Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
FireEye
AI-generated illustration
OrganisationUS

FireEye

Pioneering threat-intelligence firm founded by Ashar Aziz; merged into Trellix after 2021 STG acquisition.

FireEye no longer trades as a company: its products business merged with McAfee Enterprise in January 2022 to form Trellix, whose source-code repository RansomHouse reached in a 17 April 2026 break-in.

Last refreshed: 12 October 2026 · Appears in 1 active topic

Key Question

Does the Trellix breach mean FireEye's two decades of detection research is now in criminal hands?

Timeline for FireEye

#14 8 Oct

Mentioned in: Ten agencies name Beijing firm in hacks

Cybersecurity: Threats and Defences
#6 1 Jun

Mentioned in: WebLogic flaw revived as ransomware vector

Cybersecurity: Threats and Defences
#4 11 May

Mentioned in: RansomHouse posts Trellix internal screenshots as extortion leverage

Cybersecurity: Threats and Defences
#3 8 May

Trellix discloses 21-day-old breach of source-code repository

Cybersecurity: Threats and Defences
View full timeline →
Follow Cybersecurity: Threats and Defences →

Background

FireEye was founded in 2004 by Ashar Aziz, a former Sun Microsystems engineer, and listed on Nasdaq in 2013. It became one of the most influential threat-intelligence and incident-response firms, known for nation-state attribution, including tying the 2014 Sony Pictures hack to North Korea, and for long-running reporting on Chinese groups. FireEye's own incident data later showed China-based break-ins at US firms dropping steeply once Barack Obama and Xi Jinping had agreed, in September 2015, to curb commercial cyber theft.

In December 2020 FireEye detected the SolarWinds Orion supply-chain compromise, some 14 months after the first intrusion. It disclosed the theft of its own red-TEAM tools within days of detection and released detection signatures at the same time.

In 2021 Symphony Technology Group bought FireEye's products business for $1.2bn, separating it from the Mandiant services Arm, which Google bought in 2022 for about $5.4bn. STG merged the products business with McAfee Enterprise in January 2022 to create Trellix. When RansomHouse reached part of Trellix's source code on 17 April 2026, the code base it touched descends in part from FireEye's products.

Common Questions
Was FireEye's legacy code exposed in the 2026 Trellix source-code breach?
Yes. RansomHouse accessed Trellix's repository in April 2026. FireEye's detection logic, signature databases, and proprietary analytics form part of the Trellix codebase that was breached, meaning FireEye intellectual property built over two decades was among the exposed material.Source: Trellix
What is the difference between FireEye, Mandiant, and Trellix now?
FireEye's products business became Trellix (via an STG merger with McAfee Enterprise) in 2022. The Mandiant services division was sold to Google in 2022 and operates as Google Threat Intelligence Group. Neither the FireEye nor Mandiant brands exist independently; both are absorbed into their respective acquirers.
How was FireEye involved in the SolarWinds hack discovery?
FireEye's Mandiant division discovered the SolarWinds Orion supply-chain compromise in December 2020 when investigating its own breach, notifying the US government and triggering one of the largest cyber investigations in history. Mandiant's disclosure made the SolarWinds attack public.Source: Mandiant / FireEye
What happened to FireEye?
FireEye's products business was acquired by STG in 2021, then merged with McAfee Enterprise to form Trellix in January 2022. The Mandiant services division was sold separately to Google in 2022.
Is Mandiant the same as FireEye?
Mandiant was FireEye's incident-response and threat-intelligence services division. When STG acquired FireEye in 2021, it separated the products and services businesses. Mandiant was sold to Google in 2022 and now operates as Google Threat Intelligence Group.
Source Material
Trellix — FireEye products successor