Worksome pulls $13M into its high skill freelancer talent platform

More money for the now very buzzy business of reshaping how people work: Worksome is announcing it recently closed a $13 million Series A funding round for its “freelance talent platform” — after racking up 10x growth in revenue since January 2020, just before the COVID-19 pandemic sparked a remote working boom.

The 2017 founded startup, which has a couple of ex-Googlers in its leadership team, has built a platform to connect freelancers looking for professional roles with employers needing tools to find and manage freelancer talent.

It says it’s seeing traction with large enterprise customers that have traditionally used Managed Service Providers (MSPs) to manage and pay external workforces — and views employment agency giants like Randstad, Adecco and Manpower as ripe targets for disruption.

“Most multinational enterprises manage flexible workers using legacy MSPs,” says CEO and co-founder Morten Petersen (one of the Xooglers). “These largely analogue businesses manage complex compliance and processes around hiring and managing freelance workforces with handheld processes and outdated technology that is not built for managing fluid workforces. Worksome tackles this industry head on with a better, faster and simpler solution to manage large freelancer and contractor workforces.”

Worksome focuses on helping medium/large companies — who are working with at least 20+ freelancers at a time — fill vacancies within teams rather than helping companies outsource projects, per Petersen, who suggests the latter is the focus for the majority of freelancer platforms.

“Worksome helps [companies] onboard people who will provide necessary skills and will be integral to longer-term business operations. It makes matches between companies and skilled freelancers, which the businesses go on to trust, form relationships with and come back to time and time again,” he goes on.

“When companies hire dozens or hundreds of freelancers at one time, processes can get very complicated,” he adds, arguing that on compliance and payments Worksome “takes on a much greater responsibility than other freelancing platforms to make big hires easier”.

The startup also says it’s concerned with looking out for (and looking after) its freelancer talent pool — saying it wants to create “a world of meaningful work” on its platform, and ensure freelancers are paid fairly and competitively. (And also that they are paid faster than they otherwise might be, given it takes care of their payroll so they don’t have to chase payments from employers.)

The business started life in Copenhagen — and its Series A has a distinctly Nordic flavor, with investment coming from the Danish business angel and investor on the local version of the Dragons’ Den TV program Løvens Hule; the former Minister for Higher Education and Science, Tommy Ahlers; and family home manufacturer Lind & Risør.

It had raised just under $6M prior to thus round, per Crunchbase, and also counts some (unnamed) Google executives among its earlier investors.

Freelancer platforms (and marketplaces) aren’t new, of course. There are also an increasing number of players in this space — buoyed by a new flush of VC dollars chasing the ‘future of work’, whatever hybrid home-office flexible shape that might take. So Worksome is by no means alone in offering tech tools to streamline the interface between freelancers and businesses.

A few others that spring to mind include Lystable (now Kalo), Malt, Fiverr — or, for techie job matching specifically, the likes of HackerRank — plus, on the blue collar work side, Jobandtalent. There’s also a growing number of startups focusing on helping freelancer teams specifically (e.g. Collective), so there’s a trend towards increasing specialism.

Worksome says it differentiates vs other players (legacy and startups) by combining services like tax compliance, background and ID checks and handling payroll and other admin with an AI powered platform that matches talent to projects.

Although it’s not the only startup offering to do the back-office admin/payroll piece, either, nor the only one using AI to match skilled professionals to projects. But it claims it’s going further than rival ‘freelancer-as-a-service’ platforms — saying it wants to “address the entire value chain” (aka: “everything from the hiring of freelance talent to onboarding and payment”).

Worksome has 550 active clients (i.e. employers in the market for freelancer talent) at this stage; and has accepted 30,000 freelancers into its marketplace so far.

Its current talent pool can take on work across 12 categories, and collectively offers more than 39,000 unique skills, per Petersen.

The biggest categories of freelancer talent on the platform are in Software and IT; Design and Creative Work; Finance and Management Consulting; plus “a long tail of niche skills” within engineering and pharmaceuticals.

While its largest customers are found in the creative industries, tech and IT, pharma and consumer goods. And its biggest markets are the U.K. and U.S.

“We are currently trailing at +20,000 yearly placements,” says Petersen, adding: “The average yearly spend per client is $300,000.”

Worksome says the Series A funding will go on stoking growth by investing in marketing. It also plans to spend on product dev and on building out its team globally (it also has offices in London and New York).

