Trellix

In October/November 2009, FireEye participated to take down the Mega-D botnet (also known as Ozdok).[43] On March 16, 2011, the Rustock botnet was taken down through action by Microsoft, US federal law enforcement agents, FireEye, and the University of Washington.[44] In July 2012, FireEye was involved in the analysis[45] of the Grum botnet's command and control servers located in the Netherlands, Panama, and Russia.[46]

In 2013, Mandiant (before being acquired by FireEye) uncovered a multi-year espionage effort by a Chinese hacking group called APT1.[47]

In 2014, the FireEye Labs team identified two new zero-day vulnerabilities – CVE-2014–4148 and CVE-2014–4113 – as part of limited, targeted attacks against major corporations. Both zero-days exploit the Windows kernel. Microsoft addressed the vulnerabilities in October 2014 Security Bulletin.[48] Also in 2014, FireEye provided information on a threat group it calls FIN4. FIN4 appears to conduct intrusions that are focused on a single objective: obtaining access to insider information capable of making or breaking the stock prices of public companies. The group has targeted hundreds of companies and specifically targets the emails of C-level executives, legal counsel, regulatory, risk, and compliance personnel, and other individuals who would regularly discuss confidential, market-moving information.[49] Also in 2014, FireEye released a report focused on a threat group it refers to as APT28. APT28 focuses on collecting intelligence that would be most useful to a government. FireEye found that since at least 2007, APT28 has been targeting privileged information related to governments, militaries, and security organizations that would likely benefit the Russian government.[50]

In 2015, FireEye confirmed the existence of at least 14 router implants spread across four different countries: Ukraine, the Philippines, Mexico, and India. Referred to as SYNful Knock, the implant is a stealthy modification of the router’s firmware image that can be used to maintain persistence within a victim’s network.[51]

In September 2015, FireEye obtained an injunction against a security researcher attempting to report vulnerabilities in FireEye Malware Protection System.[52]

In 2015, FireEye uncovered an attack exploiting two previously unknown vulnerabilities, one in Microsoft Office (CVE-2015–2545) and another in Windows (CVE-2015–2546). The attackers hid the exploit within a Microsoft Word document (.docx) that appeared to be a résumé. The combination of these two exploits grants fully privileged remote code execution. Both vulnerabilities were patched by Microsoft.[53]

In 2015, the FireEye as a Service team in Singapore uncovered a phishing campaign exploiting an Adobe Flash Player zero-day vulnerability (CVE-2015–3113). Adobe released a patch for the vulnerability with an out-of-band security bulletin. FireEye attributed the activity to a China-based threat group it tracks as APT3.[54]

In 2016, FireEye announced that it has been tracking a pair of cybercriminals referred to as the “Vendetta Brothers.” The company said that the enterprising duo uses various strategies to compromise point-of-sale systems, steal payment card information and sell it on their underground marketplace “Vendetta World.”[55] In mid-2016, FireEye released a report on the impact of the 2015 agreement between former U.S. President Barack Obama and China's paramount leader Xi Jinping that neither government would “conduct or knowingly support cyber-enabled theft of intellectual property” for economic advantage. The security firm reviewed the activity of 72 groups that it suspects are operating in China or otherwise support Chinese state interests and determined that, as of mid-2014, there was an overall decrease in successful network compromises by China-based groups against organizations in the U.S. and 25 other countries.[56]

In 2016, FireEye announced that it had identified several versions of an ICS-focused malware – dubbed IRON GATE – crafted to manipulate a specific industrial process running within a simulated Siemens control system environment. Although Siemens Product Computer Emergency Readiness Team (ProductCERT) confirmed to FireEye that IRON GATE is not viable against operational Siemens control systems and that IRON GATE does not exploit any vulnerabilities in Siemens products, the security firm said that IRON GATE invokes ICS attack concepts first seen in Stuxnet.[57]

On May 8, 2016, FireEye detected an attack exploiting a previously unknown vulnerability in Adobe Flash Player (CVE-2016–4117). The security firm reported the issue to the Adobe Product Security Incident Response Team (PSIRT) and Adobe released a patch for the vulnerability just four days later.[58]

In 2016, FireEye discovered a widespread vulnerability affecting Android devices that permits local privilege escalation to the built-in user “radio”, making it so an attacker can potentially perform activities such as viewing the victim’s SMS database and phone history. FireEye reached out to Qualcomm in January 2016 and subsequently worked with the Qualcomm Product Security Team to address the issue.[59]

In 2016, FireEye provided details on FIN6, a cybercriminal group that steals payment card data for monetization from targets predominately in the hospitality and retail sectors. The group was observed aggressively targeting and compromising point-of-sale (POS) systems, and making off millions of payment card numbers that were later sold on an underground marketplace.[60]

In 2017, FireEye detected malicious Microsoft Office RTF documents leveraging a previously undisclosed vulnerability, CVE-2017-0199. This vulnerability allows a malicious actor to download and execute a Visual Basic script containing PowerShell commands when a user opens a document containing an embedded exploit. FireEye shared the details of the vulnerability with Microsoft and coordinated public disclosure timed with the release of a patch by Microsoft to address the vulnerability.[61]

In 2018, FireEye helped Facebook identify 652 fake accounts.[62]

FireEye revealed on Tuesday, December 8, 2020, that its systems were pierced by what it called "a nation with top-tier offensive capabilities".[63] The company said the attackers used "novel techniques" to steal copies of FireEye's red team tool kit, which the attackers could potentially use in other attacks.[64][65] The same day, FireEye published countermeasures against the tools that had been stolen.[66][67]

A week later in December 2020, FireEye reported the SolarWinds supply chain attack to the U.S. National Security Agency (NSA), the federal agency responsible for defending the U.S. from cyberattacks, and said its tools were stolen by the same actors. The NSA is not known to have been aware of the attack before being notified by FireEye. The NSA uses SolarWinds software itself.[68]

Within a week of FireEye's breach, cyber-security firm McAfee said the stolen tools had been used in at least 19 countries, including the US, the UK, Ireland, the Netherlands, and Australia.[69]

During the continued investigation of the hack of their data and that of federal agencies revealed on December 8, 2020, FireEye reported in early January that the hacks originated from inside the USA, sometimes very close to the facilities affected, which enabled the hackers to evade surveillance by the National Security Agency and the defenses used by the Department of Homeland Security.[70]

A 2022 report by Trellix noted that hacking groups Wicked Panda (linked to China) and Cozy Bear (linked to Russia) were behind 46% of all state-sponsored hacking campaigns in the third quarter of 2021 and that in a third of all state-sponsored cyber attacks, the hackers abused Cobalt Strike security tools to get access to the victim's network.[71] In a January 2022 report on Fox News, Trellix CEO Bryan Palma stated that there is an increasing level of cyberwarfare threats from Russia and China.[72]

A 2022 Trellix report stated that hackers are using Microsoft OneDrive in an espionage campaign against government officials in Western Asia. The malware, named by Trellix as Graphite, employs Microsoft Graph to use OneDrive as a command and control server and execute the malware. The attack is split into multiple stages to remain hidden for as long as possible.[73]