Mandiant Advantage, our SaaS platform, was always intended to house more than just our threat intelligence—and now it does. With the addition of Mandiant Automated Defense and Mandiant Security Validation, we are continuing to roll out new features in a platform that is easily accessible, as well as easy to deploy and scale. 

 Mike Armistead, SVP of Mandiant Advantage Products, joined host Luke McNamara to discuss what security teams will be able to do with these new features. Mike joined FireEye during the Respond Software acquisition, in which Respond’s solution became what is now known as Mandiant Automated Defense. Mike shared how the addition of Mandiant Automated Defense to the Mandiant Advantage platform enables the automation of tier one triage alerts. 

 One thing that really stuck out about their conversation is how weaving together Mandiant Automated Defense, Mandiant Security Validation, and Mandiant Threat Intelligence helps organizations prioritize threats that matter to them, fast.

 Listen to this episode to get a walkthrough of how a SOC analyst can use the Mandiant Advantage platform to access intel about an alert they receive. You’ll also get a glimpse into what’s next for the Mandiant Advantage platform. 

Have you ever wondered what it takes to develop our annual M-Trends report? The short answer is: a whole lot! Our host Luke McNamara asked Regina Elwell, Senior Principal Threat Analyst on the Advanced Practices Team, and Steve Stone, Senior Director for Advanced Practices, to take us behind the scenes so we can see exactly what goes into building an edition of M-Trends.  

Steve started by discussing the sheer amount of data collection that is required, and how the team has to pore over this data—which comes directly from our incident response investigations—to determine what is a trend and what is not. Regina and Steve also touched on the evolution of the report from its first iteration in 2011. Not surprisingly, the reports have gotten more robust and include new data points almost every year.  

We also discussed some of the highlights from our latest report, M-Trends 2021, and interpreted some of the key findings, including drops in median dwell time, increases in internal detections, impact of ransomware, and notable malware families from 2020. Additionally, we covered some of the process and approach Mandiant puts into grouping new threat groups (UNCs) and Steve and Regina’s favorite threat actors. 

Listen to the podcast now, and when you’re done, read the full M-Trends 2021 report. 

We are wrapping up our “Big Four” series with a country that has been
one to watch for quite some time: Russia. And who better to join me
for this episode than our Vice President for Mandiant Threat
Intelligence, John Hultquist.

We started off this episode discussing how Russian cyber threat
activity evolved to what we know today, from the days of Moonlight
Maze and Agent.BTZ. We then shifted the conversation to some of the
most notable Russian threat groups and the difficulties of assigning
attribution at the organizational sponsorship level. While many APT
groups from the “Big Four” may blend together various types of threat
activity, Russia has utilized a particularly interesting mix of cyber
espionage, information operations, and disruptive attacks over the
years.

John brought up many notable Russian incidents, including: the
Olympics, the Ukrainian power grid, the targeting of elections, and
the SolarWinds supply chain breach. We also discussed some of the
challenges in communicating threat intelligence to both customers and
wider audiences. To cap off the series, John delved into how
organizations should think about not only Russian threat activity, but
the operations and campaigns from North Korea, Iran, and China.


You can stay ahead of threat actors like those from the “Big Four” by
joining Mandiant Advantage Free where you’ll have access to
up-to-the-minute threat intelligence: http://feye.io/MA

The third installment of our “Big Four” series on China is filled with
so much great information that it’s our longest episode yet. Lloyd
Brown, Principal Analyst for our Custom Intel Team, and Scott
Henderson, Principal Analyst for our Cyber Espionage Team, joined our
host, Luke McNamara to peel back the layers of China’s cyber
capabilities.

Similar to past episodes in this series, we started at the beginning
of China’s cyber operations—dating back to 2003. Scott and Lloyd took
us through a detailed look at all the stages of China’s operations,
including the shift in 2015/2016 from being “clumsy and noisy” to
stealthy. Lloyd brings up a great point that’s worth hearing about
their use of CVE exploits (which came into play with the recent
Microsoft Exchange server exploits).

We also discussed how China’s cyber activity is driven by economic
interests such as the Belt and Road initiative, the nature of their
operations surrounding global elections, APT41’s cybercrime activity
in addition to cyber espionage, and where they think China’s
operations are headed. You’ll definitely want to stick around to the
very end. Since our initial recording occurred before the Microsoft
Exchange exploits, Luke decided to follow up with Lloyd to get his
take on HAFNIUM and the UNC groups we’re tracking related to that
activity.



Know the threats that affect your organization with up-to-the-minute
threat intelligence by signing up for Mandiant Advantage Free:
http://feye.io/MA

How does Reddit handle malicious or suspicious coordinated activity on
their platform? Our host Luke McNamara asked Aylea Baldwin, Threat
Intelligence Lead at Reddit, to answer that question and more during
this episode of Eye on Security.

During the discussion Aylea shared a few ways Reddit is unique
compared to other social media networks—its tolerance for varying
levels of behavior on different communities, the lack of user data
collection, and the way posts are amplified through voting. The voting
feature is unique to Reddit and Luke was curious to know how threat
actors leverage it as part of their influence campaigns. As it turns
out, the answer to that question isn’t so simple since foreign actors
have to get buy-in from people to up-vote their posts.

We ended our conversation with Aylea’s thoughts on the future of
disinformation and deep fake technology, which is a concern in the
security and many other industries, and something that can have a huge
influence on sites such as Reddit.

Did you know that women are disproportionately affected by cybercrime,
cyber stalking, cyber bullying, cyber harassment, and image-based
sexual abuse? We asked Cris Kittner, Principal Analyst at Mandiant
Threat Intelligence, and Lillian Teng, Director of Threat
Investigations from Verizon Media to join us for a discussion around
their recent talk on digital safety for women and practical strategies
women of all ages can take to increase their online safety.