Over the past 12 months the startup doubled the size of its team to 50 — and wants to do so again within 12 months so it can ramp up its enterprise client base in the U.S., U.K. and euro-zone.

“Yes, there are a lot of freelancer platforms out there but a lot of these don’t appreciate that hiring is only the tip of the iceberg when it comes to reducing the friction in working with freelancers,” argues Petersen. “Of the time that goes into hiring, managing and paying freelancers, 75% is currently spent on admin such as timesheet approvals, invoicing and compliance checks, leaving only a tiny fraction of time to actually finding talent.”

Worksome woos employers with a “one-click-hire” offer — touting its ability to find and hire freelancers “within seconds”.

If hiring a stranger in seconds sounds ill-advised, Worksome greases this external employment transaction by taking care of vetting the freelancers itself (including carrying out background checks; and using proprietary technology to asses freelancers’ skills and suitability for its marketplace).

“We have a two-step vetting process to ensure that we only allow the best freelance talent onto the Worksome platform,” Petersen tells TechCrunch. “For step one, an inhouse-built robot assesses our freelancer applicants. It analyses their skillset, social media profiles, profile completeness and hourly or daily rate, as well as their CV and work history, to decide whether each person is a good fit for Worksome.

“For step two, our team of talent specialists manually review and decline or approve the freelancers that pass through step one with a score of 85% or more. We have just approved our 30,000th freelancer and will be able to both scale and improve our vetting procedure as we grow.”

A majority of freelancer applicants fail Worksome’s proprietary vetting processes. This is clear because it says it has received 80,000 applicants so far — but only approved 30,000.

That raises interesting questions about how it’s making decisions on who is (and isn’t) an ‘appropriate fit’ for its talent marketplace.

It says its candidate assessing “robot” looks at “whether freelancers can demonstrate the skillset, matching work history, industry experience and profile depth” deemed necessary to meet its quality criteria — giving the example that it would not accept a freelancer who says they can lead complex IT infrastructure projects if they do not have evidence of relevant work, education and skills.

On the AI freelancer-to-project matching side, Worksome says its technology aims to match freelancers “who have the highest likelihood of completing a job with high satisfaction, based on their work-history, and performance and skills used on previous jobs”.

“This creates a feedback loop that… ensure that both clients and freelancers are matched with great people and great work,” is its circular suggestion when we ask about this.

But it also emphasizes that its AI is not making hiring decisions on its own — and is only ever supporting humans in making a choice. (An interesting caveat since existing EU data protection rules, under Article 22 of the GDPR, provide for a right for individuals to object to automated decision making if significant decisions are being taken without meaningful human interaction.) 

Using automation technologies (like AI) to make assessments that determine whether a person gains access to employment opportunities or doesn’t can certainly risk scaled discrimination. So the devil really is in the detail of how these algorithmic assessments are done.

That’s why such uses of technology are set to face close regulatory scrutiny in the European Union — under incoming rules on ‘high risk’ users of artificial intelligence — including the use of AI to match candidates to jobs.

The EU’s current legislative proposals in this area specifically categorize “employment, workers management and access to self-employment” as a high risk use of AI, meaning applications like Worksome are likely to face some of the highest levels of regulatory supervision in the future.

Nonetheless, Worksome is bullish when we ask about the risks associated with using AI as an intermediary for employment opportunities.

“We utilise fairly advanced matching algorithms to very effectively shortlist candidates for a role based solely on objective criteria, rinsed from human bias,” claims Petersen. “Our algorithms don’t take into account gender, ethnicity, name of educational institutions or other aspects that are usually connected to human bias.”

“AI has immense potential in solving major industry challenges such as recruitment bias, low worker mobility and low access to digital skills among small to medium sized businesses. We are firm believers that technology should be utilized to remove human bias’ from any hiring process,” he goes on, adding: “Our tech was built to this very purpose from the beginning, and the new proposed legislation has the potential to serve as a validator for the hard work we’ve put into this.

“The obvious potential downside would be if new legislation would limit innovation by making it harder for startups to experiment with new technologies. As always, legislation like this will impact the Davids more than the Goliaths, even though the intentions may have been the opposite.”

Zooming back out to consider the pandemic-fuelled remote working boom, Worksome confirms that most of the projects for which it supplied freelancers last year were conducted remotely.

