The Good, the Bad and the Ugly in Cybersecurity – Week 23

/0 Comments/in /by

The Good

This week, the Cybersecurity and Infrastructure Security Agency (CISA) released the first, in what is to be a series, of Cyber Essentials Toolkits. The agency plans to release new toolkit updates each month. Each toolkit is designed to align with what CISA has deemed the 6 “Essential Elements” of Cyber Readiness. Through each step and module of the toolkit(s), the goal is to walk business leaders, CISOs, and information owners through the process of developing and implementing proper cybersecurity practices and hygiene. By taking these “bite size” baby-steps, organizations should gain the ability to properly manage and understand risk, as well as properly compartmentalize information and resources to complement the lowering of risk and exposure. The 6 “Essential Elements” as defined by CISA are:

  • Yourself
  • Your Staff
  • Your Systems
  • Your Surroundings
  • Your Data
  • Your Actions Under Stress

    •  

    The first of these toolkits is focused on the Yourself element and is aimed at cybersecurity leaders as well as IT professionals and service providers. The overall project is aimed at C-level executives. If you would like to learn more about the Cyber Essentials Toolkit and related efforts, we encourage you to visit CISA’s site for ongoing updates to this effort.

    The Bad

    This week’s ‘Bad’ is a critical vulnerability in VMware Cloud Director, disclosed by researchers who say it could allow attackers to fully take over affected infrastructure.

    The flaw lies in improper input handling, leading to a state allowing for arbitrary code injection. The flaw can be triggered via maliciously-crafted traffic by way of the Flex and HTML5-based interfaces, as well as via supplied APIs. The vulnerability, assigned CVE-2020-3956, was discovered during a security audit by researchers at Citadelo.

    The impact of this vulnerability goes beyond remote code execution. The researchers were able to show that through this flaw it was possible to gain access to external cloud infrastructure. The flaw could be used to gain full access to a vCloud database, manipulate the credentials of a System Administrator account, and ultimately access all hosted customers with full privileges.

    In addition to the posted disclosure, Citadelo has posted a detailed PoC to demonstrate the flaw. VMware has released updates to address the issue. All exposed or concerned customers are encouraged to review the posted materials, and follow the recommended guidelines and fixes.

    The Ugly

    Actors behind the DoppelPaymer ransomware have announced their breach of Digital Management, LLC, an IT service provider based in Maryland. The victim has a number of Fortune 100 clients including NASA. The NASA relationship is specifically called out on the DoppelPaymer blog site.

    The attackers have posted verified samples of data on the TOR-based blog, and claim to have encrypted 2,583 machines. At the time of writing, the ransomware operators have publicly posted 21 sample files from the hack.

    The gang claim to have stolen equipment designs and plans, HR and personnel data, as well as internal documents belonging to both NASA and SpaceX. The sample data appears to span multiple years, from 2016 or earlier to the present day.

    Given that Digital Management LLC works within the federal space, compliance and regulatory requirements are much stricter than they are for non-federal entities, so the company could face devastating repercussions both from regulators and from clients. In some ways, these attacks can prove to be as damaging if not more so than many state-sponsored campaigns. While they may lack the stealthy techniques of an APT group, the impact can be just as devastating or even business-ending. Digital Management, LLC are certainly going to find themselves fighting on several fronts as they try to put out the wildfires caused by this breach.

    Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

    Read more about Cyber Security

    SaaS earnings rise as pandemic pushes companies more rapidly to the cloud

    /0 Comments/in /by

    As the pandemic surged and companies moved from offices to working at home, they needed tools to ensure the continuity of their business operations. SaaS companies have always been focused on allowing work from anywhere there’s access to a computer and internet connection, and while the economy is reeling from COVID-19 fallout, modern software companies are thriving.

    That’s because the pandemic has forced companies that might have been thinking about moving to the cloud to find tools what will get them there much faster. SaaS companies like Zoom, Box, Slack, Okta and Salesforce were there to help; cloud security companies like CrowdStrike also benefited.

