From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
FireEye, Inc.
Russell 1000 Component
Industry Computer security
Founded 2004
Founder Ashar Aziz
Headquarters Milpitas, California, United States
Key people
Kevin Mandia (CEO 2016 - ?? )
Products Network security
  • Email Security
  • Endpoint Security
  • File Security
  • Cross Vendor Management Interface
  • Incident Response
  • Vulnerability Testing
  • Preparedness Assessment
  • Security Consulting
  • Increase US $751 million
  • Increase US $303 million
Total assets US $2.33 billion (2017)[3]
Number of employees
~3,200 (2016)

FireEye, Inc. is a publicly listed enterprise cybersecurity company[5] that provides products and services to protect against advanced cyber threats, such as advanced persistent threats and spear phishing. Founded in 2004, the company is headquartered in Milpitas, California.

USAToday says FireEye "has been called in to investigate high-profile attacks against Target, JP Morgan Chase, Sony Pictures, Anthem and others".[6] Yahoo Finance says FireEye is again the fastest-growing cyber security firm, according to Deloitte.[7]

Corporate History[edit]


Kevin Mandia, CEO and Board Director of FireEye at the Vanity Fair New Establishment Summit at Yerba Buena Center for the Arts on October 8, 2014 in San Francisco, California

In 2004, Ashar Aziz, a Pakistani American, founded FireEye with venture capital provided by Sequoia Capital.[8]

In June 2012, former CEO and President of McAfee, Dave DeWalt, joined FireEye as chairman.[9] DeWalt was appointed CEO in November 2012.[9][10]

Expansion and IPO[edit]

On September 20, 2013 the company went public on NASDAQ.[11]

In May 2016, it was announced that Dave DeWalt would step down from his position as CEO and become executive chairman on June 15, 2016. DeWalt was replaced by the company's president, Kevin Mandia.[12] Mandia came on board with the acquisition of Mandiant in 2013.


Announcement date Company Business Deal size References
December 30, 2013 Mandiant Information security $1 billion [13]
May 8, 2014 nPulse Technologies Information security $60 million [14]
January 2016 iSight Partners Cyber Threat Intelligence $275 Million [15]
February 2016 Invotas Security Orchestration [16]
October 2017 The Email Laundry Email Security [17]
January 2018 X15 Software Machine and Log Data Management $15 million in equity and $5 million in cash [18]

Products and services[edit]

Central Management System[edit]

The Central Management System (CMS) consolidates the management, reporting, and data sharing of Web MPS (Malware Protection System), Email MPS, File MPS, and Malware Analysis System (MAS) into a single network-based appliance by acting as a distribution hub for malware security intelligence.[19]

Dynamic Threat Intelligence[edit]

The FireEye Cloud crowd-sources Dynamic Threat Intelligence (DTI) detected by individual FireEye MPS appliances, and automatically distributes this time sensitive zero-day intelligence globally to all subscribed customers in frequent updates. Content Updates include a combination of DTI and FireEye Labs generated intelligence identified through research efforts.

Cyber actions[edit]


In October/November 2009, FireEye participated in an effort to take down the Mega-D botnet (also known as Ozdok).[20] On March 16, 2011, the Rustock botnet was taken down through an action by Microsoft, US federal law enforcement agents, FireEye, and the University of Washington.[21] In July 2012, FireEye was involved in analysis[22] of the Grum botnet's command and control servers located in the Netherlands, Panama, and Russia.[citation needed]

In 2014, the FireEye Labs team identified two new zero-day vulnerabilities – CVE-2014-4148 and CVE-2014-4113 – as part of limited, targeted attacks against major corporations. Both zero-days exploit the Windows kernel. Microsoft addressed the vulnerabilities in their October 2014 Security Bulletin.[23] Also in 2014, FireEye provided information on a threat group it calls FIN4. FIN4 appears to conduct intrusions that are focused on a single objective: obtaining access to insider information capable of making or breaking the stock prices of public companies. The group has targeted hundreds of companies, and specifically targets the emails of C-level executives, legal counsel, regulatory, risk, and compliance personnel, and other individuals who would regularly discuss confidential, market-moving information.[24] Also in 2014, FireEye released a report focused on a threat group it refers to as APT28. APT28 focuses on collecting intelligence that would be most useful to a government. Specifically, FireEye found that since at least 2007, APT28 has been targeting privileged information related to governments, militaries, and security organizations that would likely benefit the Russian government.[25]


