FireEye
FireEye is a publicly traded cybersecurity company headquartered in Milpitas, California.It has been involved in the detection and prevention of major cyber attacks.
It provides hardware, software, and services to investigate cybersecurity attacks, protect against malicious software, and analyze IT security risks. FireEye was founded in 2004. Initially, it focused on developing virtual machines that would download and test internet traffic before transferring it to a corporate or government network. The company diversified over time, in part through acquisitions. In 2014, it acquired Mandiant, which provides incident response services following the identification of a security breach. FireEye went public in 2013. USAToday says FireEye "has been called in to investigate high-profile attacks against Target, JP Morgan Chase, Sony Pictures, Anthem and others". Yahoo Finance says FireEye is again the fastest-growing cyber security firm, according to Deloitte.
Corporate history
FireEye was founded in 2004 by Ashar Aziz, a former Sun Microsystems engineer. It received early investments from the likes of Sequoia Capital and Norwest Venture Partners in 2005, and DAG Ventures in 2008. FireEye's first commercial product was not developed and sold until 2010. That same year, FireEye expanded into the Middle-East. This was followed by the opening of new offices in Asia Pacific in 2010, Europe in 2011 and Africa in 2013.In December 2012, founder Aziz stepped down as CEO and former McAfee CEO David DeWalt was appointed to the position. DeWalt was recruited in order to prepare the company for an initial public offering. The following year, FireEye raised an additional $50 million in venture capital, bringing its total funding to $85 million. In late 2013, FireEye went public, raising $300 million.
At the time, FireEye was growing rapidly. It had 175 employees in 2011, which grew to 900 by June 2013. Revenues multiplied eight-fold between 2010 and 2012. However, FireEye was not yet profitable, due to high operating costs such as research and development expenses.
In December 2013, FireEye acquired Mandiant for $1 billion. Mandiant was a private company founded in 2004 by Kevin Mandia that provided incident response services in the event of a data security breach. Mandiant was known for investigating high-profile hacking groups. Before the acquisition, FireEye would often identify a security breach, then partner with Mandiant to investigate who the hackers were. Mandiant became a subsidiary of FireEye.
In late 2014, FireEye initiated a secondary offering, selling another $1.1 billion in shares, in order to fund development of a wider range of products. Shortly afterward, FireEye acquired another data breach investigation company, nPulse, for approximately $60 million. By 2015, FireEye was making more than $100 million in annual revenue, but was still unprofitable, largely due to research and development spending.
In January 2016, FireEye acquired iSIGHT Partners for $275 million. iSIGHT was a threat intelligence company that gathered information about hacker groups and other cybersecurity risks. This was followed by the acquisition of Invotas, an IT security automation company. DeWalt stepped down as CEO in 2016 and was replaced by Mandiant CEO and former FireEye President Kevin Mandia. Afterwards, there was a downsizing and restructuring in response to lower-than-expected sales, resulting in a layoff of 300-400 employees. Profit and revenue increased on account of shifts to a subscription model and lower costs.
Acquisitions
| Announcement date | Company | Business | Deal size | References |
| December 30, 2013 | Mandiant | Information security | $1 billion | |
| May 8, 2014 | nPulse Technologies | Information security | $60 million | |
| January 2016 | iSight Partners | Cyber Threat Intelligence | $275 Million | |
| February 2016 | Invotas | Security Orchestration | ||
| October 2017 | The Email Laundry | Email Security | ||
| January 2018 | X15 Software | Machine and Log Data Management | $15 million in equity and $5 million in cash | |
| May 2019 | Verodin, Inc. | Security Instrumentation | Approximately $250 million in cash and stock | |
| January 2020 | Cloudvisory | Cloud Security |
Products and services
FireEye started out as a "sandboxing" company. Sandboxing is where incoming network traffic is opened within a virtual machine to test it for malicious software, before being introduced into the network. FireEye's products diversified over time, in part through acquisitions. In 2017, FireEye transitioned from primarily selling appliances, to a software-as-a-service model.FireEye sells technology products including network, email and endpoint security, a platform for managing security operations centers called Helix, consulting services primarily based on incident response, and threat intelligence products.
The Central Management System consolidates the management, reporting, and data sharing of Web MPS, Email MPS, File MPS, and Malware Analysis System into a single network-based appliance by acting as a distribution hub for malware security intelligence.
The FireEye Cloud crowd-sources Dynamic Threat Intelligence detected by individual FireEye MPS appliances, and automatically distributes this time sensitive zero-day intelligence globally to all subscribed customers in frequent updates. Content Updates include a combination of DTI and FireEye Labs generated intelligence identified through research efforts.
