Mandiant

Mandiant, Inc. is an American cybersecurity firm and a subsidiary of Google. The company published a report in February 2013 that implicated China in cyber espionage. In December 2013, FireEye acquired Mandiant for $1 billion. FireEye later sold its product line, name, and employees to Symphony Technology Group for $1.2 billion in June 2021. In March 2022, Google announced it would acquire Mandiant for $5.4billion. The firm was fully incorporated into the Google Cloud division in September 2022.[2]

Founding

Kevin Mandia, a former United States Air Force officer who serves as the company's chief executive officer, founded Mandiant as Red Cliff Consulting in 2004 before rebranding to its current name in 2006.[3][4] In 2011, Mandiant received funding from Kleiner Perkins Caufield & Byers and One Equity Partners to expand its staff and grow its business-to-business operations, providing incident response and general security consulting along with incident management products to major global organizations, governments, and Fortune 100 companies.[5]

History

Mandiant is the creator of OpenIOC (Open Indicators of Compromise), an extensible XML schema for the description of technical characteristics that identify threats, security hackers' methodologies, and evidence of compromise. In 2012, its revenues were over $100 million, up 76% from 2011.[6]

In February 2013, Mandiant released a report documenting evidence of cyber attacks by the People's Liberation Army,[7] specifically Pudong-based PLA Unit 61398,[8] targeting at least 141 organizations in the United States and other English-speaking countries extending as far back as 2006.[9] In the report, Mandiant referred to the espionage unit as "APT1".[10]

In December 2013, Mandiant was acquired by FireEye for $1 billion.[11][12] In October 2020, the company announced Mandiant Advantage, a subscription-based SaaS platform designed to augment and automate security response teams which combined the threat intelligence gathered by Mandiant and data from cyber incident response engagements;[13] in December, the company investigated a major supply chain attack through SolarWinds software in U.S. government infrastructure.[14][15][16]

In May 2021, Mandiant was contracted to assist in the response to a ransomware incident impacting Colonial Pipeline, a fuel pipeline operator that supplies close to half of the gasoline, diesel, and other fuels to the East Coast of the U.S.[17][18] In June, the company was spun off FireEye as part of the latter's acquisition by Symphony Technology Group.[19][20] In August, the company acquired Intrigue, which specialized in surface management.[21]

In 2022, Axios reported that Mandiant reporters identified a pro-China disinformation campaign targeting American voters ahead of the 2022 midterm elections.[22]

On May 4, 2023, Mandiant announced its integration for MISP, Splunk SIEM and SOAR.[23]

In March 2024, Mandiant assisted with the investigation of the Snowflake data breach, where Snowflake’s customers were targeted in a massive data theft and extortion campaign. Targeted customers included Ticketmaster, Advance Auto Parts, Santander Bank, Neiman Marcus, LendingTree, AT&T, Pure Storage, and Bausch Health.[24][25]

Flare-On

Since 2014, every year around autumn the company organises a well-known cybersecurity reverse engineering challenge called Flare-On, with participants from around the world.[34]

External links

• Flare-On challenge website