Mandiant Managed Defense identified three zero-day vulnerabilities in SonicWall’s Email Security (ES) product that were being exploited in the wild.

New evidence allows us to assess that UNC1151, a suspected state-sponsored cyber espionage actor, conducts at least some components of Ghostwriter influence activity.

We show how a threat actor, with the right privilege, can extract the encrypted Token Signing Certificate from anywhere on the internal network.

How attackers use the Background Intelligent Transfer Service (BITS), techniques for detecting attacker activity, and the public release of our BitParser tool.

Mandiant’s Red Team discovered a series of vulnerabilities present within Digi International’s ConnectPort X2e device, which allows for remote code execution as a privileged user.

Mandiant’s Red Team discovered a series of vulnerabilities present within Digi International’s ConnectPort X2e device, which allows for remote code execution as a privileged user.

A suspected Turla Team operation distributing a reconnaissance utility and backdoor to malware victims in Ukraine.

In this post we  share insights from Mandiant's analysis of 2022 zero-day exploitation.

Mandiant is investigating a Barracuda ESG appliance zero-day vulnerability being exploited in the wild.

In the first half of 2023, we  observed a threefold increase in the number of attacks using infected USB drives to steal secrets.