    While it’s too soon to say how the pandemic will affect work long term when it’s safe for all employees to return to the office, it seems that companies have learned that you can work from anywhere and still get work done, something that could change how we think about working in the future.

    One thing is clear: SaaS companies that have reported recent earnings have done well, with Zoom being the most successful example. Revenue was up an eye-popping 169% year-over-year as the world shifted in a big way to online meetings, swelling its balance sheet.

    There is a clear connection between the domestic economy’s rapid transition to the cloud and the earnings reports we are seeing — from infrastructure to software and services. The pandemic is forcing a big change to happen faster than we ever imagined.

    Big numbers

    Zoom and CrowdStrike are two companies expected to grow rapidly thanks to the recent acceleration of the digital transformation of work. Their earnings reports this week made those expectations concrete, with both firms beating expectations while posting impressive revenue growth and profitability results.

    Slack’s new integration deal with AWS could also be about tweaking Microsoft

    /0 Comments/in /by

    Slack and Amazon announced a big integration late yesterday afternoon. As part of the deal, Slack will use Amazon Chime for its call feature, while reiterating its commitment to use AWS as its preferred cloud provider to run its infrastructure. At the same time, AWS has agreed to use Slack for internal communications.

    Make no mistake, this is a big deal as the SaaS communications tool increases its ties with AWS, but this agreement could also be about slighting Microsoft and its rival Teams product by making a deal with a cloud rival. In the past Slack CEO Stewart Butterfield has had choice words for Microsoft saying the Redmond technology giant sees his company as an “existential threat.”

    Whether that’s true or not — Teams is but one piece of a huge technology company — it’s impossible not to look at the deal in this context. Aligning more deeply with AWS sends a message to Microsoft, whose Azure infrastructure services compete with AWS.

    Butterfield didn’t say that of course. He talked about how synergistic the deal was. “Strategically partnering with AWS allows both companies to scale to meet demand and deliver enterprise-grade offerings to our customers. By integrating AWS services with Slack’s channel-based messaging platform, we’re helping teams easily and seamlessly manage their cloud infrastructure projects and launch cloud-based services without ever leaving Slack,” he said in a statement

    The deal also includes several other elements including integrating AWS Key Management Service with Slack Enterprise Key Management (EKM) for encryption key management, deeper alignment with AWS’s chatbot service and direct integration with AWS AppFlow to enable secure transfer of data between Slack and Amazon S3 storage and the Amazon Redshift data warehouse.

    AWS CEO Andy Jassy saw it as a pure integration play. “Together, AWS and Slack are giving developer teams the ability to collaborate and innovate faster on the front end with applications, while giving them the ability to efficiently manage their backend cloud infrastructure,” Jassy said in a statement.

    Like any good deal, it’s good for both sides. Slack gets a big customer in AWS and AWS now has Slack directly integrating more of its services. One of the reasons enterprise users are so enamored with Slack is the ability to get work done in a single place without constantly have to change focus and move between interfaces.

    This deal will provide more of that for common customers, while tweaking a common rival. That’s what you call win-win.

    Stewart Butterfield says Microsoft sees Slack as existential threat

    Is Cryptojacking Going Out Of Fashion or Making A Comeback?

    /0 Comments/in /by

    The recent Verizon DBIR suggests that Cryptojacking is declining in popularity, but evidence from the field might suggest otherwise. The intensity of cryptojacking activity usually mimics the price of cryptocurrencies, especially Bitcoin and Monero. The price of Bitcoin has fluctuated greatly during the last 12 months, from highs of $12,000 back in July 2019 to lows of around $5,000 in March 2020. The value of Bitcoin has doubled since that nadir, as has the price of its lesser-known sibling Monero.

    With Cryptocurrency rates going up, it would be no surprise to see mining activities, legal and illegal, increase. As several recent incidents have shown, Cryptojacking is still a threat to both enterprises and individuals.

    What is Cryptojacking?

