I think the key thing other commenters here are missing is how the compromise at the time did not appear to be anything unusual. You will notice that network t

I think the key thing other commenters here are missing is how the compromise at the time did not appear to be anything unusual. You will notice that network traffic got their attention, not endpoint telemetry. This means they had no idea what process did what. Implants like that do everything in memory, chances are they found some malicious code and weird network traffic but it was on a trial box and they didn't have enough information to figure out what was happening. This is why in IR we say "the worst thing that can happen during an incident is to eradicate incorrectly" (paraphrasing). Mandiant being who they are probably had their agents all over and could tell what was happening where (and as they claim, if they were a country, their intel capability would be 5th in the world), but not only that they had access to customer networks which allowed them to get an idea of the scale of the breach. Lastly, even in infosec, people who don't respond to incidents don't get just how much luck is involved, for threat actors as well as incident responders. As I recall, someone noticed weird MFA device registration on his account and reported it or something at Mandiant. Had that been ignored FSB would have been very happy for at least a few months more.