to run at startup.

Figure 3: Screenshot of second stage AutoIt script.

The observed AutoIt script is a process injection loader. It reads an encrypted binary from /rauuq in APPDATA, then XOR-decodes every byte with the key 47 to reconstruct the payload in memory. Next, it silently launches the legitimate Windows app ‘charmap.exe’ (Character Map) and obtains a handle with full access. It allocates executable and writable memory inside that process, writes the decrypted payload into the allocated region, and starts a new thread at that address. Finally, it closes the thread and process handles.

The binary that is injected into charmap.exe is 64-bit Windows binary. On launch, it takes a snapshot of running processes and specifically checks whether Task Manager is open. If Task Manager is detected, the binary kills sigverif.exe; otherwise, it proceeds. Once the condition is met, NBMiner is retrieved from a Chimera URL (https://api[.]chimera-hosting[.]zip/frfnhis/zdpaGgLMav/nbminer%5B.%5Dexe) and establishes persistence, ensuring that the process automatically restarts if terminated. When mining begins, it spawns a process with the arguments ‘-a kawpow -o asia.ravenminer.com:3838 -u R9KVhfjiqSuSVcpYw5G8VDayPkjSipbiMb.worker -i 60’ and hides the process window to evade detection.

Figure 4: Observed NBMiner arguments.

The program includes several evasion measures. It performs anti-sandboxing by sleeping to delay analysis and terminates sigverif.exe (File Signature Verification). It checks for installed antivirus products and continues only when Windows Defender is the sole protection. It also verifies whether the current user has administrative rights. If not, it attempts a User Account Control (UAC) bypass via Fodhelper to silently elevate and execute its payload without prompting the user. The binary creates a folder under %APPDATA%, drops rtworkq.dll extracted from its own embedded data, and copies ‘mfpmp.exe’ from System32 into that directory to side-load ‘rtworkq.dll’. It also looks for the registry key HKCU\Software\kap, creating it if it does not exist, and reads or sets a registry value it expects there.

Zooming Out: Darktrace Coverage of NBMiner

Darktrace’s analysis of the malicious PowerShell script provides clear evidence that the payload downloaded and executed the NBMiner cryptominer. Once executed, the infected device is expected to attempt connections to cryptomining endpoints (mining pools). Darktrace initially observed this on the targeted device once it started making DNS requests for a cryptominer endpoint, “gulf[.]moneroocean[.]stream” [7], one minute after the connection involving the malicious script.

Figure 5: Darktrace Advanced Search logs showcasing the affected device making a DNS request for a Monero mining endpoint.

Though DNS requests do not necessarily mean the device connected to a cryptominer-associated endpoint, Darktrace detected connections to the endpoint specified in the DNS Answer field: monerooceans[.]stream, 152.53.121[.]6. The attempted connections to this endpoint over port 10001 triggered several high-fidelity model alerts in Darktrace related to possible cryptomining mining activity. The IP address and destination port combination (152.53.121[.]6:10001) has also been linked to cryptomining activity by several OSINT security vendors [8][9].

Figure 6: Darktrace’s detection of a device establishing connections with the Monero Mining-associated endpoint, monerooceans[.]stream over port 10001.

Darktrace / NETWORK grouped together the observed indicators of compromise (IoCs) on the targeted device and triggered an additional Enhanced Monitoring model designed to identify activity indicative of the early stages of an attack. These high-fidelity models are continuously monitored and triaged by Darktrace’s SOC team as part of the Managed Threat Detection service, ensuring that subscribed customers are promptly notified of malicious activity as soon as it emerges.

Figure 7: Darktrace’s correlation of the initial PowerShell-related activity with the cryptomining endpoint, showcasing a pattern indicative of an initial attack chain.

Darktrace’s Cyber AI Analyst launched an autonomous investigation into the ongoing activity and was able to link the individual events of the attack, encompassing the initial connections involving the PowerShell script to the ultimate connections to the cryptomining endpoint, likely representing cryptomining activity. Rather than viewing these seemingly separate events in isolation, Cyber AI Analyst was able to see the bigger picture, providing comprehensive visibility over the attack.

Figure 8: Darktrace’s Cyber AI Analyst view illustrating the extent of the cryptojacking attack mapped against the Cyber Kill Chain.

Darktrace’s Autonomous Response

Fortunately, as this customer had Darktrace configured in Autonomous Response mode, Darktrace was able to take immediate action by preventing  the device from making outbund connections and blocking specific connections to suspicious endpoints, thereby containing the attack.

Figure 9: Darktrace’s Autonomous Response actions automatically triggered based on the anomalous connections observed to suspicious endpoints.

Specifically, these Autonomous Response actions prevented the outgoing communication within seconds of the device attempting to connect to the rare endpoints.

