fireeye

Every major power has had at least one widespread computer espionage campaign discovered by Kaspersky, Symantec, Mandiant/FireEye, etc.

Presumably FireEye boxes and related flavors of security sandboxes go to great lengths to camouflage their VM-ness.

The widespread vulnerability of corporate networks is not something that FireEye discovered on its own, as the article notes.

This is basically what existing corporate proxies (like FireEye) and AV software (like Avast!) already do.

And of course, the company that Sony hired to investigate and clean up the breach, FireEye/Mandiant, believe it was North Korea.

However, these companies do not share Crowdstrike's or FireEye's niche industry, which is tracking and defending against targeted and government-sponsored groups.

FireEye and Mandiant also track APT groups; Mandiant notably released their report on one of China's state-sponsored cyberwarfare divisions, APT1, some time ago.

Corporations can buy services from Mandiant, Fireeye and a number of other private parties for real-time information about threat intelligence (exploit/behavioral signitures and hacking group MOs).

I'm surprised that FireEye announced this while the hacking campaign is (presumably) still ongoing.

Also, full disclosure, I work for FireEye (I build automation tools for some other product though, and have nothing to do with this).

Did you read the analysis from Fireeye or Symantec?

Why aren't we asking FireEye, Mandiant, CloudFlare, Incapsula or any of the other supercool security company what are they parameters for behavioural detection?

"The latest in the pile of studies to show as much found that over 95 percent of corporate networks were hacked between last October and March..." The single cited study was done by FireEye, which sells security products and services.

Fireeye, Cloud (Microsoft, Amazon and Google), Facebook, RSA, CloudFlare, IBM, Intel, chip manufacturers, pentesting companies...