Starting from a singular intrusion at a client, we were able to discover activity at multiple customers by a group referred to as UNC1878.

Chinese actor APT41 carried out one of the broadest campaigns by a Chinese cyber espionage actor that we have observed in recent years.

A shift to post-compromise ransomware operations is fueling adversaries’ ability to disrupt industrial operations.

M-Trends 2020 contains all of the statistics, trends, case studies and hardening recommendations that readers have come to expect.

Given the nature of unmanaged exports, our previously released DueDLLigence tool can also be used for DLL abuse techniques.

Learn steps organizations can proactively take to harden their environment to prevent the downstream impact of a ransomware event.

Mandiant observed DARKSIDE affiliate UNC2465 accessing at least one victim through a Trojanized software installer downloaded from a legitimate website.

We provide an update on our investigation into compromised Pulse Secure devices by suspected Chinese espionage operators.

We take a look at simple attacks against OT systems, where actors with varying levels of skill and resources use common IT tools and techniques.

The creators of DARKSIDE ransomware and their affiliates have launched a global crime spree affecting organizations in more than 15 countries and multiple industry verticals.