    Cryptojacking is the criminal manifestation of cryptomining. Cryptojackers use similar techniques as malware to sneak on to an endpoint: drive-by downloads, phishing campaigns, in-browser vulnerabilities, and browser plugins to name a few. There are two main methods of operation for Cryptojacking: the first is to infect the browser with a plugin that consumes some computing power when the victim is online (naturally, without the user’s awareness). The second type resembles classic malware: installed on endpoints and servers, it runs on the local machine (even when the user thinks the computer is turned off) and utilizes the victim’s internet connection to mine cryptocurrency for the attackers.

    Miners are designed to operate on all operating systems: Windows, Linux and even macOS.

    Where Have All The Cryptominers Gone?

    There has been a consensus in the cybersecurity and law-enforcement community over the last 12 months that cryptojacking is on the decline. This is a result of several massive takedowns of mining botnets, like the huge botnet consisting of 850,000 computers that was detected and taken offline by a joint operation of French police and the security company Avast, or the Smominru campaign that hijacked half a million PCs to mine cryptocurrency, or an organized crime scheme in China enslaving computing resources of 9,000 internet cafés throughout the country.

    Additional factors are the shutdown of Coinhive, the leading site that dealt with cryptominers. Coinhive provided JavaScript code that websites could incorporate to make visitors’ computers mine Monero, a cryptocurrency that happens to appeal to cybercriminals because it’s difficult to trace. Coinhive’s code was quickly abused: a mining script can also be injected into a website by hackers without the site owner’s knowledge. The site shutdown on March 2019, and with it, the number of site infections went sharply down.

    These activities even led to the incarceration of some cyber criminals – a rare occurence in cybercrime, particularly as a result of mining, which is generally considered a low-risk form of criminal activity. However, two Romanian nationals were sentenced to two decades in U.S. prison apiece after their malware mined crypto on 400,000 infected computers. The two were part of the Bayrob Group that developed, deployed and monetized malware for mining Bitcoin and Monero.

    But Wait…Cryptojacking Is Hot Right Now!

    But as effective as these activities were, the increasing price of cryptocurrencies appears to have lured criminal hackers back into the game.

    Last year, around 10% of organizations polled by Verizon reported cryptocurrency malware, but that figure is almost certainly below the actual incidence in the wild. First, the report notes that many organizations likely do not even report cryptocurrency incidents, particularly if the installer has been detected or blocked before the miner manifests itself as a malicious process. Moreover, last year’s figures may not reflect what’s happening now, as several more recent reports have indicated that crimninal cryptomining is still very much in vogue.

    In Singapore, for instance, a spike in cryptojacking attempts was observed between January and March 2020, when there were three times more attempts to conduct cryptojacking than the same period in the previous year. The shift to working from home during the Covid-19 era has also aided cyber criminals, who are utilizing Zoom installers to infect victims with cryptocurrency-mining malware inside installers.

    Hackers are also eager to exploit vulnerabilities to allow them to mine freely. Blogging platform Ghost has reported that attackers have successfully infiltrated its Salt-based server infrastructure and deployed cryptomining malware.

    Another cybercrime group called “Blue Mockingbird” has infected more than 1,000 business systems with Monero mining malware since December 2019. The group’s specialty is exploiting servers running ASP.NET, obtaining administrator-level access to modify the server settings and installing the XMRig application to take advantage of the resources of the infected machines to mine away.

    Cybercriminals who wished to utilize even more computing power have targeted several supercomputers across Europe in locations such as Germany, Scotland, Switzerland and Spain. The attackers exploited a Secure Shell (SSH) connection used by academic researchers to log in remotely. Once inside, they deployed cryptocurrency-mining malware on the supercomputers.

    In another incident, cryptojacking malware almost caused some physical harm when an enthusiastic gamer felt his machine was not performing to spec, and burned his hand after touching the overheated casing of it’s GPU. It turned out that the gamer had inadvertently downloaded cryptomining malware, which may have been running for three weeks or more before he discovered it.

    What Can Be Done To Stop Cryptojacking?

    The first and best step would be to avoid getting infected in the first place. Enterprises should employ an advanced EDR solution to ensure that miners are detected either pre- or on-execution. If the malware dropper is not caught pre-execution, automated behavioral detection engines will catch cryptominers shortly after execution as they begin to behave abnormally. Some sophisticated miners might operate in stealth mode to avoid detection by legacy AV solutions, such as throttling CPU usage or mining only when the machine is in a certain state. These can be identified by monitoring for and analyzing any increased network traffic. Features like SentinelOne’s Deep Visibility make this kind of threat hunting simple without special training.

