Simpplr raises $32M for its intranet platform

Simpplr, a modern platform for building intranet sites (or “employee communications and enablement platforms,” as the company calls it), today announced that it has raised a $32 million Series C round led by Tola Capital. Norwest Ventures, which led the company’s Series B round last year, as well as Salesforce Ventures and George Still Ventures also participated. This brings Simpplr’s total funding to just over $61 million.

As Simpplr CEO and founder Dhiraj Sharma told me, the Series B round was meant to help the team accelerate product innovation and development. Unsurprisingly, the COVID-19 pandemic only increased demand for digital workplace solutions like Simpplr. As Sharma noted, the company’s thesis was always that the world was moving toward remote/hybrid work. The pandemic only accelerated this process and with that, the sense of urgency in its customer base to modernize their own platforms for communicating with their employees. To keep up with this growth, the company doubled its team since last August (though Sharma, just like many other startup founders I’ve recently talked to, also bemoaned that it’s becoming increasingly hard to find talent).

The company says that it added 100 enterprise customers over the course of the last year. Today, its customer base includes a number of early adopters like Splunk or Nutanix, which were always building toward a global workforce and always had a need for a product like Simpplr. But due to the pandemic, more traditional businesses like Fox, AAA insurance or Renewal by Andersen also needed to quickly find ways to support their newly remote workforces.

“When this pandemic happened, there were lots of traditional companies who didn’t think that they would be doing remote work as much in the near future as they had to,” Sharma said. “For them, things changed and then what they realized is that they did not have effective means of formal employee communication and also lacked the digital employee experience — and they realized that very quickly.”

Simpplr is obviously not the only intranet solution on the market, but Sharma argues that the service isn’t just recognized by analyst firms like Gartner and Forrester, but also highly reviewed by its customers, in large part thanks to its focus on user experience. “UX is our number one strength and differentiator. We have been pushing the boundaries of intranet for the last five years,” he said and cited features like the company’s auto-governance engine, which he likened to a “Roomba for your intranet.”

Image Credits: Simpplr

Analytics, too, is another area where Simpplr is trying to differentiate itself. “Our company’s mission is to help companies build a better workplace — and unless we can show the areas of improvement and provide insights like how to do something better, we just become a dumb tool,” he said. “For us, what is very important is not only that you are communicating but helping our customers to understand what’s working and what’s not working. What’s the impact of the communication and how are your employees feeling about it?”

Looking ahead, the company is working on building more AI into its tools — including its analytics — to help companies better communicate with their employees and understand the impact of those messages.

As for the new funding round, Sharma noted that he bootstrapped his previous two companies, which has made him take a somewhat conservative approach to fundraising. “When I used to hear that your investors or VCs expect growth at all costs, I just could never understand that,” he said. “So while building this company, even though this is a venture-funded company, I still wanted to make sure that I use the finances responsibly and I build a business in a sustainable manner. I wanted to make sure that if we raised a large investment, we have a proper use for that investment and that this investment will bring the right results.”

Tola Capital principal Eddie Kang will now join Simpplr’s board. “The future of work is hybrid and Simpplr is essential to a company’s ability to engage with employees,” he said. “As enterprise software investors, what excites us about Simpplr’s platform is that it allows leadership teams to streamline communications across channels and provides a turnkey platform that drives value to customers very quickly. Our partnership with Simpplr will accelerate its roadmap to meet the needs of global business leaders and communications teams.”

You can see fires, but now Qwake wants firefighters to see through them

When it comes to tough environments to build new technology, firefighting has to be among the most difficult. Smoke and heat can quickly damage hardware, and interference from fires will disrupt most forms of wireless communications, rendering software all but useless. From a technology perspective, not all that much has really changed today when it comes to how people respond to blazes.

Qwake Technologies, a startup based in San Francisco, is looking to upgrade the firefighting game with a hardware augmented reality headset named C-THRU. Worn by responders, the device scans surrounding and uploads key environmental data to the cloud, allowing all responders and incident commanders to have one common operating picture of their situation. The goal is to improve situational awareness and increase the effectiveness of firefighters, all while minimizing potential injuries and casualties.

The company, which was founded in 2015, just raised about $5.5 million in financing this week. The company’s CEO, Sam Cossman, declined to name the lead investor, citing a confidentiality clause in the term sheet. He characterized the strategic investor as a publicly-traded company, and Qwake is the first startup investment this company has made.

(Normally, I’d ignore fundings without these sorts of details, but given that I am obsessed with DisasterTech these days, why the hell not).

Qwake has had success in recent months with netting large government contracts as it approaches a wider release of its product in late-2021. It secured a $1.4 million contract from the Department of Homeland Security last year, and also secured a partnership with the U.S. Air Force along with RSA in April. In addition, it raised a bit of angel funding and participated in Verizon’s 5G First Responder Lab as part of its inaugural cohort (reminder that TechCrunch is still owned by Verizon).

