Mandiant M-Trends 2026: Voice Phishing Becomes Second-Most Common Intrusion Vector
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Mandiant’s analysis of 2025 investigations finds exploits remained the leading entry vector at 32%, followed by voice phishing at 11%. Median dwell time rose to 14 days, while ransomware operations increasingly relied on access handoffs.
Key points
- The report draws on more than 500,000 hours of global incident response engagements, with metrics covering targeted attacks identified during 2025.
- Exploits accounted for 32% of investigations with an identified entry vector, followed by voice phishing at 11%. Email phishing declined from 14% in 2024 to 6% in 2025.
- Organizations detected 52% of compromises internally, up from 43% in 2024, although global median dwell time increased from 11 to 14 days.
- Mandiant found evidence of data theft in 40% of investigations, compared with 37% in 2024. Targets included credentials, code repositories, and customer information.
- Prior compromise supplied initial access in 30% of ransomware-related investigations, double its 2024 share. Some handoffs between initial-access actors and follow-on operators occurred in under 30 seconds.
- Voice phishing led initial access in cloud-related compromises at 23%; evidence of data theft appeared in 59% of cloud investigations.
- Mandiant warns that ransomware operators increasingly target identity services, virtualization management, and backup infrastructure to undermine recovery, making isolated recovery capabilities and hardened administrative access important.
Article Details
- Publisher
- Mandiant
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Global targeted-attack incident response investigations, with ransomware, cloud, and regional analyses.
- Sample Size
- More than 500,000 hours of incident response engagements; the number of investigations is not disclosed.
- Key Statistics
- Among 2025 investigations with an identified initial infection vector, exploits accounted for 32%, voice phishing for 11%, and stolen credentials for 9%.
- Global median dwell time increased from 11 days in 2024 to 14 days in 2025; cyber espionage and North Korean IT worker incidents each had a median of 122 days.
- Organizations detected compromises internally in 52% of 2025 investigations, compared with 43% in 2024; external entities provided notification in 34% and adversaries in 14%.
- Mandiant identified data theft in 40% of 2025 investigations; attempted or successful ransomware deployments occurred in 13%.
- For incidents involving initial-access hand-offs, the median interval between initial access and a second group's earliest attributable activity fell from more than eight hours in 2022 to 22 seconds in 2025; this does not necessarily represent interactive activity.
- Recommendations
- Harden identity and administrative access with strong MFA, time-bound privileges, and Privileged Access Workstations; segment trusted service infrastructure to constrain lateral movement.
- Treat hypervisors and virtualization management planes as Tier-0 infrastructure, consider removing domain integration, and use dedicated out-of-band management with local MFA-protected accounts.
- Maintain offline or immutable Tier-0 recovery assets and an isolated recovery environment; exercise disaster recovery assuming loss of production infrastructure and primary identity services.
- Prioritize initial-access malware alerts, correlate them with potential follow-on activity, and reduce unnecessary software execution through centrally supplied, pre-approved tools.
- Inventory and protect SaaS integration secrets, scan repositories for exposed credentials, enforce pre-commit secret checks, and prevent users from authorizing unverified third-party applications.
MITRE ATT&CK
T1021 · Remote ServicesRemote Services was observed in 30.6% of investigations; threat clusters used remote access mechanisms for internal movement.T1027 · Obfuscated Files or InformationObfuscated Files or Information was observed in 27.2% of investigations; stealth-focused intrusions also used obfuscation to reduce detection.T1033 · System Owner/User DiscoverySystem Owner/User Discovery was observed in 24.0% of investigations as part of internal reconnaissance.T1059 · Command and Scripting InterpreterCommand and Scripting Interpreter was observed in 45.9% of investigations; attackers used native command-line capabilities across multiple attack stages.T1059.001 · PowerShellPowerShell was observed in 24.0% of investigations; ClickFix lures induced users to execute attacker-supplied commands.T1070 · Indicator RemovalIndicator Removal was observed in 24.8% of investigations; attackers removed artifacts to maintain undetected access.T1074 · Data StagedData Staged was observed in 39.6% of investigations; the report describes attackers staging stolen data before exfiltration.T1083 · File and Directory DiscoveryFile and Directory Discovery was observed in 33.5% of investigations and supported post-compromise reconnaissance.T1105 · Ingress Tool TransferIngress Tool Transfer was observed in 24.5% of investigations; downloaders such as GOLDVEIN.JAVA retrieved additional payloads.T1133 · External Remote ServicesExternal Remote Services was observed in 23.8% of investigations; UNC6276 obtained initial access using stolen or brute-forced VPN credentials.T1190 · Exploit Public-Facing ApplicationExploit Public-Facing Application was observed in 27.7% of investigations, including exploitation of internet-facing enterprise application servers.T1486 · Data Encrypted for ImpactRansomware operators encrypted production systems and virtualized infrastructure, including REDBIKE attacks affecting virtualized servers.T1490 · Inhibit System RecoveryRansomware operators destroyed backups and recovery configurations; REDBIKE executed a PowerShell command to delete volume shadow copies.T1505.003 · Web ShellWeb Shell was observed in 14.8% of investigations; exploitation of SAP NetWeaver and SharePoint vulnerabilities was followed by web shell deployment.T1550.001 · Application Access TokenUNC6395 stole SaaS integration tokens and used them to access downstream client environments and export data.
