Mandiant - Security Ticks

Rapid7 Reveals RCE Path in Ivanti VPN Appliance After Silent Patch Debacle

Connect Secure, CVE-2025-22457, Incident Response, Ivanti, Malware & Threats, Mandiant, Rapid7, VPN, Vulnerabilities / SecurityTicks

Rapid7 Reveals RCE Path in Ivanti VPN Appliance After Silent Patch Debacle 2025-04-11 at 21:05 By Ryan Naraine The CVE-2025-22457 has already been exploited by a China-nexus hacking gang notorious for breaking into edge network devices. The post Rapid7 Reveals RCE Path in Ivanti VPN Appliance After Silent Patch Debacle appeared first on SecurityWeek. This […]

React to this headline:

Rapid7 Reveals RCE Path in Ivanti VPN Appliance After Silent Patch Debacle Read More »

Google Targets SOC Overload With Automated AI Alert and Malware Analysis Tools

agentic AI, AI, Artificial Intelligence, Google, Mandiant, SOC, Threat Intelligence / SecurityTicks

Google Targets SOC Overload With Automated AI Alert and Malware Analysis Tools 2025-04-09 at 20:50 By Ryan Naraine Google plans to unleash automated AI agents into overtaxed SOCs to reduce the manual workload for cybersecurity investigators. The post Google Targets SOC Overload With Automated AI Alert and Malware Analysis Tools appeared first on SecurityWeek. This

React to this headline:

Google Targets SOC Overload With Automated AI Alert and Malware Analysis Tools Read More »

Google Pushing ‘Sec-Gemini’ AI Model for Threat-Intel Workflows

Artificial Intelligence, Gemini, Google, Mandiant, Sec-Gemini, Threat Intelligence, threat-intel / SecurityTicks

Google Pushing ‘Sec-Gemini’ AI Model for Threat-Intel Workflows 2025-04-07 at 18:06 By Ryan Naraine Experimental Sec-Gemini v1 touts a combination of Google’s Gemini LLM capabilities with real-time security data and tooling from Mandiant. The post Google Pushing ‘Sec-Gemini’ AI Model for Threat-Intel Workflows appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View

React to this headline:

Google Pushing ‘Sec-Gemini’ AI Model for Threat-Intel Workflows Read More »

Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)

cyber espionage, Don't miss, Hot stuff, Ivanti, Mandiant, News, VPN, vulnerability / SecurityTicks

Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457) 2025-04-03 at 21:01 By Zeljka Zorz A suspected Chinese APT group has exploited CVE-2025-22457 – a buffer overflow bug that was previously thought not to be exploitable – to compromise appliances running Ivanti Connect Secure (ICS) 22.7R2.5 or earlier or Pulse Connect Secure 9.1x. The vulnerability

React to this headline:

Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457) Read More »

Chinese APT Pounces on Misdiagnosed RCE in Ivanti VPN Appliances

Connect Secure, CVE-2025-22457, Ivanti, Malware & Threats, Mandiant, Network Security, Pulse Connect, UNC5221 / SecurityTicks

Chinese APT Pounces on Misdiagnosed RCE in Ivanti VPN Appliances 2025-04-03 at 20:17 By Ryan Naraine Ivanti misdiagnoses a remote code execution vulnerability and Mandiant reports that Chinese hackers are launching in-the-wild exploits. The post Chinese APT Pounces on Misdiagnosed RCE in Ivanti VPN Appliances appeared first on SecurityWeek. This article is an excerpt from

React to this headline:

Chinese APT Pounces on Misdiagnosed RCE in Ivanti VPN Appliances Read More »

CISA reveals new malware variant used on compromised Ivanti Connect Secure devices

China, CISA, cyber espionage, Don't miss, Hot stuff, Ivanti, Malware, Mandiant, Microsoft, News / SecurityTicks

CISA reveals new malware variant used on compromised Ivanti Connect Secure devices 2025-03-31 at 16:12 By Zeljka Zorz CISA has released indicators of compromise, detection signatures, and updated mitigation advice for rooting out a newly identified malware variant used by the attackers who breached Ivanti Connect Secure VPN appliances in December 2024 by exploiting the

React to this headline:

CISA reveals new malware variant used on compromised Ivanti Connect Secure devices Read More »

Mandiant Uncovers Custom Backdoors on End-of-Life Juniper Routers

backdoor, China, Juniper, Junos OS, Mandiant, Nation-State, Network Security, UNC3886 / SecurityTicks