“We are currently seeing a slow shift back towards a combination of remote and onsite work and expect this combination to stick amongst most of our clients,” Petersen goes on. “Whenever we are in uncertain economic times, we see a rise in the number of freelancers that companies are using. However, this trend is dwarfed by a much larger overall trend towards flexible work, which drives the real shift in the market. This shift has been accelerated by COVID-19 but has been underway for many years.

“While remote work has unlocked an enormous potential for accessing talent everywhere, 70% of the executives expect to use more temporary workers and contractors onsite than they did before COVID-19, according to a recent McKinsey study. This shows that businesses really value the flexibility in using an on-demand workforce of highly skilled specialists that can interact directly with their own teams.”

Asked whether it’s expecting growth in freelancing to sustain even after we (hopefully) move beyond the pandemic — including if there’s a return to physical offices — Petersen suggests the underlying trend is for businesses to need increased flexibility, regardless of the exact blend of full-time and freelancer staff. So platforms like Worksome are confidently poised to keep growing.

“When you ask business leaders, 90% believe that shifting their talent model to a blend of full-time and freelancers can give a future competitive advantage (Source: BCG),” he says. “We see two major trends driving this sentiment; access to talent, and building an agile and flexible organization. This has become all the more true during the pandemic — a high degree of flexibility is allowing organisations to better navigate both the initial phase of the pandemic as well the current pick up of business activity.

“With the amount of change that we’re currently seeing in the world, and with businesses are constantly re-inventing themselves, the access to highly skilled and flexible talent is absolutely essential — now, in the next 5 years, and beyond.”

BluBracket nabs $12M Series A to expand source code security platform

BluBracket, an early-stage startup that focuses on keeping source code repositories secure, even in distributed environments, announced a $12 million Series A today.

Evolution Equity Partners led the round, with help from existing investors Unusual Ventures, Point72 Ventures, SignalFire and Firebolt Ventures. When combined with the $6.5 million seed round we reported on last year, the company has raised $19.5 million so far.

As you might imagine, being able to secure code in distributed environments came in quite handy when much of the technology world moved to work from home last year. BluBracket co-founder and COO Ajay Arora says that the pandemic forced many organizations to look carefully at how they secured their code base.

“So the anxiety organizations had about making sure their source code was secure and that it wasn’t leaking, from that standpoint that was a big tailwind for us. [With companies moving to a] completely remote development workforce, and with code being so important to their business as intellectual property, they needed to get that visibility into what vulnerabilities were there,” Arora explained.

Even prior to the pandemic, the company was finding they were gaining traction with developers and security pros by using a bottom up approach offering a free community version of the software. Having that free version as a top of the funnel for their sales motion was also helpful once COVID hit full force.

Today, Arora says the company has multiple thousands of developers, DevOps and SecOps users across dozens of organizations using the company’s suite of products. The big reference company right now is Priceline, but he says there are other big names that would prefer not to be public about it.

The company currently has 30 employees, with plans to double that by the end of the year, and he says that building diversity and inclusion into the hiring process is part of the company’s core values, and part of how the executive team gets measured.

“We’re big believers in putting our money where our mouth is and one of the OKRs for me and my co-founder [CEO Prakash Linga], or one of the things that we’re actually compensated for, is how well we are doing in building diversity and inclusion on the team,” he said. He adds that the recruiters that they are using are also being held to the same standard when it comes to providing a diverse set of candidates for open positions.

The company launched in 2018 and the founding team came from Vera, a startup that helped secure documents in motion. That company was sold to HelpSystems in December 2020 after Arora and Linga had left to start BluBracket.

Busy day at VMware ended yesterday with Ragurham as CEO and COO Poonen exiting

They say for every door that opens another closes, and the executive shuffle at VMware is certainly proving that old chestnut true. Four months after Pat Gelsinger stepped down as CEO to return to run Intel, the virtual machine pioneer announced yesterday that long-time exec Raghu Raghuram was taking over that role.

That set in motion another change when COO Sanjay Poonen, whom some had speculated might get the CEO job, announced yesterday afternoon on Twitter that he was leaving the company after seven years.

Coincidence? We think not.

Holger Mueller, an analyst at Constellation Research, says that he was surprised that Poonen didn’t get the job, but perhaps the VMware board valued Raghuram’s product focus more highly. “At 50, he [would have been] a long-term solution, and he did a great job on the End User Computing (EUC) side of the product before becoming COO. I guess that it is still not VMware’s core business,” he said.

