With buyout, Cloudera hunts for relevance in a changing market

When Cloudera announced its sale to a pair of private equity firms yesterday for $5.3 billion, along with a couple of acquisitions of its own, the company detailed a new path that could help it drive back toward relevance in the big data market.

When the company launched in 2008, Hadoop was in its early days. The open-source project developed at Yahoo three years earlier was built to deal with the large amounts of data that the internet pioneer generated. It became increasingly clear over time that every company would have to deal with growing data stores, and it seemed that Cloudera was in the right market at the right time.

And for a while things went well. Cloudera rode the Hadoop startup wave, garnering a cool billion in funding along the way, including a stunning $740 million check from Intel Capital in 2014. It then went public in 2018 to much fanfare.

But the markets had already started to shift by the time of its public debut. Hadoop, a highly labor-intensive way to manage data, was being supplanted by cheaper and less complex cloud-based solutions.

“The excitement around the original promise of the Hadoop market has contracted significantly. It’s incredibly expensive and complex to get it working effectively in an enterprise context,” Casey Aylward, an investor at Costanoa Ventures told TechCrunch.

The company likely saw that writing on the wall when it merged with another Hadoop-based company, Hortonworks, in 2019. That transaction valued the combined entity at $5.2 billion, almost the same amount it sold for yesterday, two years down the road. The decision to sell and go private may also have been spurred by Carl Icahn buying an 18% stake in the company that same year.

Looking to the future, Cloudera’s sale could provide the enterprise unicorn room as it regroups.

Patrick Moorhead, founder and principal analyst at Moor Insight & Strategies, sees the deal as a positive step for the company. “I think this is good news for Cloudera because it now has the capital and flexibility to dive head first into SaaS. The company invented the entire concept of a data life cycle, implemented initially on premises, then extended to private and public clouds,” Moorhead said.

Adam Ronthal, Gartner Research VP, agrees that it at least gives Cloudera more room to make necessary adjustments to its market strategy as long as it doesn’t get stifled by its private equity overlords. “It should give Cloudera an opportunity to focus on their future direction with increased flexibility — provided they are able to invest in that future and that this does not just focus on cost cutting and maximizing profits. Maintaining a culture of innovation will be key,” Ronthal said.

Which brings us to the two purchases Cloudera also announced as part of its news package.

If you want to change direction in a hurry, there are worse ways than via acquisitions. And grabbing Datacoral and Cazena should help Cloudera alter its course more quickly than it could have managed on its own.

“[The] two acquisitions will help Cloudera capture some of the value on top of the lake storage layer — perhaps moving into different data management features and/or expanding into the compute layer for analytics and AI/ML use cases, where there has been a lot of growth and excitement in recent years,” Aylward said.

Chandana Gopal, research director for the future of intelligence at IDC, agrees that the transactions give Cloudera some more modern options that could help speed up the data-wrangling process. “Both the acquisitions are geared towards making the management of cloud infrastructure easier for end-users. Our research shows that data prep and integration takes 70%-80% of an analyst’s time versus the time spent in actual analysis. It seems like both these companies’ products will provide technology to improve the data integration/preparation experience,” she said.

The company couldn’t stay on the path it was on forever, certainly not with an activist investor breathing down its neck. Its recent efforts could give it the time away from public markets it needs to regroup. How successful Cloudera’s turnaround proves to be will depend on whether the private equity companies buying it can both agree on the direction and strategy for the company, while providing the necessary resources to push the company in a new direction. All of that and more will determine if these moves pay off in the end.

The Soul of SentinelOne: Our Values

I am in awe and have immense gratitude for the dedication and commitment displayed by the SentinelOne team in navigating one of the most turbulent years in recent history. The relentlessness, the drive, and the integrity our team demonstrates each and every day inspire and lift us. As a younger company in the security space, I truly believe that at the core of our success are our values. They continue to serve as the north star for our culture that unites and propels us forward – and for that, I am thankful.