Figure 10: Darktrace’s Autonomous Response blocked connections to the mining-related endpoint within a second of the initial connection.

Additionally, the Darktrace SOC team was able to validate the effectiveness of the Autonomous Response actions by analyzing connections to 152.53.121[.]6 using the Advanced Search feature. Across more than 130 connection attempts, Darktrace’s SOC confirmed that all were aborted, meaning no connections were successfully established.

Figure 11: Advanced Search logs showing all attempted connections that were successfully prevented by Darktrace’s Autonomous Response capability.

Conclusion

Cryptojacking attacks will remain prevalent, as threat actors can scale their attacks to infect multiple devices and networks. What’s more, cryptomining incidents can often be difficult to detect and are even overlooked as low-severity compliance events, potentially leading to data privacy issues and significant energy bills caused by misused processing power.

Darktrace’s anomaly-based approach to threat detection identifies early indicators of targeted attacks without relying on prior knowledge or IoCs. By continuously learning each device’s unique pattern of life, Darktrace can detect subtle deviations that may signal a compromise.

In this case, the cryptojacking attack was quickly identified and mitigated during the early stages of malware and cryptomining activity. Darktrace’s Autonomous Response was able to swiftly contain the threat before it could advance further along the attack lifecycle, minimizing disruption and preventing the attack from potentially escalating into a more severe compromise.

Credit to Keanna Grelicha (Cyber Analyst) and Tara Gould (Threat Research Lead)

Appendices

Darktrace Model Detections

NETWORK Models:

• Compromise / High Priority Crypto Currency Mining (Enhanced Monitoring Model)
• Device / Initial Attack Chain Activity (Enhanced Monitoring Model)
• Compromise / Suspicious HTTP and Anomalous Activity (Enhanced Monitoring Model)
• Compromise / Monero Mining
• Anomalous File / Script from Rare External Location
• Device / New PowerShell User Agent
• Anomalous Connection / New User Agent to IP Without Hostname
• Anomalous Connection / Powershell to Rare External
• Device / Suspicious Domain

Cyber AI Analyst Incident Events:

• Detect \ Event \ Possible HTTP Command and Control
• Detect \ Event \ Cryptocurrency Mining Activity

Autonomous Response Models:

• Antigena / Network::Significant Anomaly::Antigena Alerts Over Time Block
• Antigena / Network::External Threat::Antigena Suspicious Activity Block
• Antigena / Network::Significant Anomaly::Antigena Enhanced Monitoring from Client Block
• Antigena / Network::External Threat::Antigena Crypto Currency Mining Block
• Antigena / Network::External Threat::Antigena File then New Outbound Block
• Antigena / Network::External Threat::Antigena Suspicious File Block
• Antigena / Network::Significant Anomaly::Antigena Significant Anomaly from Client Block

List of Indicators of Compromise (IoCs)

(IoC – Type – Description + Confidence)

• 45.141.87[.]195:8000/infect.ps1 – IP Address, Destination Port, Script – Malicious PowerShell script
• gulf.moneroocean[.]stream – Hostname – Monero Endpoint
• monerooceans[.]stream – Hostname – Monero Endpoint
• 152.53.121[.]6:10001 – IP Address, Destination Port – Monero Endpoint
• 152.53.121[.]6 – IP Address – Monero Endpoint
• https://api[.]chimera-hosting[.]zip/frfnhis/zdpaGgLMav/nbminer%5B.%5Dexe – Hostname, Executable File – NBMiner
• Db3534826b4f4dfd9f4a0de78e225ebb – Hash – NBMiner loader

MITRE ATT&CK Mapping

(Tactic – Technique – Sub-Technique)

• Vulnerabilities – RESOURCE DEVELOPMENT – T1588.006 – T1588
• Exploits – RESOURCE DEVELOPMENT – T1588.005 – T1588
• Malware – RESOURCE DEVELOPMENT – T1588.001 – T1588
• Drive-by Compromise – INITIAL ACCESS – T1189
• PowerShell – EXECUTION – T1059.001 – T1059
• Exploitation of Remote Services – LATERAL MOVEMENT – T1210
• Web Protocols – COMMAND AND CONTROL – T1071.001 – T1071
• Application Layer Protocol – COMMAND AND CONTROL – T1071
• Resource Hijacking – IMPACT – T1496
• Obfuscated Files – DEFENSE EVASION – T1027            
• Bypass UAC – PRIVILEGE ESCALATION – T1548.002
• Process Injection – PRIVILEGE ESCALATION – T055
• Debugger Evasion – DISCOVERY – T1622
• Logon Autostart Execution – PERSISTENCE – T1547.009

Sources:

[1] https://www.darktrace.com/cyber-ai-glossary/cryptojacking#:~:text=Battery%20drain%20and%20overheating,fee%20to%20%E2%80%9Cmine%20cryptocurrency%E2%80%9D.

