The barrier to entry for enterprising cybercriminals has been dropping considerably over recent years, in part due to the availability of RaaS (Ransomware as a Service) offerings on the darknet but also due to publicly-accessible code being shared for free. One such offering is the Slam Ransomware Builder, which had been hosted until recently on Github. In this post, we highlight how free ransomware builders like Slam offer an easy route into cybercrime and yet present a credible threat to organizations and enterprises. We provide a detailed list of indicators to help security teams detect and protect against Slam ransomware payloads.

Ransomware For “Educational Purposes Only”?

The Slam Ransomware Builder first appeared in late 2021, with Slam ransomware payloads appearing in the wild shortly after (e.g., ConsoleApp2.exe). During mid-2022, downloadable and executable versions of the Slam Ransomware Builder appeared on a publicly-visible repository on Github and were available for several months until Github admins removed the repository on September 1st, 2022.

The owner of the now-removed repository dubbed it “The Most Advanced Free Ransomware Builder” and has a history of providing “educational” videos on Vimeo, Youtube and KZHome, instructing viewers how to build ransomware and “virus payloads”.

While the author’s public postings contain the usual “for educational purposes only” and “don’t try this” disclaimers to avoid responsibility, they also contain language such as “most advanced ransomware” and “damage rate: destructive”.

The author had described the ransomware’s behavior in detail in earlier publicly-posted videos, describing how victim data could be exfiltrated to an attacker-controlled site.

The author’s reasons for distributing free ransomware builders can only be guessed at, but despite being free, the builder and payloads are genuine threats that can cause real damage. As our analysis below shows, Slam is a full-featured ransomware with AES256 encryption, UAC bypass, shadow backup copy deletion and data exfiltration capabilities. In other words, everything needed to lock and steal enterprise data.

Slam Ransomware Builder Features

The most recent release of the Slam ransomware builder prior to being removed from Github was version 1.7. Earlier versions of the tool supported either English or Spanish locales, while later versions including 1.7 allow toggling between the two.

The existing feature set includes the following:

• Fully customizable ransom notes
• Custom encryption passphrases
• All ransomware to lay dormant until a network is available
• UAC Bypass (1)
• Run external commands with the ransomware launch
• VSS/ backup deletion
• Basic file transfers (HTTP) for exfiltration

Despite the code being removed from Github, it is possible the author intends to find or already has other distribution outlets. A list of features promised for the future include screen locking, MBR overwrites, and “LogonUI overwriting”.

Upon running the code provided on Github, users of the builder are presented with a menu leading to different builder components or indications of their upcoming release.

When choosing the “slam ransomware builder” option, users must first “Install”, then “Start” to launch the builder interface. This installation essentially consists of writing the builder EXE to c:slam_ransomware_builder. Any other component requiring an “Install” step will also go to the root of the C drive (e.g., c:slam_mbr_builder)

Once the main interface is launched, the user is presented with a standard set of options for building their ransomware payloads.

Options including the following are present in this interface:

• Ransom note name and text
• Wallpaper modification options and images
• Affected file extensions
• File encryption (types / extensions to encrypt)
• Remote folder options (OneDrive)

The tool provides more ‘Advanced’ configuration options as well. These options are accessible via the “advanced” button.

Options in this section include:

• Network awareness (remain idle until Wi-Fi is available)
• Verbose output options (decrypter)
• Persistence (add to startup)
• Inhibit recovery (website blocking, self-destruction, backup destruction).

The “block antivirus websites” option is meant to inhibit the victims from being able to download security software or check suspicious files on public malware repository sites such as VirusTotal.

The ransomware achieves this by modifying the device’s Hosts file, adding a long list of sites belonging to the likes of Avast, Avira, Bitdefender, CCleaner, Google, Kaspersky, McAfee, Microsoft, Panda Security, Trend Micro, VirusTotal, YouTube, and others. Each site is simply bound to the machine’s loopback address (typically, 127.0.0.1), preventing the domain name from being resolved to an external IP address.

With regard to bypasses, the version of Slam we analyzed includes a single UAC bypass, based on UACMe, which attempts to defeat Windows User Account Control by abusing the built-in Windows AutoElevate backdoor. UACMe is a bypass technique that has been known for some years and widely abused by a number of other malware families including Multiplug adware, Dyre, Empercrypt and IcedID.