Hypergrowth and hiring are not easy at any stage of a company’s lifecycle; in fact, they are quite the opposite. Even in regular times, hypergrowth can bring on challenges that can derail an organization’s culture if one is not purposeful. Much less with the challenges brought on by the overnight shifts redefining the future of work with the onset of a global pandemic!

Reflecting back, the path that SentinelOne has taken towards achieving our hypergrowth has been different in how intentional our team has been about our culture and our mission from day one. It is easy to get “caught up” in an upwards growth spiral and lose track of your mission and ethos. We have cared about strengthening our culture and thrived while taking on opportunities to give back to communities around us. We have improved our talent retention rates by double digits and nearly doubled our company size worldwide by attracting and retaining some of the best talent in the industry. Simply put, we cared.

Building this intentional culture has been achieved by clearly communicating and integrating our core values in all our talent processes from hiring, to developing, to promoting, rewarding and retaining. Here is what these core values mean to us:

  1. Trust means being dependable. Conducting yourself with highest integrity at all times. Working as a team requires trust among peers, with customers and prospects and with the cybersecurity industry as a whole. We live trust; our product is based on trust, and without it, we can’t grow.
  2. Accountability means being reliable in all your actions and words. Putting customers first. To be the owner! As we grow, adding more members to the SentinelOne family, we learn how to take ownership and strive for excellence – Without Accountability, people may try their best. Still, the results needed to operate on our scale, serving customers who do not compromise their security, make us all accountable to keeping them safe.
  3. OneSentinel means being passionate about driving team success and collaboration across SentinelOne. This core tenet binds us strongly together and makes us run that much faster knowing that we all are strongly vested in each others’ success and are rooting for others always! We are not just talented individuals who share the same line of work. We work together, as we know the whole is bigger than the sum of its parts.
  4. Relentlessness means acting with unwavering purpose and determination in everything we do. Hackers and bad cybersecurity actors are relentless; therefore, we, as defenders, must be even more so. Constant determination and focus on our mission, ensuring we always keep the bar high enough, and putting our customers first is what makes us SentinelOne.
  5. Ingenuity means encouraging innovative approaches to problem-solving and  market leadership. Embracing diverse perspectives. We hustle, we keep challenging one another; we are sincere about our mistakes and learn from them. This constantly keeps us on our toes and stretching to be better every single day!
  6. Community means being kind to one another. Thinking about how your actions will affect others both within and outside SentinelOne. Together as a team we come together again and again on causes that give back to our communities and make them stronger.

Integrating our talent processes with our company values has made us who we are today. Managing hypergrowth, especially during such challenging times, was not easy. While we may have some members of our family we have yet to meet in person, we still live under one motto: to enjoy what we do. As one sales leader recently shared:

“We are ONE TEAM. We work hard – but also always have time in meetings to smile and get excited. Even in the crazy home office year – I felt like I was working with close friends, some of them I have not met so far – but still feel very close to them. This is special and shows the great culture.”

Throughout it all, we’ve continued to be recognized as a Best Place To Work across the globe by organizations including, Comparably, Silicon Valley Business Journal and Inc. We were proud to be awarded Best Sales Team, Best Engineering team and Best Product & Design team by Comparably. Our employees have spoken, making us one of the best cybersecurity companies to work for based on employee reviews on Glassdoor. As one Engineer put it “SentinelOne feels more like a big family rather than a big company, people here have personal connections with others and care about them”. And, we couldn’t agree more.

We have thrived in an unpredictable year, all by remaining true to our roots and by relying on our core values. We brought together a team of Sentinels that are relentless, accountable, trusted — who value integrity and autonomy, are passionate about team success, and choose to win every day!

Take a look and see for yourself what these values mean to us.

Soul of SentinelOne: Our Values


Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Cloudera to go private as KKR & CD&R grab it for $5.3B

Cloudera was once one of the hottest Hadoop startups, but over time the shine has come off that market, and today it went private as KKR and Clayton, Dubilier & Rice, a pair of private equity firms, announced they intended to purchase Cloudera for $5.3 billion. The company has a market cap of around $3.7 billion.

