Daily Crunch: G Suite becomes Google Workspace

Google rebrands G Suite, Apple announces its next event date and John McAfee is arrested. This is your Daily Crunch for October 6, 2020.

The big story: G Suite becomes Google Workspace

To a large extent, Google Workspace is just a rebranding of G Suite, complete with a new set of (less distinctive) logos for Gmail, Calendar, Drive, Docs and Meet. But the company is also launching a number of new features.

For one thing, Google is (as previously announced) integrating Meet, Chat and Rooms across applications, with Gmail as the service where they really come together. Other features coming soon are the ability to collaborate on documents in Chats and a “smart chip” with contact details and suggested actions that appear when you @mention someone in a document.

Pricing remains largely the same, although there’s now an $18 per user per month Business Plus plan with additional security features and compliance tools.

The tech giants

Apple will announce the next iPhone on October 13 — Apple just sent out invites for its upcoming hardware event, all but confirming the arrival of the next iPhone.

Facebook’s Portal adds support for Netflix, Zoom and other features — The company will also introduce easier ways to launch Netflix and other video streaming apps via one-touch buttons on its new remote.

Instagram’s 10th birthday release introduces a Stories Map, custom icons and more — There’s even a selection of custom app icons for those who have recently been inspired to redesign their home screen.

Startups, funding and venture capital

SpaceX awarded contract to help develop US missile-tracking satellite network — The contract covers creation and delivery of “space vehicles” (actual satellites) that will form a constellation offering global coverage of advance missile warning and tracking.

Salesforce Ventures launches $100M Impact Fund to invest in cloud startups with social mission — Focus areas include education and reskilling, climate action, diversity, equity and inclusion, as well as providing tech for nonprofits and foundations.

Ÿnsect, the makers of the world’s most expensive bug farm, raises another $224 million — The team hopes to provide insect protein for things like fish food and fertilizer.

Advice and analysis from Extra Crunch

Inside Root’s IPO filing — As insurtech booms, Root looks to take advantage of a warm market and enthusiastic investors.

To fill funding gaps, VCs boost efforts to find India’s standout early-stage startups — Blume Ventures’ Karthik Reddy says, “There’s an artificial skew toward unicorns.”

A quick peek into Opendoor’s financial results — Opendoor’s 2020 results are not stellar.

(Reminder: Extra Crunch is our subscription membership program, which aims to democratize information about startups. You can sign up here.)

Everything else

John McAfee arrested after DOJ indicts crypto millionaire for tax evasion — The cybersecurity entrepreneur and crypto personality’s wild ride could be coming to an end after he was arrested in Spain and now faces extradition to the U.S.

Trump is already breaking platform rules again with false claim that COVID-19 is ‘far less lethal’ than the flu — Facebook took down Trump’s post, while Twitter hid it behind a warning.

The Daily Crunch is TechCrunch’s roundup of our biggest and most important stories. If you’d like to get this delivered to your inbox every day at around 3pm Pacific, you can subscribe here.

GrubMarket raises $60M as food delivery stays center stage

Companies that have leveraged technology to make the procurement and delivery of food more accessible to more people have been seeing a big surge of business this year, as millions of consumers are encouraged (or outright mandated, due to COVID-19) to socially distance or want to avoid the crowds of physical shopping and eating excursions.

Today, one of the companies that is supplying produce and other items both to consumers and other services that are in turn selling food and groceries to them, is announcing a new round of funding as it gears up to take its next step, an IPO.

GrubMarket, which provides a B2C platform for consumers to order produce and other food and home items for delivery, and a B2B service where it supplies grocery stores, meal-kit companies and other food tech startups with products that they resell, is today announcing that it has raised $60 million in a Series D round of funding.

Sources close to the company confirmed to TechCrunch that GrubMarket — which is profitable, and originally hadn’t planned to raise more than $20 million — has now doubled its valuation compared to its last round — sources tell us it is now between $400 million and $500 million.

The funding is coming from funds and accounts managed by BlackRock, Reimagined Ventures, Trinity Capital Investment, Celtic House Venture Partners, Marubeni Ventures, Sixty Degree Capital and Mojo Partners, alongside previous investors GGV Capital, WI Harper Group, Digital Garage, CentreGold Capital, Scrum Ventures and other unnamed participants. Past investors also included Y Combinator, where GrubMarket was part of the Winter 2015 cohort. For some context, GrubMarket last raised money in April 2019 — $28 million at a $228 million valuation, a source says.

