M-Trends 2026: Initial-Access Handoffs Fell to 22 Seconds
Summary
Mandiant’s M-Trends 2026 report says the median initial-access-to-handoff time fell to 22 seconds in 2025. It also reports exploits as the leading initial vector and a 14-day median dwell time.
Key points
- The report draws on Mandiant’s 2025 investigations and Google Threat Intelligence Group information.
- Median time from initial access to handoff to a secondary group fell from more than eight hours in 2022 to 22 seconds in 2025; Mandiant researchers suggest closer collaboration or automated delivery may explain the change.
- Exploits accounted for 32% of initial infection vectors, followed by phishing at 11%; email phishing fell from 22% in 2022 to 6% in 2025.
- The most frequently exploited access vulnerabilities were SAP NetWeaver CVE-2025-31324, Oracle EBS CVE-2025-61882, and SharePoint CVE-2025-53770 (ToolShell).
- Median dwell time was 14 days in 2025, compared with 10 days in 2023 and 11 in 2024; Mandiant also observed more incidents remaining undetected for one to six months.
- About 40% of incidents involved data theft, and the high-tech sector was the most targeted. Google identified 714 new malware families in 2025, up from 632 in 2024.
Article Details
- Publisher
- Report Period
- 2025
- Scope
- M-Trends 2026 findings based on Mandiant incident investigations and Google Threat Intelligence Group analysis.
- Sample Size
- More than 500,000 hours of Mandiant incident investigations conducted in 2025; the number of incidents is not disclosed.
- Key Statistics
- The median time from initial access to handoff to a secondary threat group fell from more than 8 hours in 2022 to 22 seconds in 2025.
- Initial infection vectors in the reported cases: exploits 32%, phishing 11%, prior compromise 10%, and stolen credentials 9%. Email phishing accounted for 6%, down from 22% in 2022.
- Breaches were detected internally in 52% of cases; victims learned of the intrusion from an external entity in 34% of cases.
- Median attacker dwell time was 14 days in 2025, compared with 10 days in 2023, 11 days in 2024, and 146 days in 2015.
- Google Threat Intelligence Group identified 714 new malware families in 2025, up from 632 in 2024; 146 of the 2025 families targeted Linux and 55 targeted macOS.
MITRE ATT&CK
CVE
CVE-2025-31324SAP_SE · SAP NetWeaver (Visual Composer development server)The three vulnerabilities that were most often exploited for access were the SAP NetWeaver vulnerability CVE-2025-31324, the Oracle EBS flaw CVE-2025-61882, and the SharePoint flaw CVE-2025-53770 (ToolShell).CVE-2025-53770Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreThe three vulnerabilities that were most often exploited for access were the SAP NetWeaver vulnerability CVE-2025-31324, the Oracle EBS flaw CVE-2025-61882, and the SharePoint flaw CVE-2025-53770 (ToolShell).CVE-2025-61882Oracle Corporation · Oracle Concurrent ProcessingThe three vulnerabilities that were most often exploited for access were the SAP NetWeaver vulnerability CVE-2025-31324, the Oracle EBS flaw CVE-2025-61882, and the SharePoint flaw CVE-2025-53770 (ToolShell).
Threat Actors
Cl0pIdentified as the cybercrime group for which the GoldVein downloader was used in the Oracle EBS campaign.Scattered SpiderMandiant attributed cloud-related compromise activity involving voice phishing largely to Scattered Spider and ShinyHunters.ShinyHuntersMandiant attributed cloud-related compromise activity involving voice phishing largely to ShinyHunters and Scattered Spider.
Malware
AkiraThe malware family most frequently observed in 2025 was GoldVein, the downloader used by the Cl0p cybercrime group in the Oracle EBS campaign, followed by the Akira ransomware.GoldVeinThe malware family most frequently observed in 2025 was GoldVein, the downloader used by the Cl0p cybercrime group in the Oracle EBS campaign, followed by the Akira ransomware.
Products
Microsoft SharePointThe three vulnerabilities that were most often exploited for access were the SAP NetWeaver vulnerability CVE-2025-31324, the Oracle EBS flaw CVE-2025-61882, and the SharePoint flaw CVE-2025-53770 (ToolShell).Oracle E-Business SuiteThe three vulnerabilities that were most often exploited for access were the SAP NetWeaver vulnerability CVE-2025-31324, the Oracle EBS flaw CVE-2025-61882, and the SharePoint flaw CVE-2025-53770 (ToolShell).SAP NetWeaverThe three vulnerabilities that were most often exploited for access were the SAP NetWeaver vulnerability CVE-2025-31324, the Oracle EBS flaw CVE-2025-61882, and the SharePoint flaw CVE-2025-53770 (ToolShell).
Industries
business servicesThe most targeted sector in 2025 was high-tech, followed by financial, business services, and healthcare.financialRoughly 30% of the attacks observed in 2025 were motivated by financial gain, and 40% of all incidents involved data theft.HealthcareThe most targeted sector in 2025 was high-tech, followed by financial, business services, and healthcare.High-techThe most targeted sector in 2025 was high-tech, followed by financial, business services, and healthcare.