Mandiant
Mandiant is a cybersecurity company acquired by Google in 2022 and now operating as a brand under Google Cloud. The company is known for threat intelligence, incident response, and security consulting services, with particular expertise in tracking and analyzing advanced persistent threats (APTs) and nation-state cyberattacks. Its research findings are widely applied to cyber defense and security assessment in critical sectors including government, finance, and energy.
Core Facts
Timeline (last 90 days)
Attack acceleration began long ago and predates the emergence of large language models, a trend corroborated by Cisco's own reports, Mandiant's M-Trends, and Verizon DBIR data.
Mandiant described the paired use of the WHIPSHOT and SLAPSHOT tools: WHIPSHOT is a PHP WebShell that hides Base64-encoded C2 payloads in native HTTP headers, and SLAPSHOT is a Python tunneling tool that proxies traffic into the internal network.
Reports from professional organizations such as Mandiant and CrowdStrike generally indicate that the primary use cases of AI by APT groups currently remain concentrated on efficiency improvement rather than creating entirely new attack types
Kevin Mandia是Mandiant的创始人
Flare-On is hosted by the Mandiant security team, and Mandiant is now part of Google.
Independent threat intelligence firms such as Mandiant and CrowdStrike can be used for technical verification of leak incidents.
According to Mandiant data, the average time-to-exploitation of zero-day vulnerabilities in 2023 has been shortened from approximately 60 days in 2020 to fewer than 5 days.
All Facts (11)
Google acquired Mandiant in 2022 for $5.4 billion.
65%VerifiedAccording to statistics from Google Project Zero, more than 90 zero-day vulnerabilities were actively exploited globally in 2023.
65%UnverifiedGTIG是谷歌在2024年整合旗下多个安全团队后形成的统一威胁情报力量，融合了Mandiant、VirusTotal和TAG的能力
90%Unverified2023年全年被追踪到的在野零日利用超过90个，呈逐年上升趋势
75%UnverifiedAttack acceleration began long ago and predates the emergence of large language models, a trend corroborated by Cisco's own reports, Mandiant's M-Trends, and Verizon DBIR data.
50%UnverifiedMandiant described the paired use of the WHIPSHOT and SLAPSHOT tools: WHIPSHOT is a PHP WebShell that hides Base64-encoded C2 payloads in native HTTP headers, and SLAPSHOT is a Python tunneling tool that proxies traffic into the internal network.
50%UnverifiedReports from professional organizations such as Mandiant and CrowdStrike generally indicate that the primary use cases of AI by APT groups currently remain concentrated on efficiency improvement rather than creating entirely new attack types
50%UnverifiedKevin Mandia是Mandiant的创始人
50%UnverifiedFlare-On is hosted by the Mandiant security team, and Mandiant is now part of Google.
50%UnverifiedIndependent threat intelligence firms such as Mandiant and CrowdStrike can be used for technical verification of leak incidents.
50%UnverifiedAccording to Mandiant data, the average time-to-exploitation of zero-day vulnerabilities in 2023 has been shortened from approximately 60 days in 2020 to fewer than 5 days.
50%