Cossman, who founded Qwake along with John Long, Mike Ralston, and Omer Haciomeroglu, has long been interested in fires, and specifically, volcanos. For years, he has been an expeditionary videographer and innovator who climbed calderas and attempted to bridge the gap between audiences, humanitarian response, and science.

“A lot of the work that I have done up until this point was focused on earth science and volcanoes,” he said. “A lot of projects were focused on predicting volcanic eruptions and looking at using sensor networks and different things of that nature to make people who live in those regions that are exposed to volcanic threats safer.”

During one project in Nicaragua, his team suddenly found itself lost amidst the smoke of an active volcano. There were “thick, dense superheated volcanic gases that prevented us from navigating correctly,” Cossman said. He wanted to find technology that might help them navigate in those conditions in the future, so he explored the products available to firefighters. “We figured, ‘Surely these men and women have figured out how do you see in austere environments, how do you make quick decisions, etc.’”

He was left disappointed, but also with a new vision: to build such technology himself. And thus, Qwake was born. “I was pissed off that the men and women who arguably need this stuff more than anybody — certainly more than a consumer — didn’t have anywhere to get it, and yet it was entirely possible,” he said. “But it was only being talked about in science fiction, so I’ve dedicated the last six years or so to make this thing real.”

Building such a product required a diverse set of talent, including hardware engineering, neuroscience, firefighting, product design and more. “We started tinkering and building this prototype. And it very interestingly got the attention of the firefighting community,” Cossman said.

Qwake offers a helmet-based IoT product that firefighters wear to collect data from environments. Image Credits: Qwake Technologies

Qwake at the time didn’t know any firefighters, and as the founders did customer calls, they learned that sensors and cameras weren’t really what responders needed. Instead, they wanted more operational clarity: not just more data inputs, but systems that can take all that noise, synthesize it, and relay critical information to them about exactly what’s going on in an environment and what the next steps should be.

Ultimately, Qwake built a full solution, including both an IoT device that attaches to a firefighter’s helmet and also a tablet-based application that processes the sensor data coming in and attempts to synchronize information from all teams simultaneously. The cloud ties it all together.

So far, the company has design customers with the fire departments of Menlo Park, California and Boston. With the new funding, the team is looking to advance the state of its prototype and get it ready for wider distribution by readying it for scalable manufacturing as it approaches a more public launch later this year.

Remote raises $150M on a $1B+ valuation to manage payroll and more for organizations’ global workforces

For many of us, going to work these days no longer means going into a specific office like it used to; and today one of the startups that’s built a platform to help cater to that new, bigger world of employment — wherever talent might be — is announcing a major round of funding on the back of strong demand for its tools.

Remote, which provides tools to manage onboarding, payroll, benefits and other services for tech and other knowledge workers located in remote countries — be they contractors or full-time employees — has raised $150 million. Job van der Voort, the Dutch-based CEO and co-founder of New York-based Remote, confirmed in an interview that funding values Remote at over $1 billion.

Accel is leading this Series B, with participation also from previous investors Sequoia, Index Ventures, Two Sigma, General Catalyst and Day One Ventures.

The funding will be used in a couple of areas. First and foremost, it will go toward expanding its business to more markets. The startup has been built from the ground up in a fully integrated way, and in contrast to a number of others that it competes with in providing Employer of Record services, Remote fully owns all of its infrastructure. It now provides its HR services, as fully operational legal entities, for 50 countries (it has a target of growing that to 80 by the end of this year). The platform is also set to be enhanced with more tools around areas like benefits, equity incentive planning, visa and immigration support and employee relocation.

“We are doubling down on our approach,” van der Voort said. “We try to fully own the entire stack: entity, operations, experts in house, payroll, benefits and visa and immigration — all of the items that come up most often. We want to to build infrastructure products, foundational products because those have a higher level of quality and ultimately a lower price.”

In addition, Remote will be using the funding to continue building more tools and partnerships to integrate with other providers of services in what is a very fragmented human resources market. Two of these are being announced today to coincide with the funding news: Remote has launched a Global Employee API that HR platforms that focus on domestic payroll can integrate to provide their own international offering powered by Remote. HR platform Rippling (Parker Conrad’s latest act) is one of its first customers. And Remote is also getting cosier with other parts of the HR chain of services: applicant tracking system Greenhouse is now integrating with it to help with the onboarding process for new hires.

Indeed, $150 million at a $1 billion+ valuation is a very, very sizable Series B, even by today’s flush-market standards, but it comes after a bumper year for the company, and in particular since November last year when it raised a Series A of $35 million. In the last nine months, customer numbers have grown seven-fold, with users on the platform increasing 10 times. Most interestingly, perhaps, is that Remote’s revenues — its packages start at $149 per month but go up from there — have increased by a much bigger amount: 65x, the company said. That basically points to the fact that engagement from those users — how much they are leaning on Remote’s tech — has skyrocketed.

