Mandiant, Inc.
Subsidiary
Former nameRed Cliff Consulting (2004–2006)
Founded2004 (age 22)
FounderKevin Mandia
IndustryInformation security
LocationReston, Virginia, U.S.
Key peopleKevin Mandia (CEO)
Num employees2,335 (December 2021)
RevenueUS$483 million (2021)
Websitemandiant.com

Mandiant, Inc. is an American cybersecurity firm and a subsidiary of Google. The company published a report in February 2013 that implicated China in cyber espionage. In December 2013, FireEye acquired Mandiant for $1 billion. FireEye later sold its product line, name, and employees to Symphony Technology Group for $1.2 billion in June 2021. In March 2022, Google announced it would acquire Mandiant for $5.4 billion. The firm was fully incorporated into the Google Cloud division in September 2022.[1][2]

Founding

Kevin Mandia, a former United States Air Force officer who serves as the company's chief executive officer, founded Mandiant as Red Cliff Consulting in 2004 before rebranding to its current name in 2006.[3][4] In 2011, Mandiant received funding from Kleiner Perkins Caufield & Byers and One Equity Partners to expand its staff and grow its business-to-business operations, providing incident response and general security consulting along with incident management products to major global organizations, governments, and Fortune 100 companies.[5]

History

Mandiant is the creator of OpenIOC (Open Indicators of Compromise), an extensible XML schema for the description of technical characteristics that identify threats, security hackers' methodologies, and evidence of compromise. In 2012, its revenues were over $100 million, up 76% from 2011.[6]

In February 2013, Mandiant released a report documenting evidence of cyber attacks by the People's Liberation Army,[7] specifically Pudong-based PLA Unit 61398,[8] targeting at least 141 organizations in the United States and other English-speaking countries extending as far back as 2006.[9] In the report, Mandiant referred to the espionage unit as "APT1".[10]

In December 2013, Mandiant was acquired by FireEye for $1 billion.[11][12] In October 2020, the company announced Mandiant Advantage, a subscription-based SaaS platform designed to augment and automate security response teams which combined the threat intelligence gathered by Mandiant and data from cyber incident response engagements;[13] in December, the company investigated a major supply chain attack through SolarWinds software in U.S. government infrastructure.[14][15][16]

In May 2021, Mandiant was contracted to assist in the response to a ransomware incident impacting Colonial Pipeline, a fuel pipeline operator that supplies close to half of the gasoline, diesel, and other fuels to the East Coast of the U.S.[17][18] In June, the company was spun off FireEye as part of the latter's acquisition by Symphony Technology Group.[19][20] In August, the company acquired Intrigue, which specialized in surface management.[21]

In 2022, Axios reported that Mandiant reporters identified a pro-China disinformation campaign targeting American voters ahead of the 2022 midterm elections.[22]

On May 4, 2023, Mandiant announced its integration for MISP, Splunk SIEM and SOAR.[23]

In March 2024, Mandiant assisted with the investigation of the Snowflake data breach, where Snowflake’s customers were targeted in a massive data theft and extortion campaign. Targeted customers included Ticketmaster, Advance Auto Parts, Santander Bank, Neiman Marcus, LendingTree, AT&T, Pure Storage, and Bausch Health.[24][25]

Acquisition by Google

In March 2022, it was announced that the company would be acquired by Google for $5.4 billion and subsequently integrated into the Google Cloud division.[1][26] Following the announcement, Fortune reported that while the deal could face antitrust scrutiny, the acquisition "could help increase competition" rather than harm it.[27]

In April 2022, it was reported that the Department of Justice (DOJ) Antitrust Division was probing the deal for potential violations of federal antitrust law.[28] However, Mandiant revealed in July 2022 that the DOJ granted the acquisition approval.[29] Following a review over potential competition concerns, the Australian Competition & Consumer Commission (ACCC) announced it would not oppose the deal.[30]

On September 12, 2022, the deal closed and integration between Mandiant and Google Cloud began. Following the acquisition, Mandiant was allowed to maintain its brand as a subsidiary of Google Cloud.[31][32]

Flare-On

Since 2014, every year around autumn the company organises a cybersecurity reverse engineering challenge called Flare-On, with participants from around the world.[33]