Cloudera and Hortonworks, two key startups in the Hadoop space, merged in 2018 for $5.2 billion. Cloudera was likely under pressure from activist investor Carl Icahn, who took an 18% stake in the company in 2019 and now stands to gain from the sale, which the company stated represented a 24% premium for shareholders at $16 a share. Prior to the market opening this morning, the stock was sitting at $12.86.

Back in the day, about a decade ago, when Hadoop was the way to process big data, venture money was pouring into the space. Over time it lost some of its glow. That’s because it was highly labor intensive, and companies began moving to the cloud and looking at software services that did more of the work for them. More modern technologies like data lakes began replacing it and the company recognized that it must change its approach to survive in the modern data processing marketplace.

Cloudera CEO Rob Bearden sees the transaction as a way to do just that. “We believe that as a private company with the expertise and support of experienced investors such as CD&R and KKR, Cloudera will have the resources and flexibility to drive product-led growth and expand our addressable market opportunity,” Bearden said in a statement.

While there is a lot of executive jargon in that statement, it basically means that the company hopes that these private equity firms can give it some additional financial resources to move toward a more modern approach for processing large amounts of data.

While it was at it, Cloudera also announced a couple of acquisitions of its own to help it move toward that modernization goal. For starters, it grabbed Datacoral, a startup that abstracts away the infrastructure needed to build a data pipeline without using code. It also acquired Cazena, a startup that helps customers build cloud data lakes, giving the company a more modern approach to processing big data. Bearden sees both of these services helping Cloudera reposition itself in the big data self-service market

“Both businesses will enable our combined customers to enjoy a reduction in complexity and faster time to value for their data initiatives, leading to improved insights, faster innovation, and stronger engagements with their customers and partners,” Bearden said in a statement.

Cloudera went public in 2018, closing at $18.09 a share after raising $1 billion. The vast majority of that was a $740 million investment from Intel Capital in 2014. It’s worth noting that Cloudera bought Intel’s stake in the company at the end of last year for $314 million.

Hortonworks raised another $248 million. A third Hadoop startup, MapR, raised $280 million. The company’s assets were sold rather unceremoniously to HPE in 2019 for a price pegged at under $50 million, showing just how far the market has fallen since its earlier glory days.

The Cloudera deal includes a brief “go shop” provision that allows it to continue to look for a better deal. It’s doubtful it will find one, and if it doesn’t the transaction with KKR and CD&R is expected to close in the second half of this year subject to typical regulatory review. The company will announce earnings later today.

Sprinklr’s IPO filing shows uneven cash flow but modest growth

Another week, another unicorn IPO. This time, Sprinklr is taking on the public markets.

The New York-based software company works in what it describes as the customer experience market. After attracting over $400 million in capital while private, its impending debut will not only provide key returns to a host of venture capitalists but also more evidence that New York’s startup scene has reached maturity. (More evidence here.)


The Exchange explores startups, markets and money. 

Read it every morning on Extra Crunch or get The Exchange newsletter every Saturday.


Sprinklr last raised a $200 million round at a $2.7 billion valuation in September 2020. That round, as TechCrunch reported, also included a host of secondary shares and $150 million in convertible notes. Inclusive of the latter instrument, Sprinklr’s total capital raised to date soars above the $500 million mark.

Temasek Holdings, Battery Ventures, ICONIQ Capital, Intel Capital and others have plugged funds into Sprinklr during its startup days.

Sure, Robinhood didn’t file last week as many folks hoped, but the Sprinklr IPO ensures that we’ll have more than just SPACs to chat about in the coming days. But one thing at a time. Let’s discuss what Sprinklr does for a living.

Sprinklr’s business

Sprinklr’s IPO filing and corporate website suffer from a slight case of corporate speak, so we have some work to do this morning to determine what the company does. Here’s what the company says about itself in its filing:

Sprinklr empowers the world’s largest and most loved brands to make their customers happier.