To exfiltrate victim data, the user can specify an HTTP server in the configuration interface, where a connection test can also be performed. If the connection test fails, an error is displayed. Other options available to the user include USB infection and execution of custom commands when the payload is detonated on the victim machine.

Slam Ransomware Payloads

With all options configured, the executable payloads generated are standard EXE files. The builder outputs both the encryptor and decryptor tools.

When executed with non-Administrator privileges, the UAC prompts and/or configured bypasses will come into play.

Post-execution, the victim device is encrypted according to the options configured in the builder.

The payload is written to %AppData%Localdiscord.exe, which is called in the registry (Run key), ensuring the ransomware payload is persistent.

As advertised, the Slam payload successfully inhibits recovery via removal of VSS backups on an unprotected machine. Both wmic and vssadmin methods are utilized for VSS deletion.

/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

wmic shadowcopy delete

The ransomware also deletes various logs, Windows installation and recovery-related files via cleanmgr.exe. In the payload we analyzed, for example, a process named wgMHhFHnkiczPUNfqaA8Cx4kqwVcRG.exe issues the cleanmgr.exe command with the /AUTOCLEAN parameter, which executes Windows disk cleanup and removes Windows installation files on unprotected devices.

system32cleanmgr.exe /autoclean /d C:

Slam MBR Builder

The Slam builder also contains a very early stage “Alpha” MBR builder tool. Choosing to “Install” should write start.exe to c:slam_mbr_builderstart.exe. This does not appear to occur in our testing and analysis, and the feature appears to be non-functional in the version of the Slam Builder we analyzed from Github.

However, we were able to obtain a copy of the builder from another source that allowed us to launch the builder and observe the output.

Within the MBR Builder interface, users are able to configure the message displayed to the victim.

Prior to executing the build, a final screen allows the attacker to choose the “reboot mode” with the options being

• Do Nothing
• BSOD
• Reboot
• Shutdown
• Nothing

Payloads from the MBR builder have been observed in the wild with the following PDB string.

C:slam_mbr_builderMbrOverwritermbrcsobjDebugmbrcs.pdb

Conclusion

In this area and many others of infosec, there is a fine line between “education” and researcher-led offensive security that seeks to explore and improve weaknesses in enterprise defenses on the one hand, and simple, out-and-out malicious code designed to aid and abet criminal offenses on the other. We see no indications in the various public artifacts around the Slam ransomware builder (code, videos, Github repository) that suggest it could reasonably be interpreted as in the service of the former.

However that may be, once in the hands of unscrupulous actors, full-featured projects such as these represent a real risk to enterprises and organizations.

We applaud Github for removing this code and hope this post serves as a reminder to defenders to be vigilant as threat actors continue to simplify the ransomware-centric extortion process. The barrier to entry into the world of cybercrime has never been lower.

SentinelOne Singularity detects and prevents malicious behavior associated with Slam Ransomware and its associated artifacts.

Indicators of Compromise

Observed File Names
ConsoleApp2.exe
mbrcs.exe
JpegMedic ARWE
slam ransomware builder.exe

Observed PDB Strings

C:slam_mbr_builderMbrOverwritermbrcsobjDebugmbrcs.pdb
c:slam_ransomware_builderConsoleApp2ConsoleApp2objDebugConsoleApp2.pdb
C:UsersamdgaDesktopUACME-masterSourceAkagioutputWin32DebugAkagi.pdb
D:agent_work20sbinariesx86retbini386vcruntime140d.i386.pdb
c:slam_ransomware_builderuacConsoleApp2objDebugConsoleApp2.pdb
c:slam_ransomware_builderConsoleApp2ConsoleApp2objDebugConsoleApp2.pdb
C:slam_mbr_builderMbrOverwritermbrcsobjDebugmbrcs.pdb
C:UsersamdgasourcereposconectconectobjDebugconect.pdb
C:Usersandersourcereposslam ransomware builderslam ransomware builderobjDebugslam ransomware builder.pdb