    Next, employ a solution to identify and mitigate in-browser cryptominers. SentinelOne utilize sIntel’s Accelerated Memory Scanning (AMS) library, which enables fast memory scanning offloaded to the Graphics Processing Unit (GPU), to seek unique characteristics of cryptominers.

    Conclusion

    Cryptojacking is far from dead. It continues to exist and remains popular given the increase in cryptocurrency prices. Cryptominers can be stealthy and pose a challenge to security teams, particularly if they are relying on legacy AV solutions that do not possess AI-powered behavioral detection engines. To help keep cryptojackers from stealing your resources, try SentinelOne’s free demo or contact us for more information.

    Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

    Read more about Cyber Security

    Daily Crunch: Zoom reports spectacular growth

    /0 Comments/in /by

    Zoom’s latest earnings report was even better than expected, SoftBank announces a new fund to invest in founders of color and Google pulls a trending app that targets apps from China.

    Here’s your Daily Crunch for June 3, 2020.

    1. Remote work helps Zoom grow 169% in one year, posting $328.2M in Q1 revenue

    Zoom’s customer numbers were similarly sharp, with the firm reporting that it had 265,400 customers with more than 10 seats (employees) at the end of the quarter, which was up 354% from the year-ago period.

    Not all of the news coming out of its latest earnings report was positive, however. CEO Eric Yuan confirmed that a plan to implement end-to-end encryption does not in fact extend to non-paying users.

    2. SoftBank launches $100M+ Opportunity Growth Fund to invest in founders of color

    The Opportunity Growth Fund “will only invest in companies led by founders and entrepreneurs of color,” according to an internal memo from SoftBank’s COO Marcelo Claure, who said the fund will initially start with $100 million — meaning there is room for SoftBank or other limited partners to add more over time.

    3. Google pulls ‘Remove China Apps’ from Play Store

    The top trending app in India, which was downloaded more than 5 million times since late May and enabled users to detect and easily delete apps developed by Chinese firms, was pulled from Android’s marquee app store for violating Google Play Store’s Deceptive Behavior Policy.

    4. Facebook and PayPal invest in Southeast Asian ride-hailing giant Gojek

    Facebook and PayPal are joining Google and Tencent as high-profile tech firms that have backed the five-year-old Southeast Asian ride-hailing startup, which also offers food delivery and mobile payments.

    5. The fundraising marketplace has stabilized. Or has it?

    DocSend CEO Russ Heddleston said the last two weeks could be establishing a new normal for fundraising this year. Even though most VCs aren’t taking in-person meetings, they were more active in the past month than they were in May of both 2019 and 2018. (Extra Crunch membership required.)

    6. Venture firms rush to find ways to support Black founders and investors

    Firms like Benchmark, Sequoia, Bessemer, Eniac Ventures, Work-Bench and SaaSTR Fund founder Jason Lemkin all tweeted in support of the cause and offered to take steps to improve the lack of representation in their industry. But some Black entrepreneurs and investors are questioning the firms’ motivations.

    7. Lili raises $10M for its freelancer banking app

    CEO Lilac Bar David suggested that no traditional banking solutions are really designed to solve the problems faced by freelancers — whether they’re designers, programmers, fitness instructors, chefs or beauty professionals. She described Lili as the first “all-in-one” solution, offering both a bank account and a broader suite of financial tracking tools.

    The Daily Crunch is TechCrunch’s roundup of our biggest and most important stories. If you’d like to get this delivered to your inbox every day at around 9am Pacific, you can subscribe here.

    NetApp to acquire Spot (formerly Spotinst) to gain cloud infrastructure management tools

    /0 Comments/in /by

    When Spotinst rebranded to Spot in March, it seemed big changes were afoot for the startup, which originally helped companies find and manage cheap infrastructure known as spot instances (hence its original name). We had no idea how big at the time. Today, NetApp announced plans to acquire the startup.