We do this with a new category of enterprise software — Unified Customer Experience Management, or Unified-CXM — that enables every customer-facing function across the front office, from Customer Care to Marketing, to collaborate across internal silos, communicate across digital channels, and leverage a complete suite of modern capabilities to deliver better, more human customer experiences at scale — all on one unified, AI-powered platform.

Not very clear, yeah? Don’t worry, I’ve got you. Here’s what the company actually does:

4 proven approaches to CX strategy that make customers feel loved

Customers have been “experiencing” business since the ancient Romans browsed the Forum for produce, pottery and leather goods. But digitization has radically recalibrated the buyer-seller dynamic, fueling the rise of one of the most talked-about industry acronyms: CX (customer experience).

Part paradigm, part category and part multibillion-dollar market, CX is a broad term used across a myriad of contexts. But great CX boils down to delighting every customer on an emotional level, anytime and anywhere a business interaction takes place.

Great CX boils down to delighting every customer on an emotional level, anytime and anywhere a business interaction takes place.

Optimizing CX requires a sophisticated tool stack. Customer behavior should be tracked, their needs must be understood, and opportunities to engage proactively must be identified. Wall Street, for one, is taking note: Qualtrics, the creator of “XM” (experience management) as a category, was spun-out from SAP and IPO’d in January, and Sprinklr, a social media listening solution that has expanded into a “Digital CXM” platform, recently filed to go public.

Thinking critically about customer experience is hardly a new concept, but a few factors are spurring an inflection point in investment by enterprises and VCs.

Firstly, brands are now expected to create a consistent, cohesive experience across multiple channels, both online and offline, with an ever-increasing focus on the former. Customer experience and the digital customer experience are rapidly becoming synonymous.

The sheer volume of customer data has also reached new heights. As a McKinsey report put it, “Today, companies can regularly, lawfully, and seamlessly collect smartphone and interaction data from across their customer, financial, and operations systems, yielding deep insights about their customers … These companies can better understand their interactions with customers and even preempt problems in customer journeys. Their customers are reaping benefits: Think quick compensation for a flight delay, or outreach from an insurance company when a patient is having trouble resolving a problem.”

Moreover, the app economy continues to raise the bar on user experience, and end users have less patience than ever before. Each time Netflix displays just the right movie, Instagram recommends just the right shoes, or TikTok plays just the right dog video, people are being trained to demand just a bit more magic.

Extra Crunch roundup: Inside Sprinklr’s IPO filing, how digital transformation is reshaping markets

Despite a recent history of uneven cash flow and moderate growth, SaaS customer experience management platform Sprinklr has filed to go public.

In today’s edition of The Exchange, Alex Wilhelm pores over the New York-based unicorn’s S-1 to better understand exactly what Sprinklr offers: “Marketing and comms software, with some machine learning built in.”

Despite 19% growth in revenue over the last fiscal year, its deficits increased during the same period. But with more than $250 million in cash available, “Sprinklr is not going public because it needs the money,” says Alex.

Since we were off yesterday for Memorial Day, today’s roundup is brief, but we’ll have much more to recap on Friday. Thanks very much for reading Extra Crunch!

Walter Thompson
Senior Editor, TechCrunch
@yourprotagonist


Full Extra Crunch articles are only available to members.
Use discount code ECFriday to save 20% off a one- or two-year subscription.


Once a buzzword, digital transformation is reshaping markets

Digital transformation concept. Binary code. AI (Artificial Intelligence).

Image Credits: metamorworks / Getty Images

The changes brought by a global shift to remote work and schooling are myriad, but in the business realm, they have yielded a change in corporate behavior and consumer expectations — changes that showed up in a bushel of earnings reports last week.

Startups have told us for several quarters that their markets are picking up momentum as customers shake up buying behavior with a distinct advantage for companies helping users move into the digital realm.

Public company results are now confirming the startups’ perspective. The accelerating digital transformation is real, and we have the data to prove it.

3 views on the future of meetings

In a recent episode of TechCrunch Equity, hosts Danny Crichton, Natasha Mascarenhas and Alex Wilhelm connected the dots between multiple funding rounds to sketch out three perspectives on the future of workplace meetings.