Regardless, Mueller still liked the choice of Raghuram as CEO, saying that he brought stability and reliability to the position, but he sees him likely as a solid interim solution for several years as the company spins out from Dell and becomes a fully independent organization again.

“Obviously the board wanted to have someone who knows product, and has been there a long time, and is associated with the VMware core success — so that creates relatability [and stability].” He added, “At 57 he is the transitional candidate, and a good choice, a veteran who is happy to run this two-three or maybe five years and won’t go anywhere [in the interim]. And the board has time to find a long-term solution,” Mueller told me.

Mark Lockwood, lead analyst on VMware at Gartner, sees Raghuram as the right man for the job, with no reservations, one who will continue to implement the current strategy while putting his own stamp on the position.

“That the VMware board chose someone in Raghu Raghuram who has been the technical strategy executive inside the company for years speaks volumes about the board’s comfort level with the existing strategy trajectory of the company. Mr. Raghuram will most certainly steer the company slightly differently than Mr. Gelsinger did, but at least from the outside, the CEO appointment appears to be a stamp of approval on the company’s broad portfolio,” Lockwood said.

As for Poonen, he says that the writing was on the wall when he didn’t get the promotion. “Although Sanjay Poonen has indeed been a valuable executive for VMware, it was always unlikely that he would remain if not chosen for the CEO role,” Lockwood said.

Stephen Elliot, an analyst at IDC, was also bullish on the Raghuram appointment, saying he brings a broad understanding of the company, and that’s important to VMware right now. “He understands VMware customers, the technologies, M&A, and the importance of execution and its impact on profitable growth. He has been central to almost every successful strategy the company has created, and been a leader for product strategy and execution. He has a very good balance of making tactical and strategic moves to anticipate the value VMware can deliver for customers in a one-three year horizon,” Elliot said.

Elliot thinks Poonen will be just fine and will find a landing spot pretty quickly. “He is another very talented executive; he will become a CEO elsewhere, and another company will be very lucky,” he said. He says that it will take time to see if there is any impact from that, but he believes that VMware shouldn’t have trouble attracting other executive talent to fill in any gaps.

For every executive move, there are choices for replacements, and subsequent fallout from those choices. We saw a full-fledged example of that yesterday on display at VMware. If these industry experts are right, the company chose stability and reliability and a deep understanding of product. That would seem to be solid enough reasoning on the part of the board, even though Poonen leaving seems to be collateral damage from the decision, and a big loss for the company.

New Relic is bringing in a new CEO as founder Lew Cirne moves to executive chairman role

At the market close this afternoon ahead of its earnings report, New Relic, an applications performance monitoring company, announced that founder Lew Cirne would be stepping down as CEO and moving into the executive chairman role.

At the same time, the company announced that Bill Staples, a software industry vet, would be taking over as CEO. Staples joined the company last year as chief product officer before being quickly promoted to president and chief product officer in January. Today’s promotion marks a rapid rise through the ranks to lead the company.

Cirne said when he began thinking about stepping into that executive chairman role, he was looking for a trusted partner to take his place as CEO, and he found that in Staples. “Every founder’s dream is for the company to have a long-lasting impact, and then when the time is right for them to step into a different role. To do that, you need a trusted partner that will lead with the right core values and bring to the table what the company needs as an active partner. And so I’m really excited to move to the executive chairman role [and to have Bill be that person],” Cirne told me.

For Staples, who has worked at large organizations throughout his career, this opportunity to lead the company as CEO is the pinnacle of his long career arc. He called the promotion humbling, but one he believes he is ready to take on.

“This is a new chapter for me, a new experience to be a CEO of a public company with a billion-dollar-plus value valuation, but I think the experience I have in the seat of our customers, as well as the experience I’ve had at Microsoft and Adobe, very large companies with very large stakes running large organizations has really prepared me well for this next phase,” Staples said.

Cirne says he plans to take some time off this summer to give Staples the space to grow as the leader of the company without being in the shadow of the founder and long-time CEO, but he plans to come back and work with him as the executive chairman moving forward come the fall.

As he steps into this new role, Staples will be taking over. “Certainly I have a lot to learn about what it takes to be a great CEO, but I also come in with a lot of confidence that I’ve managed organizations at scale. You know I’ve been part of P&Ls that were many times larger than New Relic, and I have confidence that I can help New Relic grow as a company.”