SHA1 Hashes
1ba9043ac164c6c60de4a1ee2ca50b2e7f4ebaf5
2037d9f2e7cd15930e83f5142c5a48adecd3b617
272566e8b5880e32cefb7a165a833652815a003f
27b1ca0793caa19edabfbc49e6cffc05b73093da
2c41f64557056e69541acf5ba52313869122f625
336371f4200af680f73c0b9c51fca5a25dd5754a
35ab1d4924990bf98a8e2e1026f91b5c9052de8e
3fa6705ca1b056a66f25a689dff72af0893f5b86
40bfa92e86484c09f2f7668121a1c4047c17ae72
44aaef83b79f4e963c4fee56250bc053eae5ec64
4879bd193dd73681c977371c857217257f141c92
4cff2b02cb6c1f866499125c003af1032a81b480
5a28f787cc73cffa7b5786faf3298d43e00d12aa
61e8ba86725ec3f4e034c51950cabc6254c5cca5
6325c42719b1aa3a48dd39b8add200054d3e0118
669ce00937bde782a88526205f083861e6d71be1
6e420a6c7b8e2d144df66dcbbae1afba62c82f4b
7429fdf9151dfa9e4d4dc8ef86528313d13dc73f
7690c273c8164a65602ed8f4284f0d50966d27c6
863edff3c71e89349674df35ab07f27ecb6702ef
880c343e75e7e8731f185ce756357599c37be065
8b46ce2ffa24a377ff30ea094e02bc3ba3e808da
8f3dc8437563182e06699763581fd6f7923b7582
9edd3d920fbe89240d52cc8b300a90e5bf576f73
b031d4c3747b58d930f33fe73abbf518dac63a31
be82474f54f49249c43c701c12907ec730e2a723
c5351846988ef5d6e7b95f564416138f59e2092a
c84aeb8c0b3939fd7f6beb9d73e72cc5ed8745db
c998384c7b8cfd2ca881f282dfdbc104d8402bac
ca2999c9c5a17b0253579194f651b4aafdce16f1
cb243b61a8d43816e1de7f0767b1377d0276dd71
cf30cc1e653043df81aa9d8974f2f927ceadc826
d187d81f4d021839e8f6e925dc192e231eb4679c
d635103117daaf2a2b93d465e32e7b722dd4d367
d6c9a556f5770f0a8f8ad05c5d46becd0cd021d3
d94eb94bb3c2c6c0c70916f8be2417ac616e8b43
dc327f3afbb6c770656be16fc885e1090f8395a3
ddba71aae3b8139210f71e835e1b89e90b0bd1dc
e0868fdb2f09d3a4aefe4c79d6af88c2f9b55ce2
e2052995d368355e899a518dbbbab716045abbd1
e9a5b40d0ba5a8bb5c4a1c5471616c93e0851558
ea4f7dda5a64a740a9c5570870ccba2788c69ea6
ee144154139619b8c1d890e5b6f9bf130d929e6f
eeafbbfaaf05d8b7a8a1dc3f7858a21e7fdb0531
f31855a1d5509b1e906caee75db3326515488cbc
fcd90af249796fc3c40e1e94d558b6f2d61304b5

MITRE ATT&CK
T1542.003 – Pre-OS Boot: Bootkit
T1047 – Windows Management Instrumentation
T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1564.003 – Hide Artifacts: Hidden Window
T1112 – Modify Registry
T1490 – Inhibit System Recovery
T1486 – Data Encrypted for Impact
T1491.001 – Defacement: Internal Defacement
T1083 – File and Directory Discovery
T1005 – Data from Local System
T0809 – Data Destruction

Businesses have thrived in the era of more – more tools, more access, and more connections. When it comes to the digital landscape though, the notion of having more doesn’t come without risk. While businesses have continued to grow and scale, cyber attacks have done the same and quickly so.

This post discusses some of the most dangerous endpoint, identity, and cloud-based cyber attacks from the first three quarters of this year. Understanding their causes and impacts is the first step businesses can take to strengthen their defenses against similar attacks in the future.

Endpoint-Based Attacks

Endpoint attacks have evolved in the last two decades from computer viruses to sophisticated ransomware campaigns targeting high-profile organizations. The challenge today is that protecting endpoints isn’t what it used to be. Threat actors are professionalizing, turning ransomware activities into full-scale service models. The rise of Ransomware-as-a-Service (RaaS) means that even low-level cybercriminals can now access and become profitable off of complex malware tools.