Although there are a lot of competitors in the same space as Remote — they include a number of more local players alongside a pretty big range of startups like Oyster (which announced $50 million in funding in June), Deel, which is now valued at $1.25 billionTuring; Papaya Global (now also valued at over $1 billion); and many more — the opportunity they are collectively tackling is a massive one that, if anything, appears to be growing.

Hiring internationally has always been a costly, time-consuming and organizationally challenged endeavor, so much so that many companies have opted not to do it at all, or to reserve it for very unique cases. That paradigm has drastically shifted in recent years, however.

Even before COVID-19 hit, there was a shortage of talent, resulting in a competitive struggle for good people, in companies’ home markets, which encouraged companies to look further afield when hiring. Then, once looking further afield, those employers had to give consideration to employing those people remotely — that is, letting them work from afar — because the process of relocating them had also become more expensive and harder to work through.

Then COVID-19 happened, and everyone, including people working in a company’s HQ, started to work remotely, changing the goalposts yet again on what is expected by workers, and what organizations are willing to consider when bringing on a new person, or managing someone it already knows, just from a much farther distance.

While a lot of that has played out in the idea of relocating to different cities in the same country — Miami and Austin getting a big wave of Silicon Valley “expats” being two examples of that — it seems just a short leap to consider that now that sourcing and managing is taking on a much more international slant. A lot of new hires, as well as existing employees who are possibly not from the U.S. to begin with, or simply want to see another part of the world, are now also a part of the mix. That is where companies like Remote are coming in and lowering the barriers to entry by making it as easy to hire and manage a person abroad as it is in your own city.

“Remote is at the center of a profound shift in the way that companies hire,” said Miles Clements, a partner at Accel, in a statement. “Their new Global Employee API opens up access to Remote’s robust global employment infrastructure and knowledge map, and will help any HR provider expand internationally at a speed impossible before. Remote’s future vision as a financial services provider will consolidate complicated processes into one trusted platform, and we’re excited to partner with the global leader in the quickly emerging category of remote work.”

And it’s interesting to see it now partnering with the likes of Rippling. It was a no-brainer that as the latter company matured and grew, it would have to consider how to handle the international component. Using an API from Remote is an example of how the model that has played out in communications (led by companies like Twilio and Sinch) and fintech (hello, Stripe) also has an analogue in HR, with Remote taking the charge on that.

And to be clear, for now Remote has no plans to build a product that it would sell directly to individuals.

“Individuals are reaching out to us, saying, ‘I found this job and can you help me and make sure I get paid?’ That’s been interesting,” van der Voort said. “We thought about [building a product for them] but we have so much to do with employers first.” One thing that’s heartening in Remote’s approach is that it wouldn’t want to provide this service unless it could completely follow through on it, which in the case of an individual would mean “vetting every major employer,” he said, which is too big a task for it right now.

In the meantime, Remote itself has walked the walk when it comes to remote working. Originally co-founded by two European transplants to San Francisco, the pair had firsthand experience of the paradoxical pains and opportunities of being in an organization that uses remote workforces.

Van der Voort had been the VP of product for GitLab, which he scaled from five to 450 employees working remotely (it’s now a customer of Remote’s); and before co-founding Remote, CTO Marcelo Lebre had been VP of engineering for Unbabel — another startup focused on reducing international barriers, this time between how companies and global customers communicate.

Today, not only is the CEO based out of Amsterdam in The Netherlands, with the CTO in Lisbon, Portugal, but New York-based Remote itself has grown to 220 from 50 employees, and this wider group has also been working remotely across 47 countries since November 2020.

“The world is looking very different today,” van der Voort said. “The biggest change for us has been the size of the organization. We’ve gone from 50 to more than 200 employees, and I haven’t met any of them! We have tried to follow our values of bringing opportunity everywhere so we hire everywhere as we solve that for our customers, too.”

Product-led sales startup Endgame raises over $17M

Endgame, enabling software companies to turn customer observations into go-to-market strategies, announced Tuesday it raised a total of $17 million in back-to-back seed and Series A funding rounds.

The $12.25 million Series A was led by Menlo Ventures, while the $5 million seed round was led by Upfront Ventures. Also participating in the round are a group of investors including Todd and Rahul’s Fund, Liquid 2 Ventures and Gainsight CEO Nick Mehta.

Los Angeles-based Endgame was founded in 2020 and provides a self-service look at what’s happening in a software trial so that a sales team can prioritize accounts based on user behavior signals and act on them faster without having to be a data scientist or engineer.

Company CEO Alex Bilmes told TechCrunch that the concepts of product-led sales and product-led growth have taken over the sale of software. Today’s customers sign up for a trial, and if they like it, they invite their friends to try it.