Mike Xu, the founder and CEO, said that the plan remains for the company to go public (he’s talked about it before), but given that it’s not having trouble raising from private markets and is currently growing at 100% over last year, and the IPO market is less certain at the moment, he declined to put an exact timeline on when this might actually happen, although he was clear that this is where his focus is in the near future.

“The only success criteria of my startup career is whether GrubMarket can eventually make $100 billion of annual sales,” he said to me over both email and in a phone conversation. “To achieve this goal, I am willing to stay heads-down and hardworking every day until it is done, and it does not matter whether it will take me 15 years or 50 years.”

I don’t doubt that he means it. I’ll note that we had this call in the middle of the night his time in California, even after I asked multiple times if there wasn’t a more reasonable hour in the daytime for him to talk. (He insisted that he got his best work done at 4:30 a.m., a result of how a lot of the grocery business works.) Xu on the one hand is very gentle with a calm demeanor, but don’t let his quiet manner fool you. He also is focused and relentless in his work ethic.

When people talk today about buying food, alongside traditional grocery stores and other physical food markets, they increasingly talk about grocery delivery companies, restaurant delivery platforms, meal kit services and more that make or provide food to people by way of apps. GrubMarket has built itself as a profitable but quiet giant that underpins the fuel that helps companies in all of these categories by becoming one of the critical companies building bridges between food producers and those that interact with customers.

Its opportunity comes in the form of disruption and a gap in the market. Food production is not unlike shipping and other older, non-tech industries, with a lot of transactions couched in legacy processes: GrubMarket has built software that connects the different segments of the food supply chain in a faster and more efficient way, and then provides the logistics to help it run.

To be sure, it’s an area that would have evolved regardless of the world health situation, but the rise and growth of the coronavirus has definitely “helped” GrubMarket not just by creating more demand for delivered food, but by providing a way for those in the food supply chain to interact with less contact and more tech-fueled efficiency.

Sales of WholesaleWare, as the platform is called, Xu said, have seen more than 800% growth over the last year, now managing “several hundreds of millions of dollars of food wholesale activities” annually.

Underpinning its tech is the sheer size of the operation: economies of scale in action. The company is active in the San Francisco Bay Area, Los Angeles, San Diego, Seattle, Texas, Michigan, Boston and New York (and many places in between) and says that it currently operates some 21 warehouses nationwide. Xu describes GrubMarket as a “major food provider” in the Bay Area and the rest of California, with (as one example) more than 5 million pounds of frozen meat in its east San Francisco Bay warehouse.

Its customers include more than 500 grocery stores, 8,000 restaurants and 2,000 corporate offices, with familiar names like Whole Foods, Kroger, Albertson, Safeway, Sprouts Farmers Market, Raley’s Market, 99 Ranch Market, Blue Apron, Hello Fresh, Fresh Direct, Imperfect Foods, Misfit Market, Sun Basket and GoodEggs all on the list, with GrubMarket supplying them items that they resell directly, or use in creating their own products (like meal kits).

While much of GrubMarket’s growth has been — like a lot of its produce — organic, its profitability has helped it also grow inorganically. It has made some 15 acquisitions in the last two years, including Boston Organics and EJ Food Distributor this year.

It’s not to say that GrubMarket has not had growing pains. The company, Xu said, was like many others in the food delivery business — “overwhelmed” at the start of the pandemic in March and April of this year. “We had to limit our daily delivery volume in some regions, and put new customers on waiting lists.” Even so, the B2C business grew between 300% and 500% depending on the market. Xu said things calmed down by May and even as some B2B customers never came back after cities were locked down, as a category, B2B has largely recovered, he said.

Interestingly, the startup itself has taken a very proactive approach in order to limit its own workers’ and customers’ exposure to COVID-19, doing as much testing as it could — tests have been, as we all know, in very short supply — as well as a lot of social distancing and cleaning operations.

“There have been no mandates about masks, but we supplied them extensively,” he said.

So far it seems to have worked. Xu said the company has only found “a couple of employees” that were positive this year. In one case in April, a case was found not through a test (which it didn’t have, this happened in Michigan) but through a routine check and finding an employee showing symptoms, and its response was swift: the facilities were locked down for two weeks and sanitized, despite this happening in one of the busiest months in the history of the company (and the food supply sector overall).

That’s notable leadership at a time when it feels like a lot of leaders have failed us, which only helps to bolster the company’s strong growth.