Each agreed that the traditional meeting is broken, so we gathered their perspectives about where the industry is heading and which aspects are ripe for disruption:

  • Alex Wilhelm: Faster information throughput, please.
  • Natasha Mascarenhas: Meetings should be ongoing, not in calendar invites.
  • Danny Crichton: Redesign meetings for flow.

Cognigy raises $44M to scale its enterprise-focused conversational AI platform

Artificial intelligence is becoming an increasingly common part of how customer service works — a trend that was accelerated in this past year as so many other services went virtual and digital — and today a startup that has built a set of low-code tools to help enterprises integrate more AI into their customer service processes is announcing some funding to fuel its growth.

Cognigy, which provides a low-code conversational AI platform that notably can be used flexibly across a range of applications and geographies — it supports 120 languages; it can be used in external or internal service applications; it can support voice services but also chatbots; it provides real-time assistance for human agents and usage analytics or fully automated responses; it can integrate with standard call center software, and also with RPA packages; and it can be run in the cloud or on-premise — has closed a round of $44 million, funding that it will be using to continue scaling its business internationally.

Insight Partners is leading the Series B investment, with previous backers DN Capital, Global Brain, Nordic Makers, Inventures and Digital Innovation and Growth also participating. The Dusseldorf-based company had previously only raised $11 million and spent the first several years of business bootstrapped.

Cognigy is not disclosing its valuation but it has up to now built up a concentration of customers in areas like transportation, e-commerce and insurance and counts a number of big multinational companies among its customer list, including Lufthansa, Mobily, BioNTech, Vueling Airlines, Bosch and Daimler, with “thousands” of virtual assistants now powered by Cognigy live in the market.

With 25% of Cognigy’s business already coming from the U.S., the plan now is to use some funding to invest in building out its service deeper into the U.S., Asia and across more of Europe, CEO and founder Philipp Heltewig said in an interview.

“Conversational AI” these days appears in many guises: it can be a chatbot you come across on a website when you’re searching for something, or it can be prompts provided to agents or salespeople, information and real-time feedback to help them do their jobs better. Conversational AI can also be a personal assistant on your company’s HR application to help you book time off or deal with any number of other administrative jobs, or a personal assistant that helps you use your phone or set your house alarm.

There are a number of companies in the tech world that have built tools to address these various use cases. Specifically in the area of services aimed at enterprises, some of them, like Gong, are raising huge money right now. What is notable about Cognigy is that it has built a platform that is attempting to address a wide swathe of applications: one platform, many uses, in other words.

Cognigy’s other selling point is that it is playing into the new interest in low- and no-code tools, which in Cognigy’s case makes the integration of AI into a customer assistance process a relatively easy task, something that can be built not just by developers, but data scientists, those working directly on conversation design, and nontechnical business users using the tools themselves.

“The low-code platform helps enterprises adopt what is otherwise complex technology in an easy and flexible way, whether it is a customer or employee contact center,” said Heltewig. As you might expect, there are some direct competitors in the low- and no-code conversational AI space, too, including Ada, Talkie, Snaps and more.

Flexibility seems to be the order of the day for enterprises, and also the companies building tools for them: it means that a company can grow into a larger customer, and that in theory Cognigy will also evolve the platform based on what its customers need. As one example, Heltewig pointed out that a number of its customers are — contrary to the beating drum and march you see every day toward cloud services — running a fair number of applications on-premises, since this appears to be a key way to ensure the security of the customer data that they handle.

“Lufthansa could never run its customer services in the cloud because they handle a lot of sensitive data and they want full ownership of it,” he noted. “We can run cloud services and have a full offering for those who want it, but many large enterprises prefer to run their services on premises.”

Teddie Wardi, an MD at Insight, is joining the board with this round. “We are thrilled to be leading Cognigy’s Series B as the company continues on their ScaleUp journey,” he said in a statement. “Evident by their strong customer retention, Cognigy has created an essential product for global businesses to improve their customer experience in an efficient and effortless manner. With the new funding, Cognigy will be able to expand their leadership position to reach new markets and acquire more customers.”