Operations
FireEye is known for uncovering high-profile hacking groups.2008-2014
In October/November 2009, FireEye participated in an effort to take down the Mega-D botnet. On March 16, 2011, the Rustock botnet was taken down through an action by Microsoft, US federal law enforcement agents, FireEye, and the University of Washington. In July 2012, FireEye was involved in analysis of the Grum botnet's command and control servers located in the Netherlands, Panama, and Russia.In 2013, Mandiant uncovered a multi-year espionage effort by a Chinese hacking group called APT1.
In 2014, the FireEye Labs team identified two new zero-day vulnerabilities – – as part of limited, targeted attacks against major corporations. Both zero-days exploit the Windows kernel. Microsoft addressed the vulnerabilities in their October 2014 Security Bulletin. Also in 2014, FireEye provided information on a threat group it calls FIN4. FIN4 appears to conduct intrusions that are focused on a single objective: obtaining access to insider information capable of making or breaking the stock prices of public companies. The group has targeted hundreds of companies, and specifically targets the emails of C-level executives, legal counsel, regulatory, risk, and compliance personnel, and other individuals who would regularly discuss confidential, market-moving information. Also in 2014, FireEye released a report focused on a threat group it refers to as APT28. APT28 focuses on collecting intelligence that would be most useful to a government. Specifically, FireEye found that since at least 2007, APT28 has been targeting privileged information related to governments, militaries, and security organizations that would likely benefit the Russian government.
2015
In 2015, FireEye confirmed the existence of at least 14 router implants spread across four different countries: Ukraine, Philippines, Mexico, and India. Referred to as SYNful Knock, the implant is a stealthy modification of the router’s firmware image that can be used to maintain persistence within a victim’s network.In September 2015, FireEye obtained an injunction against a security researcher attempting to report vulnerabilities in FireEye Malware Protection System.
In 2015, FireEye uncovered an attack exploiting two previously unknown vulnerabilities, one in Microsoft Office and another in Windows. The attackers hid the exploit within a Microsoft Word document that appeared to be a résumé. The combination of these two exploits grant fully privileged remote code execution. Both vulnerabilities were patched by Microsoft.
In 2015, the FireEye as a Service team in Singapore uncovered a phishing campaign exploiting an Adobe Flash Player zero-day vulnerability. Adobe released a patch for the vulnerability with an out-of-band security bulletin. FireEye attributed the activity to a China-based threat group it tracks as APT3.
2016
In 2016, FireEye announced that it has been tracking a pair of cybercriminals referred to as the “Vendetta Brothers.” The company said that the enterprising duo uses various strategies to compromise point-of-sale systems, steal payment card information and sell it on their underground marketplace “Vendetta World.”In mid-2016, FireEye released a report on the impact of the 2015 agreement between former U.S. President Barack Obama and China's paramount leader Xi Jinping that neither government would “conduct or knowingly support cyber-enabled theft of intellectual property” for an economic advantage. The security firm reviewed the activity of 72 groups that it suspects are operating in China or otherwise support Chinese state interests and determined that, as of mid-2014, there was an overall decrease in successful network compromises by China-based groups against organizations in the U.S. and 25 other countries.
In 2016, FireEye announced that it had identified several versions of an ICS-focused malware – dubbed IRONGATE – crafted to manipulate a specific industrial process running within a simulated Siemens control system environment. Although Siemens Product Computer Emergency Readiness Team confirmed to FireEye that IRONGATE is not viable against operational Siemens control systems and that IRONGATE does not exploit any vulnerabilities in Siemens products, the security firm said that IRONGATE invokes ICS attack concepts first seen in Stuxnet.
On May 8, 2016, FireEye detected an attack exploiting a previously unknown vulnerability in Adobe Flash Player. The security firm reported the issue to the Adobe Product Security Incident Response Team and Adobe released a patch for the vulnerability just four days later.
In 2016, FireEye discovered a widespread vulnerability affecting Android devices that permits local privilege escalation to the built-in user “radio”, making it so an attacker can potentially perform activities such as viewing the victim’s SMS database and phone history. FireEye reached out to Qualcomm in January 2016 and subsequently worked with the Qualcomm Product Security Team to address the issue.
In 2016, FireEye provided details on FIN6, a cyber criminal group that steals payment card data for monetization from targets predominately in the hospitality and retail sectors. The group was observed aggressively targeting and compromising point-of-sale systems, and making off with millions of payment card numbers that were later sold on an underground marketplace.