Research reports
1,224 reports from 387 publishers45 added in the past week
7 reports, newest added first
Added Sat 24 Oct
Investigating Ephemeral Supply Chain Tampering
Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst…
Supply chain
ARMORY CASTLE Exploits BeyondTrust
Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…
Vulnerabilities
Added Sun 18 Oct
Mandiant Cybersecurity Consulting
Elevate your cyber defense, from incident response to business resilience. Mandiant Cybersecurity Consulting Elevate your cyber defense, from incident response to business resilience. Cyber Defense Summit 2026 Watch the keynotes on YouTube M-Trends 2026 Stay…
Added Fri 16 Oct
Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety
UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors…
RansomwareState-sponsoredPhishing
Added Wed 14 Oct
Beyond source code: The files AI coding agents trust — and attackers exploit
As AI coding agents become deeply embedded in developer workflows, defenders must evolve their definition of malicious files and rethink how to protect against them. Autonomous AI agents operate across integrated development environments (IDEs), editors,…
Vulnerabilities
M-Trends 2026: Data, Insights, and Strategies From the Frontlines
Every year, the cyber threat landscape forces defenders to adapt to evolving adversary tactics, techniques, and procedures (TTPs). In 2025, Mandiant observed a clear divergence in adversary pacing that closely aligns with the trends we have been documenting…
Added Wed 7 Oct
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with…
State-sponsoredVulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.