“Having a proven track record of sustained hypergrowth and net income profitability, GrubMarket stands out as an extraordinarily rare Silicon Valley startup in the food technology and ecommerce segment,” said Jay Chen, managing partner of Celtic House Venture Partner. “Scaling over 15x in 4 years, GrubMarket’s creativity and capital efficiency is unmatched by anyone else in this space. Mike’s team has done an incredible job growing the company thoughtfully and sustainably. We are proud to be a partner in the company’s rapid nationwide expansion and excited by the strong momentum of WholesaleWare, their SaaS suite, which is the best we have seen in space.”
Updated with more detail on the valuation.

As it closes in on Arm, Nvidia announces UK supercomputer dedicated to medical research

As Nvidia continues to work through its deal to acquire Arm from SoftBank for $40 billion, the computing giant is making another big move to lay out its commitment to investing in U.K. technology. Today the company announced plans to develop Cambridge-1, a new £40 million AI supercomputer that will be used for research in the health industry in the country, the first supercomputer built by Nvidia specifically for external research access, it said.

Nvidia said it is already working with GSK, AstraZeneca, London hospitals Guy’s and St Thomas’ NHS Foundation Trust, King’s College London and Oxford Nanopore to use the Cambridge-1. The supercomputer is due to come online by the end of the year and will be the company’s second supercomputer in the country. The first is already in development at the company’s AI Center of Excellence in Cambridge, and the plan is to add more supercomputers over time.

The growing role of AI has underscored an interesting crossroads in medical research. On one hand, leading researchers all acknowledge the role it will be playing in their work. On the other, none of them (nor their institutions) have the resources to meet that demand on their own. That’s driving them all to get involved much more deeply with big tech companies like Google, Microsoft and, in this case, Nvidia, to carry out work.

Alongside the supercomputer news, Nvidia is making a second announcement in the area of healthcare in the U.K.: it has inked a partnership with GSK, which has established an AI hub in London, to build AI-based computational processes that will be used in drug vaccine and discovery — an especially timely piece of news, given that we are in a global health pandemic and all drug makers and researchers are on the hunt to understand more about, and build vaccines for, COVID-19.

The news is coinciding with Nvidia’s industry event, the GPU Technology Conference.

“Tackling the world’s most pressing challenges in healthcare requires massively powerful computing resources to harness the capabilities of AI,” said Jensen Huang, founder and CEO of Nvidia, in his keynote at the event. “The Cambridge-1 supercomputer will serve as a hub of innovation for the U.K., and further the groundbreaking work being done by the nation’s researchers in critical healthcare and drug discovery.”

The company plans to dedicate Cambridge-1 resources in four areas, it said: industry research, in particular joint research on projects that exceed the resources of any single institution; university granted compute time; health-focused AI startups; and education for future AI practitioners. It’s already building specific applications in areas, like the drug discovery work it’s doing with GSK, that will be run on the machine.

The Cambridge-1 will be built on Nvidia’s DGX SuperPOD system, which can process 400 petaflops of AI performance and 8 petaflops of Linpack performance. Nvidia said this will rank it as the 29th fastest supercomputer in the world.

“Number 29” doesn’t sound very groundbreaking, but there are other reasons why the announcement is significant.

For starters, it underscores how the supercomputing market — while still not a mass-market enterprise — is increasingly developing more focus around specific areas of research and industries. In this case, it underscores how health research has become more complex, and how applications of artificial intelligence have both spurred that complexity but, in the case of building stronger computing power, also provides a better route — some might say one of the only viable routes in the most complex of cases — to medical breakthroughs and discoveries.

It’s also notable that the effort is being forged in the U.K. Nvidia’s deal to buy Arm has seen some resistance in the market — with one group leading a campaign to stop the sale and take Arm independent — but this latest announcement underscores that the company is already involved pretty deeply in the U.K. market, bolstering Nvidia’s case to double down even further. (Yes, chip reference designs and building supercomputers are different enterprises, but the argument for Nvidia is one of commitment and presence.)

“AI and machine learning are like a new microscope that will help scientists to see things that they couldn’t see otherwise,” said Dr. Hal Barron, chief scientific officer and president, R&D, GSK, in a statement. “NVIDIA’s investment in computing, combined with the power of deep learning, will enable solutions to some of the life sciences industry’s greatest challenges and help us continue to deliver transformational medicines and vaccines to patients. Together with GSK’s new AI lab in London, I am delighted that these advanced technologies will now be available to help the U.K.’s outstanding scientists.”