However, at a certain point, some sales pressure is needed to close the deal. That’s where Endgame comes in: It shows who is doing what, and what features are being used — data that is typically opaque to sales and revenue teams.

Traditional customer relationship management systems are designed to be rep-driven, meaning the sales rep is responsible for adding notes. It’s simpler if a rep only has a few accounts, but across tens of millions of users, Endgame analyzes the data and identifies which accounts are most likely to convert, who are the users to engage, what makes a good customer and how to take action with the right people.

Endgame is not competing against other companies so much as in-house developers that are cobbling a bunch of apps together in efforts to create a system that works for them, Bilmes said.

“Most of this is solved with do-it-yourself,” he added. “I have built Endgame a number of times at other companies using databases and other piece-meals to put together something so I could mash data from lots of places and build subscriptive views for revenue teams. We compete with those data scientists and internal teams stitching together horizontal tools.”

Endgame is pre-revenue and is already catering to a group of beta customers like Figma, Loom, Airtable, Clubhouse, Mode, Retool and Algolia that are looking for a dedicated software platform to capture product-led value.

Bilmes said the customer relationship management market, both huge and fast-growing at 35% annually, is expected to reach $114 billion by 2027. To meet demand, he intends to use the new funds to continue hiring aggressively. He has already tripled the size of the team to nine in the past few months, and expects to double that in the coming year. In addition, funds will go toward R&D and to further define the product-led sales landscape.

Growth over the next year will be customer-focused as Endgame works to get into the hands of the right customers and making it as accessible as possible for people to begin doing product-led motions.

“Our efforts are product-focused,” Bilmes said. “We’ve seen more demand than we can possibly hope to fill given the problem is so real for so many.”

As part of the investment, Upfront Ventures Partner Kara Nortman and Menlo Ventures Partner Naomi Ionita will join Endgame’s board of directors. Sandhya Hegde, partner at Unusual Ventures, which also participated in both rounds, joins as a board observer to create an all-women investor board.

When Endgame was raising its seed fund, it wanted to work with Nortman, who has expertise in applying consumer concepts to enterprise, Bilmes said. When it came to the Series A, Bilmes said he felt Ionita was the perfect partner due to her similar background to Bilmes and expertise in teaching salespeople how to engage.

Ionita told TechCrunch she learned about Endgame from Nortman, with whom she has invested in other startups. The company understands the pain point and is for companies that offer a self-service version for the “why and how.”

“This intelligence doesn’t exist, and I know that because I lived it — building in-house or seeing companies flying blind,” she added. “Alex just gets this, and I see Endgame being the system of record and intelligence for bridging self-serve. They will be the final bridge that needs to exist between product teams and product-facing sales reps for which accounts to address and why.”

 

Build a digital ops toolbox to streamline business processes with hyperautomation

Reliance on a single technology as a lifeline is a futile battle now. When simple automation no longer does the trick, delivering end-to-end automation needs a combination of complementary technologies that can give a facelift to business processes: the digital operations toolbox.

According to a McKinsey survey, enterprises that have likely been successful with digital transformation efforts adopted sophisticated technologies such as artificial intelligence, Internet of Things or machine learning. Enterprises can achieve hyperautomation with the digital ops toolbox, the hub for your digital operations.

The hyperautomation market is burgeoning: Analysts predict that by 2025, it will reach around $860 billion.

The toolbox is a synchronous medley of intelligent business process management (iBPM), robotic process automation (RPA), process mining, low code, artificial intelligence (AI), machine learning (ML) and a rules engine. The technologies can be optimally combined to achieve the organization’s key performance indicator (KPI) through hyperautomation.

The hyperautomation market is burgeoning: Analysts predict that by 2025, it will reach around $860 billion. Let’s see why.

The purpose of a digital ops toolbox

The toolbox, the treasure chest of technologies it is, helps with three crucial aspects: process automation, orchestration and intelligence.

Process automation: A hyperautomation mindset introduces the world of “automating anything that can be,” whether that’s a process or a task. If something can be handled by bots or other technologies, it should be.

Orchestration: Hyperautomation, per se, adds an orchestration layer to simple automation. Technologies like intelligent business process management orchestrate the entire process.

Intelligence: Machines can automate repetitive tasks, but they lack the decision-making capabilities of humans. And, to achieve a perfect harmony where machines are made to “think and act,” or attain cognitive skills, we need AI. Combining AI, ML and natural language processing algorithms with analytics propels simple automation to become more cognitive. Instead of just following if-then rules, the technologies help gather insights from the data. The decision-making capabilities enable bots to make decisions.

 

Simple automation versus hyperautomation

Here’s a story of evolving from simple automation to hyperautomation with an example: an order-to-cash process.

