FireEye Breach Discovery

In this post, we document FireEye’s discovery of its breach.

As per Politico (¹) and Yahoo News (²):

Attackers attempted to enroll a mobile device into FireEye’s multi-factor authentication system (used for VPN authentication); the attackers were pretending to be a specific employee and already had the employees user-id and password
FireEye’s IT systems issued an automated alert to the employee and to the internal security team that a new device was registered to the company’s multi-factor authentication system as if the device belonged to the employee
The employee told FireEye’s security team that the device didn’t belong to him/her
A subsequent investigation into the incident lead to the conclusion that FireEye had been breached
During this (initial) investigation, FireEye was unaware that SolarWinds Orion had been tampered with

A subsequent post on Dark Reading (³) confirms the sequence of events as listed above.

The story above was reiterated in a CBS interview ⁴.