< div class=”block-paragraph_advanced”> Executive Summary Cybercrime makes up a majority of the malicious activity online and occupies the majority of defenders’ resources. In 2024, Mandiant Consulting responded to almost four times more intrusions conducted by financially motivated actors than state-backed…
Tag: Threat Intelligence
Using capa Rules for Android Malware Detection
< div class=”block-paragraph_advanced”> Mobile devices have become the go-to for daily tasks like online banking, healthcare management, and personal photo storage, making them prime targets for malicious actors seeking to exploit valuable information. Bad actors often turn to publishing and…
CVE-2023-6080: A Case Study on Third-Party Installer Abuse
Written By: Jacob Paullus, Daniel McNamara, Jake Rawlins, Steven Karschnia < div class=”block-paragraph_advanced”> Executive Summary Mandiant exploited flaws in the Microsoft Software Installer (MSI) repair action of Lakeside Software’s SysTrack installer to obtain arbitrary code execution. An attacker with low-privilege…
Adversarial Misuse of Generative AI
< div class=”block-paragraph_advanced”> Rapid advancements in artificial intelligence (AI) are unlocking new possibilities for the way we work and accelerating innovation in science, technology, and beyond. In cybersecurity, AI is poised to transform digital defense, empowering defenders and enhancing our…
Adversarial Misuse of Generative AI
< div class=”block-paragraph_advanced”> Rapid advancements in artificial intelligence (AI) are unlocking new possibilities for the way we work and accelerating innovation in science, technology, and beyond. In cybersecurity, AI is poised to transform digital defense, empowering defenders and enhancing our…
ScatterBrain: Unmasking the Shadow of PoisonPlug’s Obfuscator
Written by: Nino Isakovic Introduction Since 2022, Google Threat Intelligence Group (GTIG) has been tracking multiple cyber espionage operations conducted by China-nexus actors utilizing POISONPLUG.SHADOW. These operations employ a custom obfuscating compiler that we refer to as “ScatterBrain,” facilitating attacks…
Securing Cryptocurrency Organizations
Written by: Joshua Goddard < div class=”block-paragraph_advanced”> The Rise of Crypto Heists and the Challenges in Preventing Them Cryptocurrency crime encompasses a wide range of illegal activities, from theft and hacking to fraud, money laundering, and even terrorist financing, all…
Your Single-Page Applications Are Vulnerable: Here’s How to Fix Them
Written by: Steven Karschnia, Truman Brown, Jacob Paullus, Daniel McNamara < div class=”block-paragraph_advanced”> Executive Summary Due to their client-side nature, single-page applications (SPAs) will typically have multiple access control vulnerabilities By implementing a robust access control policy on supporting APIs, the…
Backscatter: Automated Configuration Extraction
Written by: Josh Triplett < div class=”block-paragraph_advanced”> Executive Summary Backscatter is a tool developed by the Mandiant FLARE team that aims to automatically extract malware configurations. It relies on static signatures and emulation to extract this information without dynamic execution,…
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation
Written by: John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson < div class=”block-paragraph_advanced”>Note: This is a developing campaign under active analysis by Mandiant and Ivanti. We will continue to add more indicators,…