Security Validation

We noticed that the GCP Cloud NGFW Enterprise endpoints issue impersonation certificates without AKID extension. This violates https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1While Cloud NGFW is claimed to be powered by Palo Alto networks (https://www.paloaltonetworks.com/blog/2024/04/google-cloud-ngfw-enterprise/), we see the Palo Alto Firewall exhibit the RFC compliant behaviour. What does this break?Python 3.13, https://docs.python.org/3/library/ssl.html#ssl.create_default_context. Although we can work around this problem by disabling strict checks, it would be prudent for GCP to address this gap on priority in the interest of a long term solution. Steps to reproduce:Python 3.13.15 (main, Aug 6 2026, 11:06:22) [GCC 13.3.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> import ssl>>> import socket>>> hostname = "api.github.com">>> port = 44>>> port = 443>>> context = ssl.create_defau

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.7.0 of the MSV platform.EnhancementsAdded the option to set a default landing page (such as the Topology Map) upon sign in, improving load times for users who prefer to bypass the initial Simulations page. For Windows 10/11, added support for TPM 2.0 on Protected Theater.  Added the ability to hide unselectable actors from the user interface, streamlining the actor selection process when running actions. Improved system memory efficiency and performance when downloading or exporting large datasets—including attachments, assessments, Bulk Job results, and suspect events. Enhanced the scaling and responsiveness of the Jobs interface through optimizations, including batched loading and database aggregation for event lists.Bug fixesThis release includes a number of bug fixes and stability improvements. Key fixes are categorized as follows:Actor and integration stabilityFixed an intermittent issue where Actors w

We're building a production certificate automation tool using Google Trust Services' production ACME API (dv.acme-v02.api.pki.goog).We've observed that when we place a new order and fetch the raw authorization object, the "expires" field is consistently exactly 8 days after the order's creation timestamp — reproduced across 2 different domains and 2 different ACME accounts.Within this 8-day window, a new order for the same domain/account automatically reuses the existing authorization as "valid" — no DNS-01 challenge needed. After 8 days, a new order requires a fresh DNS-01 challenge.GTS's CP/CPS (Section 4.2.1) states validation data may be reused for up to 200 days — but we observe a hard boundary at 8 days.Questions:1. Is this 8-day authorization validity an intentional, fixed, documented policy, separate from the 200-day CP/CPS ceiling?2. Is this duration stable, or could it change without notice?3. Does this differ for wildcard domain authorizations?A clear, authoritative answer w

I'm trying to verify the OAuth consent screen (branding) for my app and it keeps failing on the same two issues, even though my home page appears to meet the requirements.App details:- App name (consent screen): Perfect Lien Law- Home page: https://perfectlien.com- The app requests the Google Calendar sensitive scope (calendar deadline sync)- Authorized domain ownership is verified in Google Search Console under the same accountThe two errors branding verification returns:1. "Your home page does not explain the purpose of your app."2. "The app name 'Perfect Lien Law' configured for your OAuth consent screen does not match the app name on your home page."Why I believe the home page already meets both requirements:- The site was originally a client-side React app (empty #root in the HTML), so I added server-rendered content. The raw HTML of https://perfectlien.com now contains a <title>Perfect Lien Law...</title>, a <meta name="description"> describing the app, and an &

Getting error while publishing Terraform Kubernetes App. on GCP marketplace.{ "taskReports": [ { "taskType": "EXECUTE_TERRAFORM_PLAN", "taskExecutionStatus": "ISSUES_FOUND", "digest": "Failed to execute terraform plan for some versions.", "errorMessage": "Error validating Terraform zip: Marketplace UI deployments must declare a variable 'goog_cm_deployment_name'. This variable specifies the name of the deployment, and should be used to avoid resource name collisions across deployments\n" } ]}Possible solutions I have tried:I have changed variable.tf file to include variable:variable "goog_cm_deployment_name" { description = "Name of the Google Cloud Marketplace deployment. Auto-populated by the Marketplace UI." type = string}Added below in metadata.yaml file:interfaces: variables: # ---- GCP / cluster --------------------------------------------------- - name: goog_cm_deployment_name description: The name of the deployment.