In 2015, FireEye confirmed the existence of at least 14 router implants spread across four different countries: Ukraine, Philippines, Mexico, and India. Referred to as SYNful Knock, the implant is a stealthy modification of the router’s firmware image that can be used to maintain persistence within a victim’s network.[26]

In September 2015, FireEye obtained an injunction against a security researcher attempting to report vulnerabilities in FireEye Malware Protection System.[27]

In 2015, FireEye uncovered an attack exploiting two previously unknown vulnerabilities, one in Microsoft Office (CVE-2015-2545) and another in Windows (CVE-2015-2546). The attackers hid the exploit within a Microsoft Word document (.docx) that appeared to be a résumé. The combination of these two exploits grant fully privileged remote code execution. Both vulnerabilities were patched by Microsoft.[28]

In 2015, the FireEye as a Service team in Singapore uncovered a phishing campaign exploiting an Adobe Flash Player zero-day vulnerability (CVE-2015-3113). Adobe released a patch for the vulnerability with an out-of-band security bulletin. FireEye attributed the activity to a China-based threat group it tracks as APT3.[29]


In 2016, FireEye announced that it has been tracking a pair of cybercriminals referred to as the “Vendetta Brothers.” The company said that the enterprising duo uses various strategies to compromise point-of-sale systems, steal payment card information and sell it on their underground marketplace “Vendetta World.”[30]

In mid-2016, FireEye released a report on the impact of the 2015 agreement between US President Barack Obama and Chinese President Xi Jinping that neither government would “conduct or knowingly support cyber-enabled theft of intellectual property” for an economic advantage. The security firm reviewed the activity of 72 groups that it suspects are operating in China or otherwise support Chinese state interests and determined that, as of mid-2014, there was an overall decrease in successful network compromises by China-based groups against organizations in the U.S. and 25 other countries.[31]

In 2016, FireEye announced that it had identified several versions of an ICS-focused malware – dubbed IRONGATE – crafted to manipulate a specific industrial process running within a simulated Siemens control system environment. Although Siemens Product Computer Emergency Readiness Team (ProductCERT) confirmed to FireEye that IRONGATE is not viable against operational Siemens control systems and that IRONGATE does not exploit any vulnerabilities in Siemens products, the security firm said that IRONGATE invokes ICS attack concepts first seen in Stuxnet.[32]

On May 8, 2016, FireEye detected an attack exploiting a previously unknown vulnerability in Adobe Flash Player (CVE-2016-4117). The security firm reported the issue to the Adobe Product Security Incident Response Team (PSIRT) and Adobe released a patch for the vulnerability in just four days later.[33]

In 2016, FireEye discovered a widespread vulnerability affecting Android devices that permits local privilege escalation to the built-in user “radio”, making it so an attacker can potentially perform activities such as viewing the victim’s SMS database and phone history. FireEye reached out to Qualcomm in January 2016 and subsequently worked with the Qualcomm Product Security Team to address the issue.[34]

In 2016, FireEye provided details on FIN6, a cyber criminal group that steals payment card data for monetization from targets predominately in the hospitality and retail sectors. The group was observed aggressively targeting and compromising point-of-sale (POS) systems, and making off with millions of payment card numbers that were later sold on an underground marketplace.[35]

FireEye's firm Mandiant was hired by Russia's Alfa Bank to locate information on connections to Trump's servers and was also hired by Equifax to determine source of data breach and in both cases, Mandiant did not find anything conclusive. [36][37]


In 2017, FireEye detected malicious Microsoft Office RTF documents leveraging a previously undisclosed vulnerability, CVE-2017-0199. This vulnerability allows a malicious actor to download and execute a Visual Basic script containing PowerShell commands when a user opens a document containing an embedded exploit. FireEye shared the details of the vulnerability with Microsoft and coordinated public disclosure timed with the release of a patch by Microsoft to address the vulnerability.[38]