    The companies did not share the price, but Israeli publication CTECH pegged the deal at $450 million. NetApp would not confirm that price.

    It may seem like a strange pairing, a storage company and a startup that helps companies find bargain infrastructure and monitor cloud costs, but NetApp sees the acquisition as a way for its customers to bridge storage and infrastructure requirements.

    “The combination of NetApp’s leading shared storage platform for block, file and object and Spot’s compute platform will deliver a leading solution for the continuous optimization of cost for all workloads, both cloud native and legacy,” Anthony Lye, senior vice president and general manager for public cloud services at NetApp said in a statement.

    Holger Mueller, an analyst with Constellation Research says the deal makes sense on that level, but it depends on how well NetApp incorporates the Spot technology into its stack. “At the end of the day to run next generation applications successfully in the cloud you need to be efficient on compute and storage usage. NetApp is doing great on the latter but needed way to monitor and automate compute consultation. This is what Spot brings to the table, so the combination makes sense, but as in all acquisitions execution is key now,” Mueller told TechCrunch.

    Spotinst, excess cloud capacity management service, snares $35M Series B

    Spot helps companies do a couple of things. First of all it manages spot and reserved instances for customers in the cloud. Spot instances in particular, are extremely cheap because they represent unused capacity at the cloud provider. The catch is that the vendor can take the resources back when they need them, and Spot helps safely move workloads around these requirements.

    Reserved instances are cloud infrastructure you buy in advance for a discounted price. The cloud vendor gives a break on pricing, knowing that it can count on the customer to use a certain amount of infrastructure resources.

    At the time it rebranded, the company also had gotten into monitoring cloud spending and usage across clouds. Amiram Shachar, co-founder and CEO at Spot, told TechCrunch in March, “With this new product we’re providing a more holistic platform that lets customers see all of their cloud spending in one place — all of their usage, all of their costs, what they are spending and doing across multiple clouds — and then what they can actually do [to deploy resources more efficiently],” he said at the time.

    Shachar writing in a blog post today announcing the deal indicated the company will continue to support its products as part of the NetApp family, and as startup CEOs typically say at a time like this, move much faster as part of a large organization.

    “Spot will continue to offer and fully support our products, both now and as part of NetApp when the transaction closes. In fact, joining forces with NetApp will bring additional resources to Spot that you’ll see in our ability to deliver our roadmap and new innovation even faster and more broadly,” he wrote in the post.

    NetApp has been quite acquisitive this year. It acquired Talon Storage in early March and CloudJumper at the end of April. This represents the twentieth acquisition overall for the company, according to Crunchbase data.

    Spot was founded in 2015 in Tel Aviv. It has raised over $52 million, according to Crunchbase data. The deal is expected to close later this year, assuming it passes typical regulatory hurdles.

    Spotinst rebrands as Spot and announces new cloud spend dashboard

    Bryter raises $16M for a no-code platform for non-technical people to build enterprise automation apps

    /0 Comments/in /by

    Automation is the name of the game in enterprise IT at the moment: we now have a plethora of solutions on the market to speed up your workflow, simplify a process, and perform more repetitive tasks without humans getting involved. Now, a startup that is helping non-technical people get more directly involved in how to make automation work better for their tasks is announcing some funding to seize the opportunity.

    Bryter — a no-code platform based in Berlin that lets workers in departments like accounting, legal, compliance and marketing who do not have any special technical or developer skills build tools like chatbots, trigger automated database and document actions and risk assessors — is today announcing that it has raised $16 million. This is a Series A round and it’s being co-led by Accel and Dawn Capital, with Notion Capital and Chalfen Ventures also participating.

    The funding comes less than a year after Bryter raised a seed round — $6 million in November 2019 — and it was oversubscribed, with term sheets coming in from many of the bigger VCs in Europe and the US. With this funding, the company has now raised around $25 million, and while the valuation is considerably up on the last round, Bryter is not disclosing what it is.

