A rare, admirable predator: the specimen's kill was real — the intelligence was sound — and it turned the kill into the most lucrative press release in the industry's history. The archive salutes the craft even as it names it.
The decision to publish a significant part of our intelligence about Unit 61398 was a painstaking one. … It is time to acknowledge the threat is originating in China, and we wanted to do our part to arm and prepare security professionals to combat that threat effectively.
Mandiant official statement — the APT1 report itself, “Why We Are Exposing APT1” (Feb 2013), via the National Security Archive
We are acutely aware of the risk this report poses for us. We expect reprisals from China as well as an onslaught of criticism.
Mandiant, same section of the APT1 report — the company's own accounting of what the release would cost it. The record above shows what it earned instead. National Security Archive
Understand what this file is not. It is not a claim that Mandiant lied. The APT1 report was, by broad expert consensus, correct: it tied a wave of intrusions to a specific People's Liberation Army unit, with the receipts. On the merits, it holds up.
What the archive observes is the choreography. Sound intelligence, written for clients, was released as a national media event — advance copy to the paper of record, timing that experts read against an expected IPO — and it converted an obscure consultancy into a billion-dollar acquisition target inside a year. Whether that proves the report was intelligence or marketing depends, as the research file puts it, on whether you think the two are mutually exclusive. Both sides below.
ACT I — THE RELEASE
A creature that has hunted quietly for years steps, once, fully into the light — and picks the morning.
APT1 drops — with an advance copy
Mandiant publishes the APT1 report tying a long intrusion campaign to PLA Unit 61398 in Shanghai. The New York Times runs it with an advance copy; the AP notes the report "puts Mandiant front-and-center at a critical time on a national debate about cybersecurity." The attribution is sound. The timing is immaculate.
Note the staging. The evidence was real; the premiere was produced. Both can be true at once — that is the entire lesson of this file.
ACT II — THE PAYOFF
Fame in this habitat is not an end. It is a valuation event.
Instant fame, expected IPO
The report makes Mandiant a household name. Multiple security experts anticipate a Mandiant IPO that year; Kevin Mandia later acknowledges he warned only one of his five board members before releasing it.
$1 billion, in under eleven months
FireEye acquires Mandiant for about $1 billion — less than 11 months after APT1 made it famous. A 60-page PDF written for existing clients, released as a coordinated media event, generated a billion-dollar acquisition.
Google buys it for $5.4B
Google acquires Mandiant for $5.4 billion. Kevin Mandia's reputation as the man who caught the Chinese spies red-handed — earned honestly, marketed brilliantly — long outlives the appliance business FireEye once wrapped around it.
Intelligence staged as spectacle. A client-facing report was released as a national media event with an NYT advance copy amid IPO speculation [1] [2].
The payoff was enormous and fast. Obscure firm to $1B acquisition in under 11 months; $5.4B to Google by 2022 [3] [5].
Board kept in the dark. Mandia says he warned one of five directors before release [1].
The report was accurate. The APT1→PLA Unit 61398 attribution is broadly accepted; no one has shown the intelligence was wrong [6].
Publishing it was a public good. It moved a national debate and named state-sponsored intrusion with evidence — exactly what a threat-intel firm exists to do; Mandia later briefed the Senate Intelligence Committee [4].
Marketing and truth are not opposites. That accurate intelligence was also good business is a critique of the incentive, not a finding of dishonesty [2].
Scoped to the claim — and the claim is narrow. Nobody here says the report was false; the record says the opposite. The question the file raises is only about the rollout: when accurate intelligence is premiered like a blockbuster the same year you're expected to IPO, is it intelligence or is it marketing?
Weigh the costly signal: the kill was real. So was the billion dollars it produced eleven months later.
The archive does not judge. It admires the technique and notes the timing.
PRIMARY RECORD
PRESS & MARKET RECORD