In the first three quarters of this year alone, ransomware has targeted multiple critical infrastructure organizations, including those listed below:

• Bernalillo County (Ransomware attack) – In January 2022, New Mexico’s most heavily populated county, experienced a ransomware attack which took out many of its government systems and services. The attack forced officials to keep most county buildings closed to the public.
• Denso (Pandora Ransomware) – In February, Denso, a Fortune 500 company supplying automotive parts for Toyota, Honda, Mercedes-Benz, Volvo, Fiat, General Motors, and Ford, detected unauthorized, third-party access to its network. The attack was later claimed by ransomware gang Pandora, who then threatened to leak 1.4 terabytes of the company’s trade secrets and transactional records.
• Bridgestone (LockBit Ransomware) – In March, Bridgestone was hit with a cyber attack that forced operators to shut down affected computer networks and production across its North American factories. The LockBit ransomware group later took responsibility for this attack.
• Costa Rican Government (Conti) – In April, a ransomware attack on the Costa Rican government led to the first national emergency declared in response to a cyber attack. The impact of the ransomware attack affected government services, the country’s ministry of finance, as well as the import and export sectors. Later claimed by Conti ransomware group, the government was asked to pay $20 million dollars. Shortly after, Conti group hit the Costa Rican government a second time, this time using HIVE ransomware to cause widespread disruption of the country’s public health services systems.
• Spice Jet (Ransomware attack) – India’s second largest airline, SpiceJet, faced a ransomware attack in May, leading to a cascading delay of flights which stranded many passengers at both airports and within aircrafts. Many passengers aired their frustrations regarding the delay and lack of communications over social media.
• Entrust (LockBit 3.0) – In June, Digital security firm, Entrust, confirmed that its networks were breached by a ransomware gang who successfully stole data from their internal systems. Entrust’s services include identity management, comms encryption, and secure digital payments making news of their ransomware attack an immediate concern for organizations using their software for authentication. Subsequently, Entrust was found to be added to the LockBit 3.0 Tor-based website.
• Knauf (Black Basta) – In July, Black Basta ransomware gang claimed responsibility for their cyber attack on Knauf, the multinational building and construction materials giant. Knauf’s global team was forced to shut down all of their IT systems to isolate the attack, which disrupted business operations and delivery processes. Post-attack, Black Basta published 20% of the exfiltrated files, congruent to their notoriety for double-extorting their high-profile victims.

In addition, in the 3rd quarter of 2022, CISA and the FBI warned of a number of ongoing, widespread ransomware campaigns currently attacking unnamed businesses and organizations.

• Zeppelin Ransomware Campaign – In August, the FBI and CIS released a joint cybersecurity advisory to share known indicators of compromise, as well as tactics, techniques, and procedures of Zeppelin malware, functioning as a RaaS. This malware has been used against defense contractors, educational institutions, manufacturers, technology companies, and especially organizations in the healthcare and medical industries.
• Vice Society Campaign – In September, the FBI, CISA, and Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint cybersecurity advisory warning against a disproportionate increase of ransomware attacks on the education sector by Vice Society in tandem with the start of the 2022-2023 academic year for American schools.

Identity-Based Attacks

Ransomware, data breaches, and supply chain attacks saturate global news headlines, but another rising threat has gained traction in 2022. Identity-based attacks are now a threat businesses keep at the forefront of their threat awareness efforts. With remote workforces, widespread adoption of IoT, and the huge numbers of digital identities being created even for a single organization, the attack surface continues to widen, leaving businesses vulnerable to identity-based exploitation by opportunistic threat actors.

Attacks on Active Directory – Cisco

Too often, threat actors weaponize legitimate tools and solutions that their targets use. Active Directory (AD) works by storing information about objects on a network in a logic hierarchy to make information easy to find for administrators and users. As seen in several identity-based attacks over the last few quarters, threat actors leverage Active Directory (AD) infrastructure in their ransomware campaigns and extortion efforts especially when there is a lack of identity protection. Consider the following examples where ransomware gangs targeted AD as part of their tactics.

