Top all-time · #1416
Google Cloud
Company blog · mandiant.com/resources/blogsecurity
Google Cloud is the company blog at mandiant.com, writing about security. Since 2013, 50 different Hacker News readers have linked it 56 times, most often “Ghidrathon: Snaking Ghidra with Python 3 Scripting”. No feed was found, so read it on the site itself.
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
Most-linked posts?
- Ghidrathon: Snaking Ghidra with Python 3 Scripting2 people · 2 mentions · first linked 2022-09-02
- /apt12 people · 2 mentions · first linked 2013-02-20
- North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack2 people · 2 mentions · first linked 2023-07-24
- Google to Acquire Mandiant2 people · 2 mentions · first linked 2022-03-08
- Evolution of UNC4990: Uncovering USB Malware's Hidden Depths2 people · 2 mentions · first linked 2024-01-31
- Proactive Preparation and Hardening to Protect Against Destructive Attacks2 people · 2 mentions · first linked 2022-01-14
What Hacker News says?
Mandiant | Senior DevOps Engineer | Remote (US) The Managed Defense DevOps team is hiring. We are the backbone of the Mandiant Engineering organization. Our job is to ensure the success of our products and services. We partner with engineering teams to design world-class cybersecurity solutions. As a member of the team, you’ll maintain CI pipelines, participate in designing scalable and robust systems and contribute…
Comment linking /company/press-release/mgc
on “Ask HN: Who is hiring? (June 2022)”Submitted Google to Acquire Mandiant as a story · 353 points
HN discussionThe link above has a typo, here's the corrected link: https://www.mandiant.com/resources/apt1-exposing-one-of-chin...
Comment linking /resources/apt1-exposing-one-of-chinas-cyber-espionage-units
on “Google to Acquire Mandiant”Submitted Mandiant Exposes APT1, One of China’s Cyber Espionage Units as a story · 140 points
HN discussionKevin Mandia was always incredible at finding a grade A talent pipeline of IR professionals that enabled Mandiant to always be the folks that responded to the incidents "that mattered" (his words). Their APT-1 report ( https://www.mandiant.com/resources/apt1-exposing-one-of-chin... they released in 2013 was at the time unprecedented and brought awareness to nation-state sponsored hacking to a much broader audience t…
Comment linking /resources/apt1-exposing-one-of-chinas-cyber-espionage-unit)s
on “Google to Acquire Mandiant”Submitted Attackers Exploit Heartbleed to Circumvent Multi-factor Authentication on VPNs as a story · 37 points
HN discussionREMOTE - Mandiant/FireEye - http://mandiant.com / http://fireeye.com We're currently looking for several roles, including a junior front-end dev, Rails developers, and several security analyst positions that aren't on my team. On my team, we use Rails 4.x, PostgreSQL, Redis, etc. For the front-end role, we're looking for someone who wants to work more on the HTML/CSS implementation side of things and less so JavaScr…
Comment linking /
on “Ask HN: Who is hiring? (May 2014)”Submitted Suspected Russian Hackers Targeting Govt and Business Entities Around the Globe as a story · 6 points
HN discussionhttps://www.mandiant.com Sometimes they're called auditors. Or "formal audits" because people think if they call something "formal" it's somehow different from not being "formal".
