We detail APT41’s persistent effort that allowed them to successfully compromise at least six U.S. state government networks.

We are excited to release M-Trends 2023, our comprehensive report from the frontlines of incident response.

A ransomware affiliate is targeting publicly exposed Veritas installations to gain access to organizations.

We describe ESXi detection methodologies and discuss how to harden hypervisors.

In August 2021, Mandiant Managed Defense identified and responded to the exploitation of a chain of vulnerabilities known as ProxyShell.,  , The ProxyShell vulnerabilities consist of three CVEs (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) affecting the following versions of on-premises Microsoft Exchange Servers.

We have discovered a global intrusion campaign, and we are tracking the actors behind this campaign as UNC2452.

We introduce Commando VM, a tool for penetration testers who use Windows.

With more threat actors using Remote Desktop Protocol, security teams are being challenged to decipher between legitimate and malicious RDP traffic.

This blog post details various PowerShell logging options and how they can help you obtain the visibility needed to better respond, investigate, and remediate attacks involving PowerShell.

We are excited to announce version 2.0 of our open-source tool, capa, which supports both malware triage and deep dive reverse engineering.