“The use of big data, supercomputing and artificial intelligence have the potential to transform research and development; from target identification through clinical research and all the way to the launch of new medicines,” added James Weatherall, PhD, head of Data Science and AI, AstraZeneca, in his statement.

“Recent advances in AI have seen increasingly powerful models being used for complex tasks such as image recognition and natural language understanding,” said Sebastien Ourselin, head, School of Biomedical Engineering & Imaging Sciences at King’s College London. “These models have achieved previously unimaginable performance by using an unprecedented scale of computational power, amassing millions of GPU hours per model. Through this partnership, for the first time, such a scale of computational power will be available to healthcare research – it will be truly transformational for patient health and treatment pathways.”

Dr. Ian Abbs, chief executive & chief medical director of Guy’s and St Thomas’ NHS Foundation Trust Officer, said: “If AI is to be deployed at scale for patient care, then accuracy, robustness and safety are of paramount importance. We need to ensure AI researchers have access to the largest and most comprehensive datasets that the NHS has to offer, our clinical expertise, and the required computational infrastructure to make sense of the data. This approach is not only necessary, but also the only ethical way to deliver AI in healthcare – more advanced AI means better care for our patients.”

“Compact AI has enabled real-time sequencing in the palm of your hand, and AI supercomputers are enabling new scientific discoveries in large-scale genomic data sets,” added Gordon Sanghera, CEO, Oxford Nanopore Technologies. “These complementary innovations in data analysis support a wealth of impactful science in the U.K., and critically, support our goal of bringing genomic analysis to anyone, anywhere.”

 

Strike Graph raises $3.9M to help automate security audits

Compliance automation isn’t exactly the most exciting topic, but security audits are big business and companies that aim to get a SOC 2, ISO 207001 or FedRamp certification can often spend six figures to get through the process with the help of an auditing service. Seattle-based Strike Graph, which is launching today and announcing a $3.9 million seed funding round, wants to automate as much of this process as possible.

The company’s funding round was led by Madrona Venture Group, with participation from Amplify.LA, Revolution’s Rise of the Rest Seed Fund and Green D Ventures.

Strike Graph co-founder and CEO Justin Beals tells me that the idea for the company came to him during his time as CTO at machine learning startup Koru (which had a bit of an odd exit last year). To get enterprise adoption for that service, the company had to get a SOC 2 security certification. “It was a real challenge, especially for a small company. In talking to my colleagues, I just recognized how much of a challenge it was across the board. And so when it was time for the next startup, I was just really curious,” he told me.

Image Credits: Strike Graph

Together with his co-founder Brian Bero, he incubated the idea at Madrona Venture Labs, where he spent some time as Entrepreneur in Residence after Koru.

Beals argues that today’s process tends to be slow, inefficient and expensive. The idea behind Strike Graph, unsurprisingly, is to remove as many of these inefficiencies as is currently possible. The company itself, it is worth noting, doesn’t provide the actual audit service. Businesses will still need to hire an auditing service for that. But Beals also argues that the bulk of what companies are paying for today is pre-audit preparation.

“We do all that preparation work and preparing you and then, after your first audit, you have to go and renew every year. So there’s an important maintenance of that information.”

Image Credits: Strike Graph

When customers come to Strike Graph, they fill out a risk assessment. The company takes that and can then provide them with controls for how to improve their security posture — both to pass the audit and to secure their data. Beals also noted that soon, Strike Graph will be able to help businesses automate the collection of evidence for the audit (say your encryption settings) and can pull that in regularly. Certifications like SOC 2, after all, require companies to have ongoing security practices in place and get re-audited every 12 months. Automated evidence collection will launch in early 2021, once the team has built out the first set of its integrations to collect that data.

That’s also where the company, which mostly targets mid-size businesses, plans to spend a lot of its new funding. In addition, the company plans to focus on its marketing efforts, mostly around content marketing and educating its potential customers.

“Every company, big or small, that sells a software solution must address a broad set of compliance requirements in regards to security and privacy. Obtaining the certifications can be a burdensome, opaque and expensive process. Strike Graph is applying intelligent technology to this problem — they help the company identify the appropriate risks, enable the audit to run smoothly and then automate the compliance and testing going forward,” said Hope Cochran, managing director at Madrona Venture Group. “These audits were a necessary pain when I was a CFO, and Strike Graph’s elegant solution brings together teams across the company to move the business forward faster.”

