Artifacts, logging options, and hardening steps to detect and prevent tactics and techniques seen by UNC3886.

A campaign targeting Western Media and Technology companies from a suspected North Korean espionage group.

We have tracked GRU disruptive operations against Ukraine adhering to a standard five-phase playbook.

FakeNet-NG is a powerful and highly configurable tool that can be used to perform more advanced tasks such as process and traffic filtering, aiding in automatic malware unpacking, security assessment of thick-client applications and many others.

We focus on how UNC2970 utilized Bring Your Own Vulnerable Device (BYOVD) to further enable their operations.

We release a new IDA Python utility to assist reverse engineers who face similar obstacles as Mandiant analysts.

We cover security tools, log sources, and hunting guidance to identify insider threat behavior.

FireEye monitored more than 12 million malware communications seeking instructions—or callbacks—across hundreds of thousands of infected enterprise hosts.

We showcase the investigative tooling and analysis process of our Managed Defense analysts.

COSMICENERGY is the latest example of specialized OT malware capable of causing cyber physical impacts.