M-Trends 2026 Reports Faster Attacker Handoffs and Persistent Edge Threats
Summary
Mandiant’s M-Trends 2026 reports 14-day median dwell time, rising voice phishing, 22-second attacker handoffs, ransomware recovery denial and espionage persistence on edge devices, and recommends stronger identity controls, longer log retention and behavioral detection.
Key points
- The report draws on more than 500,000 hours of Mandiant incident investigations conducted globally in 2025.
- Global median dwell time rose to 14 days; it was 122 days for espionage and North Korean IT worker incidents.
- Exploits accounted for 32% of initial infection vectors, while voice phishing rose to 11%; email phishing fell to 6%.
- The median hand-off from initial access partners to secondary groups fell from more than eight hours in 2022 to 22 seconds in 2025.
- Ransomware operators targeted backups, identity services and virtualization management to prevent recovery; the report names REDBIKE (Akira) and AGENDA (Qilin).
- Espionage clusters UNC6201 and UNC5807 targeted edge and network devices; the report describes BRICKSTORM persistence and packet capture on those systems.
- Recommendations include stricter identity controls, isolating critical virtualization and backup systems, behavior-based detection, and extending log retention beyond 90 days.
Article Details
- Publisher
- Mandiant
- Report Period
- 2025
- Scope
- Global incident investigations and observed cyber threat activity during 2025.
- Sample Size
- More than 500,000 hours of Mandiant frontline incident investigations conducted globally in 2025.
- Key Statistics
- Global median dwell time was 14 days in 2025, up from 11 days; it was 122 days for cyber espionage and North Korean IT worker incidents.
- Exploits accounted for 32% of intrusions, while voice phishing accounted for 11% in 2025.
- Organizations first detected malicious activity internally in 52% of 2025 investigations, compared with 43% in 2024.
- Median time from initial access to hand-off to a secondary group fell from more than 8 hours in 2022 to 22 seconds in 2025.
- High tech accounted for 17% of incidents and financial organizations for 14.6%.
- Recommendations
- Treat routine malware alerts as high-priority indicators of possible secondary intrusion and remediate promptly.
- Protect virtualization and management platforms as Tier-0 assets; decouple backup environments from corporate Active Directory and use immutable storage.
- Enforce least privilege, regularly audit SaaS integrations, and route SaaS applications through a central identity provider.
- Use behavior-based detection for anomalous activity, including unauthorized edge-device access, bulk API operations, and suspicious SaaS integration-token use.
- Extend log retention beyond standard 90-day windows and centralize critical network-device and hypervisor telemetry.
MITRE ATT&CK
T1040 · Network SniffingAdversaries used native packet-capturing functionality on edge devices to intercept credentials and other data in transit.T1078 · Valid AccountsStolen or hard-coded credentials and tokens were used to access downstream systems and SaaS integrations.T1098 · Account ManipulationMisconfigured Active Directory Certificate Services templates were exploited to create persistent administrator accounts that bypass password rotation.T1190 · Exploit Public-Facing ApplicationThe report identifies exploits as a leading initial infection vector and explicitly maps this activity to T1190.T1199 · Trusted RelationshipThe report describes attackers compromising third-party SaaS vendors and using stolen keys and tokens to pivot to downstream customers.T1490 · Inhibit System RecoveryRansomware operators deleted backup objects and other recovery mechanisms to prevent restoration.T1539 · Steal Web Session CookieAttackers harvested long-lived OAuth tokens and session cookies to access SaaS environments.T1566 · PhishingVoice phishing, including calls targeting IT help desks to bypass MFA, is described as an access method.
Threat Actors
AkiraThe report pairs Akira with REDBIKE in its description of ransomware groups involved in recovery-denial operations.QilinThe report names AGENDA as a ransomware group involved in recovery-denial operations and pairs its name with Qilin.REDBIKEThe report names REDBIKE as a ransomware group involved in recovery-denial operations and pairs its name with Akira.UNC3944The report says UNC3944 targets IT help desks to bypass MFA and gain access to SaaS environments.UNC5807The report identifies UNC5807 among threat clusters targeting edge and core network devices for persistence.UNC6201The report identifies UNC6201 among threat clusters targeting edge and core network devices; it also references UNC6201 exploitation of a Dell RecoverPoint for Virtual Machines zero-day.
Malware
BRICKSTORM#BRICKSTORM #UNC3944PROMPTFLUXAdversaries abused AI and LLMs in attacks (e.g., PROMPTFLUX, PROMPTSTEAL, QUIETVAULT) while defenders are urged to adopt continuous identity verification, behavioral detection, and extended log retention.PROMPTSTEALAdversaries abused AI and LLMs in attacks (e.g., PROMPTFLUX, PROMPTSTEAL, QUIETVAULT) while defenders are urged to adopt continuous identity verification, behavioral detection, and extended log retention.QUIETVAULTAdversaries abused AI and LLMs in attacks (e.g., PROMPTFLUX, PROMPTSTEAL, QUIETVAULT) while defenders are urged to adopt continuous identity verification, behavioral detection, and extended log retention.
Vendors
Dell[Affected Products / Systems ] targeted infrastructure and appliances – VMware vSphere hypervisors and management planes, Dell RecoverPoint for Virtual MachinesMandiantIn 2025, Mandiant observed a clear divergence in adversary pacing that closely aligns with the trends we have been documenting for defenders over the past year.VMware[Affected Products / Systems ] targeted infrastructure and appliances – VMware vSphere hypervisors and management planes, Dell RecoverPoint for Virtual Machines
Products
Dell RecoverPoint for Virtual Machines[Affected Products / Systems ] targeted infrastructure and appliances – VMware vSphere hypervisors and management planes, Dell RecoverPoint for Virtual MachinesVMware vSphere[Affected Products / Systems ] targeted infrastructure and appliances – VMware vSphere hypervisors and management planes, Dell RecoverPoint for Virtual Machines
Industries
financialof incidents affected more than 16 industry verticals, with the high tech sector (17%) outpacing the financial sector (14.6%) as the most frequently targeted industry, shifting the financial sector out of the topHigh TechTargeted Industries: The full scope of incidents affected more than 16 industry verticals, with the high tech sector (17%) outpacing the financial sector (14.6%) as the most frequently targeted industry, shifting the