Hope Cochran, managing director at Madrona Ventures, who is also the chairman of the New Relic Board, said that the board fully backs of the decision to pass the CEO torch from Cirne to Staples. “With the foundation that Lew built and Bill’s leadership, New Relic has a very bright future ahead and a clear path to accelerate growth as the leader in observability,” she said in a statement.

The official transition is scheduled to take place on July 1st.

Zencargo raises $42M to expand its digital-first freight-forwarding platform internationally

While consumers and businesses continue to use their purchasing power to spin the wheels of the globalized economy, one of the companies that’s built a technology platform to help that economy operate more smoothly is announcing an investment to double down on growth.

Zencargo, which has built a digital platform to enable freight forwarding — the process by which companies organize and track the movements of items they are making and selling (and the components needed for those items) — has raised £30 million (about $42 million). Alex Hersham, the CEO who co-founded the company with Richard Fattal (CCO) and Jan Riethmayer, said that London-based Zencargo will be using the funding to open offices in the Netherlands, Hong Kong and the U.S.; to more than double its headcount to 350 from 150 today; and to begin to make moves into trade finance — a critical lever for facilitating the trading activities that are the bread and butter of Zencargo’s business.

The Series B is being led by Digital+ Partners, with HV Capital, which led its previous round, also participating. Zencargo is not disclosing its valuation, but the company — which provides services both to companies and distributors like Amazon to ship goods to its fulfillment centers, and brands like Vivienne Westwood, Swoon Furniture, and Soho Home — said that it is on track to make £100 million in revenues this year, and £200 million in 2022.

That is against the backdrop of some major world events that have both proven to be challenges as well as opportunities for the startup.

Brexit in the U.K. has created quite a mess for moving goods in and out of the country and into Europe (difficult but ultimately a net positive for Zencargo: it helps facilitate some aspects of that movement for its clients). COVID-19, meanwhile, has impacted economies (again: a difficult impact but also a positive, in that people are spending more money on goods for themselves and less on travel, leading to more demand for shipping those goods around the globe).

The Suez Canal blockage, on the other hand, also continues to loom (not great: Hersham said that Zencargo and others are still dealing with the fallout of those delays, although it’s highlighted the need for blended approaches when it comes to moving goods, with some items shipped slower by sea, and others faster by air or road). And there is the growing priority of how shipping impacts carbon footprints (an area of opportunity, interestingly: Zencargo can provide more efficient routing, and also services to consider how to carbon offset shipping activities).

The more general challenge that Zencargo is tackling goes hand in hand with our existence as consumers.

Many of us do not blink an eye when we go online or to a store to procure something, and we get whatever that happens to be right away.

But the simplicity of wanting and subsequently obtaining goods sits on top of a huge, and hugely complex, logistics operation. It might involve components, assembly or growing and processing things, shipping from one place to another, passing through multiple distribution and shipping hubs, customs, retailers and finally delivery to your store, or directly to you — a logistics chain that, taking all the world’s goods into account, has been estimated to be worth up to $12 trillion annually. Freight forwarding is the process by which all of that logistics works as it should, and in itself accounts for hundreds of billions of dollars in spend, and potentially more than $1 trillion in costs when things go awry.

Traditionally, a lot of freight forwarding work has been done offline, a messy process involving paper and faxing, prone to mistakes, over- and under-supply based on sales and typically hard to scrutinize because of the lack of centralized information. Companies like Zencargo — along with others in the same space like Flexport — have built digitized platforms to manage all of this, tracking items by SKU data, matching shipments with real-time insights into sales and demand, and balancing different kinds of freight options to provide the right items at the right time. (Zencargo works across sea, air and land freight, with sea accounting for about half of all of its traffic, Hersham said.)

Zencargo’s services arguably will continue to see demand growing in line with the growth of the logistics industry, but the curveballs of the last several years, and in the last 12 months in particular, that have impacted the shipping business lay out an interesting road ahead for the startup in the future.

“The freight industry has struggled to keep pace with innovation. Archaic processes are still in place across the board, resulting in widespread inefficiencies,” said Patrick Beitel, managing director and founding partner at Digital+ Partners, in a statement. “Zencargo’s cutting edge technologies, plus deep industry experience and knowledge, are transforming the supply chain, and that marries up perfectly with Digital + Partners’ mission to back companies with best-in-class technology and exceptional management teams. We are honoured to join them on the next stage of their journey.”

