Static analysis of a large, obfuscated sample can take dozens of hours, so dynamic analysis can provide an alternate solution.

If a software vulnerability can be detected and remedied, then a potential intrusion is prevented.

The Mandiant Advanced Practices team recently discovered a new malware family we have named PRIVATELOG and its installer, STASHLOG. In this post, we will share a novel and especially interesting technique the samples use to hide data, along with detailed analysis of both files that was performed with the support of FLARE analysts. We will also share sample detection rules, and hunting recommendations to find similar activity in your environment.

We offer a comprehensive analysis of recent hacktivist activity targeting OT systems.

We identified attacker activity in Microsoft Azure that we attribute to a financially motivated threat actor.

We introduce the Speakeasy, a framework that enables emulation of malware samples at scale in the easiest way possible.

COM objects have recently been used by penetration testers, Red Teams, and malicious actors to perform lateral movement.

The messy realities behind attribution and the different trade-offs involved in the process.