  1. ^ a b "FireEye Inc., Annual Income Statement (2017)". Retrieved April 2, 2018. 
  2. ^ "FireEye Reports Record Revenue for Fourth Quarter and Full Year 2017". Retrieved April 2, 2018.  External link in |website= (help)
  3. ^ "FireEye Total Assets (Dec. 31, 2017)". Retrieved April 2, 2018. 
  4. ^ "FireEye, Inc. (FEYE)". Retrieved April 3, 2018. 
  5. ^ Oltsik, Jon. "FireEye Myth and Reality". Network World. Retrieved 2016-10-19. 
  6. ^ "FireEye has become Go-to Company for Breaches". USA Today. Retrieved 21 May 2015. 
  7. ^ "FireEye Fastest Growing Cyber Security". Yahoo Finance. Retrieved 2015-11-20. 
  8. ^ Mitra, Sramana (January 29, 2009). "Barriers To Innovation". Forbes. Retrieved 2009-11-30. 
  9. ^ a b "FireEye Appoints Board Chairman David DeWalt as Chief Executive Officer" (Press release). FireEye. 2012-11-28. Retrieved 2012-11-30. 
  10. ^ Robertson, Jordan (2012-11-28). "Former McAfee Chief DeWalt Named FireEye CEO, Aims for 2013 IPO". Bloomberg. Retrieved 2012-11-30. 
  11. ^ Geron, Tomio (2013-09-20). "FireEye Founder Banks Hundreds Of Millions In IPO". Forbes. Retrieved 2017-01-06. 
  12. ^ "FireEye Names New CEO". Fortune. 2016-05-06. Retrieved 2016-05-06. 
  13. ^ Perlroth, Nicole; Sanger, David E. (2014-01-02). "FireEye Computer Security Firm Acquires Mandiant". The New York Times. 
  14. ^ Miller, Ron (May 8, 2014). "FireEye Buys nPulse Technologies For $60M+ To Beef Up Network Security Suite". TechCrunch. 
  15. ^
  16. ^
  17. ^ "The Future is Bright for FireEye Email Security « The Future is Bright for FireEye Email Security". FireEye. Retrieved 2018-07-12. 
  18. ^
  19. ^ "FireEye Forecasts Downbeat Results for Current Quarter; Shares Tumble (NASDAQ:FEYE) - Sonoran Weekly Review". Sonoran Weekly Review. 2016-05-06. Retrieved 2016-05-06. 
  20. ^ Cheng, Jacqui (November 11, 2009). "Researchers' well-aimed stone takes down Goliath botnet". Ars Technica. Retrieved 2009-11-30. 
  21. ^ Wingfield, Nick (2011-03-18). "Spam Network Shut Down". Wall Street Journal. Retrieved 2011-03-18. 
  22. ^ "FireEye Blog | Threat Research, Analysis, and Mitigation". Archived from the original on 2013-01-31. Retrieved 2014-04-12. 
  23. ^ "Microsoft Security Bulletin Summary for October 2014". Microsoft. Retrieved 21 June 2017. 
  24. ^ Sullivan, Gail (2 December 2014). "Report: 'FIN4' hackers are gaming markets by stealing insider info". Washington Post. Retrieved 21 June 2017. 
  25. ^ Fox-Brewster, Tom (29 October 2014). "'State sponsored' Russian hacker group linked to cyber attacks on neighbours". The Guardian. 
  26. ^ Leyden, John (15 September 2015). "Compromised Cisco routers spotted bimbling about in the wild". The Register. Retrieved 21 June 2017. 
  27. ^ Goodin, Dan (September 11, 2015). "Security company litigates to bar disclosure related to its own flaws". Retrieved September 12, 2015. 
  28. ^ "Acknowledgments – 2015". Microsoft. Retrieved 21 June 2017. 
  29. ^ "Security updates available for Adobe Flash Player". Adobe. Retrieved 21 June 2017. 
  30. ^ Korolov, Maria (29 September 2016). "Diversified supply chain helps 'Vendetta Brothers' succeed in criminal business". CSO. Retrieved 21 June 2017. 
  31. ^ Hackett, Robert (25 June 2016). "China's Cyber Spying on the U.S. Has Drastically Changed". Fortune. Retrieved 21 June 2017. 
  32. ^ Cox, Joseph (2 June 2016). "There's a Stuxnet Copycat, and We Have No Idea Where It Came From". Motherboard. Retrieved 21 June 2017. 
  33. ^ "Security updates available for Adobe Flash Player". Adobe. Retrieved 21 June 2017. 
  34. ^ Goodin, Dan (5 May 2016). "Critical Qualcomm security bug leaves many phones open to attack". Ars Technica. Retrieved 21 June 2017. 
  35. ^ Taylor, Harriet (20 April 2016). "What one criminal gang does with stolen credit cards". CNBC. Retrieved 21 June 2017. 
  36. ^
  37. ^
  38. ^ "CVE-2017-0199 Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API". Microsoft. Retrieved 21 June 2017. 

External links[edit]