ZoomInfo drops $575M on Chorus.ai as AI shakes up the sales market

ZoomInfo announced this morning it intends to acquire conversational sales intelligence tool Chorus.ai for $575 million. Shares of ZoomInfo are unchanged in premarket trading following the news, per Yahoo Finance data.

Sales intelligence, Chorus’s market, is a hot space that uses AI to “listen” to sales conversations to help improve interactions between salespeople and customers. ZoomInfo is mostly known for providing information about customers, so the acquisition expands the acquiring company’s platform in a significant way.

The company sees an opportunity to bring together different parts of the sales process in a single platform by “combining ZoomInfo’s historic top-of-the-funnel strength with insights driven from the middle of the funnel in the customer conversations that Chorus captures,” it said in a release.

“With Chorus, the entire organization can make better decisions by surfacing insights and analytics that you would only get if you sat in on every sales or customer success call,” ZoomInfo CEO and founder Henry Schuck said in a blog post announcing the deal.

Ahead of the transaction, ZoomInfo was valued at just under $21 billion.

Chorus looks for what it calls “smart themes” in sales calls, which help managers steer sales teams toward the types of conversation and tone that is likely to drive more revenue. In fact, Chorus holds the largest patent portfolio related to conversational intelligence, according to the company.

Chorus was founded in 2015 and raised more than $100 million along the way, according to PitchBook data. The most recent round was a $45 million Series C last year.

Crunchbase News reports that at the time of its Series C round of funding, Chorus had “doubled its headcount to more than 100 employees and tripled its revenue over the past year.” That’s the sort of growth that venture capitalists covet, making the company’s 2020 funding round a nonsurprise.

Notably PitchBook data indicates that the company’s final private valuation was around the $150 million mark; if accurate, it would imply that the company’s last private round was expensive in dilution terms, and that its investors did well in the exit, quickly more than trebling the capital that was last invested, with investors who put capital in earlier doing even better.

But we’re slightly skeptical of the company’s available valuation history given the growth that it claimed at the time of its Series C; it feels low. If that’s the case, the company’s exit multiple would decrease, making its final sale price slightly less impressive.

Of course, a half-billion-dollar exit is always material, even if venture capitalists in today’s red-hot, and expensive, market are more interested in $1 billion exits and larger.

Chorus.ai will likely not be the final exit in the conversational intelligence space. Its rival Gong (often known by its URL, Gong.io) is one of the hotter startups in this space, having raised over $500 million. Its most recent raise was $250 million on a $7.25 billion valuation last month.

The implication of the Chrous.ai exit and Gong’s enormous private valuation is that the application of AI to audio data in a sales environment is incredibly useful, given the number of customers the two companies’ aggregate valuation implies.

Microsoft Patch Tuesday, July 2021 Edition

Microsoft today released updates to patch at least 116 security holes in its Windows operating systems and related software. At least four of the vulnerabilities addressed today are under active attack, according to Microsoft.

Thirteen of the security bugs quashed in this month’s release earned Microsoft’s most-dire “critical” rating, meaning they can be exploited by malware or miscreants to seize remote control over a vulnerable system without any help from users.

Another 103 of the security holes patched this month were flagged as “important,” which Microsoft assigns to vulnerabilities “whose exploitation could result in compromise of the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources.”

Among the critical bugs is of course the official fix for the PrintNightmare print spooler flaw in most versions of Windows (CVE-2021-34527) that prompted Microsoft to rush out a patch for a week ago in response to exploit code for the flaw that got accidentally published online. That patch seems to have caused a number of problems for Windows users. Here’s hoping the updated fix resolves some of those issues for readers who’ve been holding out.

CVE-2021-34448 is a critical remote code execution vulnerability in the scripting engine built into every supported version of Windows — including server versions. Microsoft says this flaw is being exploited in the wild.

Both CVE-2021-33771 and CVE-2021-31979 are elevation of privilege flaws in the Windows kernel. Both are seeing active exploitation, according to Microsoft.

Chad McNaughton, technical community manager at Automox, called attention to CVE-2021-34458, a remote code execution flaw in the deepest areas of the operating system. McNaughton said this vulnerability is likely to be exploited because it is a “low-complexity vulnerability requiring low privileges and no user interaction.”

Another concerning critical vulnerability in the July batch is CVE-2021-34494, a dangerous bug in the Windows DNS Server that earned a CVSS score (severity) of 9.8 out of a possible 10.

“Both core and full installations are affected back to Windows Server 2008, including versions 2004 and 20H2,” said Aleks Haugom, also with Automox.

“DNS is used to translate IP addresses to more human-friendly names, so you don’t have to remember the jumble of numbers that represents your favorite social media site,” Haugom said. “In a Windows Domain environment, Windows DNS Server is critical to business operations and often installed on the domain controller. This vulnerability could be particularly dangerous if not patched promptly.”