Cisco to acquire Indy startup Socio to bring hybrid events to Webex

Cisco announced this morning that it intends to acquire Indianapolis-based startup Socio, which helps plan hybrid in-person and virtual events. The two companies did not share the purchase price.

Socio provides a missing hybrid event management component for the company to add to its Webex platform. The goal appears to be to combine this with the recent purchase of Slido and transform Webex from an application mostly for video meetings into a more comprehensive event platform.

“As part of Cisco Webex’s vision to deliver inclusive, engaging and intelligent meeting and event experiences, the acquisition of Socio Labs complements Cisco’s recent acquisition of Slido, an industry-leading audience engagement tool, which together will create a comprehensive, cost-effective and easy-to-use event management solution [ … ],” the company explained in a statement.

The impact of the pandemic was not lost on Cisco, and it’s clear that as we can foresee going back to live events, having the ability to combine it with a virtual experience means that you can open up your event to a much wider audience beyond those who can attend in person. That’s likely not something that’s going away, even after we get past COVID.

Jeetu Patel, SVP and GM for security and collaboration at Cisco says that the future of work is going to be hybrid, whether it’s for work meetings or larger events and Cisco is making this acquisition to expand the use cases for the Webex platform.

“Whether it’s a 1:1 call, a small team huddle, a group meeting or a large external event, we want to remove friction and help people engage with each other in an inclusive manner. Slido allows for every voice to be heard — even when you’re not talking. Socio allows for getting your voice heard by a large number of people,” Patel said.

And the company believes that Webex provides the platform to make it all happen. “It’s a really potent combination of technology to make human interactions more engaging, no matter the type of conversation,” he added.

Brent Leary, founder and principal analyst at CRM Essentials, says that it’s a smart move to take advantage of the changing events landscape and that this acquisition helps make Cisco a serious player in this space.

“As we get closer to a post-pandemic world, the need to create hybrid event experiences is going to quickly accelerate as people start venturing out to attend physical events. So having an event stack that combines local event support/participation with tools to integrate a broader virtual audience will be the future of event management,” Leary told me.

Socio was founded in 2016 and raised around $7 million in investment capital, according to Crunchbase data. It has a prestigious list of enterprise customers that includes Microsoft, Google, Jet Blue, Greenpeace, PepsiCo and Hyundai.

The deal is expected to close in Q4 of FY2021. When it does close, Socio’s 135 employees will be joining Cisco. The plan is to incorporate Socio’s tooling into the Webex platform while allowing it to continue as a stand-alone product, according to a Cisco spokesperson.

Salesforce is bringing drag and drop interactive components to its low-code toolkit

Low-code and no-code tools abound these days, as the industry attempts to give nontechnical end users the ability to create applications without code (or very little anyway). Salesforce has been a big proponent of this approach to help reduce the complexity of working on its platform, and today the CRM giant announced a new wrinkle: drag and drop interactive components.

These new components allow users to create more sophisticated kinds of interactions, says Ryan Ellis, SVP for product management and platform at Salesforce. “We’re introducing this new feature called Dynamic Interactions and prior to their existence you had to have developers if you wanted to be able to build essentially truly interactive applications,” Ellis said.

What he means by this is if you have an application made up of multiple components such as a list of companies, a map and information about the company. You can click a company name and its location instantly appears on the map, and information about the company appears alongside it.

Salesforce will be providing about 150 such interactions like maps, lists, Einstein next best action and so forth. Developers can also create these for users as reusable building blocks that make sense to your organization or make them available in the AppExchange for others to use. Finally, you might have a systems integrator or consultant help build them for you.

“With dynamic interactions, we’re really dramatically simplifying the process of building apps with components that communicate with each other, pass data back and forth and react to user actions. It’s an entirely no-code tool so that developers write the code once for their component, and then that component can be reused by people who don’t have technical skills by dragging and dropping them onto the page, then configuring what should happen when a user takes an action,” Ellis explained.

An example of dynamic interactions from Salesforce. Clicking an item of the left causes its locations to appear in the center and information about the selected item on the right.

Image Credits: Salesforce

He says that this is part of a larger trend of digital transformation happening across the industry, one that was accelerated by the pandemic, something we hear frequently from tech companies like Salesforce.

“There’s really this big push to go digital faster than ever before, and this was happening for years as we were seeing businesses having to pivot much more rapidly as new business models were coming about. […] But then in this last year COVID really changed the game, and people just had to put on full gas in terms of actually being able to deliver those digital transformations in some instances overnight,” he said.