    Michael Grupp, the CEO who co-founded the company with Micha-Manuel Bues and Michael Hübl (pictured below), said that the whole Series A process took no more than a month to initiate and close, an impressive turnaround considering the chilling effect that the COVID-19 health pandemic has had on dealmaking.

    Part of the reason for the enthusiasm is because of the traction that Bryter has had since launching in 2018. Its 50 enterprise customers include the likes of McDonalds, Telefónica, banks, healthcare and industrial companies, and professional services firms PwC, KPMG and Deloitte (who in turn use it for themselves as well as for clients). (Note: because of its target users being large enterprises, the company doesn’t publish per-person pricing on its site as such.)

    Bryter’s been seeing a lot of attention from customers and investors because its platform speaks to a big opportunity within the wider world of software today.

    Enterprise IT has long been thought of as the less-fun end of technology: it’s all about getting work done, and a lot of the software used in a business environment is complex and often requires technical knowledge to implement, use, fix and adapt in any way.

    This may still the case for a lot of it, especially for the most sophisticated tools, but at the same time we have seen a lot of “consumerization” come into IT, where user-friendly hardware and software built for consumers — specifically non-technical consumers — either inspires new enterprise services, or are simply directly imported into the workplace environment.

    No-code software — like automation, another big trend in enterprise IT right now — plays a big role in how enterprise tools are becoming more user-friendly. One of the biggest roadblocks in a lot of office environments is that when workers identify things that don’t work, or could work much better than they do, they need to file tickets and get IT teams — also often overworked — to do the fixing for them. No-code platforms can help circumvent some of that work — so long as the roadblock of IT approves the use, that is.

    Bryter’s conception and existence comes out of the no-code trend. It plays on the same ideas as IFTTT or Zapier but is very firmly aimed at users who might use pieces of enterprise software as part of their jobs, but have never had to delve into figuring out how they actually work.

    There are already a lot of “low-code” (minimal coding) and other no-code on the market today for business (not consumer) use cases. They include Blender.io, Zapier, Tray.io (a London-founded startup that itself raised a big round last autumn), n8n (also German, backed by Sequoia), and also biggies like MuleSoft (acquired by Salesforce in 2018 at a $6.5 billion valuation).

    Bryter’s contention is that many of these actually need more technical know-how than they initially claim. Grupp pointed out that the earliest automation tools for enterprise have been around for decades at this point, but even most of the very modern descendants of those “will require some coding.” Bryter’s toolbox essentially lets users create dialogues with users — which they can program based on the expertise that they will have in their particular fields — which then sources data they can then plug into other software via the Bryter platform in order to “perform” different tasks more quickly.

    Grupp’s contention is that while these kinds of tools have long been used, they will be in even more demand going forward.

    “After COVID-19 workers will be even more distributed,” he said. “Teams and individuals will need to access information in a faster way, and the only way for big organizations to distribute that knowledge is through more digital tools.” The idea is that Bryter can essentially help bridge those gaps in a more efficient way.

    Bryter’s target user and its approach underscores why investors like Accel see accessible, no-code solutions as a big opportunity.

    “No-code software is really reducing the barriers of adoption,” Luca Bocchio, a partner at Accel, said in an interview. “If people like you and I can use the software, then that means demand can multiply by big numbers.” That’s in contrast to a lot of enterprise software today, which very limited in how it can grow, he added. “Plus, enterprises these days want to see more future visibility in terms of the products they adopt. They want to make sure something will stick around, and so they tend not to want to work with super young startups. But it’s happening for Bryter, and the is a testament to Bryter and to the market potential.”

    Nanox, maker of a low-cost scanning service to replace X-rays, expands Series B to $51M

    /0 Comments/in /by

    A lot of the attention in medical technology today has been focused on tools and innovations that might help the world better fight the COVID-19 global health pandemic. Today comes news of another startup that is taking on some funding for a disruptive innovation that has the potential to make both COVID-19 as well as other kinds of clinical assessments more accessible.

    Nanox, a startup out of Israel that has developed a small, low-cost scanning system and “medical screening as a service” to replace the costly and large machines and corresponding software typically used for X-rays, CAT scans, PET scans and other body imaging services, is today announcing that it has raised $20 million from a strategic investor, South Korean carrier SK Telecom.