CVE
CVE-2025-31324Prominent examples include the exploitation of CVE-2025-31324 in SAP NetWeaver, and the data theft extortion campaign exploiting a zero-day vulnerability and using GOLDVEIN.JAVA.CVE-2025-42999files. This flaw can lead to unauthorized access and be chained with another vulnerability, such as CVE-2025-42999, to achieve code execution.CVE-2025-53770- **Microsoft SharePoint**: CVE-2025-53770CVE-2025-53771attacker to execute arbitrary code on the affected SharePoint server. This flaw can be chained with CVE-2025-53771 in an exploit known as ToolShell. CVE-2025-53771 is a path traversal and spoofing vulnerability thatCVE-2025-61882- **Oracle E-Business Suite**: CVE-2025-61882
Threat Actors
ARMORY CASTLEPRC-nexus espionage actor targeting edge devices, credentials, and virtualization infrastructure for persistent access. Although sometimes equated publicly with Silk Typhoon, GTIG does not currently consider them the same cluster.Evil CorpPublicly reported threat group with significant overlap with UNC2165; the report describes UNC2165's use of initial-access partnerships and ransomware.EvilCorpFinancially motivated group with significant overlap with public reporting on Evil Corp; obtained access from UNC1543, stole data, destroyed backups, and deployed RansomHub in a 2025 investigation.FIN11GTIG attributes Oracle E-Business Suite exploitation and subsequent extortion to a suspected FIN11 cluster, citing similarities with earlier operations and use of the CL0P data leak site.Scattered SpiderPublicly reported threat actor whose activity overlaps with UNC3944; the report does not establish complete equivalence.Silk TyphoonPublicly reported threat actor sometimes equated with UNC5221; GTIG explicitly states that it does not currently consider the two clusters the same.UNC1543Initial-access partner distributing FAKEUPDATES through drive-by downloads and providing access to multiple groups, including its closely linked partner UNC2165.UNC1549Suspected Iranian cyber espionage cluster targeting aerospace and defense and pivoting through third-party providers; deployed custom backdoors and maintained access for months to more than two years.UNC2465Financially motivated cluster using malicious installers and malvertising to deliver SMOKEDHAM; assessed as likely using AGENDA in current ransomware operations.UNC3944Financially motivated cluster that impersonated employees to help desks to obtain password resets and MFA changes; overlaps with public reporting on Scattered Spider.UNC5267Designation GTIG uses to track most North Korean IT worker activity; frequently observed in investigations in the Americas.UNC5518Initial-access cluster that compromised websites to distribute FAKETREFF through fake browser updates and later ClickFix; supplied malware distribution services used by secondary groups.UNC6016Malware distribution cluster using SEO and malvertising to deliver trojanized software; provided access to UNC4696 and UNC6286 in separate intrusions into the same environment.UNC6040Used voice phishing to obtain credentials and authorization for an attacker-controlled SaaS application, and used native utilities and bulk API operations for large-scale data theft.UNC6201PRC-nexus espionage cluster that deployed BRICKSTORM on appliances lacking EDR support and accessed vCenter and ESXi to clone virtual machines and obtain sensitive data and credentials.UNC6240GTIG separately tracks extortion activity following UNC6040-related data theft under this designation because of the significant interval between theft and extortion.UNC6276Financially motivated cluster that used stolen or brute-forced VPN credentials, reconnaissance and credential-theft tools, and SYSTEMBC.LINUX before AGENDA deployment and data theft extortion.UNC6357Financially motivated cluster that exploited SharePoint vulnerabilities and ultimately deployed LOCKBIT.WARLOCK ransomware.UNC6395Compromised a SaaS provider, stole client authentication tokens, and used them to access downstream environments, download code repositories, and locate additional credentials.
