Mandiant analyzed over 500,000 hours of incident investigations in 2025 to produce the M-Trends 2026 report. I observe a massive shift in how attackers operate. Ransomware handoffs between criminal partners now collapse to just seconds. In 2024, attackers stayed in environments for 11 days before discovery, a drop from the 205 days recorded in 2014. Attackers target edge devices like Palo Alto, Ivanti, and Fortinet. Stolen credentials rank second as a method for gaining access. For cloud breaches, phishing remains the top infection method, and SIM swapping occurred in 6% of infections. Data theft drove 66% of identified cloud compromises. Attackers use AI to automate exploit development. A researcher used ChatGPT to write Python scripts to find differences between vulnerable and patched Erlang/OTP SSH server code to determine the root cause of a vulnerability. The researcher then used Cursor AI to fix the PoC code and run the exploit. This automation removes previous barriers for attackers. The convergence of AI and credential theft allows attackers to complete full breach cycles in minutes. This force compels security leaders to move away from reactive strategies toward automated, real-time response capabilities through advanced detection tools.
Google and Microsoft fight for security dominance
Google integrates Mandiant’s threat hunting into Google Security Operations to help U.S.-based customers. This service uses insights from Mandiant’s own threat hunts to provide real-time detection. Google also introduced Private Collection Sharing for Google Threat Intelligence to help companies share indicators of compromise. Google’s security products include the Gemini AI-powered agent, which adds conversational search tooling across threat intelligence data. This tool reduces manual analysis tasks from 30 minutes to 60 seconds. Google protects 4 billion devices and 1.5 billion email accounts. Microsoft maintains a $15 billion security business and uses the Defender brand to simplify its XDR platforms. Google’s acquisition of Siemplify and Chronicle strengthens Google’s ability to target modern security operations centers. You know that Google’s use of Mandiant’s expertise to build an XDR platform provides the best advantage against Microsoft.
| Product | Security Focus |
|---|---|
| Google Threat Intelligence | Threat actor TTPs |
| Mandiant Managed Defense | Threat hunting |
| Google Security Operations | AI-powered detection |
Google also released the Defender’s Advantage framework to help organizations use internal knowledge for detection and response. This framework provides guidance on identifying gaps in cybersecurity posture. Google Cloud’s new security agents include a Threat Hunting agent, a Detection Engineering agent, and a Third-Party Context agent. These agents work to reduce the burden of routine alert triage.
Credential theft and the TeamPCP takedown
Identity theft drives most initial access. Attackers use infostealer malware and phishing to steal credentials. For example, the IBM X-Force 2025 Threat Intelligence Index noted an 84% increase in infostealer phishing emails in 2024. Modern attackers use living-off-the-land techniques and novel attack vectors. Mandiant’s undercover analyst worked within the TeamPCP group for months to build a cover identity before the gang could use stolen credentials to breach over 1,000 organizations, such as major targets GitHub, OpenAI, and the European Commission across the globe. Mandiant bypassed individual victim notifications and worked with identity providers like AWS and Microsoft to force a bulk revocation of stolen credentials used by the TeamPCP group. This method works because the fastest kill switch sits with the identity provider. I find the reliance on identity providers for large-scale remediation to be blunt and necessary. Flare monitors over 1 million new stealer logs weekly from dark web marketplaces and Telegram channels. It identifies credentials from malware families like RedLine, Raccoon, Vidar, and Lumma. GreyNoise helps SOC teams distinguish targeted attacks from the background noise of internet scanning. GreyNoise uses a Global Observation Grid with 5,000 sensors across 80+ countries to process 500 million sessions daily. How can defenders protect unmonitored Tier-0 assets?