When you combine that with a shortage of developers, it makes sense that Salesforce and many other companies in the industry are developing these low-code tools that allow nontechnical business users to build some applications themselves, while freeing developers to concentrate on more sophisticated organizational requirements.

Dynamic Interactions will be available starting today from Salesforce (in beta). The product is expected to be generally available around Dreamforce in the fall.

Ahead of Dell’s spin out, VMware appoints longtime exec Raghu Raghuram as its new CEO

Five months after it was announced that Pal Gelsinger would be stepping down as CEO of VMware to take the top job at Intel, the virtualization giant has finally appointed a permanent successor. Raghu Raghuram — a longtime employee of the company — has been appointed the new CEO. He will be taking on the new role on June 1. Until then, CFO Zane Rowe will continue in the role in the interim.

Raghuram has been with the company for 17 years in a variety of roles, most recently COO of products and cloud services. He’s also held positions at the company overseeing areas like data centers and VMware’s server business. Putting a veteran at the helm sends a clear message that VMware has picked someone clearly dedicated to the company and its culture. No drama here.

Indeed, the move is coming at a time when there is already a lot of other change underway and speaks to the company looking for stability and continuity to lead it through that. About a month ago, Dell confirmed long-anticipated news that it would be spinning out its stake in VMware in a deal that’s expected to bring Dell at least $9 billion — putting to an end a financial partnership that initially kicked off with an eye-watering acquisition of EMC in 2016. That partnership will not end the strategic relationship, however, which is set to continue and now Raghuram will be in charge of building and leading.

For that reason, you might look at this as a deal nodded through significantly by Dell.

“I am thrilled to have Raghu step into the role of CEO at VMware. Throughout his career, he has led with integrity and conviction, playing an instrumental role in the success of VMware,” said Michael Dell, chairman of the VMware board of directors, in a statement. “Raghu is now in position to architect VMware’s future, helping customers and partners accelerate their digital businesses in this multicloud world.”

Raghuram has not only been the person overseeing some of VMware’s biggest divisions and newer areas like software-defined networking and cloud computing, but he’s had a central role in building and driving strategy for the company’s core virtualization business, been involved with M&A and, as VMware points out, “key in driving partnerships with Dell Technologies,” among other partners.

“VMware is uniquely poised to lead the multicloud computing era with an end-to-end software platform spanning clouds, the data center and the edge, helping to accelerate our customers’ digital transformations,” said Raghuram in a statement. “I am honored, humbled and excited to have been chosen to lead this company to a new phase of growth. We have enormous opportunity, we have the right solutions, the right team and we will continue to execute with focus, passion and agility.”

The company also took the moment to update on guidance for its Q1 results, which will be coming out on May 27. Revenues are expected to come in at $2.994 billion, up 9.5% versus the same quarter a year ago. Subscription and SaaS and license revenue, meanwhile, is expected to be $1.387 billion, up 12.5%. GAAP net income per diluted share is expected to be $1.01 per diluted share, and non-GAAP net income per diluted share is expected to be $1.76 per diluted share, it said.

AWS releases tool to open source that turns on-prem software into SaaS

AWS announced today that it’s releasing a tool called AWS SaaS Boost as open source distributed under the Apache 2.0 license. The tool, which was first announced at the AWS re:Invent conference last year, is designed to help companies transform their on-prem software into cloud-based software as a service.

In the charter for the software, the company describes its mission this way: “Our mission is to create a community-driven suite of extensible building blocks for Software-as-a-Service (SaaS) builders. Our goal is to foster an open environment for developing and sharing reusable code that accelerates the ability to deliver and operate multi-tenant SaaS solutions on AWS.”

What it effectively does is provide the tools to turn the application into one that lets you sign up users and let them use the app in a multi-tenant cloud context. Even though it’s open source, it is designed to get you to move your application into the AWS system where you can access a number of AWS services such as AWS CloudFormation, AWS Identity and Access Management (IAM), Amazon Route 53, Elastic Load Balancing, AWS Lambda (Amazon’s serverless tool), and Amazon Elastic Container Service (Amazon’s Kubernetes Service). Although presumably you could use alternative services, if you were so inclined.

By making it open source, it gives companies that would need this kind of service access to the source code, giving them a comfort level and an ability to contribute to the project to expand upon the base product and give back to the community. That makes it a win for users who get flexibility and the benefit of a community behind the tool, and a win for AWS, which gets that community working on the tool to improve and enhance it over time.