Printing giant Vistaprint acquires 99designs

Vistaprint announced today that its parent company Cimpress has acquired freelance design marketplace 99designs.

The companies say that 99designs will become part of Vistaprint while also operating as a separate brand, with 99designs CEO Patrick Llewelyn continuing to lead his team and reporting to Cimpress/Vistaprint CEO Robert Keane.

The acquisition announcement emphasizes the opportunity of connecting 99designs’ freelance designers with the 20 million small businesses who use Vistaprint to print signs, banners, business cards and other marketing materials — so they can have their design and printing needs handled in one place.

Apparently Vistaprint has already been expanding into design services, with offerings that include a design service that businesses have used to create custom face masks during the pandemic.

“The driving force behind Vistaprint’s future with 99designs is our passion to help small businesses,” Keane said in a statement. “We know how critical great design is for entrepreneurs on their journey. 99designs and Vistaprint have shared values and vision to be a trusted partner to business owners and creators, which lay the foundation for something bigger and more valuable than either of our teams could create alone.”

The financial terms of the acquisition were not disclosed. Cimpress is publicly traded, while 99designs has remained private, despite Llewellyn’s plans to go public a couple of years ago. The design company was founded in 2008 and raised a total of $45 million from Accel and Recruit Strategic Partners.

 

The Good, the Bad and the Ugly in Cybersecurity – Week 40

The Good

With the US elections just two months away, and absentee voting via email and mail already underway, it is encouraging to see multiple agencies getting serious about election security. The FBI and CISA have made several joint public service announcements with the aim of reducing unnecessary anxiety over foreign intervention while clearly explaining what might actually happen.

The first announcement warned of the potential threat posed by foreign actors and cybercriminals spreading disinformation about the 2020 election results. They note that:

“foreign actors and cybercriminals could create new websites, change existing websites, and create or share corresponding social media content to spread false information in an attempt to discredit the electoral process and undermine confidence in U.S. democratic institutions”.

Acknowledging this will hopefully go some way to persuading the general public that the elections aren’t rigged and that it is worthwhile to make the effort and vote, instead of staying at home (the intent of said foreign actors being to reduce voting levels).

Next, a PSA warned of foreign actors and cyber criminals spreading false rumors that they have somehow compromised election infrastructure and facilitated the “hacking” and “leaking” of U.S. voter registration data. This is done in an attempt to discredit the electoral process and undermine confidence in U.S. democratic institutions. It’s worth noting that much U.S. voter information can be purchased or acquired through publicly available sources, and the FBI and CISA added that they “have no information suggesting any cyberattack on U.S. election infrastructure has prevented an election from occurring, compromised the accuracy of voter registration information, prevented a registered voter from casting a ballot, or compromised the integrity of any ballots cast”.

A further PSA warned of DDoS Attacks against Election Infrastructure that can hinder access to voting information, delay voting and hold up vote counting. The agencies stress that even if such attacks did take place, measures are in place to ensure that they would not prevent anyone from casting their vote.

But the FBI and CISA are not the only agencies that tackle the issue of securing the election process. The House of Representatives unanimously approved legislation that would make hacking voting systems a federal crime. This follows the “Defending the Integrity of Voting Systems Act” approved by Senate last year and will enable the federal government to play a role in helping states defend against threats to elections.

The Bad

CISA has reported that a threat actor attacked an unnamed federal agency network this past week. By leveraging compromised credentials, the cyber threat actor gained persistent access through two reverse Socket Secure (SOCKS) proxies that exploited weaknesses in the agency’s firewall. They reportedly used the agency’s anti-malware product’s software license key and installation guide and “then visited a directory used by the product for temporary file analysis.” After accessing this directory, the attackers were able to run inetinfo.exe, a sophisticated malware dropper and file decrypter, to further the attack.

Wired reports that the hackers are none other than Fancy Bear/APT28: a team of hackers working for Russia’s GRU. Referring to a previous report (dating back to May 2020) the FBI noted that Fancy bear attacked US networks and provided an IP of a server in Hungary – the same IP address appears in the CISA report. An older report by the Department of Energy warned that APT28 had probed a US government organization’s network from a server in Latvia, and that Latvian IP address also appears in the report. Moreover, the sophisticated TTPs detailed by CISA match those of APT28 as shown in previous campaigns. While we don’t know which agency was hacked and the extent of the breach, it serves as another reminder of just how capable these threat kinds of APT threat actors are.

