Tag: mandiant

FBI Removes Accenture Contractor Over ShinyHunters Breach Patch Failure

The FBI has taken swift action by removing an Accenture contractor after a patch failure led to the ShinyHunters breach, exposing sensitive information of thousands of employees. A clever URL-encoding trick was used to outsmart a web application firewall, exploiting a vulnerability cataloged as CVE-2026-35273.

AI-Discovered Vulnerabilities Skew Toward Remote Code Execution

Stay ahead of potential threats: with AI-discovered vulnerabilities, remote code execution is a growing concern, making it crucial to examine your systems for compromise before upgrading or patching. NetScaler customers, in particular, should prioritize checking their systems for signs of exploitation.

Bitget Breach Exposes Zero-Day Flaw in Third-Party Security Products

A staggering $387.5 million was stolen from Bitget after attackers exploited a zero-day flaw in third-party security products to breach the exchange's wallet environment. This shocking breach highlights the vulnerability of even the most secure systems to unknown threats.

Google Warns of AI Data Extortion Surge

Google's top analyst warns that AI data has become a prime target for extortionists, with companies willing to pay up to keep their valuable intellectual property under wraps. Attackers are exploiting this vulnerability, as seen in recent breaches at a healthcare firm and an AI media generation company.

Breeze Comet Exploits Brazilian Payment Systems in Hundreds of Fraudulent Transactions

Meet Breeze Comet, a financially motivated threat actor that's been wreaking havoc on Brazilian payment systems with hundreds of fraudulent transactions, exploiting customized malware and compromised websites to siphon off tens of thousands of dollars. Their tactics are evolving, and Latin American countries should beware of potential expansion.

TeamPCP Linked to Years-Old Cryptojacking Operation

New research reveals that TeamPCP, a notorious cryptojacking group, has been secretly operating for years, with evidence tracing back to 2020 and a recent connection to a massive supply-chain compromise in March 2026. Their operation, linked to the TA-NATALSTATUS activity, involved a sophisticated deployment framework and shared infrastructure.

Google Unveils Unified Naming System for Hacker Groups

Say goodbye to memorization overload - Google's Threat Intelligence Group is shaking up threat tracking with a sleek, unified naming system for hacker groups, using simple two-word code names to make it easier to stay on top of cyber threats. This game-changing approach kicks off with dozens of high-priority groups and will keep expanding to make threat tracking a whole lot more intuitive.

Google Unveils Cybercrime Taxonomy, Shakes Up Threat Naming Norms

Google is shaking up the world of cybercrime threat naming with a fresh approach, introducing a simple and streamlined taxonomy that's easy to map across different systems. The tech giant has teamed up with Mandiant to launch the Google Threat Intelligence Group, using a catchy two-word naming schema to identify cybercrime crews.

Cisco SD-WAN Zero-Day Exploited for Root Access

A shocking new discovery reveals that a Cisco SD-WAN zero-day vulnerability, CVE-2026-20245, was exploited for root access at least two months before its public disclosure. This highly critical flaw, with a CVSS score of 7.8, allows attackers to execute arbitrary commands with elevated privileges.

Hackers Exploit KnowledgeDeliver Flaw to Install Web Shells

Hackers have exploited a critical flaw in KnowledgeDeliver, using it as a zero-day to sneakily install a powerful .NET web shell called Godzilla on vulnerable servers. This sneaky attack was made possible by a deserialization vulnerability, CVE-2026-5426, that allowed threat actors to execute code at the operating-system level.

Mandiant Exposes KnowledgeDeliver Vulnerability via ViewState Deserialization

A critical vulnerability, CVE-2026-5426, was discovered in KnowledgeDeliver installations, allowing unauthenticated remote code execution across multiple customer sites due to identical ASP.NET machineKey values. This widespread flaw was caused by a standardized web.config with hardcoded keys, used across deployments, leaving sites vulnerable to attack.

Remediation Programs Often Fail to Validate Fixes

The alarming truth is that remediation programs often fall short, with a staggering mismatch between the speed of exploits and fixes - Mandiant's report reveals a mean time to exploit of just -7 days, while Verizon's data shows a median remediation time of 32 days.

