'Victory for the good guys' - criminal behind Mandiant hack arrested
FireEye has caught the hacker behind a well-publicised attack that leaked a security researcher's details and claimed to infiltrate the company's networks earlier this year.
Mandiant employee Adi Peretz was the attack's main victim as a number of his online accounts were exposed. Mandiant is a division of FireEye.
The alleged hacker, who went by the username of LeakTheAnalyst, has now been arrested according to reports, although their name and location have not been made public.
"These attackers rarely, if ever get caught…Over my career, I have found it frustrating how little risk or repercussions exist for the attackers, who hide behind the anonymity of the internet to cause harm to good, well-intentioned people," Mandia says in a statement.
In addition to OneDrive accounts and PayPal invoices, Peretz's LinkedIn login was compromised and his page was allegedly defaced by the hacker. The hacker also claimed to have gained access to Mandiant's systems and customer data.
It was fun to be inside a giant company named 'Mandiant' we enjoyed watching how they try to protect their clients and how their dumb analysts are trying to reverse engineer malwares and stuffs. Now that 'Mandiant' knows how deep we breached into its infrastructure its so-called threat analysts are trying to block us. Let's see how successful they are going to be :D," the hackers' say as part of their data dump," a post on PasteBin said.
Two weeks later, the hacker posted another batch of information apparently from the data dump. They also claimed that FireEye was conducting a coverup.
"Well we were waiting FireEye for a public comment and FireEye lied again, and they lied in cost of their customers. They did a mistake. They knew we had access to JIRA, Their IDF workshop wasn't a part of Adi Peretz's job. They knew Adi Peretz wasn't working on Bank Hapoalim," The PasteBin dump says.
"They said our documents was "public", are license files, private contract documents, private IDF workshops and internal network topologies public? If they weren't public why did you removed our files and from public file hosting? Why did you removed our first Pastebin message? They knew the truth and they're hiding it from their customers and the public," it continues.
"Therefore, I am pleased that, in this case, we were able to impose repercussions for the attacker and achieve a small victory for the good guys," Mandia concludes.
Want to see how the story unfolded? Read our initial coverage: Mandiant security researcher stung by hackers - parent co FireEye denies entire network breach And our followup story, FireEye data leaks continue - or are the hackers just trolling?