Microsoft also patched six vulnerabilities in Exchange Server, an email product that has been under siege all year from attackers. Satnam Narang, staff research engineer at Tenable, noted that while Microsoft says two of the Exchange bugs tackled this month (CVE-2021-34473 and CVE-2021-34523) were addressed as part of its security updates from April 2021, both CVEs were somehow omitted from that April release. Translation: If you already applied the bevy of Exchange updates Microsoft made available in April, your Exchange systems have protection against these flaws.

Other products that got patches today include Microsoft Office, Bing, SharePoint Server, Internet Explorer, and Visual Studio. The SANS Internet Storm Center as always has a nice visual breakdown of all the patches by severity.

Adobe also issued security updates today for Adobe Acrobat and Reader, as well as Dimension, Illustrator, Framemaker and Adobe Bridge.

Chrome and Firefox also recently have shipped important security updates, so if you haven’t done so recently take a moment to save your tabs/work, completely close out and restart the browser, which should apply any pending updates.

The usual disclaimer:

Before you update with this month’s patch batch, please make sure you have backed up your system and/or important files. It’s not uncommon for Windows updates to hose one’s system or prevent it from booting properly, and some updates even have been known to erase or corrupt files.

So do yourself a favor and backup before installing any patches. Windows 10 even has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.

And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see this guide.

As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips. Also, check out AskWoody, which keeps a close eye out for specific patches that may be causing problems for users.

How to Defeat Adversaries With Real-Time Cyber Threat Intelligence

To respond effectively to an incident, it is essential to understand the big picture: how, when, and why an incident occurred. This is critical because the moment you begin containing a threat, it may set off alarm bells for adversaries, triggering them to accelerate an attack or stealthily change techniques. Responding to a threat without understanding the big picture can lead to an infinite loop where we contain a threat only to wait for the adversary to leverage the same attack methodology again. This is the reason why at least in theory, SOC analysts spend time analyzing how, when, and why an incident occurs.

Unfortunately, in reality, SOC analysts don’t often have the time required to perform these types of in-depth analyses because their incident queues are full, and metrics like average time for mean time to detect (MTTD) or mean time to respond (MTTR), continues to increase. So the question becomes how can an organization acquire the intelligence they need without adding even more work to an already overloaded team?

Enriched Intelligence Through Singularity Signal

Earlier this month, we announced Singularity Signal, our cyber threat intelligence (CTI) platform, and shortly after we announced the general availability of threat intelligence reports for all Singularity Complete customers. Today, we are excited to announce enhancements in how we provide real-time enriched intelligence through Singularity Signal.

Singularity Signal combines artificial- and human-based intelligence to provide context, enrichment, and actionability to cyber data, empowering organizations to stay a step ahead with unparalleled insight into the attacker mindset. The platform performs tactic, technique, and procedure (TTP) analysis and correlation of all incoming threats at scale and in real time through the Singularity Signal AI Engine.

By leveraging the Singularity Signal AI Engine, security professionals can offload much of the previously labor-intensive work that they didn’t have time to get to before. That translates to instant, enriched intelligence for your organization to help you navigate through even the most sophisticated attacks. Singularity Signal is your dedicated AI-based threat researcher who knows your environment and aids your SOC analysts to respond to threats more effectively.

See Enriched Intelligence in Action

From the SentinelOne Singularity Platform console, navigate to the incident that you want to investigate. At a glance, you will gain information on when the threat was first seen, when it was last seen, and the scope of the breach. Additionally, in the Threat Indicators section, you can access real-time TTP analysis and correlation performed by the Singularity Signal AI Engine. At your fingertips, you immediately gain vital insights on each TTP mapped towards the MITRE ATT&CK framework.

In the example above, you are looking at an incident within the SentinelOne management console. Here you can quickly identify that this is a detection of a ransomware campaign, and by leveraging the Singularity Signal AI Engine you are able to get enriched intelligence on what, how, and when the incident occurred as well as insights on how each step of the adversary maps to the tactics, techniques, and procedures (TTP)’s of the MITRE ATT&CK framework.

Sometimes, you may be in a situation where you need additional information—that’s when proactive or reactive threat hunting is critical. Historically, in order to succeed, SOC analysts needed to first familiarize themselves with an often very complex threat hunting platform, the respective data schema of their telemetry sources, then how to build threat hunting queries for Indicator of Compromise (IOC), Indicator of Attack (IOA), or specific adversary lookup. SentinelOne’s Deep Visibility capability pairs direct access to all the structured data of an organization with an easy-to-learn query language, making it a powerful tool for threat hunters.

In the example above, we are in the Deep Visibility feature within the SentinelOne management console. With just one line, we can look up all the endpoints on who might have a particular file based on an hash value.