    SK Telecom in turn plans to help distribute physical scanners equipped with Nanox technology as well as resell the pay-per-scan imaging service, branded Nanox.Cloud, and corresponding 5G wireless network capacity to operate them. Nanox currently licenses its tech to big names in the imaging space like FujiFilm, and Foxconn is also manufacturing its donut-shaped Nanox.Arc scanners.

    The funding is technically an extension of Nanox’s previous round, which was announced earlier this year at $26 million with backing from Foxconn, FujiFilm and more. Nanox says that the full round is now closed off at $51 million, with the company having raised $80 million since launching almost a decade ago, in 2011.

    Nanox’s valuation is not being publicly disclosed, a but a news report in the Israeli press from December said that one option the startup was considering was an IPO at a $500 million valuation. We understand from sources that the valuation is about $100 million higher now.

    The Nanox system is based around proprietary technology related to digital X-rays. Digital radiography is a relatively new area in the world of imaging that relies on digital scans rather than X-ray plates to capture and process images.

    Nanox says the ARC comes in at 70 kg versus 2,000 kg for the average CT scanner, and production costs are around $10,000 compared to $1-3 million for the CT scanner.

    But in addition to being smaller (and thus cheaper) machines with much of the processing of images done in the cloud, the Nanox system, according to CEO and founder Ran Poliakine, can make its images in a tiny fraction of a second, making them significantly safer in terms of radiation exposure compared to existing methods.

    Imaging has been in the news a lot of late because it has so far been one of the most accurate methods for detecting the progress of COVID-19 in patients or would-be patients in terms of how it is affecting patients’ lungs and other organs. While the dissemination of equipment like Nanox’s definitely could play a role in handling those cases better, the ultimate goal of the startup is much wider than that.

    Ultimately, the company hopes to make its devices and cloud-based scanning service ubiquitous enough that it would be possible to run early detection, preventative scans for a much wider proportion of the population.

    “What is the best way to fight cancer today? Early detection. But with two-thirds of the world without access to imaging, you may need to wait weeks and months for those scans today,” said Poliakine.

    The startup’s mission is to distribute some 15,000 of its machines over the next several years to bridge that gap, and it’s getting there through partnerships. In addition to the SK Telecom deal it’s announcing today, last March, Nanox inked a $174 million deal to distribute 1,000 machines across Australia, New Zealand and Norway in partnership with a company called the Gateway Group.

    The SK Telecom investment is an interesting development that underscores how carriers see 5G as an opportunity to revisit what kinds of services they resell and offer to businesses and individuals, and SK Telecom specifically has singled out healthcare as one obvious and big opportunity.

    “Telecoms carriers are looking for opportunities around how to sell 5G,” said Ilung Kim, SK Telecom’s president, in an interview. “Now you can imagine a scanner of this size being used in an ambulance, using 5G data. It’s a game changer for the industry.”

    Looking ahead, Nanox will continue to ink partnerships for distributing its hardware and reselling its cloud-based services for processing the scans, but Poliakine said it does not plan to develop its own  technology beyond that to gain insights from the raw data. For that, it’s working with third parties — currently three AI companies – that plug into its APIs, and it plans to add more to the ecosystem over time.

    Searchable.ai nabs additional $4M seed to continue building AI-driven search

    /0 Comments/in /by

    Searchable.ai is an early-stage startup in the alpha phase of testing its initial product, but it has an idea compelling enough to attract investment, even during a pandemic. Today the company announced an additional $4 million in seed capital to continue building its AI-driven search solution.

    Susquehanna International Group and Omicron Media co-led the round with participation by Defy Partners, NextView Ventures and a group of unnamed angel investors. Today’s investment comes on top of the $2 million in seed money the startup announced in October.

    Company co-founder and CEO Brian Shin said that when he presented to his investors in early March at the last event he attended before everything shut down, they approached him about additional money, and given the economic uncertainty he decided to take it.