The Ugly

As the COVID crisis continues into the last quarter of 2020, with no vaccine in site and with many countries relapsing into lockdowns, some might have expected cybercriminals to ease their onslaught on healthcare facilities. A ransomware attack this week on Universal Health Services (UHS), a Fortune 500 hospital and healthcare services provider, proves just how misplaced any such thoughts really are.

UHS operates 26 Acute Care hospitals, 328 Behavioral Health inpatient facilities, and 42 outpatient facilities and ambulatory care centers in 37 states in the U.S., Washington, D.C., Puerto Rico and the United Kingdom.

The healthcare provider was most likely hit by Ryuk ransomware. BleepingComputer reports that during the cyberattack, files were being renamed with the .ryk extension, a telltale sign of Ryuk.

The immediate result was the shutting down of all supporting IT systems and a return to what the company described as “established back-up processes including offline documentation methods”, meaning pen and paper reporting and scheduling. According to the company, no patient or employee data was compromised in the attack.


Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Attacks Aimed at Disrupting the Trickbot Botnet

Over the past 10 days, someone has been launching a series of coordinated attacks designed to disrupt Trickbot, an enormous collection of more than two million malware-infected Windows PCs that are constantly being harvested for financial data and are often used as the entry point for deploying ransomware within compromised organizations.

A text snippet from one of the bogus Trickbot configuration updates. Source: Intel 471

On Sept. 22, someone pushed out a new configuration file to Windows computers currently infected with Trickbot. The crooks running the Trickbot botnet typically use these config files to pass new instructions to their fleet of infected PCs, such as the Internet address where hacked systems should download new updates to the malware.

But the new configuration file pushed on Sept. 22 told all systems infected with Trickbot that their new malware control server had the address 127.0.0.1, which is a “localhost” address that is not reachable over the public Internet, according to an analysis by cyber intelligence firm Intel 471.

It’s not known how many Trickbot-infected systems received the phony update, but it seems clear this wasn’t just a mistake by Trickbot’s overlords. Intel 471 found that it happened yet again on Oct. 1, suggesting someone with access to the inner workings of the botnet was trying to disrupt its operations.

“Shortly after the bogus configs were pushed out, all Trickbot controllers stopped responding correctly to bot requests,” Intel 471 wrote in a note to its customers. “This possibly means central Trickbot controller infrastructure was disrupted. The close timing of both events suggested an intentional disruption of Trickbot botnet operations.”

Intel 471 CEO Mark Arena said it’s anyone’s guess at this point who is responsible.

“Obviously, someone is trying to attack Trickbot,” Arena said. “It could be someone in the security research community, a government, a disgruntled insider, or a rival cybercrime group. We just don’t know at this point.

Arena said it’s unclear how successful these bogus configuration file updates will be given that the Trickbot authors built a fail-safe recovery system into their malware. Specifically, Trickbot has a backup control mechanism: A domain name registered on EmerDNS, a decentralized domain name system.

“This domain should still be in control of the Trickbot operators and could potentially be used to recover bots,” Intel 471 wrote.

But whoever is screwing with the Trickbot purveyors appears to have adopted a multi-pronged approach: Around the same time as the second bogus configuration file update was pushed on Oct. 1, someone stuffed the control networks that the Trickbot operators use to keep track of data on infected systems with millions of new records.

Alex Holden is chief technology officer and founder of Hold Security, a Milwaukee-based cyber intelligence firm that helps recover stolen data. Holden said at the end of September Trickbot held passwords and financial data stolen from more than 2.7 million Windows PCs.

By October 1, Holden said, that number had magically grown to more than seven million.

“Someone is flooding the Trickbot system with fake data,” Holden said. “Whoever is doing this is generating records that include machine names indicating these are infected systems in a broad range of organizations, including the Department of Defense, U.S. Bank, JP Morgan Chase, PNC and Citigroup, to name a few.”

Holden said the flood of new, apparently bogus, records appears to be an attempt by someone to dilute the Trickbot database and confuse or stymie the Trickbot operators. But so far, Holden said, the impact has been mainly to annoy and aggravate the criminals in charge of Trickbot.

“Our monitoring found at least one statement from one of the ransomware groups that relies on Trickbot saying this pisses them off, and they’re going to double the ransom they’re asking for from a victim,” Holden said. “We haven’t been able to confirm whether they actually followed through with that, but these attacks are definitely interfering with their business.”