Next, save time building threat hunting queries by simply leveraging SentinelOne Hunter to instantly look up threat hunting queries for specific adversaries, TTPs, and other types of IOC and IOAs.

By simply using the search function in Hunter, you are quickly able to find relevant threat hunting queries. In this example, I looked for all the threat hunting queries related to the adversary group named Hafnium. I can again take this query and run it instantly in Deep Visibility within the SentinelOne management console with one click.

Summary

The cyber threat landscape continues to evolve rapidly. As a result, in many organizations, the time to detect and contain a threat continues to increase. Most security teams today are too overloaded with long incident queues to perform in-depth, meaningful analysis as part of their incident investigation. Singularity Signal leverages the Signal AI Engine to perform real-time threat modeling, incident correlation, and TTP analysis at scale, delivering enriched intelligence that you can use to respond more effectively to threats.

To explore more ways Singularity Signal is helping enterprises around the world take a new approach to threat intelligence, read more here.


Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Quantexa raises $153M to build out AI-based big data tools to track risk and run investigations

As financial crime has become significantly more sophisticated, so too have the tools that are used to combat it. Now, Quantexa — one of the more interesting startups that has been building AI-based solutions to help detect and stop money laundering, fraud, and other illicit activity — has raised a growth round of $153 million, both to continue expanding that business in financial services and to bring its tools into a wider context, so to speak: linking up the dots around all customer and other data.

“We’ve diversified outside of financial services and working with government, healthcare, telcos and insurance,” Vishal Marria, its founder and CEO, said in an interview. “That has been substantial. Given the whole journey that the market’s gone through in contextual decision intelligence as part of bigger digital transformation, was inevitable.”

The Series D values the London-based startup between $800 million and $900 million on the heels of Quantexa growing its subscriptions revenues 108% in the last year.

Warburg Pincus led the round, with existing backers Dawn Capital, AlbionVC, Evolution Equity Partners (a specialist cybersecurity VC), HSBC, ABN AMRO Ventures and British Patient Capital also participating. The valuation is a significant hike up for Quantexa, which was valued between $200 million and $300 million in its Series C last July. It has now raised over $240 million to date.

Quantexa got its start out of a gap in the market that Marria identified when he was working as a director at Ernst & Young tasked with helping its clients with money laundering and other fraudulent activity. As he saw it, there were no truly useful systems in the market that efficiently tapped the world of data available to companies — matching up and parsing both their internal information as well as external, publicly available data — to get more meaningful insights into potential fraud, money laundering and other illegal activities quickly and accurately.

Quantexa’s machine learning system approaches that challenge as a classic big data problem — too much data for a humans to parse on their own, but small work for AI algorithms processing huge amounts of that data for specific ends.

Its so-called “Contextual Decision Intelligence” models (the name Quantexa is meant to evoke “quantum” and “context”) were built initially specifically to address this for financial services, with AI tools for assessing risk and compliance and identifying financial criminal activity, leveraging relationships that Quantexa has with partners like Accenture, Deloitte, Microsoft and Google to help fill in more data gaps.

The company says its software — and this, not the data, is what is sold to companies to use over their own datasets — has handled up to 60 billion records in a single engagement. It then presents insights in the form of easily digestible graphs and other formats so that users can better understand the relationships between different entities and so on.

Today, financial services companies still make up about 60% of the company’s business, Marria said, with 7 of the top 10 UK and Australian banks and 6 of the top 14 financial institutions in North America among its customers. (The list includes its strategic backer HSBC, as well as Standard Chartered Bank and Danske Bank.)

But alongside those — spurred by a huge shift in the market to relying significantly more on wider data sets, to businesses updating their systems in recent years, and the fact that, in the last year, online activity has in many cases become the “only” activity — Quantexa has expanded more significantly into other sectors.

“The Financial crisis [of 2007] was a tipping point in terms of how financial services companies became more proactive, and I’d say that the pandemic has been a turning point around other sectors like healthcare in how to become more proactive,” Marria said. “To do that you need more data and insights.”

So in the last year in particular, Quantexa has expanded to include other verticals facing financial crime, such as healthcare, insurance, government (for example in tax compliance), and telecoms/communications, but in addition to that, it has continued to diversify what it does to cover more use cases, such as building more complete customer profiles that can be used for KYC (know your customer) compliance or to serve them with more tailored products. Working with government, it’s also seeing its software getting applied to other areas of illicit activity, such as tracking and identifying human trafficking.

In all, Quantexa has “thousands” of customers in 70 markets. Quantexa cites figures from IDC that estimate the market for such services — both financial crime and more general KYC services — is worth about $114 billion annually, so there is still a lot more to play for.