In late 2021, researchers reported on a recent BazarLoader infection and how it led to the use of Cobalt Strike, and finally Conti ransomware to perform network reconnaissance. Just three minutes after the initial compromise, the threat actor used ADFind, a command line tool, to enumerate an AD environment on the infected host. By compromising AD, the actors were able to discover users, computers, file shares, and more from the environment. Typically, a threat actor’s next step is to gain access to the domain controller and other network servers, moving laterally into the system.

The Cisco breach that occurred in May 2022 leveraged legitimate employee credentials synced in an employee’s browser and a combination of vishing (voice phishing) attacks and MFA fatigue techniques to achieve VPN access to the targeted network. Once in, the threat actor exfiltrated the contents of a Box folder and the employee’s authentication data from Active Directory.

Abuse of AD serves threat actors well as it is designed to provide convenient access into a network. Compromising AD means threat actors can move deep into the network, escalating their access rights and encrypting andexfiltrating data on the way. With AD being the crown jewels of a business, attackers have zeroed in on targeting identity and access management gaps to reach what it is they want.

Attacks on Identity Management Platforms – Okta and Lapsus$

In March of this year, Lapsus$ digital extortion gang published what looked like substantial amounts of source code from Microsoft’s Bing and Cortana products. Though a potential Microsoft breach was serious enough, Lapsus$ also posted screenshots of their control over an Okta super admin account. Okta is a popular identity management platform used by thousands of large-scale organizations allowing users to access multiple services and apps through a single login interface.

Lapsus$’s control of an Okta super admin account is dire indeed as businesses increasingly rely on identity management software to streamline login experiences for their employees, partners, and customers. Businesses are falling victim to more account takeovers that directly stem from compromised identity management vendors, giving threat actors system privileges such as resetting account passwords, changing account email addresses, and access to sensitive data.

As ransomware and other malicious actors target on-premises Active Directory and cloud-hosted Azure AD for initial access and lateral movement, Identity protection has become a must for organizations.

Cloud-Based Attacks

The accelerated move from on-prem to hybrid and cloud environments has introduced a pressing need for businesses to keep their cloud workloads safe from threat actors. Cloud servers allow businesses to scale with ease, boosting efficiency, but also requires unique considerations such as securing serverless workloads and Kubernetes, virtual machines, and containers.

Amazon Web Services (AWS)

A subsidiary of Amazon, AWS is a comprehensive cloud computing platform providing a variety of on-demand services such as data storage, content delivery, networking, and more. One of its main services is Amazon Simple Storage Service (S3) – an object storage service built to house and retrieve any amount of data for its users. Objects (files) are then stored in S3 buckets which serve as containers for any amount of data belonging to an account.

While AWS S3 buckets are highly popular, they have become a prime target for threat actors as they are accessible to the public and are often misconfigured. Once an S3 bucket is compromised, it provides the threat actor with access to incredible amounts of data of which they could exfiltrate, use for ransom, sell on darknet marketplaces, or all of the above.

In the recent Civicom data leak, the misconfiguration of an S3 bucket resulted in a massive data leak, compromising over 100,000 files. In this case, the bucket was left open without password or security verification. The online video conferencing firm reported that 8 terabytes of stolen data included the video and audio files of customers’ meetings, recordings, and transcripts. As the firm’s main customer base included B2B companies, much of the data may have contained private company secrets or intellectual property. Further, the leak also revealed personally identifiable information (PII) of many of Civicom’s own employees.

The July breach of Pegasus Airlines showcases yet another example of unprotected S3 buckets leading to data loss. In this attack, the airline reported 6.5 terabytes of data was compromised with over 23 million files publicly exposed. Files in the unprotected bucket were linked to proprietary software developed by the company for use in aircraft navigation and in-flight processes such as take off and landing, refueling, and safety procedures. Pegasus Airlines also confirmed that sensitive information such as the PII of flight crews, source code, secret keys, and even plain-text passwords were also exposed. At least two other affiliated airlines using the same proprietary software may also be compromised in relation to this breach, exponentially increasing the number of total persons affected.

Kubernetes Vulnerabilities

Kubernetes is an open-source system that automates the deployment, scaling, and management of applications running in containers. It uses a cluster architecture composed of many control plans and one of more virtual or physical machines called worker nodes. The worker nodes are what host “Pods” – components of the application workload. The control plane exists to establish policy which manages the worker nodes and Pods in the cluster. Since the control plan is responsible for running across multiple endpoints to provide fault-tolerance and high availability, it is a valuable target for threat actors seeking to leverage its infrastructure for malicious purposes or to cause a denial of service attack.