Comment linking /
on “The wild world of non-C operating systems”Submitted Chinese Espionage Group UNC3886 Found Exploiting CVE-2023-34048 Since Late 2021 as a story · 5 points
HN discussionAlso F5 or Citrix: some of their core security products had 90s-style C exploits and other signs of development practices well behind the times - roughly at the level of going to surgery and seeing your surgeon not washing their hands in the bathroom. https://www.cisa.gov/guidance-addressing-citrix-netscaler-ad... https://www.mandiant.com/resources/blog/session-hijacking-ci... https://www.fortinet.com/blog/threat-re…
Comment linking /resources/blog/session-hijacking-citrix-cve-2023-4966
on “What we know about the xz Utils backdoor that almost infected the world”Submitted Russian-affiliated APT29 targeting German political parties – Mandiant as a story · 4 points
HN discussionREMOTE - Mandiant/FireEye - http://mandiant.com / http://fireeye.com We have positions open in both development (Ruby, Node.js, etc.) and security-analyst-type positions (I know we were looking for malware analysts recently, for example). Previously, candidates had to be U.S.-based, but now that we've been acquired by FireEye, we have a little more flexibility on international candidates. So, if you're interested, d…
Comment linking /
on “Ask HN: Who is hiring? (February 2014)”Submitted Google Completes Acquisition of Mandiant as a story · 4 points
HN discussionGoogle "live incident response" software. The author works for a security company, they get hired to detect malware and intruders. You can remotely connect to machines and analyze memory, commands, etc. It doesn't matter what TTY it was when you have full system access. http://digital-forensics.sans.org/blog/2011/07/21/live-mem-f... https://code.google.com/p/grr/ https://www.mandiant.com/resources/download/redline
Comment linking /resources/download/redline
on “We may have witnessed a NSA "Shotgiant" TAO-like action”Submitted Pro-PRC Dragonbridge Influence Campaign Targets Rare Earths Mining Companies as a story · 4 points
HN discussionAttribution is generally hard in these types of things, and some guy with IR experience can probably explain more than I can. However, some of these attack groups follow specific patterns, use specific IP addresses, domains, emails, etc. because there is no real consequence to them doing so. Kaspersky, Mandiant et al [1] often have great writeups on these types of things that are often posted to their own blogs and…
Comment linking /apt1
on “Twitter Tells Users They May Be Targets of a 'State Sponsored Attack'”Submitted Russian-affiliated APT-29 targeting German political parties - Mandiant as a story · 3 points
HN discussionnot sure if this specific TTP is common, but generally there are a lot of ways that malware authors perform first c2 discovery and then actual c2. attackers can use DNS itself for both of these aspects of C2. Even very old reports of since-long-gone attackers like APT1 https://www.mandiant.com/media/9941/download indicate use of covert c2 over otherwise benign web applications like google calendar.
Comment linking /media/9941/download
on “New SysJoker Backdoor Targets Windows, Linux, and macOS”Submitted Evolution of UNC4990: Uncovering USB Malware's Hidden Depths as a story · 3 points
HN discussionhttps://www.mandiant.com/resources/blog/how-mandiant-tracks-...
Comment linking /resources/blog/how-mandiant-tracks-uncategorized-threat-actors
on “US airport websites under DoS attack”Submitted Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally as a story · 3 points
HN discussionThe quote you embedded is attributed to a person and where they work? Perhaps you meant to quote something else? Mandiants attribution methodology is trivially found on their website: https://www.mandiant.com/resources/blog/how-mandiant-tracks-...
Comment linking /resources/blog/how-mandiant-tracks-uncategorized-threat-actors
on “US airport websites under DoS attack”Submitted Don't (at) Me: URL Obfuscation Through Schema Abuse as a story · 3 points
HN discussionThat depends on the industry and company size, and also on your definition of a breach. 45% of all retail companies DETECTED at least one serious information systems breach in 2013. (Many more would have experienced a breach without knowing.) According to Trustwave's 2013 Global Security Report, the top 5 most breached industries are 1. Retail 2. Food & Beverage 3. Hospitality 4. Financial Services and 5 Non-Profits…
Comment linking /services/incident-response/
on “Bruce Schneier Joins Startup Co3 Systems”Submitted Cosmicenergy: New OT Malware Related to Russian Emergency Response Exercises as a story · 3 points
HN discussionCybersecurity firm Mandiant has identified this threat actor as "UNC3886". https://www.mandiant.com/resources/blog/vmware-esxi-zero-day... The heuristics used by security researchers are not really based in externals as you suggest. There is significant energy devoted to classifying and categorizing threat actors, and the main takeaways here are (1) nation-state-level power/funding and (2) not on our side.
Comment linking /resources/blog/vmware-esxi-zero-day-bypass
on “Chinese hackers exploit VMware bug as zero-day for two years”Submitted Assessed Cyber Structure and Alignments of North Korea in 2023 as a story · 2 points
HN discussionHey Shanghai, what's the feeling on the ground about Mandiant's APT1 report from yesterday? http://www.mandiant.com/apt1
Comment linking /apt1
on “Shanghai Hacker News Meetup”Submitted Evolution of UNC4990: Uncovering USB Malware's Hidden Depths as a story · 2 points
HN discussion