Intel 471’s Arena said this could be part of an ongoing campaign to dismantle or wrest control over the Trickbot botnet. Such an effort would hardly be unprecedented. In 2014, for example, U.S. and international law enforcement agencies teamed up with multiple security firms and private researchers to commandeer the Gameover Zeus Botnet, a particularly aggressive and sophisticated malware strain that had enslaved up to 1 million Windows PCs globally.

Trickbot would be an attractive target for such a takeover effort because it is widely viewed as a platform used to find potential ransomware victims. Intel 471 describes Trickbot as “a malware-as-a-service platform that caters to a relatively small number of top-tier cybercriminals.”

One of the top ransomware gangs in operation today — which deploys ransomware strains known variously as “Ryuk” and “Conti,” is known to be closely associated with Trickbot infections. Both ransomware families have been used in some of the most damaging and costly malware incidents to date.

The latest Ryuk victim is Universal Health Services (UHS), a Fortune 500 hospital and healthcare services provider that operates more than 400 facilities in the U.S. and U.K.

On Sunday, Sept. 27, UHS shut down its computer systems at healthcare facilities across the United States in a bid to stop the spread of the malware. The disruption has reportedly caused the affected hospitals to redirect ambulances and relocate patients in need of surgery to other nearby hospitals.

Altinity grabs $4M seed to build cloud version of ClickHouse open-source data warehouse

Earlier this month, cloud data warehouse Snowflake turned heads when it debuted on the stock market. Today, Altinity, the commercial company behind the open-source ClickHouse data warehouse, announced a $4 million seed round from Accel along with a new cloud service, Altinity.Cloud.

“Fundamentally, the company started out as an open-source services bureau offering support, training and [custom] engineering features into ClickHouse. And what we’re doing now with this investment from Accel is we’re extending it to offer a cloud platform in addition to the other things that we already have,” CEO Robert Hodges told TechCrunch.

As the company describes it, “Altinity.Cloud offers immediate access to production-ready ClickHouse clusters with expert enterprise support during every aspect of the application life cycle.” It also helps with application design and implementation and production assistance, in essence combining the consulting side of the house with the cloud service.

The company was launched in 2017 by CTO Alexander Zaitsev, who was one of the early adopters of ClickHouse. Up until now the startup has been bootstrapped with revenue from the services business.

Hodges came on board last year after a stint at VMware because he saw a company with tremendous potential, and his background in cloud services made him a good person to lead the company as it built the cloud product and moved into its next phase.

ClickHouse at its core is a relational database that can run in the cloud or on-prem with big improvements in performance, Hodges says. And he says that developers are enamored with it because you can start a project on a laptop and scale it up from there.

“We’re very simple to operate, just a single binary. You can start from a Docker image. You can run it anywhere, literally anywhere that Linux runs, from an Intel Nuc all the way up to clusters with hundreds of nodes,” Hodges explained.

The investment from Accel should help them finish building the cloud product, which has been in private beta since July, while helping them build a sales and marketing operation to help sell it to the target enterprise market. The startup currently has 27 people, with plans to hire 15 more.

Hodges says that he wants to build a diverse and inclusive company, something he says the tech industry in general has failed at achieving. He believes that one of the reasons for that is the requirement of a computer science degree, which he says has created “a gate for women and people of color,” and he thinks by hiring people with more diverse backgrounds, you can build a more diverse company.

“So one of the things that’s high up on my list is to get back to a more equitable and diverse population of people working on this thing,” he said.

Over time, the company sees the cloud business overtaking the consulting arm in terms of revenue, but that aspect of the business will always have a role in the revenue mix because this is complex by its nature, even with a cloud service.

“Customers can’t just do it entirely by having a push-button interface. They will actually need humans that work with them, and help them understand how to frame problems, help them understand how to build applications that take care of that […] And then finally, help them deal with problems that naturally arise when you’re when you’re in production,” he said.

Cisco acquires PortShift to raise its game in DevOps and Kubernetes security

Cisco is making another acquisition to expand its reach in security solutions, this time specifically targeting DevOps and the world of container management. It is acquiring PortShift, an Israeli startup that has built a Kubernetes-native security platform.

Terms of the deal were not disclosed but Israeli publication Globes reported later on the day of the deal that it was for $100 million (we’re trying to confirm if this is accurate). PortShift had raised about $5.3 million from Team8, an incubator and backer of security startups in Israel founded by a group of cybersecurity vets. Cisco, along with Microsoft and Walmart, are among the large corporates that back Team8. (Indeed, their participation is in part a way of getting an early look and inside scoop on some of the more cutting-edge technologies being built, and in part a way to help founders understand what corporates’ security needs are these days.)

