Mandiant M-Trends 2025 — AI used by financially-motivated and state-sponsored actors
Date: 2025-04
Affected: GenAI tools; varied industry verticals
Attack vector: tool-abuse
Category: threat-report
Severity: High

Mandiant's M-Trends 2025 report documents AI usage across investigated incidents — phishing-lure generation by FIN6, fake interview personas by FAMOUS CHOLLIMA, AI-assisted PowerShell tooling by UNC5221, and an uptick in deepfake voice fraud against finance teams. Dwell time held at 11 days.


Mitigations:

Architectural layers (MAESTRO):