As it is hosted in a cloud environment, Kubernetes is afflicted with the same main threat vectors that clouds are susceptible to:

• Supply Chain Risks – These kinds of risks can occur at the container level if a malicious container or third-party application provides threat actors with a foothold in the cluster. Actors could also gain a foothold into any of the worker nodes or part of the control plane was compromised.
• Malicious Threat Actors – Threat actors can exploit vulnerabilities and misconfigurations in components of the Kubernetes infrastructure allowing them to gain access from a remote location.
• Insider Threats – Administrators, users, or cloud service providers (CSPs) would all have access to physical systems or hypervisors managing Kubernetes nodes. This level of access could be used to compromise a Kubernetes environment.

How SentinelOne Measures Up to 2022 Cyber Attacks

2022 has, so far, been a complex year as businesses settle back into offices and hybrid workspaces but face the ramifications of geopolitical uncertainty, economic downturn, and cyber attacks that are climbing to new heights. Having more tools, access, and connections has no doubt benefited businesses, but it has also opened up a larger attack surface in which threat actors can operate.

While no business is immune from cyber attacks, examining the most dangerous attacks of the first three quarters of 2022 allows for better preparation for the following quarter and beyond. SentinelOne’s autonomous, AI-driven solutions can help deliver comprehensive security for those in search of endpoint, identity, and cloud protection.

In a single cybersecurity platform, Singularity XDR, fuses together the data, access, control, and integration planes of its endpoint protection (EPP), endpoint detection and response (EDR), IoT security, cloud workload protection (CWPP), and identity threat detection and response (ITDR). With Singularity, organizations gain access to back-end data across the organization through a single solution, providing a cohesive view of their network and assets by adding a real time autonomous security layer across all enterprise assets.

Request a demo of Singularity XDR to start leveraging AI-powered prevention, detection, response, and threat hunting across user endpoints, containers, cloud workloads, and IoT devices. Need expert advice? Contact us here.

SentinelOne has been named a Best Workplace in Technology on Fortune’s US Ranking for 2022. Over 150K employees working in the tech industry were surveyed on the quality and consistency of the employee experience on attributes including trust, respect, credibility, fairness, pride, and camaraderie.

We spoke to a few teammates to learn more about what makes our organization a top workplace. Tremendous pride in our leading-edge deep tech, transformative professional and personal opportunities and the equitable culture at SentinelOne were at the top of the list.

David Jung, Staff Software Engineer

David is building his career at SentinelOne and loving his fully-remote New York City lifestyle. He started at SentinelOne a little over three years ago as an intern while studying at the University of British Columbia.

“Working at SentinelOne while I was studying Computer Engineering was life-changing,” said David, who was also a Sentinel during the record-breaking IPO. “There was so much energy in the room the day we went public. There was an intense air of celebration, and then equally as intense – we were ready to get back to work!”

David has enjoyed significant career growth since starting at SentinelOne as an intern. He recently received his third promotion, going from Engineer, to Senior Engineer to now Staff Engineer.

“I have progressed very quickly by working on amazing tech with amazing people. They are all extremely smart, and at the same time, very humble. That’s a great combination.”

David works on the event database team, migrating customers into our systems and querying endpoint detection and response events. This includes developing new features, as well as making our system more scalable and efficient.

“Our goal is to ingest and query as much data as fast as we possibly can,” said David. “The amount that we are dealing with solves a lot of interesting engineering problems and that’s what I like about my job.

When David is not working, he enjoys biking, running and spending time with his dog Spitzer, a Beagle Terrier mix. He recently picked up a new hobby that allows him to express his creativity.

“I love writing code, but I can’t physically touch it,” said David. “I recently took a 12-week pottery class where I learned how to make bowls, vases and pots. It’s great to make something I can hold onto.”

David’s remote team stays connected on Zoom and Slack. His team recently had an offsite, where they were grateful to connect in person. He also enjoys spending time at the local WeWork.

“My place isn’t that big living in New York City,” said David. “It’s great having the perk to be able to enjoy really cool office space.”

