Mandiant
Google Cloud threat intelligence and IR firm; authors M-Trends; tracks state-sponsored APTs.
On 5 May 2026 Mandiant and Google's Threat Intelligence Group named North Korea-linked UNC1069 as the group that phished an Axios maintainer and slipped the WAVESHAPER.V2 backdoor into two releases with 183 million weekly downloads combined.
Last refreshed: 12 October 2026 · Appears in 1 active topic
How did Mandiant track an attack that hid for 393 days inside enterprise servers?
Timeline for Mandiant
Mentioned in: ASOS app pushes rogue alert to customers
Cybersecurity: Threats and DefencesMentioned in: Two 9.8 Check Point flaws hit firewalls
Cybersecurity: Threats and DefencesMentioned in: TfL hackers jailed five and a half years
Cybersecurity: Threats and DefencesMentioned in: One operator ran both ransomware brands
Cybersecurity: Threats and DefencesMentioned in: Splunk lands its first-ever KEV entry
Cybersecurity: Threats and DefencesBackground
Mandiant is the incident-response and threat-intelligence firm Google bought in 2022 for $5.4bn. It now works inside the Google Threat Intelligence Group while keeping its own brand. Its annual M-Trends report, built in the 2026 edition on more than 500,000 hours of incident-response work, is one of the largest public records of how real intrusions unfold.
M-Trends 2026 found that China-linked UNC5221 averaged 393 days undetected in its BRICKSTORM campaign, planting backdoors on VMware ESXi and vCenter hosts, where endpoint tools are not installed, and relaying traffic through Cloudflare Workers. Law firms, business-services companies and technology providers in the UK and US were the main targets. The same report flagged ransomware crews going after backup and disaster-recovery systems. On 23 April 2026 Mandiant described UNC6692, a group posing as IT support inside Microsoft Teams to get law-firm and outsourcing staff to run credential-stealing malware.
Mandiant's 2023 investigation of CitrixBleed remains the reference account of the exploit path that CitrixBleed 3 reproduced in March 2026. Founded in 2004 and based in Milpitas, California, The Firm's attributions are routinely cited by CISA and the UK's National Cyber Security Centre.
Mandiant names North Korea behind Axios
Mandiant and Google's Threat Intelligence Group named UNC1069 on 5 May as the crew that phished an authorised Axios maintainer and published two backdoored versions during a three-hour window on 31 March. Because a trusted developer pushed the release, the usual publishing checks raised no alarm. The case carried Mandiant's long record of nation-state attribution into the open-source package registry.
On 11 May the same team confirmed that two further npm packages, @shadanai/openclaw and @qqbrowser/openclaw-qbot, carried the identical backdoor from the 31 March injection. Developers who never installed Axios received WAVESHAPER.V2 through automated dependency resolution. The follow-up turned a single attribution into a mapped campaign of at least three packages, which defenders can now hunt by name and date.
Who is UNC1069 and what did they do to Axios?
What did Mandiant find in its 2026 security report?
How does Mandiant attribute cyberattacks to nation states?
Does Google own Mandiant?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 12 October 2026. Editorial standards.