They were probably one of the first to see the activity across a few machines.

Yes, definitely, although it was Mandiant that Google brought in, McAfee was working for one of the other companies affected it appears.