Mandiant (Google Cloud)
APT attribution and technical IOCs
Mandiant (now part of Google Cloud) has been at the forefront of threat intelligence and incident response for decades. Their APT naming conventions and attribution methodologies have become industry standards, and their research consistently reveals some of the most sophisticated threats facing organizations.
Why Follow This Blog
Mandiant’s combination of frontline incident response experience and dedicated threat research produces intelligence unmatched in depth and accuracy. Their APT research has defined how the industry understands nation-state threats.
Key Topics Covered
APT Research
- APT Attribution: Threat group identification and tracking
- Campaign Analysis: Multi-year operation documentation
- Tool Analysis: Nation-state malware families
- TTP Evolution: Technique development over time
- Geographic Focus: Region-specific threat analysis
Incident Response Insights
- Case Studies: Real-world IR experiences
- Attack Patterns: Common intrusion methods
- Forensic Techniques: Investigation methodologies
- Recovery Guidance: Remediation best practices
Malware Analysis
- Custom Malware: Bespoke threat actor tools
- Backdoors: Persistent access mechanisms
- Rootkits: Deep system compromise
- Wipers: Destructive malware analysis
Vulnerability Research
- Zero-Day Analysis: Novel vulnerability discovery
- Exploitation Tracking: In-the-wild exploitation
- Patch Analysis: Understanding fixes
- Mitigation Guidance: Defensive recommendations
M-Trends Report
The annual M-Trends report is essential reading, covering global threat statistics, dwell time trends, detection source analysis, industry-specific insights, and actionable recommendations based on hundreds of real-world incidents.