References

  1. ^ Shead, Sam (March 8, 2022). "Google to acquire cybersecurity firm Mandiant for $5.4 billion". CNBC. Archived March 8, 2022 at the Wayback Machine. Retrieved March 8, 2022.
  2. ^ "Google Completes $5.4 Billion Acquisition of Mandiant". www.channelfutures.com. Retrieved 2025-01-17.
  3. ^ "MANDIANT, A New Name for a Fast Growing Company; Red Cliff Consulting LLC Rebrands as Firm Offers Expanded Services, Education and Software Tools". Business Wire. February 14, 2006. Archived from the original on April 2, 2015. Retrieved January 5, 2016.
  4. ^ Alspach, Kyle. "Kevin Mandia Stepping Down As CEO At Google-Owned Mandiant". www.crn.com. Retrieved 2025-01-17.
  5. ^ Overly, Steven (February 17, 2013). "Mandiant in the spotlight as cyber attacks on companies increase". The Washington Post. Archived February 18, 2013 at the Wayback Machine.
  6. ^ Brad Stone and Michael Riley (February 7, 2013). "Mandiant, the Go-To Security Firm for Cyber-Espionage Attacks". Bloomberg Business. Retrieved January 5, 2016.
  7. ^ Harris, Paul (February 23, 2013). "Chinese army hackers are the tip of the cyberwarfare iceberg". The Guardian. Archived August 22, 2022 at the Wayback Machine.
  8. ^ Xu, Weiwei (February 20, 2013). "China denies hacking claims". Morning Whistle. Archived from the original on June 29, 2013. Retrieved January 5, 2016.
  9. ^ Sanger, David E.; Barboza, David; Perlroth, Nicole (February 18, 2013). "Chinese Army Unit Is Seen as Tied to Hacking Against U.S.". The New York Times. Archived February 19, 2013 at the Wayback Machine. Retrieved January 5, 2016.
  10. ^ Wan, Ellen & Nakashima (February 19, 2013). "Report ties cyberattacks on U.S. computers to Chinese military". The Washington Post. Archived February 19, 2013 at the Wayback Machine. Retrieved January 5, 2016.
  11. ^ Perlroth, Nicole & Sanger, David (January 2, 2014). "FireEye Computer Security Firm Acquires Mandiant". The New York Times. Archived January 4, 2014 at the Wayback Machine. Retrieved September 18, 2018.
  12. ^ "FireEye acquires Mandiant in $1bn deal". BBC News. January 3, 2014. Archived July 7, 2022 at the Wayback Machine.
  13. ^ Osborne, Charlie (October 6, 2020). "FireEye's Mandiant debuts new SaaS threat intelligence suite". ZDNet. Archived October 9, 2020 at the Wayback Machine. Retrieved October 7, 2020.
  14. ^ Volz, Dustin (December 13, 2020). "U.S. Agencies Hacked in Foreign Cyber Espionage Campaign Linked to Russia". The Wall Street Journal
  15. ^ Turton, William & Mehrotra, Kartikay (December 14, 2020). "FireEye Discovered SolarWinds Breach While Probing Own Hack". Bloomberg News. Archived December 16, 2020 at the Wayback Machine.
  16. ^ McLaughlin, Jenna (December 13, 2021). "The state of U.S. cybersecurity a year after the SolarWinds hack". NPR
  17. ^ Turton, William & Mehrotra, Kartikay (June 4, 2021). "Hackers Breached Colonial Pipeline Using Compromised Password". Bloomberg Business. Archived June 4, 2021 at the Wayback Machine. Retrieved June 5, 2021.
  18. ^ Nakashima, Ellen; Torbati, Yeganeh; Englund, Will (May 8, 2021). "Ransomware attack leads to shutdown of major U.S. pipeline system". The Washington Post. Archived May 8, 2021 at the Wayback Machine. Retrieved May 12, 2021.
  19. ^ Sigalos, MacKenzie (June 2, 2021). "FireEye is selling its products business and name for $1.2 billion". CNBC
  20. ^ Duckett, Chris (January 18, 2022). "McAfee Enterprise and FireEye are now called Trellix". ZDNet. Archived January 19, 2022 at the Wayback Machine. Retrieved February 8, 2022.
  21. ^ Alspach, Kyle (August 10, 2021). "Mandiant's Advantage Platform To Get A Boost With Intrigue Acquisition". CRN. Archived August 10, 2021 at the Wayback Machine.
  22. ^ Sabin, Sam (2022-10-26). "Researchers uncover new pro-China disinformation campaign targeting U.S. voters". Axios. Retrieved 2022-10-28.
  23. ^ "New Mandiant Threat Intelligence Integrations for MISP, Splunk SIEM and SOAR, and Cortex XSOAR by Palo Alto Networks". Mandiant. Retrieved 2023-05-09.
  24. ^ "Alleged Snowflake hacker consents to extradition from Canada after US charges". therecord.media. Retrieved 2025-12-04.
  25. ^ Alspach, Kyle. "Snowflake Customers Hit With ‘Significant’ Data Theft In Attacks: Mandiant". www.crn.com. Archived 2024-11-11 at the Wayback Machine. Retrieved 2025-12-04.
  26. ^ Satariano, Adam (2022-03-08). "Google is buying Mandiant, a cybersecurity firm, for $5.4 billion.". The New York Times. ISSN 0362-4331. Retrieved 2026-04-10.
  27. ^ "Can antitrust regulators justify killing a Google-Mandiant deal?". Fortune. Retrieved 2022-10-28.
  28. ^ Burt, Jeff. "US DOJ probes Google's $5.4b Mandiant acquisition". www.theregister.com. Retrieved 2022-10-28.
  29. ^ Fitzgerald, Jay (2022-07-18). "Google-Mandiant Deal Closer After DOJ Ends Antitrust Inquiry". CRN. Retrieved 2022-10-28.
  30. ^ "Google's acquisition of Mandiant not opposed". The Bull. 2022-08-11. Retrieved 2022-10-28.
  31. ^ Faife, Corin (September 12, 2022). "Google now owns the firm that found SolarWinds hack". The Verge. Archived September 12, 2022 at the Wayback Machine. Retrieved September 12, 2022.
  32. ^ Sawers, Paul (2022-09-12). "Google closes $5.4B Mandiant acquisition". TechCrunch. Retrieved 2022-09-13.
  33. ^ "Announcing the 10th Annual Flare-On Challenge | Mandiant". Google Cloud Blog. Retrieved 2025-01-17.