Cris and Lillian provided their reasons and motivations for putting
together the talk, which they first presented at the Grace Hopper
Celebration in 2020. They highlighted the connection between physical
and cyber stalking and the need for these conversations to be
normalized. Far too often, Cris and Lillian heard from young
professionals that they believed the cyber harassment that was
happening to them in the workplace or at conferences was “normal.”

To combat the issues many women are facing online, Chris and Lillian
provided a list of practical considerations that women should follow,
such as using a password manager, knowing what permissions are being
given to third-party applications, understanding that Snapchat images
can be recovered, adjusting (or eliminating) location tags, and how to
report abuse happening on social media sites.

Listen to the episode today for online safety strategies that can help
you or a loved one stay safe online.

We’re back with the second episode of our “Big Four” series focused on
North Korea, Iran, China, and Russia. We honed in on Iran for this
one, and to help explore their cyber capabilities, we invited Sarah
Hawley, Principal Analyst for Mandiant Threat Intelligence, and Lee
Foster, Senior Manager of Information Operations Analysis.

Sarah kicked off the episode by providing an overview of Iran’s past
offensive cyber activity and how these capabilities have developed
over the years. Lee shared how they have also grown their usage and
willingness to use information operations (IO) and how his team
approaches attribution and analysis of this disinformation activity.

We then touched on drivers of Iranian cyber threat and their apparent
increasing willingness to target democratic processes. Sarah also
discussed Iran’s destructive activity going after industrial targets
in the oil and gas sectors through password spraying and spear
phishing operations.

As always, we closed out the episode with thoughts about what Sarah
and Lee think we might see from Iran’s cyber operations in the coming
years. Listen to hear their predictions and stay tuned for our
upcoming episodes on China and Russia.

Listen to the podcast now, check out the “Big Four” episode on North
Korea if you haven’t already, and then head over to our Eye on
Security page for even more episodes.

“Legitimate access rules the threat landscape”, says Jon Ford,
Managing Director at Mandiant. In addition to loss of intellectual
property, malicious insiders are increasingly impacting organizational
reputation, customer trust and investor confidence. There’s a lot more
to insider cyber security threats than disgruntled employees, which is
the first thing that comes to mind for most when they think of this
threat. Jon Ford, Managing Director of Mandiant, and Johnny Collins,
Director of Mandiant, joined us to break down what insider threats are
and the trends Mandiant is seeing in recent investigations.

Johnny began by defining insider threats—from unintended link
clicking, all the way up to human enabled technical operations (think
meet-ups in parks while avoiding all electronic communications that
you see in movies). Both Johnny and Jon shared how organizations on
the commercial and government sides are thinking about insider threats
as part of their overall risk and security posture, and how clients
are approaching insider threat security from a behavior-focused
approach as opposed to targeting or profiling individuals.

Then we got to the good part: stories from recent investigations
they’ve worked on through Mandiant’s Insider Threat Security Services
offerings. You might be surprised by the outcomes of a few of them.
Johnny and Jon went on to highlight the various tiers of Mandiant’s
Insider Threat Program Assessments and Mandiant’s Insider Threat
Security as a Service offering with Mandiant Intelligence. Johnny and
Jon close with shared thoughts on the growing Insider Threat trends
we’ll see in the near future.

While many cyber threats and security issues are universal and
experienced by organizations in any part of the world, some are more
common to a particular region than others. Host Luke McNamara invited
Ryan Goss, Vice President for Latin America & the Caribbean, and Juan
Carlos Garcias Caparros, Director of Mandiant Consulting for Latin
America and the Caribbean, to talk specifically about cyber security
in Latin America.

Juan Carlos shares what threats we’ve seen our customers face in Latin
America. He also discusses the security culture in Latin America,
comparing maturity of organizations to those in United States or
Europe. We also explore whether attitudes are shifting around cyber
security in boardrooms. Ryan believes it’s moving in a good direction,
but that many companies still treat cyber security as an afterthought,
which leads to lower overall budgets and forces security teams to
focus on solutions that are “good enough” or at least allow them to
“check the compliance box”. Thus the importance of FireEye leading
with Mandiant Services and establishing ourselves as trusted advisors
and true partners for our customers.

We wrap up the episode by touching on cyber training, security
validation and unexpected activity from North Korea targeting
financial institutions throughout Latin America.

We’re kicking off Eye on Security in 2021 with a nation-state-themed
miniseries that focuses on the big four, which we recognize as North
Korea, Iran, China and Russia. In this episode, host Luke McNamara
invited Fred Plan, Senior Analyst for Mandiant Threat Intelligence,
onto the podcast to talk about North Korea.

Fred started our discussion by providing some background on the
country, how it operates geopolitically, and why they’ve shifted their
focus to a cyber capability. We also review their early cyber
operations that primarily targeted South Korea and their expansion to
the U.S. private sector with the Sony hack. Since then, North Korea
continues to be active in both financially-motivated and
espionage-related operations.

There are a lot of behaviors that make North Korean cyber operations
unique, due in part to the country being very closed off. Their cyber
operations have demonstrated rapid shifts in targeting, which likely
comes at the request of the regime. We most recently saw this with
their targeting of COVID-19 research and vaccine distribution. North
Korea hasn’t publicly reported on any COVID-19 cases, so their cyber
behavior offers us a glimpse into what might actually be going on
within the country.

As always, we like to predict what we’ll see next in a region or from
an actor. In this case, Fred says it’s quite difficult to know what
North Korea is up to next. Find out why when you listen to the
episode.