Elena Militsyna, Senior Software Engineer

Writing code is Elena’s favorite part of her job. She’s been working at SentinelOne on the Cloud Security Team for just four months and is proud to be part of such a talented team.

“It’s so cool building something from scratch to help so many customers,” said Elena. “The tech itself is an amazing  instrument, but it’s our people who make it all work so well.”

Elena describes our deep technology as the best on the market.

“There’s not many companies that can offer the opportunity to work on state-of-the-art technology,” said Elena. “We are offering solutions that provide direct value to customers by keeping all of their data safe in one autonomous platform. And we just keep getting better!”

Elena said she is also grateful for the focus on wellness and career growth in our workplace culture. Prior to working here, she worked as Java developer for several companies, including a large corporation and a smaller machine learning startup, and had a chance to compare working environments of a different style. She believes SentinelOne is combining the advantages of a corporation with established processes and the innovative vibe and ability to change quickly of a startup.

“Here we have great work-life balance,” said Elena. “We have a very fast pace when we innovate. There can be stress at times, but it’s always balanced. Our team is growing, and the company is giving us the resources we need to grow ourselves and do our best work.”

Elena works in the newly-opened Prague Office in the Czech Republic in Missouri Park with a view of Prague Castle. Built with sustainability in mind, the location has Leed Platinum Status, the highest level of certification for green buildings.

“We love going into the office, it’s so fun to work there,” said Elena. “People go in when they can, they want to be together.”

Elena immigrated to the Czech Republic four years ago, from a small town in Russia. She studied complex protection of information systems at Orenburg State University.

“My father encouraged me to study technical things,” Elena said. “Even before I started working in cybersecurity, I studied it for five years. It’s fascinating to me.”

Noa Frankel, Senior Product Manager

Noa is part of a cross-functional global team working on the Singularity XDR Platform, providing customers with a limitless data platform to ingest, retain, correlate, search and action all enterprise security data – real time and historical, from any source.

Noa has been at SentinelOne for two years and has recently relocated to London. Her teammates are located in the US, Israel and Czech Republic.

“Working with people all across the globe provides diverse perspectives,” said Noa. “That diversity allows us to better serve our customers – and each other.”

Noa describes the Sentinel team culture as one of relentless innovation.

“Working with people who are excited about our product is the foundation of our culture,” said Noa. “We are working on a vision and executing as a team. The commitment to innovation is something I feel on a daily basis.”

Noa works in product management in partnership with development, marketing and sales to create product roadmaps and execute our mission.

“Data is the key in the world of XDR,” said Noa. “It is difficult for organizations to make sense of such massive amounts of data and this is what we are here to solve. I am proud to collaborate with other leaders in our space to create a vendor-agnostic taxonomy to help all security teams realize better, faster data ingestion and analysis.”

Noa is also excited about our approach to customers as the first priority of the business.

“I don’t look at our customers as customers, I look at them as people,” said Noa. “I strive to understand their pain points to deliver what answers their needs and deliver on their requests.”

Prior to joining SentinelOne, Noa worked with two other security companies and for the Israel Defense Forces in the Joint Cyber Command. She is grateful for the transparency and equity she feels in her day-to-day interactions at all levels of the organization.

“The people at SentineOne are the best in the business,” said Noa. “It doesn’t matter what your level is at SentinelOne, you are always encouraged to suggest new things. All input is welcomed and encouraged.”

Is SentinelOne a Good Place to Work?

In addition to this Fortune ranking, SentinelOne has received a number of other recent accolades highlighting our best-in-class culture, including:

• INC. Best Workplaces 2022
• Fortune Best Workplaces in the Bay Area 2022
• Fortune Best Workplaces for Millennials 2022
• Best Workplaces in the Netherlands 2022
• Best Workplaces in the UK 2022
• Best Workplaces for Wellbeing in the UK 2022
• The Bay Area’s Best Places To Work 2022
• Comparably Best Company Outlook 2022
• Comparably Best Company For Global Culture 2022
• Comparably Best Company in the Bay Area 2022
• Comparably Best Company for Career Growth 2022
• Comparably Best CEOs for Women 2022
• Comparably Best CEOs for Diversity 2022
• Comparably Best Sales Team 2022
• Comparably Best Engineering Team 2022

To learn more about our award-winning culture and job opportunities, visit our careers page.