UNC3944: Mandiant’s Tracking Name for Scattered Spider
UNC3944 is Mandiant's designation for the threat actor group known as Scattered Spider. The group has been involved in numerous high-profile extortion…
Tag: Mandiant
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities
The ShinyHunters extortion crew exploited an unpatched remote code execution vulnerability in Oracle PeopleSoft (CVE-2026-35273) to breach enterprise systems, primarily targeting universities.…
UNC6240: Mandiant’s Tracking Name for ShinyHunters
Mandiant tracks the ShinyHunters group as UNC6240, attributing the Oracle PeopleSoft zero-day exploitation campaign to them.
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
A new malware family named AryStinger, discovered by QiAnXin's XLab, has infected at least 4,300 legacy routers to create a distributed reconnaissance…
LapDogs: Router ORB Attack Group Similar to AryStinger
LapDogs is an attack group tracked by Mandiant that operates operational relay box networks (ORBs) using compromised end-of-life routers and IoT devices.…
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited for Root Access
An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two months…
Mandiant: Documentation of UNC3886’s VMCI Use
Mandiant is a cybersecurity company that documented UNC3886's use of VMware VMCI sockets for persistence between ESXi hosts and guest VMs, a…