Director, Vulnerability & Exploitation @Mandiant Intelligence Views are my own
Joined January 2022
- Tweets42
- Following41
- Followers166
- Likes7
Nothing like returning from PTO and seeing great traction on a piece you worked hard on for months (including from your CEO)! Big thanks to @maddiestone and James Sadowski for the amazing collaboration. If you want to know about zero-days, this is not a report to miss. Enjoy!
New report from our Threat Analysis Group + @Mandiant observed 97 zero-day vulnerabilities exploited in the wild in 2023, up 50% from 2022. Good news: investments are making a difference - vulnerabilities once common are virtually non-existent today. blog.google/technology/safet…
Had a blast talking with @maddiestone about vulns and zero-days on Mandiant's latest The Defender's Advantage Podcast. It's great to have a conversation with other people who are passionate about vulnerabilities and doing what they can to protect people.
open.spotify.com/episode/3tA…
311
This was some great work done by (@varcharr) and fellow analysts. The culmination of five months of hard work researching and analyzing. Hopefully this continues to be of value for defenders trying to better understand the adversary and what they can do to protect themselves!
Mandiant identified 55 zero-day vulnerabilities exploited in 2022 which represents a 200% increase compared to 2020.
mndt.info/3yLd3MI
3
632
As always, @campuscodi has nailed the analysis. OpenSSL vulns can be very serious, but we also need to not spin ourselves up without details. Even if they stayed "Critical," OpenSSL's Critical rating can cover a wide range of issues, many of which are objectively not critical.
This quoted post is unavailable.
#mWISE was a blast, and I'll have more thoughts on that soon, but coming home to a new member of the family was the highlight of an already great week. Welcome Cora Snickerdoodle Semrau!
1
I'm going to start letting twitter know when I'm about to take PTO, because recent history tells me there is a good chance a big vuln will drop when I do...
In a webinar this week I said: "...but it's not entirely CVSS's fault..."
I must be going soft. Not the worst standard in the vulnerability space (looking at your CPE...), but it's not good.
2
Last week, our episode of the Risky Business podcast came out, where we got to talk more about the recent @Mandiant and @nucleussec partnership and how integrating Mandiant's vulnerability intelligence into their platform can help operationalize vuln intelligence at scale!
Nucleus co-founder Scott Kuffer and Jared Semrau of Mandiant join host Patrick Gray on Risky Business #662 to talk about integrating Mandiant data into Nucleus to make threat intelligence actionable. bit.ly/3k9NSvT
#vulnerabilitymanagement #threatintelligence
If you're interested in learning more about how vulnerability intelligence can help you better prioritize your remediation efforts, please register for our upcoming webinar. Myself and @_stevecarter_ will be discussing how @Mandiant and @nucleussec can do just that!
Join experts from Mandiant and @nucleussec as they discuss how vulnerability intelligence can inform vulnerability management prioritization to stay ahead of threat actors.
Register today: mndt.info/3xwDjuQ
If you want to know what great work my team does at @Mandiant, this blog is just one tiny part of the intelligence we're working on. It's their hard work that makes these types of things possible.
Focus on the real threats, not the imagined.
In 2021, Mandiant Threat Intelligence identified 80 #zerodays exploited in the wild, which is more than double the previous record volume in 2019.
Read our latest blog post to learn more 👇 mndt.info/3Mjize6
1
Mandiant's Vulnerability & Exploitation team is hiring a senior analyst! Looking for people who understand vulnerabilities and how they can be exploited, have strong writing skills, and preferably have some software dev skills. If interested, please apply! jobs.smartrecruiters.com/Man…
SpringShell continues to highlight significant problems within the security community, with the latest battle being the misuse of words and their meanings. There needs to be clear distinction between "scanning activity," "attempted exploitation," and "confirmed exploitation."
This is a key distinction, especially in the case of SpringShell. If exploitation requires such specific conditions to be successful, and no one has proven that an exploitation attempt would have been successful against a real-world system, can you call this active exploitation?
1
1
SpringShell/Spring4Shell/CVE-2022-22965 is a thing, but it's not the thing everyone is trying to convince us it is. It is nowhere near as serious as Log4Shell. Further, conflation between mass scanning activity and "exploitation" exacerbates this, and creates a false narrative.
2
3
I'm glad to have played a small part in helping this come to fruition, but a lot of great people did a lot of great work on this.
If you know anyone who could benefit from this scholarship opportunity, please pass it along. Doesn't solve the problem, but hopefully it helps!
We are proud to partner with @tmcf_hbcu to provide four need-based scholarships to HBCUs. Share this post with anyone you know who may qualify.
The deadline to apply is April 4, 2022. Learn more: mndt.info/34S0Yd6
1