M-Trends 2024 Special Report

Published on: 
May 1, 2024

In this 15th edition, M-Trends provides an inside look at the evolving cyber threat landscape, with data drawn directly from frontline incident response investigations and threat intelligence findings of high-impact attacks and remediations around the globe.

  • The latest incident response metrics including dwell times, detection sources, initial infection vectors, and so much more
  • China-nexus attackers increasingly targeting edge devices and platforms that lack EDR
  • Trending adversary operations and motivations behind zero day attacks
  • The evolution of phishing techniques amidst modern security controls
  • How attackers are leveraging AiTM to compromise multi-factor authentication safeguards
  • The reasons and solutions behind growing cloud and hybrid cloud environment intrusions
  • How AI is effectively used in red and purple team operations to help boost cyber defenses

Read Anton Chavakin's take on the report: https://medium.com/anton-on-security/reading-the-mandiant-m-trends-2024-acb3208add80

Related Content

Research
Spetsvuzavtomatika Leak Exposes an SVR Cyber Development Ecosystem

A darknet data leak from the Russian research institute Spetsvuzavtomatika (SVA) has exposed an extensive cyber development ecosystem serving Russia’s Foreign Intelligence Service (SVR). The leaked Git repositories, project specs, and technical reports reveal a sophisticated, modular research and development model focused on automating key phases of espionage—from cloud-agent command-and-control (Initiative-24) and automated target reconnaissance (Felix-23, HAD) to internal domain exploitation (Putnik) and anonymous infrastructure procurement (Chain-24).

Learn More
Research
Lemmings: Russian Industrialized Persona Provisioning and Management for Active Measures Campaigns

Leaked internal data from Russian contractor Okenit reveals "Lemmings" (Лемминги)—a Python-based framework designed to industrialize the creation, verification, and management of synthetic online personas for Russian active measures. Built to automate phone verification, email infrastructure, CAPTCHA solving, and anti-detection measures, Lemmings functions as the identity-provisioning layer within a larger ecosystem alongside proxy and tasking tools (SOI and SOS). Live tests against platforms like VK and Reddit demonstrate a shift toward scalable, modular software frameworks capable of maintaining durable cover identities for intelligence, influence, and disinformation operations.

Learn More
Research
Threat Intelligence Report: University Leak Exposes Russia’s Military Cyber Training Pipeline

A leaked cache of institutional files reveals that Department No. 4 at Bauman Moscow State Technical University operates as a structured force-generation pipeline for Russian military cyber operations, training roughly 250 students across specializations. Supervised directly by senior GRU leadership, the program blends offensive intrusion, malware analysis, financial-systems targeting, and cryptographic defense with field placements that feed graduates straight into GRU- linked cyber formations like APT28 (Unit 26165) and Sandworm (Unit 74455).

Learn More