“Quantexa’s proprietary technology enables clients to create single views of individuals and entities, visualized through graph network analytics and scaled with the most advanced AI technology,” said Adarsh Sarma, MD and co-head of Europe at Warburg Pincus, in a statement. “This capability has already revolutionized the way KYC, AML and fraud processes are run by some of the world’s largest financial institutions and governments, addressing a significant gap in an increasingly important part of the industry. The company’s impressive growth to date is a reflection of its invaluable value proposition in a massive total available market, as well as its continued expansion across new sectors and geographies.”

Interestingly, Marria admitted to me that the company has been approached by big tech companies and others that work with them as an acquisition target — no real surprises there — but longer term, he would like Quantexa to consider how it continues to grow on its own, with an independent future very much in his distant sights.

“Sure, an acquisition to the likes of a big tech company absolutely could happen, but I am gearing this up for an IPO,” he said.

The Good, the Bad and the Ugly in Cybersecurity – Week 28

The Good

This week sees another victory for law enforcement in the fight against cybercrime. An approximately two-year long investigation dubbed ‘Operation Lyrebird’ has culminated in the capture of an individual with a long trail of fraud and cybercrime offenses. The suspect was taken into custody by the Moroccan police according to INTERPOL. The individual, who goes by the hacker alias “Dr HeX”, is tied to a number of activities including credit card fraud, website intrusions, phishing attacks and more. He is also known as the creator of a multi-script tool called ‘ZombiBot’, which exists in various versions.

“Dr HeX” has been active, in current capacity, since at least 2009, but more recently was known for phishing kits. These ‘kits’ are sold to low-level actors for very little money. They serve to simplify and automate as much of the phishing attack process as possible. Typical phishing kits include templates for masquerading as various well-known websites such as bank login pages, shopping login pages, and company portals) along with the requisite scripts and config files to properly trick and redirect victims. These items are often sold in open forums, Telegram channels and the like.

During the course of their investigation, investigators were able to follow a rather direct trail of OSINT clues to identify “Dr HeX”. Once they tied the ‘Dr HeX’ moniker to a valid email address, they were quickly able to identify the individual and confirm his ties to multiple additional phishing and fraud campaigns. Hats off to the Morroccan Police, INTERPOL, and Group-IB on the successful operation.

The Bad

It did not take cybercriminals long to begin using the Kaseya attack as a social engineering lure. Within two days of the incident, spam campaigns were observed which lure victims into installing Cobalt Strike payloads masquerading as security updates from Kaseya. From that point, anything is possible with regards to data theft or additional code execution.

The scope of this attack is quite large, as is the accompanying flurry of information for, about, and around it. The attackers are very much preying on the ‘state of confusion’ (or shock for some). At the end of the day, we can always expect the adversary to capitalize on anything at all times.

Also this week, our researchers discovered a potential new RaaS-in-the-making in the form of something calling itself “EP918” Ransomware service. The actor(s) behind this early-stage setup claim to be offering a “powerful FUD ransomware” for between $300 and $500. At the lower tier, the ransomware is available as a “script to be embedded in a website”. The upper tier offers buyers a unique ransomware payload embedded in a malicious PDF file. It is then up to the buyer to distribute the malware as they see fit. Both Bitcoin (BTC) and Monero (XMR) payments are supported. While many of these underground Ransomware-as-a-Service offerings ironically turn out to be scams aimed at (would-be) criminals, others are genuine ransomware services that are later seen in real-world attacks. SentinelLabs will be keeping its eye on this one.

The Ugly

If there is one event that dominated our landscape this week, it would have to be the wide-reaching attack against Kaseya VSA. Attackers leveraged a sly combination of LOLBins, Microsoft Defender and a zero-day exploit to distribute the REvil ransomware to thousands of endpoints. This was a well-staged attack, with very deliberate timing as well (holiday weekend in the United States). This attack became quite complex rather quickly, affecting both Kaseya and the connected customers they provide services to. There is a level of trust there that these attackers are taking direct advantage of.

It is believed that this is one of the largest mass-scale ransomware-deployments to date. REvil has yet to fully ‘comment’ apart from a very short update on their public “blog” in which they claim “more than a million systems were infected”. For a mere $70 million (later revised to $50 million) in Bitcoin, the gang offer “everyone will be able to recover from attack in less than an hour”.

Following the initial incident, Kaseya has been releasing frequent updates via both video and their blogs. At this stage most of the services for On-Premise customers are back online and SaaS services should not be far behind. That said, the issue is still unfolding and there will be much to learn in the coming weeks.

Incidents like this illustrate the need to have full visibility and understanding into your infrastructure, shared and otherwise. A good deal of security is built on a certain level of assumed “trust”. It is wise to not take that trust for granted and continually review your ties and connections to third party dependencies. Understand and analyse your ingress points from both the outside and from the perspective of connected vendors and partners. The action being taken on this issue has been ‘good’. But the ‘ugliness’ here lies in the knowledge that this will not be the last attack of this nature.


Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security