I'm currently testing an application hosted on Google Cloud, and I'm running into a security validation issue that I can't explain. The OAuth consent screen has been configured, the authorized redirect URIs are correct, and all required scopes have been reviewed. However, every time I attempt the validation process, it reports a generic security validation failure without identifying which specific requirement is not being met.I have already verified that the domain ownership is confirmed through Search Console, HTTPS is properly configured with a valid SSL certificate, and the privacy policy and terms pages are publicly accessible. I've also tested the application using different Google accounts and browsers, cleared caches, and even recreated the OAuth credentials, but the validation result remains the same.Has anyone experienced a similar issue where the security validation fails even though the project appears to meet all documented requirements? I'm mainly looking for guidance on

I am getting below error while validating my terraform kubernetes app. Can any on ehelm what is the issue?{  "taskReports": [    {      "taskType": "EXECUTE_TERRAFORM_PLAN",      "taskExecutionStatus": "ISSUES_FOUND",      "digest": "Unable to start verification.",      "errorMessage": "Failed to process container images from schema file: Unexpected response.\nHeaders:\nHTTP/1.1 400 Bad Request\r\nContent-Type: application/json; charset=utf-8\r\ndocker-distribution-api-version: registry/2.0\r\nServer: Docker Registry\r\nVary: Accept-Encoding\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nx-gcr-using-artifact-registry: true\r\nx-google-artifactregistry-docker-imageref: us-docker.pkg.dev/cloud-launcher-images-prd/gcr.io/crestdata-public/test-app/test-app:1.0\r\nx-google-gfe-cloud-project-number: 720804119614\r\nX-Google-GFE-Backend-Request-Cost: 48.89476869076971\r\nX-Google-Security-Signals: FRAMEWORK=GOA\r\nX-Google-Security-Signals: ACTION=GOA_ACTION,ENV=borg,ENV

VHR20260722 - July 22, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260722 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes109 Actions added 88 Files addedRelease HighlightsA new Action covering Campaign 26-069, an initial access campaign by actor UNC6910 leveraging social engineering lures and delivering CURLYGATE, CURLYFENCE, and NEONSLIDE malware. A new Action covering Campaign 26-014, involving North Korea-nexus threat actor UNC5342 deploying Python backdoors such as JADESNOW and INVISIBLEFERRET.JAVASCRIPT to target GitHub repositories for unauthorized code modification. New Actions demonstrating Campaign 26-068, a campaign by UNC6468 using recipe-themed executables to deliver PINESAP 

VHR20260624 - June 24, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260624 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes370 Actions added 329 Files added 14 Actions updated 6 Files updatedRelease HighlightsNew Actions demonstrating Campaign 25-002, where UNC5487 conducts a social engineering campaign to deliver REMCOS and SHADOWLADDER. New Actions demonstrating Campaign 25-082, a suspected Iranian espionage threat actor UNC1549 campaign leveraging TWOSTROKE malware against Azerbaijan and Turkish-based organizations. A new Action covering FLUXWEAVE leveraged in Campaign 25-076 by UNC6527 to deliver a downloader. New Actions demonstrating Campaign 25-039, a distribution cluster UNC1543 ca

This release note outlines the latest updates, enhancements, and bug fixes for the Mandiant SecOps Integrations (MSI) service.EnhancementsTrend Micro Vision One v1: Exposed the Alert Field Mapping configuration in the web interface, allowing users to customize which fields are used for alert data. Default mappings are still provided. Enabled support for SSL certificate authentication for the following integrations: Exabeam Cloud v1 Splunk v1 Splunk v2 Added titles to the default queries for the following integrations: Google BigQuery v1 Logzilla v1 Microsoft Defender ATP v1 Security Onion v1 Trellix Enterprise Security Manager v2 Trellix Enterprise Security Manager v1 Trellix Helix v1 Bug fixesCybereason v1: Fixed an issue where Default Malware Queries were not displaying, which prevented the integration from being saved. This was due to incorrect model typing for the malware queries field. Google Cloud Logging v1: Fixed an AttributeError that occurred during health checks whe

VHR20260603 - June 3, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260603 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes83 Actions added 61 Files added 7 Actions updated 1 Files updatedRelease HighlightsNew Actions covering Campaign 26-053, a campaign targeting healthcare and education with obfuscated PowerShell, registry modifications, and discovery via tools such as NLTEST. New Actions covering Campaign 26-054, a China-nexus threat actor UNC6863 campaign deploying SLICKDEMON and BADFALL (QUIC RAT) via software supply chain compromise of DAEMON Tools. A new Action demonstrating Campaign 26-052, a financially motivated actor UNC6780 campaign poisoning software supply chains to compromise

