Tag: mandiant
-
Google Warns of LLMJacking Attacks That Generate Over $100,000 in Cloud AI Bills Per Day
Google’s Mandiant and Threat Intelligence Group (GTIG) say attackers are hijacking enterprise access to large language models and running up huge fraudulent cloud charges. Google’s report documents more than $100,000 in a single day. At some organizations, cumulative charges reached $1 million before they revoked access. LLMJacking Attacks Mandiant responded to multiple 2026 incidents across…
-
LLMJacking is Costing Some Businesses Up to $1m, Warns Google
Google Mandiant has warned of the high cost of hijacked access to large language models, or LLMJacking First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/llmjacking-cost-business-1m-warns/
-
Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data
Threat actors are weaponizing ARTEX, an autonomous penetration-testing framework, to accelerate network intrusions, escalate privileges, and steal sensitive information. Google Threat Intelligence Group and Mandiant investigations described in the supplied report show attackers delegating substantial portions of post-compromise operations to coordinated AI agents, compressing execution sequences into seconds. Observed since late August 2026, the activity…
-
Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data
Threat actors are weaponizing ARTEX, an autonomous penetration-testing framework, to accelerate network intrusions, escalate privileges, and steal sensitive information. Google Threat Intelligence Group and Mandiant investigations described in the supplied report show attackers delegating substantial portions of post-compromise operations to coordinated AI agents, compressing execution sequences into seconds. Observed since late August 2026, the activity…
-
Attackers Tampered with AOMEI Backupper’s Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor’s own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.Google…
-
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity. BeyondTrust patched the flaw in advisory BT26-05 and disclosed it on October 15, 2026, alongside a Mandiant analysis. BeyondTrust zero-day According to research published by BeyondTrust, the actor exploited the vulnerability…
-
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found the attackers used the flaw to upload a file, then built a path from an unprivileged web service account to root access,…
-
Kevin Mandia’s new ‘agent swarm’ security startup Armadin raises $255.5M at $2.5B valuation
Kevin Mandia, best known as the founder of Mandiant, has a new startup that is using agent swarms to test and protect enterprises. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/01/kevin-mandias-new-agent-swarm-security-startup-armadin-raises-255-5m-at-2-5b-valuation/
-
Hackers Exploit Citrix NetScaler Zero-Day to Gain Root Access and Deploy Web Shells
Threat actors are actively exploiting a critical zero-day vulnerability in Citrix NetScaler, identified as CVE-2026-88772, to gain unauthenticated root-level access to vulnerable Application Delivery Controller (ADC) and Gateway appliances. After the initial compromise, they deploy custom PHP web shells and tools to tunnel within the internal network. Mandiant Consulting and the Google Threat Intelligence Group…
-
Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
Tags: access, citrix, exploit, finance, flaw, google, government, group, intelligence, mandiant, service, technology, threat, usaUnknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations in North America and Europe.The activity, observed by Mandiant Consulting and Google Threat Intelligence Group (GTIG) in September 2026, has targeted government, financial services, technology, education, and legal and professional First seen…
-
8 Top Red Teaming Service Providers for Enterprise Adversary Emulation
Compare 8 top red teaming providers for enterprise adversary emulation, from DeepSeas and Mandiant to CrowdStrike, IBM, SpecterOps, TrustedSec and NCC Group. First seen on hackread.com Jump to article: hackread.com/red-teaming-service-providers-enterprise-adversary-emulation/
-
WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign
Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been…
-
TimeExploit laut Mandiant erstmals negativ – Bei Schwachstellen zählt bald nur noch ausnutzbar oder nicht
First seen on security-insider.de Jump to article: www.security-insider.de/patches-schuetzen-nicht-vor-zero-day-exploits-a-7774968734f0818316396c70986f52af/
-
Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
Mandiant researchers said dozens of organizations have been impacted by attacks attributed to advanced and suspected state-sponsored threat groups. They expect more attacks to come. First seen on cyberscoop.com Jump to article: cyberscoop.com/citrix-netscaler-zero-day-attacks-three-weeks-undetected/
-
ShinyHunters exploiting workarounds for Oracle PeopleSoft bug, Mandiant warns
A vulnerability in a popular line of products from Oracle is being used in a new campaign by the prolific ShinyHunters hacking group, which recently claimed credit for an attack on the FBI’s jobs site. First seen on therecord.media Jump to article: therecord.media/shinyhunters-cyberattacks-oracle-mandiant
-