    “Honestly we probably would not have taken additional money if it was not for the uncertainty around the macro environment right now,” he told TechCrunch.

    The company is trying to solve enterprise search and being pre-revenue, Shin recognized that having additional capital would give them more room to build the product and get it to market.

    “We are trying to solve this problem where people just can’t find information that they need in order to do their jobs. When you look within the workplace, this problem is just getting worse and worse with the proliferation of different formats and people storing their information in many different places, local networks, cloud repositories, email and Slack,” he explained.

    They have a few thousand people in the alpha program right now testing a personal desktop version of the application that helps individual users find their content wherever it happens to be. The plan is to open that up to a wider group soon.

    The road map calls for a teams version where groups of employees can search among their different individual repositories, a developer version to build the search technology into other operations and eventually an enterprise tool. They also want to add voice search starting with an Alexa skill with the general belief that we need to move beyond keyword searches to more natural language approaches.

    “We believe that there’ll be a whole new category of search, search companies and search products that are more conversational. […] Being able to interact with your information more naturally, more and more conversationally, that’s where we think the markets is going,” he said.

    The company now has more money in the bank to help achieve that vision.

    Stealthy search startup Searchable.ai snags $2M seed

    Sourcing software provider Keelvar raises $18M from Elephant and Mosaic

    /0 Comments/in /by

    It was perhaps not until the COVID-19 pandemic hit the planet that most of us had ever heard or uttered the phrase “supply chain”. But in a global economy that had become drunk and lazy on ‘just in time ordering’ and similar, the threat to supply chains of things like, oh, food, from that pesky virus has become real and visceral. That why automation of ‘the supply chain’ has become such a huge issue. So it’s not a huge surprise that startups aimed at tackling this are suddenly thrust into the limelight.

    Step forward, Cork, Ireland-based Keelvar, strategic sourcing software company, which today announces that it has raised $18 million in Series A funding led by Elephant and Mosaic Ventures with participation from Paua Ventures, enabling the company to further expand into enterprise markets.

    The investment will support Keelvar’s expansion plans for Europe and the US, amid the rapidly-growing need for supply chain automation solutions, which has been further accelerated by the recent COVID-19 pandemic.

    Keelvar provides large enterprises with ‘Advanced Sourcing Optimization’ software and ‘Intelligent Sourcing Automation’ that uses AI to fully automate tactical buying processes.

    It competes with Coupa and Jaggaer in terms of all three offering sophisticated eSourcing software. Keelvar says its key competitive advantage is that it provide intelligent bots to autopilot the sourcing projects, thus making the whole process easier, faster and cheaper.

    It also currently manages over $90bn in spend annually for enterprises in all major industries. Customers include Siemens, Coca-Cola, Novartis, BMW, and Samsung.

    With COVID-19 disrupting supply chains globally, Keelvar expects the demand for automation to further increase.

    In a statement Alan Holland, CEO of Keelvar said:”The Future of Work in procurement is changing quickly, with COVID19 acting as a catalyst. We have witnessed an escalation in demand from enterprises seeking intelligent systems to automate complex processes as teams became overburdened with disrupted supply chains. Keelvar has proven that Sourcing Bots can relieve that burden enormously. Now it’s time to hit the accelerator and scale-up.”

    Speaking about the investment, Peter Fallon, partner at Elephant noted: “Keelvar’s sourcing optimization and automation software delivers meaningful ROI to enterprise sourcing and procurement organizations globally. We are excited to partner with Alan Holland and the team at Keelvar as the company continues to emerge as a leader in this market.”

    Private sector companies alone spend trillions annually buying from third-party suppliers. External sourcing is usually the largest expense category and on average it is 43% of total costs (Bain & Company). The global procurement software market is currently growing at a CAGR of 9.1%, and expected to reach $7.3 billion by 2022 (IDC).

    Speaking about the funding, Toby Coppel, co-founder, and partner at Mosaic Ventures said: “Keelvar is a brilliant example of machine learning in action, giving superpower to procurement teams in every large enterprise. With COVID-19 pushing businesses to embrace these new technologies, we’re excited to partner with Keelvar on the next phase of growth.”