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.6.1 of the MSV platform.Bug fixesThis hotfix release addresses the following critical issues:Resolved an issue where repeated checks on Protected Theater VNC status could overload the system, potentially leading to unresponsiveness. Fixed issues related to Google Authenticator two-factor authentication (2FA) after upgrading to 4.14.6.0, ensuring that 2FA configurations are correctly retained and preventing users from being incorrectly redirected to User Preferences with a false warning to re-enable Google Authenticator upon sign in.Known issuesLocal Event Filtering works as expected but is limited to Match Action, Match Integration, and Match Events (when the latter involves Raw Events). If a rule has a Match Event condition for any field other than Raw Event, the rule does not apply to Local Events. It only applies to events from standard local integrations in MSV. Network configuration may reset unexpecte

MSV 4.14.6.0 Product Release - May 13, 2026The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.6.0 of the MSV platform.EnhancementsUpdates to Director and content to support MITRE ATT&CK v18. Added support for Remote Integrations on installable Actors. MSI version downgrades are prevented on Director upgrades. For external database scenarios, upgraded the database encryption to support scram-sha-256 password hashing. Improved memory performance for the /analyze/pivot_data route. To enhance privacy, Azure Client Secrets used for Cloud Validation Modules (CVM) have more redactions. Added a setting to allow administrators to disable the requirement for a local user account when using Google or SAML authentication. That way, all users can use the selected authentication type without needing a local fallback. Updated API calls for the CrowdStrike Intel Threat Intelligence Platform integration to align with the latest CrowdStrike API endpoints. Improved Job Re

VHR20260506 - May 6, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260506 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes273 Actions added 111 Files added 4 Actions retiredRelease HighlightsNew Actions demonstrating Campaign 26-018, exploiting CVE-2026-20127 and CVE-2022-20775 in Cisco Catalyst SD-WAN devices. New Actions covering Campaign 26-020, which involves a threat actor deploying WINDSTRIKE malware via trojanized software to establish persistence and evade defenses. New Actions demonstrating Campaign 26-023, a campaign by UNC6740 deploying DINODANCE malware using trojanized installers and Deno Runtime for in-memory execution. New Actions demonstrating Campaign 26-028, a campaign by 

logs and  deployment  instances should be  filtered with  time  

The Mandiant Advantage Security Validation (MA-SV) team is pleased to announce version 5.14.4.0 of the MA-SV platform. This version is scheduled to be deployed on Tuesday, April 28 at 8:00AM EDT (12:00PM UTC). During this time, users might experience brief disruptions accessing the service. Full service will be restored no later than 9:00AM EDT (1:00PM UTC).  On the day of release, the release notes will be posted on the Security Validation MA-SV (SaaS) release notes page.

Many MSV deployments include multiple on-premise actors and one or two Mandiant cloud hosted actors. Many use cases like data extraction or malicious file transfers (MFT) will require that the on-premise actors can communicate with the cloud hosted actor. Mandiant requires clients to submit a list of public IP addresses that the on-premise actors will use to communicate with the cloud hosted actor. The MSV operator often does not know this information and may resort to an internal ticket or inquiry to a network administrator to find this information out and that can take more time than wanted. A simple and faster alternative is to create Host-CLI actions utilizing the cURL utility to identify the egress IP address of each on-premise actor. Yes, this works on network actors as they are linux based and can run Host-CLI actions using a bash shell. An action for multiple shell types can be similarly created as cURL is supported on many OS platforms including windows (cmd.exe or powershell)

Hello everyone,I'd like to share with the community a thing we did internally to use the MSV Library with the MITRE ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/).This job was made in collaboration with my colleagues from the CSIRT team.We had two objectives:"plot" the MSV Library on the MITRE ATT&CK matrix using layers (https://github.com/mitre-attack/attack-navigator/tree/master/layers).overlaying the MSV library with custom layers or layers from MITRE to extract the list of actions corresponding to the techniques that are common to the two layers.The approach we developed is very simple and it's the following:analyse MSV Library and collect a list of VIDs for every technique.create a MITRE ATT&CK navigator layer where for each technique the metadata field contains the list of VIDs.import the MSV layer in the Navigator.import in the Navigator the other layer (e.g. mapping of an incident, TTPs from APT41, ...).combine the two layers to see where they o

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260407 - Content Expansion. This content pack requires Director version 4.14.1.00/94-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes300 Actions added 191 Files added 274 Actions updatedRelease HighlightsNew Actions related to the Actors, Malware, and Vulnerabilities in the M-Trends 2026 Report. The M-Trends 2026 Report provides trends analysis, metrics, and learnings drawn from the frontlines of Mandiant incident response investigations and threat intelligence findings between January 1, 2025 - December 31, 2025.For full details on this release, see the Release Notes on the Mandiant Documentation Portal.