The deal underscores not just how containerization, and specifically Kubernetes, has taken hold of the enterprise world, but also how those working in this area, and building businesses around containerization and Kubernetes, are paying increasing attention to security around them.

Others are also sharpening their focus on containers and how they are secured, and M&A deals like Cisco’s decision to buy PortShift are examples of how larger enterprise tech companies are betting on this area, as well as the wider demands for the products from end users. Earlier this year, Venafi acquired Jetstack, which runs a certificate controller for Kubernetes; and last month StackRox raised funding from investors that included HPE for its own approach to Kubernetes security.

For Cisco, the deal fits strategically in a couple of ways. It has been a longtime partner of Google’s around cloud services and related to that has been building services around containerization for years now. It has also made a number of acquisitions in the area of cybersecurity. They have included acquiring Duo for $2.35 billion, OpenDNS for $635 million and, most recently, Babble Labs (which helps reduce background noise in video calls, something that both improves quality but also helps users ensure unwanted or private chatter doesn’t inadvertently get heard by unintended listeners).

But as Liz Centoni, the SVP of the Emerging Technologies and Incubation (ET&I) Group, notes in the blog post, with this latest purchase, Cisco is turning its attention also to how it can help customers better secure applications and workloads, alongside the investments that it has made to help secure people on networks (the primary thrust of deals like Duo’s and Babble Labs’).

In the area of containers, security issues can arise around container architecture in a number of areas: it can be due to misconfiguration; or because of how applications are monitored; or how developers use open-source libraries; and how companies implement regulatory compliance. Other security vulnerabilities include the use of insecure container images; problems with how containers interact with each other; the use of containers that have been infected with rogue processes; and having containers not isolated properly from their hosts.

Centoni notes that PortShift interested Cisco because it provides an all-in-one platform covering these many aspects of Kubernetes security:

“Today, the application security space is highly fragmented with many vendors addressing only part of the problem,” she writes. “The Portshift team is building capabilities that span a large portion of the lifecycle of the cloud-native application.”

PortShift provides tools for better container configuration visibility, vulnerability management, configuration management, segmentation, encryption, compliance and automation.

The acquisition is expected to close in the first half of Cisco’s 2021 fiscal year, when the team will join Cisco’s ET&I Group.

Updated with a reported price for the acquisition.

SAP continues to build out customer experience business with Emarsys acquisition

SAP seemed to be all in on customer experience when it acquired Qualtrics for $8 billion in 2018. It continued on that journey today when it announced it was acquiring Austrian cloud marketing company Emarsys for an undisclosed amount of money.

Emarsys, which raised over $55 million according to PitchBook data, gives SAP customer personalization technology. If you spoke to any marketing automation vendor over the last several years, the focus has been on using a variety of data and touch points to understand the customer better, and deliver more meaningful online experiences.

With the pandemic closing or limiting access to brick and mortar stores, personalization has taken a new urgency as customers are increasingly shopping online and companies need to meet them where they are.

With Emarsys, the company is getting an omnichannel marketing solution that they say is designed to deliver messages to customers wherever they are, including e-mail, mobile, social, SMS and the web, and deliver that at scale.

When SAP announced it was spinning out Qualtrics a couple of months ago, just 20 months after buying it, it left some question about whether SAP was fully committed to the customer experience business.

Brent Leary, founder and principal analyst at CRM Essentials, says that the acquisition shows that SAP is still very much in the game. “This illustrates that SAP is serious about CX and competing in a highly competitive space. Emarsys adds industry-specific customer engagement capabilities that should help SAP CX customers accelerate their efforts to provide their customers with the experiences they expect as their needs change over time,” Leary told TechCrunch.

As an ERP company at its core, SAP has traditionally focused on back-office kinds of operations. But Bob Stutz, president, SAP Customer Experience, sees this acquisition as a way to continue bringing back-office and front-office operations together.

“With Emarsys technology, SAP Customer Experience solutions can link commerce signals with the back office and activate the preferred channel of the customer with a relevant and consistently personalized message, allowing customers the freedom to choose their own engagement,” Stutz said in a statement.

The company, which is based in Austria, was founded back in 2000, when marketing was a very different world. It has built a customer base of 1,500 companies with 800 employees in 13 offices across the globe. All of this will become part of SAP, of course, and come under Stutz’s purview.

As with all transactions of this type it will be subject to regulatory approval, but the deal is expected to close this quarter.