Using Fake Reviews to Find Dangerous Extensions

Fake, positive reviews have infiltrated nearly every corner of life online these days, confusing consumers while offering an unwelcome advantage to fraudsters and sub-par products everywhere. Happily, identifying and tracking these fake reviewer accounts is often the easiest way to spot scams. Here’s the story of how bogus reviews on a counterfeit Microsoft Authenticator browser extension exposed dozens of other extensions that siphoned personal and financial data.

Comments on the fake Microsoft Authenticator browser extension show the reviews for these applications are either positive or very negative — basically calling it out as a scam. Image: chrome-stats.com.

After hearing from a reader about a phony Microsoft Authenticator extension that appeared on the Google Chrome Store, KrebsOnSecurity began looking at the profile of the account that created it. There were a total of five reviews on the extension before it was removed: Three Google users gave it one star, warning people to stay far away from it; but two of the reviewers awarded it between three and four stars.

“It’s great!,” the Google account Theresa Duncan enthused, improbably. “I’ve only had very occasional issues with it.”

“Very convenient and handing,” assessed Anna Jones, incomprehensibly.

Google’s Chrome Store said the email address tied to the account that published the knockoff Microsoft extension also was responsible for one called “iArtbook Digital Painting.” Before it was removed from the Chrome Store, iArtbook had garnered just 22 users and three reviews. As with the knockoff Microsoft extension, all three reviews were positive, and all were authored by accounts with first and last names, like Megan Vance, Olivia Knox, and Alison Graham.

Google’s Chrome Store doesn’t make it easy to search by reviewer. For that I turned to Hao Nguyen, the developer behind chrome-stats.com, which indexes and makes searchable a broad array of attributes about extensions available from Google.

Looking at the Google accounts that left positive reviews on both the now-defunct Microsoft Authenticator and iArtbook extensions, KrebsOnSecurity noticed that each left positive reviews on a handful of other extensions that have since been removed.

Reviews on the iArtbook extension were all from apparently fake Google accounts that each reviewed two other extensions, one of which was published by the same developer. This same pattern was observed across 45 now-defunct extensions.

Like an ever-expanding venn diagram, a review of the extensions commented on by each new fake reviewer found led to the discovery of even more phony reviewers and extensions. In total, roughly 24 hours worth of digging through chrome-stats.com unearthed more than 100 positive reviews on a network of patently fraudulent extensions.

Those reviews in turn lead to the relatively straightforward identification of:

-39 reviewers who were happy with extensions that spoofed major brands and requested financial data
-45 malicious extensions that collectively had close to 100,000 downloads
-25 developer accounts tied to multiple banned applications

The extensions spoofed a range of consumer brands, including Adobe, Amazon, Facebook, HBO, Microsoft, Roku and Verizon. Scouring the manifests for each of these other extensions in turn revealed that many of the same developers were tied to multiple apps being promoted by the same phony Google accounts.

Some of the fake extensions have only a handful of downloads, but most have hundreds or thousands. A fake Microsoft Teams extension attracted 16,200 downloads in the roughly two months it was available from the Google store. A counterfeit version of CapCut, a professional video editing software suite, claimed nearly 24,000 downloads over a similar time period.

More than 16,000 people downloaded a fake Microsoft Teams browser extension over the roughly two months it was available for download from the Google Chrome store.

Unlike malicious browser extensions that can turn your PC into a botnet or harvest your cookies, none of the extensions examined here request any special permissions from users. Once installed, however, they invariably prompt the user to provide personal and financial data — all the while pretending to be associated with major brand names.

In some cases, the fake reviewers and phony extension developers used in this scheme share names, such as the case with “brook ice,” the Google account that positively reviewed the malicious Adobe and Microsoft Teams extensions. The email address brookice100@gmail.com was used to register the developer account responsible for producing two of the phony extensions examined in this review (PhotoMath and Dollify).

Some of the data that informed this report. The full spreadsheet is available as a link at the end of the story.

