Mandiant regularly observes actors spreading industrial-themed phishing emails.

We recently came across a Ursnif/Gozi-ISFB sample that manipulated TLS callbacks while injecting to child process.

A deep dive into permhash showing its theory and demonstrating real-world successes and shortcomings.

Mandiant believes North Korea's cyber capability supports political and national security priorities, as well as financial goals.

Mandiant released Route Sixty-Sink, an open-source tool that enables defenders to quickly identify vulnerabilities in any .NET assembly.

This post discusses AVADDON ransomware, and explores how ransomware operators think and continue to turn a profit in a constantly evolving cybercrime ecosystem.

FireEye Mandiant recently encountered LNK files that indicated an attacker accessed files included in Windows Explorer search results.

FireEye recently observed a sophisticated campaign targeting individuals within the Mongolian government.

Mandiant uncovered Pro-PRC  information operations activity targeting US, Canadian and Australian rare earths mining companies

The 2017 Flare-On Challenge has ended, now come check out the solutions.