<p>Mandiant’s M-Trends 2026 report, drawn from over 500,000 hours of incident investigations in 2025, paints a picture of attackers moving faster and hiding longer at the same time — sometimes within the same campaign.</p>
<h2>Voice phishing is now the second most common way in</h2>
<p>Vishing jumped to 11% of all initial access methods in 2025, making it the second most common entry point overall and the top method for breaching cloud environments. Groups like ShinyHunters and Scattered Lapsus$ have refined the approach: call an IT help desk, impersonate an employee, and talk your way into getting an attacker-controlled MFA device registered or a password reset. No malware required.</p>
<p>ClickFix attacks also spiked during the same period, tricking users into manually running malicious commands — another technique that sidesteps traditional endpoint detection entirely.</p>
<h2>The hand-off from access to ransomware is now measured in seconds</h2>
<p>The global median dwell time rose to 14 days, but that number obscures a more alarming trend at the fast end. The window between an initial access broker handing off credentials and a ransomware operator deploying their payload collapsed from 8 hours to 22 seconds. In at least one documented case, the hand-off took under 30 seconds.</p>
<p>Ransomware groups have also expanded their playbook beyond encryption. They’re now actively destroying backup infrastructure and targeting virtualization management planes — making recovery harder even when victims have backups.</p>
<h2>Espionage groups are doing the opposite: staying invisible for over a year</h2>
<p>While ransomware operators race the clock, espionage groups are playing a completely different game. Chinese group UNC6201 deployed the Brickstorm backdoor on edge devices — firewalls, VPNs, and similar appliances that typically lack EDR telemetry — and went undetected for an average of 393 days. The malware runs in-memory, leaving minimal forensic traces.</p>
<p>Edge devices have become a preferred target precisely because defenders have less visibility there. Once inside, these groups can sit quietly and collect data for months.</p>
<h2>Exploitation is outpacing patching</h2>
<p>Mean time to exploit vulnerabilities dropped to -7 days in 2025. That’s not a typo — exploitation is routinely happening before patches are released. Organizations waiting for a patch before acting are already behind.</p>
<h2>What defenders should actually do</h2>
<p>The report’s recommendations are worth taking seriously:</p>
<ul>
<li>Treat low-impact alerts as potential indicators of something bigger, not noise to be filtered out</li>
<li>Isolate control planes, especially for virtualization and backup infrastructure</li>
<li>Extend log retention beyond 90 days — espionage groups count on short retention windows</li>
<li>Shift toward behavioral anomaly detection rather than signature-based tools</li>
<li>Operate at machine speed; human-reviewed alert queues can’t keep up with 22-second hand-offs</li>
</ul>
<p>On AI: it’s being integrated into attack tooling, but it’s not yet the primary driver of breaches. That may change, but right now the bigger problems are social engineering, unmonitored edge devices, and the sheer speed of the ransomware ecosystem.</p>


Collections

Mandiant's M-Trends 2026 report, based on 500,000+ hours of 2025 incident investigations, reveals attackers moving faster while hiding longer. Voice phishing (vishing) jumped to 11% of initial access methods, becoming the top cloud breach vector. The ransomware hand-off window collapsed from 8 hours to just 22 seconds. Meanwhile, espionage groups like UNC6201 deployed backdoors on edge devices and stayed hidden for an average of 393 days. Mean time to exploit vulnerabilities hit -7 days, meaning exploitation now routinely precedes patches. Defenders are advised to extend log retention, isolate control planes, adopt behavioral anomaly detection, and treat low-impact alerts as potential precursors to larger attacks.

Mandiant M-Trends 2026: vishing surges, ransomware hand-offs hit 22 seconds, espionage groups hide for 400 days