Research reports

apt37-reaper-the-overlooked-north-korean-actor.pdf

On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper). Recent examination of this group’s activities by FireEye…

State-sponsoredMalwareVulnerabilities

rpt-fin-10-anatomy-of-a-cyber-en.pdf

Lessons learned from investigating FIN10 and other disruptive breaches 12 Conclusion 14 Appendix - Sample Extortion Email 15

Ransomware

threat_horizons_report_h1_2025.pdf

Database Security: Critical Cloud Protection 14 Threat Actor Spotlight: UNC2165 Ransomware 16 and Data Theft Extortion Disrupting Financially Motivated Threat Actors 21 Conducting Cloud Hijacking Campaigns Growing Threat from Data Leak Sites Enabling 24…

Ransomware

m_trends_2023_report.pdf

Information Operations Surrounding Russia’s Invasion of Ukraine 63 Takeaways 64 North Korea’s Financial Operations Continue to Evolve 65 NFTs, Bridges, Ransomware and More: North Korean Cybercrime in 2022 67 Not Just Money: Continued Intelligence Collection…

m-trends-2024.pdf

Artificial Intelligence in Red (and Purple) Team Operations 81 Conclusion 83 Bibliography 85 SPECIAL REPORT: MANDIANT M-TRENDS 2023 3

01-chinese-espionage-article-m-trends-2024.pdf

Endpoint detection and response (EDR) platforms have become commonplace among companies seeking to expand the visibility into endpoint activity necessary to provide a baseline of security monitoring. This increase in visibility has forced attackers to evolve…

State-sponsored

Poison Ivy Malware Analysis

No excerpt available.

Malware

apt43-report-en.pdf

2M A N D I A N T APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations APT43 Executive Summary • APT43 is a prolific cyber operator that supports the interests of the North Korean regime. The group combines moderately-sophisticated technical…

State-sponsored

M-Trends Report - 2020

Monetizing Ransomware 35 Crimeware as a Service 36 Threats From Within 40 4 SPECIAL REPORT M-TRE

Malware

rpt-apt38-2018-web_v5-1.pdf

APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions, as well as some of the world's largest cyber heists. Based on widely publicized operations alone, the group has…

State-sponsored

Snowflake Threat Hunting Guide

This document contains threat hunting guidance and queries for detecting abnormal and malicious activity across Snowflake customer database instances. Default retention policies for the relevant views enable threat hunting across the past 1 year (365 days).…

APT1: Exposing One of China’s Cyber Espionage Units

APT1: Exposing One of China’s Cyber Espionage Units | Mandiant | FireEye APT1 Exposing One of China’s Cyber Espionage Units Mandiant APT1 www.mandiant.com Contents Executive…

State-sponsored

apt44-unearthing-sandworm.pdf

Gabby Roncone, Dan Black, John Wolfram, Tyler McLellan, Nick Simonian, Ryan Hall, Anton Prokopenkov, Dan Perez, Lexie Aytes, Alden Wahlstrom Acknowledgements Collaboration with companies and governments to track and mitigate threats is critical to our…

State-sponsored