Loading story…
FireEye disclosed that a highly sophisticated threat actor breached its internal network and stole the company's custom red-team tools used to test customer defenses. CEO Kevin Mandia said the intruder also sought information related to certain government customers, and the company assessed the operation as state-sponsored activity carried out by an actor with top-tier offensive capabilities; Microsoft helped validate that assessment, and the FBI was notified and joined the investigation.
To reduce the risk of follow-on abuse, FireEye publicly released indicators of compromise and countermeasures to help organizations detect and block any misuse of the stolen tools. The company's rapid disclosure drew attention because FireEye is one of the world's largest cybersecurity firms, and the incident underscored that even major security vendors can be targeted in advanced espionage operations.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
In response to the theft, FireEye released indicators of compromise and countermeasures on GitHub to help organizations detect and defend against potential misuse of the stolen penetration-testing tools.
CEO Kevin Mandia said FireEye assessed the operation as a state-sponsored attack conducted by a nation with top-tier offensive capabilities. Microsoft helped confirm the nation-state assessment, and the FBI was notified and began assisting the investigation.
FireEye disclosed that a highly sophisticated threat actor breached its internal network and stole custom red-team tools used to test customer environments. The company said the intruder also searched for information related to some government customers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
fireeye.com
Open sourceisc.sans.edu
Open sourceunit42.paloaltonetworks.com
Open sourcefireeye.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI confirmed that **suspicious cyber activity** targeted one of its internal surveillance networks, and officials later classified the intrusion as a **"major incident"** under FISMA because of the potential national security impact. Reporting indicates the affected environment included systems tied to the FBI’s Virgin Islands operations, where attackers accessed highly sensitive law-enforcement information, including **pen register** and **trap-and-trace** returns as well as personally identifiable information connected to active investigations. The bureau said it detected unusual activity in February, informed lawmakers in early March, and publicly acknowledged that the activity had been contained while the investigation continued. Multiple reports said investigators linked the operation to **China**, and that the attackers appear to have reached FBI systems through a commercial internet service provider’s vendor infrastructure rather than by directly breaching the bureau first. The incident prompted a broader U.S. government response, with the White House convening officials from the FBI, NSA, and CISA and the Justice Department establishing a working group to strengthen resilience and incident response. The breach was reported as separate from another cyber matter involving the FBI director’s personal email, underscoring that the bureau was confronting several cyber threats at the same time.
Jun 29, 2026
Australia’s ACSC and CISA warned that Chinese state-sponsored actors compromised networks worldwide as part of a broad espionage operation that targeted IT service providers and then leveraged that access to reach downstream customer environments. U.S. government reporting tied the activity to Chinese cyber actors associated with the Ministry of State Security, describing a long-running campaign that stole intellectual property and sensitive data from organizations across at least 12 countries and sectors including information technology, energy, healthcare, communications, and critical manufacturing. The intrusions relied on stolen administrative credentials, abuse of digital certificates, and post-compromise tooling including **PowerShell**, **PowerSploit**, **REDLEAVES**, and **PLUGX** to maintain persistence and move laterally. Authorities said the malware used techniques such as **DLL side-loading**, in-memory execution, and **RC4**-encrypted command-and-control over port `443`, including spoofed domains masquerading as Windows update infrastructure, and urged defenders to strengthen privileged account protections, network segmentation, logging, and monitoring for suspicious administrative share activity and protocol mismatches.
Jun 29, 2026
F5 confirmed that a nation-state threat actor gained persistent access to its internal systems, resulting in the theft of *BIG-IP* source code, customer configuration data, and information on 44 vulnerabilities. The company stated that only a small number of customers were affected, all of whom have since applied emergency updates, and emphasized that the stolen data was not sensitive and that customer operations experienced minimal disruption. F5 has responded by expanding its bug bounty program and partnering with CrowdStrike to enhance endpoint detection and response (EDR) capabilities for *BIG-IP* systems, while external cybersecurity firms IOActive and NCC Group found no critical flaws in the stolen code. Despite F5's assurances that the incident is contained and the impact is limited, some independent researchers have raised concerns about the company's transparency and the true extent of operational control and reputational damage. The breach, discovered in August and disclosed in October, also triggered a federal emergency directive. F5 maintains that the incident has not significantly affected its business outlook, projecting up to 4% revenue growth in fiscal 2026, but scrutiny continues regarding the adequacy of its response and communication with stakeholders.
Jun 29, 2026