[2] https://coinmarketcap.com/

[3] https://www.ibm.com/think/topics/cryptojacking

[4] https://thehackernews.com/2025/07/3500-websites-hijacked-to-secretly-mine.html

[5] https://urlhaus.abuse.ch/url/3589032/

[6] https://www.logpoint.com/en/blog/uncovering-illegitimate-crypto-mining-activity/

[7] https://www.virustotal.com/gui/domain/gulf.moneroocean.stream/detection

[8] https://www.virustotal.com/gui/domain/monerooceans.stream/detection

[9] https://any.run/report/5aa8cd5f8e099bbb15bc63be52a3983b7dd57bb92566feb1a266a65ab5da34dd/351eca83-ef32-4037-a02f-ac85a165d74e

^{The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.}

^{Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.}

^{Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.}

^{The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content without notice.}

Darktrace has published new stats from their threat research team which provide some interesting insights in relation to ongoing email and phishing threats.

Here are some of the things the team found:

• The total number of malicious emails detected by Darktrace from January to May 2025 has increased significantly.
• VIP phishing forms a notable proportion of phishing emails observed by Darktrace. 
• QR code-based phishing emails have remained a consistent tactic.
• The proportion of phishing emails containing a high text volume has noticeably increased.

Here is the blog post: http://www.darktrace.com/blog/2025-cyber-threat-landscape-darktraces-mid-year-review

 Darktrace researchers have uncovered an active campaign targeting cryptocurrency users through an elaborate social engineering scheme. Threat actors are creating sophisticated fake AI, gaming, Web3, and social media startups, complete with professional websites, hijacked verified accounts, whitepapers, GitHub repos, and Medium blogs to trick targets to download software to drain crypto wallets. 

Targets are contacted via X, Telegram, or Discord by fake “employees” offering crypto in exchange for testing software. They are then directed to professional-looking sites requiring a registration code to download the malware-laced apps. The campaign is currently active with dozens of fake companies identified, targeting both Windows and macOS users globally with malware variants.  

You can read the research here: https://www.darktrace.com/blog/crypto-wallets-continue-to-be-drained-in-elaborate-social-media-scam

Darktrace researchers have uncovered multiple attacks using ‘ClickFix’ social engineering techniques, in which threat actors trick users with fake error messages or verification prompts to execute malicious commands.  

In one recent incident, Darktrace observed threat actors using this technique to quietly steal data from an infected device. After gaining access, they connected to a remote server to begin executing commands. The device then downloaded a harmful file designed to dig deeper into the system and collect sensitive information, which was then exfiltrated to a malicious server. About ten minutes later, the device contacted another rare and suspicious server linked to past ClickFix campaigns – signaling the final stage of automated data theft. 

You can read the blog post here: Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic

 Darktrace researchers have identified a novel Go-based Linux botnet named “PumaBot” targeting embedded Linux IoT devices – notably, the malware checks for the presence of the string “Pumatronix”, a manufacturer of surveillance and traffic camera systems. 

Unlike typical botnets that scan the entire internet, PumaBot uses a remote command-and-control (C2) server to get a list of devices to attack. It gains access by brute-forcing credentials and then disguises itself as legitimate software to avoid detection. The malware establishes persistence, creates multiple backdoors and performs checks to avoid honeypots or other restricted environments, suggesting a sophisticated campaign to establish long-term access to these systems.   

You can read this blog post here.

Darktrace researchers have uncovered a new sophisticated malware campaign targeting Docker environments. The new malware variant connects out to a legitimate crypto website which allows users to join a decentralized network and run a social media scraping node in exchange for private crypto tokens. The malware simply connects out to the crypto site and sends signals between the systems to gain more and more crypto tokens. 

In this campaign, threat actors were also observed using unique obfuscation techniques, hiding this malicious code under 63 layers to evade detection. 

You can find out more here: http://www.darktrace.com/blog/obfuscation-overdrive-next-gen-cryptojacking-with-layers

Darktrace today released the findings of its second annual 2025 State of AI Cybersecurity report, which includes insights from over 1500 global security professionals on their attitudes and understanding of AI’s evolving role in cybersecurity.   

The report includes new data points that reinforce a few key trends:  

• A majority of Canadian CISOs are feeling the impact of AI-powered threats. The offensive use of AI is now very real for CISOs with these tools helping attackers increase the speed, scale and sophistication of attacks. 
• Canadian security professionals feel slightly more prepared for AI threats since last year but still cite challenges around lack of personnel as a key inhibitor to defending against these threats.  
• There is a growing gap between confidence in AI tools and understanding AI tools. Nearly all Canadian security professionals are confident in the impact AI can have on cyber defense, but few report a strong understanding of the AI technology used today.  

The report is linked here.