As we can see from the spreadsheet snippet above, many of the Google accounts that penned positive reviews on patently bogus extensions left comments on multiple apps on the same day.

Additionally, Google’s account recovery tools indicate many different developer email addresses tied to extensions reviewed here share the same recovery email — suggesting a relatively few number of anonymous users are controlling the entire scheme. When the spreadsheet data shown above is sorted by email address of the extension developer, the grouping of the reviews by date becomes even clearer.

KrebsOnSecurity shared these findings with Google and will update this story in the event they respond. Either way, Google somehow already detected all of these extensions as fraudulent and removed them from its store.

However, there may be a future post here about how long that bad extension identification and removal process has taken over time. Overall, most of these extensions were available for two to three months before being taken down.

As for the “so what?” here? I performed this research mainly because I could, and I thought it was interesting enough to share. Also, I got fascinated with the idea that finding fake applications might be as simple as identifying and following the likely fake reviewers. I’m positive there is more to this network of fraudulent extensions than is documented here.

As this story illustrates, it pays to be judicious about installing extensions. Leaving aside these extensions which are outright fraudulent, so many legitimate extensions get abandoned or sold each year to shady marketers that it’s wise to only trust extensions that are actively maintained (and perhaps have a critical mass of users that would make noise if anything untoward happened with the software).

According to chrome-stats.com, the majority of extensions — more than 100,000 of them — are effectively abandoned by their authors, or haven’t been updated in more than two years. In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base.

The information that informed this report is searchable in this Google spreadsheet.

The Good, the Bad and the Ugly in Cybersecurity – Week 22

This week, French law enforcement authorities scored another victory against illicit Dark Web vendors. The popular marketplace “Le Monde Parallèle” has been in operation (in various stages) since early 2020. With the increase in large market takedowns over the past 24 months (e.g., DarkMarket, Wall Street Market, Valhalla), Le Monde Parallèle enjoyed quite a bit of success from refugees of those fallen markets. As was the case with other popular marketplaces, Parallèle specialized in the buying and selling of stolen electronic data, drugs, weapons and other ‘underground’ items.

The Ministry of the Economy released the following statement following the arrest of two individuals involved with the administration and management of the market and its infrastructure:

“On May 17, 2021, DNRED agents carried out two home visits, in Paris and in the Metz region, following several months of investigation by the Cyberdouane service on the Darknet TOR aimed at identifying the administrators of the French-speaking platform ” Le Monde Parallèle ”(LMP), offering for sale various illicit products and services (drugs, false documents, weapons, carding, etc.).”

It is always good to see these law enforcement efforts pay off. This is the 3rd in line of large France-focused markets to be seized in recent memory, with the French DW Market and Black Hand going down in 2019 and 2018 respectively.

Also this week, we continue to see repercussions from the recent DarkSide ransomware attack against the Colonial Pipeline (both positive and negative). The United States Department of Homeland Security announced (on May 27) a new Security Directive designed to enable DHS to improve its ability to identify, respond to, and prevent malicious threats to critical pipeline infrastructure.

The announcement covers the basic goal of the directive, which will ultimately require pipeline owners and operators to swiftly and accurately report potential (and confirmed) cybersecurity incidents to the DHS Cybersecurity and Infrastructure Security Agency (CISA). Companies must also designate a Cybersecurity Coordinator, whom is to be available 365x24x7. All owners and operators will also be required to thoroughly review their current security countermeasures and procedures, identify gaps, take remediation actions, and report the findings and actions to TSA and CISA within 30 day. While it is unfortunate that it takes events like the Colonial Pipeline attack to shock some into reviewing their security posture, it is a necessary step…and will only become more so over time as these attacks continue to accelerate and expand.

The Bad

This week, Bose Corporation disclosed details around a data breach stemming back to March 2021.

The company filed a letter with the New Hampshire Office of the Attorney General stating that they had, in effect, experienced a sophisticated attack featuring a combination of ransomware and the theft of information. It is reported that during the attack some data specific to current and former employees was accessed. This includes specific HR and administrative data. In addition, the attackers were also able to gain access to “a very small number of individuals” all of whom have been notified accordingly. As a whole, exposure of external customers is extremely limited.