VHR20260401 - April 1, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260401 - Content Expansion. This content pack requires Director version 4.14.1.00/94-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes171 Actions added 98 Files added 1 Action updatedRelease HighlightsA new Action covering APT34, an Iranian state-sponsored cyber espionage group operational since at least 2014, largely focused on phishing efforts to benefit Iranian nation-state interests. New Actions covering UNC5187, a suspected Iranian cyber espionage group with moderate-confidence ties to APT34 that primarily conducts malware deployment operations. New Actions covering UNC5667, a suspected subcluster of Iranian espionage actor UNC3313 that primarily conducts custom malware deployment operations

VHR20260401 - April 1, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260401 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes171 Actions added 98 Files added 1 Action updatedRelease HighlightsA new Action covering APT34, an Iranian state-sponsored cyber espionage group operational since at least 2014, largely focused on phishing efforts to benefit Iranian nation-state interests. New Actions covering UNC5187, a suspected Iranian cyber espionage group with moderate-confidence ties to APT34 that primarily conducts malware deployment operations. New Actions covering UNC5667, a suspected subcluster of Iranian espionage actor UNC3313 that primarily conducts custom malware deployment operations via

Strategic Proposal: Neutralizing AI Prompt Injection via Recursive Honey-potting​Submitted by: Adam EehanReference ID: VRP 493408185Topic: Active Cyber-Defense & AI Security​1. The Problem: Prompt Injection​Current Large Language Models (LLMs) like Gemini are vulnerable to "Prompt Injection" attacks, where malicious users trick the AI into bypassing safety filters or revealing internal system instructions.​2. The Solution: Recursive Honey-potting​Instead of just blocking an attack, my strategy involves creating a "Digital Trap".​The Mechanism: When the system detects a suspicious or high-risk prompt, it doesn't just say "Access Denied." Instead, it triggers a Recursive Honey-pot.​The Decoy: The system serves the attacker "Decoy Data" (fake but realistic-looking internal info).​The Trap: As the attacker tries to use or dig deeper into this decoy data, the system recursively creates more fake layers, keeping the attacker busy in a "Infinite Sandbox" while silently logging their IP an

Project ID: topical-proSite URL: topical-pro.web.appHello,My Firebase project has been suspended for "Phishing," resulting in a "Site Not Found" error. I believe this is a false positive and would like to request a manual review to reinstate the project.Project Context: This is an educational resource site providing independent study guides for students.Why this is a False Positive: No Sensitive Data Collection: The site does not contain any login forms, password fields, or requests for personal/financial information. Independent Educational Content: While the site mentions exam boards (Pearson/Cambridge) in a legal disclaimer, it is a non-affiliated resource library for students. Harmless Logic: The Firebase Realtime Database scripts are used solely for a public visitor counter and do not track private user data. Actions Taken: I have reviewed the source code for any malicious scripts. I am ready to modify the site immediately if specific elements are deemed non-compliant, but I

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260306 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes382 Actions added 231 Files addedRelease HighlightsNew Actions covering UNC3313, an Iran-nexus cyber espionage group observed targeting Middle Eastern government, telecommunications, and technology entities. New Actions covering UNC1549, a suspected Iranian cyber espionage cluster targeting energy, government, and defense sectors primarily in Saudi Arabia and the United Arab Emirates. New Actions covering APT42, an Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260304 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes72 Actions added 30 Files addedRelease HighlightsNew Actions demonstrating Campaign 26-009, a campaign distributing Node.js-based malware via fake trading installers, utilizing a 'Bring Your Own Interpreter' technique and modifying Windows Defender exclusions. New Actions covering Campaign 26-004, a financially motivated actor campaign exploiting CrushFTP to deploy TRIDENT ransomware and leveraging WAVECALL, SIRENSONG, and ANYDESK. New Actions demonstrating Campaign 26-008, a TEMP.Hex campaign distributing SOGU via USB flash drives. New Actions demonstrating Campaign 26-007, a China-nexus threat