Shinyhunters starten neue Angriffswelle gegen Oracle-Peoplesoft
Tags: cve, cyberattack, cybercrime, firewall, google, group, intelligence, mandiant, oracle, threat, vulnerability, wafDie Cybercrime-Gruppe Shinyhunters hat ihre Angriffe auf Oracle-Peoplesoft deutlich ausgeweitet. Mandiant und die Google Threat Intelligence Group beobachten eine erneute massenhafte Ausnutzung der Schwachstelle CVE-2026-35273. Dabei umgehen die Angreifer vorhandene Web-Application-Firewalls (WAFs) und installieren Web-Shells sowie weitere Schadsoftware auf kompromittierten Systemen. Während die Schwachstelle zunächst vor allem gegen Einrichtungen aus dem Hochschulbereich eingesetzt wurde, hat…
-
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories.Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the First seen on…
-
Kevin Mandia joins the Amazon board with 30-plus years in cybersecurity
Amazon elected Kevin Mandia to its Board of Directors on September 8. Mandia founded Mandiant and served as its CEO before Google acquired the firm in September 2022, and he … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/10/kevin-mandia-joins-amazon-board/
-
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024.Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as “specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers.” The adversary First seen on…
-
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024.Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as “specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers.” The adversary First seen on…
-
Mandiant Opens Agentic Security Harness to Industry
AVDH Scans Enterprise Code at Scale to Find and Validate Exploit Paths. Google Mandiant opened its playbook on agentic security by releasing the architecture it used to develop its Agentic Vulnerability Discovery Harness to analyzes code and quickly identify exploit paths during reviews, penetration testing and red team operations. First seen on govinfosecurity.com Jump to…
-
Google setzt KI-Agenten auf Quellcode an: Schwachstellen finden, bevor Angreifer sie ausnutzen
Google und Mandiant setzen KI-Agenten zur Quellcodeanalyse ein. AVDH findet Schwachstellen automatisiert und soll Angreifern bei der Zero-Day-Suche zuvorkommen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/google-setzt-ki-agenten-auf-quellcode-an-schwachstellen-finden-bevor-angreifer-sie-ausnutzen/a46209/
-
Google Mandiant AI Agents Find Over 100 Critical Vulnerabilities in Source Code Within Two Days
Tags: ai, breach, corporate, cyber, google, group, incident response, intelligence, mandiant, penetration-testing, RedTeam, threat, vulnerabilityGoogle’s Threat Intelligence Group has announced that its Agentic Vulnerability Discovery Harness (AVDH) identified over 100 critical true-positive vulnerabilities in stolen corporate source code repositories within just two days. This result highlights how agentic AI can significantly accelerate vulnerability discovery during incident response, red teaming, penetration testing, and proactive secure code reviews, especially when adversaries…
-
Google’s AI security agents found 100+ critical software vulnerabilities in just two days
Google’s Mandiant has disclosed the workings of an internal tool that uses chains of AI agents to hunt for vulnerabilities in source code, saying it found over 100 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/19/google-mandiant-avdh-ai-vulnerability-discovery-tool/
-
Commvault Adds Google Threat Intelligence to Threat Scan Recovery Workflows
Commvault is adding Google Threat Intelligence data and scanning capabilities to Threat Scan workflows, a move aimed at helping organizations identify compromised recovery points and choose clean data after a cyberattack. Announced during Black Hat USA 2026, the integration combines Commvault Threat Scan with intelligence from Google’s Mandiant, VirusTotal and Google threat teams. Customers will..…
-
Google changes how it names cyber threat actors
Google Threat Intelligence Group (GTIG) has started using a new naming system for the threat actors it tracks. The change comes after Mandiant and Google’s Threat … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/27/google-threat-actors-naming-system/
-
Google Launches Unified Cryptonym-Based Naming System for Threat Actors
Google Threat Intelligence Group (GTIG) has introduced a unified cryptonym-based naming system for cyber threat actors, aiming to simplify attribution, improve analyst workflows, and eliminate inconsistencies between legacy tracking conventions used across Google’s security teams. The initiative follows the integration of Mandiant and Google’s Threat Analysis Group (TAG) into GTIG. Before the merger, both organizations…
-
Zero-Day-Sicherheitslücke in Cisco-Catalyst-SD-WAN
Mandiant hat neue Forschungsergebnisse veröffentlicht, die detailliert beschreiben, wie ein Bedrohungsakteur eine inzwischen gepatchte Zero-Day-Sicherheitslücke in Cisco-Catalyst-SD-WAN (CVE-2026-20245) bei einem Kommunikationsdienstleister ausgenutzt hat, um die Rechte eines kompromittierten Administratorkontos auf vollständigen Root-Zugriff auszuweiten. Da diese Geräte den Datenverkehr innerhalb des Netzwerks steuern, könnte ein Angreifer mit Root-Rechten potenziell umfassende und unbemerkte Einblicke in den internen…