That said, there is a ‘good’ spin to the story. Upon discovering the attack, Bose was in a position to eradicate the threat and restore any affected or manipulated data. Even more importantly, Bose was not able to find any evidence to suggest that data was exfiltrated from the corporate environment. They were able to recover, restore AND avoided paying the ransom. In the end, it’s bad when anyone gets attack and compromised in this way. However, preparation and well-executed Incident Response can mean the difference between a ‘security event’ and a ‘security catastrophe..

The Ugly

This week, the Belgian Interior Ministry announced that they had been the target of a long-term cyberattack. The attack (discovered in March 2021) is said to potentially date back to 2019. It was noted in the announcement that Federal prosecutors had launched a full investigation in to the scale and origin of the attack.

The attack appears to be a low-and-slow espionage attack. No ransomware was ever deployed, no files were otherwise obfuscated or exfiltrated. There were also no disruptions in availability (aka denial-of-service). All this adds up to a more ‘traditional’ long-term cyber-espionage campaign. As the investigation is ongoing, authorities are rather restricted on comments. Experts have been quoted by the RTBF (Radio-télévision belge de la Communauté française) saying this appeared to be “more complex and well targeted, leading us to think it was espionage”. Authorities also state that the systems involved have since been secured and properly mitigated.

While attribution has not been fully stated or speculated, this does come at an interesting time. Multiple EU leaders recently met in Brussels to discuss the ongoing threat of cyberattacks and associated tensions with Russia (where many of these events seem to originate). “The level of Russian interference both with spies and with web manipulation has become truly alarming,” Italian Prime Minister Mario Draghi told a news conference.

These are fairly standard attacks…and it is also a great reminder that data is key in forensic investigations. But more importantly data-over-time! Connecting all the dots in a campaign of this style requires that your tools (EDR, XDR, SIEM) retain data for enough time to be meaningful. This does not mean 1 week, 2 weeks, 30 days. We need to think in terms of months and years with these attacks (and the investigations around them).


Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Once a buzzword, digital transformation is reshaping markets

The notion of digital transformation evolved from a buzzword joke to a critical and accelerating fact during the COVID-19 pandemic. The changes wrought by a global shift to remote work and schooling are myriad, but in the business realm they have yielded a change in corporate behavior and consumer expectation — changes that showed up in a bushel of earnings reports this week.

TechCrunch may tend to have a private-company focus, but we do keep tabs on public companies in the tech world as they often provide hints, notes and other pointers on how startups may be faring. In this case, however, we’re working in reverse; startups have told us for several quarters now that their markets are picking up momentum as customers shake up their buying behavior with a distinct advantage for companies helping customers move into the digital realm. And public company results are now confirming the startups’ perspective.

The accelerating digital transformation is real, and we have the data to support the point.

What follows is a digest of notes concerning the recent earnings results from Box, Sprout Social, Yext, Snowflake and Salesforce. We’ll approach each in micro to save time, but as always there’s more digging to be done if you have time. Let’s go!

Enterprise earnings go up

Kicking off with Yext, the company beat expectations in its most recent quarter. Today its shares are up 18%. And a call with the company’s CEO Howard Lerman underscored our general thesis regarding the digital transformation’s acceleration.

In brief, Yext’s evolution from a company that plugged corporate information into external search engines to building and selling search tech itself has been resonating in the market. Why? Lerman explained that consumers more and more expect digital service in response to their questions — “who wants to call a 1-800 number,” he asked rhetorically — which is forcing companies to rethink the way they handle customer inquiries.

In turn, those companies are looking to companies like Yext that offer technology to better answer customer queries in a digital format. It’s customer-friendly, and could save companies money as call centers are expensive. A change in behavior accelerated by the pandemic is forcing companies to adapt, driving their purchase of more digital technologies like this.

It’s proof that a transformation doesn’t have to be dramatic to have pretty strong impacts on how corporations buy and sell online.