Microsoft Teams Used to Deploy Sophisticated Snow Malware

Cyber attackers have cleverly used Microsoft Teams to deploy a sophisticated malware suite, dubbed Snow, by tricking victims into installing a fake anti-spam patch that ultimately led to prolonged access, credential theft, and domain compromise. They started by creating a sense of urgency through email bombing, then followed up with a direct message on Microsoft Teams.

Mandiant VP Warns of Resurgent Cybersecurity Risks in AI Deployments

As organizations rush to adopt AI, they're reviving long-standing cybersecurity failures, warns Mandiant VP Jurgen Kutscher, who urges a focus on basic security controls over new AI-specific threats. Neglecting these fundamentals leaves AI-enabled environments vulnerable to measurable operational weaknesses.

Mandiant Report Reveals Evolving Cyber Threat Tactics

Discover the alarming evolution of cyber threats in Mandiant's M-Trends 2026 report, which reveals a stark reality: attackers are now operating under two distinct playbooks, drastically changing the detection, response, and risk landscape. The report uncovers a significant increase in global median dwell time to 14 days, with some attacks lingering for as long as 122 days.

A single unpatched flaw in a Dell storage appliance became a playground for hackers, allowing months of undetected espionage and the deployment of sneaky new backdoors. A joint investigation by Mandiant and Google Threat Intelligence Group uncovered this alarming zero-day exploit, which has been wreaking havoc since mid-2024.

Iran Launches Alarming Password-Spraying Attacks on M365 Accounts

As Iran's missile strikes leave destruction in their wake, a stealthier threat is emerging: coordinated password-spraying attacks targeting Microsoft 365 accounts of municipal authorities in the region. This sinister campaign seems to be exploiting the chaos, striking when defenses are down.

MonsterV2 malware: Dangerous Stunning Threat

Researchers uncovered TA585’s sophisticated campaign delivering a new MonsterV2 variant, using modular malware, resilient infrastructure and advanced obfuscation that can bypass signature-based defenses. Organizations should adopt layered detection, tighten email gateways and share intelligence now to stay ahead of these increasingly professionalized criminal operators.

Oracle E-Business Suite: Stunning Critical Breach Risk

A zero-day in Oracle E-Business Suite, actively exploited by CL0P since Aug. 9, 2025, likely hit dozens of organizations and put payroll, financial and HR data at risk. Security teams and leaders are racing to contain the damage, patch systems and lock down access before attackers strike again.

Clop ransomware: Exclusive Risky Extortion Alert

Extortion emails claiming stolen Oracle E‑Business Suite data are rattling execs — but Google and Mandiant say they’ve found no proof, leaving companies stuck between precaution and panic. The result: tough choices about trust, disclosure and whether to pay up for silence when the evidence is murky.

Google Threat Intelligence: Exclusive Risky 393-Day Breach

Google says China-linked attackers have quietly lived inside many enterprise networks since March — an average of 393 days — installing persistent backdoors and exfiltrating sensitive IP. The takeaway: tighten access, boost detection, and treat long dwell times as an urgent business and security priority.

ViewState deserialization: Critical Must-Have Patch

When Sitecore patches were abused in an active ViewState deserialization attack, Google Cloud’s Mandiant stepped in to disrupt the campaign — a stark reminder to inventory Sitecore instances, apply patches immediately, and enable ViewState protections to prevent fast-moving compromises.

OAuth tokens: Stunning Risky Drift AI Data Breach

A recent campaign abused compromised OAuth and refresh tokens tied to the Drift AI chat agent to siphon data from Salesloft—potentially creating a corridor into downstream Salesforce records. If you used Salesloft–Drift integrations, assume exposure: revoke tokens, rotate credentials, enable MFA, and audit access immediately.

CORNFLAKEV3 backdoor: Dangerous, Stunning Threat

Cybercriminals are tricking people into clicking fake CAPTCHA boxes with a social-engineering tactic called ClickFix, which silently installs the powerful CORNFLAKE.V3 backdoor and hands attackers long-term access. Stay cautious: treat unexpected verification prompts as suspicious, keep your browser and extensions up to date, and use script-blockers in untrusted contexts.