Darktrace, a global leader in AI for cybersecurity, today announced that Aviso, one of Canada’s leading wealth services suppliers, has selected the Darktrace ActiveAI Security Platform^™ to secure its organization’s digital ecosystem.

With over CAN$140 billion in assets under administration and management, Aviso is a leading wealth services supplier for the Canadian financial industry. The organization provides services to nearly all credit unions across Canada and to a wide range of portfolio managers, investment dealers, insurance and trust companies and introducing brokers. Seeing digital transformation and modernization as strategic opportunities to differentiate and drive growth, Aviso is focused on building a technology-enabled, client-centric wealth management ecosystem. Implementing a robust, modern cybersecurity strategy that keeps networks, systems, people and data secure is vital for excellent client service and Aviso’s overall growth journey.

Financial services organizations are often a top target for cyber-criminals, with this industry subject to attacks from a broad range of threat actors ranging from organized and well-funded cyber-criminal groups with financial motivations to hacktivist groups seeking to cause disruption and wreak havoc in the markets.

Faced with a rapidly evolving threat landscape, Aviso wanted to free its security team from time-consuming manual processes, including investigating an overwhelming volume of security alerts. As part of its plan to create a modern cybersecurity strategy, Aviso turned to Darktrace’s pioneering AI technology to help their security team overcome alert fatigue, while freeing up time to focus on more proactive efforts like vulnerability management and enhancing business practices in other areas such as service, operations and compliance.

Aviso is using a variety of components of the Darktrace ActiveAI Security Platform, including Darktrace / EMAIL^™ for user-focused and business-centric approach to email security, Darktrace / NETWORK^™ and Darktrace / ENDPOINT^™ for industry leading network detection and response capabilities, Darktrace / IDENTITY^™ for robust identity management and Darktrace Managed Detection and Response. The Darktrace ActiveAI Security Platform, underpinned by Darktrace’s unique Self-Learning AI engine, learns what is normal behavior for Aviso’s entire network, continuously analyzing, mapping and modeling every connection to create a full picture of devices, identities, connections and potential attack paths. Darktrace uses this deep understanding of Aviso’s enterprise network to identify suspicious behavior and autonomously respond without disrupting business operations to secure Aviso’s entire digital footprint.

In just one month, Aviso tracked 6.7 billion network events using Darktrace / NETWORK; of those events, Darktrace autonomously investigated 23 million alerts, saving Aviso’s team an estimated 1,104 hours of manual investigation.

To learn more about how Darktrace helps protect Aviso, check out the case study. 

 Darktrace released its half year financial results today, and you can find the full announcementhere.

Alongside its financials, Darktrace released new data from across its customer base that shows how phishing attacks are continuing to evolve:

• ‘Novel social engineering’ attacks – phishing attacks that use more sophisticated language and punctuation than a typical phishing email – grew by 35% between September and December 2023.
• This follows data previously released by Darktrace showing a 135% increase, on average, in these attacks in January and February last year, coinciding with the general adoption of ChatGPT.
• The ongoing rise in these sophisticated techniques suggests attackers are continuing to increase their use of generative AI tools to make their attacks more potent.
• It’s not just the sophistication of phishing attacks that is increasing, but also the scale, with Darktrace customers receiving 2,867,000 phishing emails in December alone, a 14% increase on September.

As they grow, AI threats have become a critical priority on the agendas of security teams, and they are questioning whether their organizations are prepared. In new data Darktrace is also releasing today, the company recently surveyed over 1700 security experts around the world to understand how they perceive this challenge:

• 89% of IT security experts believe AI-augmented cyber threats will have a significant impact on their organization within the next two years. 
• Yet, 60% believe they are currently unprepared to defend against these attacks.
• Their two greatest concerns, both rated as 3.84 by respondents, on a 1-5 scale of risk are:
  • Increased volume and sophistication of malware attacks – like those delivered by phishing emails – that target known vulnerabilities in software.
• Employee use of generative AI tools, leading to sensitive data being leaked.

The growing adoption of AI adds to the impact automation and as-a-service attacks are already having on the threats organizations face. The Darktrace threat report, released in January, showed that as-a-service attacks, which provide cybercriminals with everything from pre-made malware to templates for phishing emails, payment processing systems and even helplines, make up the majority of attacks.

You can find a blog post from Darktrace’s Chief Product Officer, Max Heinemeyer, delving more deeply into the findings here.

Commenting on the cybersecurity landscape, Darktrace CEO Poppy Gustafsson, said: “We continue to see the cyber-crime landscape evolve rapidly in a challenging geopolitical environment and as the availability of generative AI tools lowers the barrier to entry for hostile actors. Against this backdrop and in the period ahead, we are preparing to roll out enhanced market and product positioning to better demonstrate how our unique AI can help organizations to address novel threats across their entire technology footprint.”