Malware
ADAPTAGENTand ADAPTAGENT, the back-BEACON4. **BEACON**: 1.9%BRICKSTORM5. **BRICKSTORM**: 1.2%FAKETREFFFAKETREFF to unsuspecting users. This campaign hasGOLDVEIN.JAVAProminent examples include the exploitation of CVE-2025-31324 in SAP NetWeaver, and the data theft extortion campaign exploiting a zero-day vulnerability and using GOLDVEIN.JAVA.JSPKIT3. **JSPKIT**: 2.4%KRABDRIP7. **KRABDRIP**: 1.2%LOCKBIT.WARLOCKIn contrast, the financially motivated threat cluster UNC6357 exploited the SharePoint vulnerabilities to ultimately deploy the LOCKBIT.WARLOCK ransomware.Qilin| | | % | | followed by AGENDA (aka Qilin) | |QUIETVAULTsoftware supply chain compromise that led to the installation of the QUIETVAULT credentialRansomHubAnother model for a hand-off is led by the second-stage UNC1543, UNC2165, and RansomHubREDBIKE2. **REDBIKE**: 2.9%SAGEGIFT8. **SAGEGIFT**: 1.2%SocGholish| | UNC1543 | FAKEUPDATES | | | | | | | | | | | | CAMP.25.039 | |SPAWNSNARE6. **SPAWNSNARE**: 1.2%SystemBCThe SYSTEMBC tunneler was the fifth-most Most Frequently Seen Malware, 2025 Most Frequently Seen Malware, 2025
Vendors
Microsofthas also been known to extend the reach of a compromise; for example, UNC3203 gained access to a Microsoft 365 environment, created mailbox forwarding rules to forward received emails to an external address,Oracle- **Oracle E-Business Suite**: CVE-2025-61882SAPProminent examples include the exploitation of CVE-2025-31324 in SAP NetWeaver, and the data theft extortion campaign exploiting a zero-day vulnerability and using GOLDVEIN.JAVA.VMwareFor the VMware appliances from multiple manufacturers. Using valid credentials likely captured on the network
Products
ESXiguide, please see: device, UNC6201 then accessed VMware vCenter servers and ESXi hosts. With access toMicrosoft 365 Apps for Enterprisehas also been known to extend the reach of a compromise; for example, UNC3203 gained access to a Microsoft 365 environment, created mailbox forwarding rules to forward received emails to an external address, thenMicrosoft Active Directorywhich is the core database file for the Active DirectoryMicrosoft Endpoint ManagerMicrosoft Endpoint Manager service accounts, leveraging accessing admin consoles and documentation repositoriesMicrosoft SharePoint ServerMicrosoft SharePoint Server was affected by a deserialization of untrusted data vulnerability, CVE-2025-53770, which allows an unauthenticated, remote attacker to execute arbitrary code on the affected SharePointOracle E-Business SuiteCVE-2025-61882 is an improper authentication vulnerability affecting Oracle E-Business Suite (EBS) that allows an unauthenticated, remote attacker with network access to achieve arbitrary code execution. MandiantOracle WebLogic- **GOLDVEIN.JAVA**: GOLDVEIN.JAVA is a downloader written in Java for compromised Oracle WebLogic servers that connects to a hard-coded command-and-control (C2 or C&C) server over TCP to download an encrypted JavaSAP NetWeaverProminent examples include the exploitation of CVE-2025-31324 in SAP NetWeaver, and the data theft extortion campaign exploiting a zero-day vulnerability and using GOLDVEIN.JAVA.VMware vCenterguide, please see: device, UNC6201 then accessed VMware vCenter servers and ESXi hosts. With access to
Tools
AdaptixC2| | | 19 | 10 | available AdaptixC2 pentesting | |Advanced IP ScannerAdvanced Advanced IP Scanner (ADVIPSCAN) is a publicly available network scanner developedCobalt Strike- **BEACON**: BEACON is a backdoor written in C/C++ that is part of the Cobalt Strike framework. Supported backdoor commands include shell command execution, file transfer, file execution, and file management. BEACONMimikatztools, lateral movement tools, and credential stealers such as Mimikatz.netscan| | RAR | NETSCAN | ADVIPSCAN |Nltest.EXEarchiver, which is commonly used to prepare data for theft, and nltest, which is a utility forPINGCASTLEUNC6276 has leveraged publicly available tools such as PINGCASTLE, NETSCAN, and MIMIKATZPsExec| NLTEST | PSEXEC | RCLONE | POWERSHELL |RARinclude RAR, ZIP, and TAR.RClone| NLTEST | PSEXEC | RCLONE | POWERSHELL |
Countries
DPRK- **Global median dwell time has risen to 14 days** from 11 days, driven largely by long-term espionage and DPRK IT worker operations. The longer adversaries remain undetected, the greater the cost and complexity ofPeople’s Republic of Chinaand espionage interests of the People’s Republic of China.
Industries
Aerospace and defense| Aerospace and Defense | 2.7% |Business and professional servicesIn 2025, Mandiant responded to incidents in the high-tech sector most frequently, followed by the financial sector, business and professional services, and healthcare.Construction & Engineering| Construction and Engineering | 4.1% |Education| Education | 4.6% |financialFor example, a cryptocurrency exchange relates both to the financial and technology sectors, but for the purposes of this section, it would be categorized as a financial sector organization.Government| Government | 5.8% |HealthcareIn 2025, Mandiant responded to incidents in the high-tech sector most frequently, followed by the financial sector, business and professional services, and healthcare.High Tech| High Tech | 17% |Retail and Hospitality| Retail and Hospitality | 7.3% |Telecommunications| Telecommunications | 4.6% |