Mandiant Uncovers Custom Backdoors on End-of-Life Juniper Routers 2025-03-12 at 18:45 By Ryan Naraine China-nexus cyberespionage group caught planting custom backdoors on end-of-life Juniper Networks Junos OS routers. The post Mandiant Uncovers Custom Backdoors on End-of-Life Juniper Routers appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source React to this

React to this headline:

Mandiant Uncovers Custom Backdoors on End-of-Life Juniper Routers Read More »

How Russian Hackers Are Exploiting Signal ‘Linked Devices’ Feature for Real-Time Spying

APT44, cyberespionage, Malware & Threats, Mandiant, Nation-State, QR code, Sandworm, Signal Messenger / SecurityTicks

How Russian Hackers Are Exploiting Signal ‘Linked Devices’ Feature for Real-Time Spying 2025-02-19 at 13:04 By Ryan Naraine Mandiant warns that multiple Russian APTs are abusing a nifty Signal Messenger feature to surreptitiously spy on encrypted conversations. The post How Russian Hackers Are Exploiting Signal ‘Linked Devices’ Feature for Real-Time Spying appeared first on SecurityWeek.

React to this headline:

How Russian Hackers Are Exploiting Signal ‘Linked Devices’ Feature for Real-Time Spying Read More »

UK domain registry Nominet breached via Ivanti zero-day

0-day, CISA, Don't miss, Hot stuff, Ivanti, Mandiant, News, Nominet, Shadowserver, WatchTowr / SecurityTicks

UK domain registry Nominet breached via Ivanti zero-day 2025-01-13 at 22:17 By Zeljka Zorz The number of internet-facing Ivanti Connect Secure instances vulnerable to attack via CVE-2025-0282 has fallen from 2,048 to 800 in the last four days, the Shadowserver Foundation shared today. In the meantime, UK domain registry Nominet became the first publicly known

React to this headline:

UK domain registry Nominet breached via Ivanti zero-day Read More »

Ivanti Connect Secure zero-day exploited since mid-December (CVE-2025-0282)

0-day, Don't miss, enterprise, Hot stuff, Ivanti, Mandiant, News, VPN / SecurityTicks

Ivanti Connect Secure zero-day exploited since mid-December (CVE-2025-0282) 2025-01-09 at 14:23 By Zeljka Zorz The zero-day attacks leveraging the Ivanti Connect Secure (ICS) vulnerability (CVE-2025-0282) made public on Wednesday were first spotted in mid-December 2024, Mandiant researchers have shared. It’s still impossible to say whether they were mounted by a single threat actor, but the

React to this headline:

Ivanti Connect Secure zero-day exploited since mid-December (CVE-2025-0282) Read More »

Ivanti Connect Secure zero-day exploited by attackers (CVE-2025-0282)

Don't miss, enterprise, Hot stuff, Ivanti, Mandiant, Microsoft, News, VPN / SecurityTicks

Ivanti Connect Secure zero-day exploited by attackers (CVE-2025-0282) 2025-01-08 at 21:49 By Zeljka Zorz Ivanti has fixed two vulnerabilities affecting Ivanti Connect Secure, Policy Secure and ZTA gateways, one of which (CVE-2025-0282) has been exploited as a zero-day by attackers to compromise Connect Secure VPN appliances. About CVE-2025-0282 and CVE-2025-0283 Both are stack-based buffer overflow

React to this headline:

Ivanti Connect Secure zero-day exploited by attackers (CVE-2025-0282) Read More »

Defenders must adapt to shrinking exploitation timelines

0-day, Don't miss, exploit, Hot stuff, Mandiant, News, patching, report, vulnerability management / SecurityTicks

Defenders must adapt to shrinking exploitation timelines 2024-10-16 at 15:16 By Zeljka Zorz A new report from Mandiant reveals that the average time-to-exploit vulnerabilities before or after a patch is released has plunged to just five days in 2023, down from 32 days in 2021 in 2022. One reason for this is the fact that,

React to this headline:

Defenders must adapt to shrinking exploitation timelines Read More »

Private US companies targeted by Stonefly APT

APT, Don't miss, enterprise, extortion, government-backed attacks, Hot stuff, Mandiant, News, North Korea, Symantec, USA / SecurityTicks

Private US companies targeted by Stonefly APT 2024-10-03 at 14:01 By Zeljka Zorz Undeterred by the indictment issued against one of its alleged members, North Korean APT group Stonefly (aka APT45) continues to target companies in the US, Symantec threat analysts warned. About Stonefly Also known as Andariel and OnyxFleet, Stonefly has been linked to

React to this headline:

Private US companies targeted by Stonefly APT Read More »

North Korea Hackers Linked to Breach of German Missile Manufacturer

APT43, Diehl Defence, Kimsuky, Mandiant, Nation-State, North Korea, phishing / SecurityTicks

North Korea Hackers Linked to Breach of German Missile Manufacturer 2024-09-30 at 20:46 By Ryan Naraine The targeting of Diehl Defence is significant because the company specializes in the production of missiles and ammunition. The post North Korea Hackers Linked to Breach of German Missile Manufacturer appeared first on SecurityWeek. This article is an excerpt

React to this headline:

North Korea Hackers Linked to Breach of German Missile Manufacturer Read More »

Iranian APT Operating as Initial Access Provider to Networks in the Middle East

APT34, Iran, Mandiant, Nation-State, UNC1860 / SecurityTicks

Iranian APT Operating as Initial Access Provider to Networks in the Middle East 2024-09-24 at 19:01 By Ionut Arghire Iranian state-sponsored threat actor UNC1860 is operating as an initial access provider to high-profile networks in the Middle East. The post Iranian APT Operating as Initial Access Provider to Networks in the Middle East appeared first

React to this headline:

Iranian APT Operating as Initial Access Provider to Networks in the Middle East Read More »

Mandiant Offers Clues to Spotting and Stopping North Korean Fake IT Workers

China, Fraud & Identity Theft, KnowBe4, Mandiant, Nation-State, North Korea, Russia, UNC5267 / SecurityTicks

Mandiant Offers Clues to Spotting and Stopping North Korean Fake IT Workers 2024-09-23 at 20:31 By Ryan Naraine Mandiant shines the spotlight on the growing infiltration of US and Western companies by North Korean fake IT workers. The post Mandiant Offers Clues to Spotting and Stopping North Korean Fake IT Workers appeared first on SecurityWeek.

React to this headline:

Mandiant Offers Clues to Spotting and Stopping North Korean Fake IT Workers Read More »

Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) released

Autodesk, IBM, Industry news, Intel 471, Mandiant, Signify, Tidal Cyber, Trellix / SecurityTicks

Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) released 2024-08-05 at 15:46 By Industry News A partnership of 28 industry leaders serving public and private organizations across the vendor and consumer community volunteered their time, effort, and experience to launch the first version of the Cyber Threat Intelligence Capability Maturity Model (CTI-CMM), designed as the first-of-its-kind

React to this headline:

Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) released Read More »

Mandiant Shines Spotlight on APT45 Behind North Korea’s Digital Military Machine

Andariel, APT45, Lazarus, Malware & Threats, Mandiant, Nation-State, North Korea, Ransomware / SecurityTicks

Mandiant Shines Spotlight on APT45 Behind North Korea’s Digital Military Machine 2024-07-25 at 14:16 By Ryan Naraine A fresh Mandiant report documents North Korea’s APT45 as a distinct hacking team conducting cyberespionage and ransomware operations. The post Mandiant Shines Spotlight on APT45 Behind North Korea’s Digital Military Machine appeared first on SecurityWeek. This article is

React to this headline:

Mandiant Shines Spotlight on APT45 Behind North Korea’s Digital Military Machine Read More »

Chinese Hacking Group APT41 Infiltrates Global Shipping and Tech Sectors, Mandiant Warns

APT41, China APT, Cyberwarfare, Malware & Threats, Mandiant, Nation-State, Winnti / SecurityTicks

Chinese Hacking Group APT41 Infiltrates Global Shipping and Tech Sectors, Mandiant Warns 2024-07-18 at 22:01 By Ryan Naraine Chinese government-backed hacking team caught breaking into organizations in shipping, logistics and automotive sectors in Europe and Asia. The post Chinese Hacking Group APT41 Infiltrates Global Shipping and Tech Sectors, Mandiant Warns appeared first on SecurityWeek. This

React to this headline:

Chinese Hacking Group APT41 Infiltrates Global Shipping and Tech Sectors, Mandiant Warns Read More »

YetiHunter: Open-source threat hunting tool for Snowflake environments

Don't miss, Hot stuff, Mandiant, News, open source, Permiso, Snowflake, threat detection, threat hunting / SecurityTicks

YetiHunter: Open-source threat hunting tool for Snowflake environments 2024-06-14 at 13:31 By Zeljka Zorz Cloud identity protection company Permiso has created YetiHunter, a threat detection and hunting tool companies can use to query their Snowflake environments for evidence of compromise. YetiHunter executing queries (Source: Permiso Security) Recent attacks against Snowflake customers Cloud-based data storage and

React to this headline:

YetiHunter: Open-source threat hunting tool for Snowflake environments Read More »