“Our objective with AWS SaaS Boost is to get great quality software based on years of experience in the hands of as many developers and companies as possible. Because SaaS Boost is open source software, anyone can help improve it. Through a community of builders, our hope is to develop features faster, integrate with a wide range of SaaS software, and to provide a high quality solution for our customers regardless of company size or location,” Amazon’s Adrian De Luca wrote in a blog post announcing the intent to open source SaaS Boost.

This announcement comes just a couple of weeks after the company open-sourced its Deep Racer device software, which runs its machine-learning fueled mini race cars. That said, Amazon has had a complex relationship with the open source in the past couple of years, where companies like MongoDB, Elastic and CockroachDB have altered their open-source licenses to prevent Amazon from making their own hosted versions of these software packages.

Meet DarkSide and Their Ransomware – SentinelOne Customers Protected

The recent campaign targeting the Colonial Pipeline in the United States is a sobering example of the extent to which cybersecurity – specifically ransomware – threatens everyday life. There is a lot more to this than encrypted or stolen data. It’s hard to understand the economic reverberations of a disruptive attack on critical infrastructure, whether for financial gain or otherwise. With the pipeline being proactively shut down as of Sunday, May 9th, there are concerns around how this outage will affect ongoing fuel prices and for how long. How the coming weeks and months play out may serve as a template for predicting impact and risk associated with similar attacks that will inevitably follow.

SentinelOne detects and protects against DarkSide ransomware. No action is required for our customers.

SentinelOne Protects from DarkSide Ransomware

In this post, we discuss the evolution of the DarkSide malware and affiliate networks, including the evolution of their feature sets and recruitment areas.

Watch How SentinelOne Mitigates DarkSide Ransomware
Beyond Protection, it’s important that your security tool can mitigate and rollback in the case of a Ransomware attack

Who is DarkSide?

The attack on the Colonial Pipeline has been attributed to DarkSide, a relatively new ransomware family that emerged on the crimeware market in November 2020.

DarkSide claims not to attack Medical, Educational, Non-Profit, or Government sectors

DarkSide launched as a RaaS (Ransomware-as-a-Service) with the stated goal of only targeting ‘large corporations.’ They are primarily focused on recruiting Russian (CIS) affiliates, and are very skeptical of partnerships or interactions outside of that region. From the onset, DarkSide was focused on choosing the ‘right’ targets and identifying their most valuable data. This speaks to their efficiency and discernment when choosing where to focus their efforts. From their inception, DarkSide claimed they’d avoid attacking the medical, educational, non-profit, or government sectors.

DarkSide affiliate recruitment post

At the time of launch, the features offered by DarkSide were fairly standard. They emphasized their speed of encryption and a wealth of options for dealing with anything that may inhibit the encryption process (i.e., security software). They also advertised a Linux variant with comparable features. Following in the footsteps of recently successful ransomware families like Maze and Cl0p, DarkSide established a victim data leaks blog as further leverage to encourage ransom payouts.

The original DarkSide 1.0 Feature set was advertised as follows:

Windows [
	full ASM, salsa20 + rsa 1024, 
	i / o, own implementation of salsa and rsa, 
	fast / auto (improved space) / full, 
	token impersonalization for working with balls, 
	slave table, freeing busy files, 
	changing file permissions, 
	arp scanner, 
	process termination, 
	service termination, 
	drag-and-drop and much more].

Linux [
	C ++, chacha20 + rsa 4096, 
	multithreading (including Hyper-threading, analog of i / o on windows), 
	support for truncated OS assemblies (esxi 5.0+), 
	fast / space, 
	directory configuration and much more].

Admin panel [
	full ajax, 
	automatic acceptance of Bitcoin, Monero, 
	generation of win / lin builds with indication of all parameters (processes, services, folders, extensions ...), 
	bots reporting and detailed statistics on the company’s performance, 
	automatic distribution and withdrawal of funds, 
	sub -accounts, 
	online chat and many others].

Leak site [
	hidden posts, 
	phased publication of target data and many more functionality].

CDN system for data storage [
	Receiving quotas, 
	fast data loading, 
	storage 6m from the moment of loading].

A Well-Organized Affiliate Network

Hopeful affiliates are subject to DarkSide’s rigorous vetting process, which examines the candidate’s ‘work history,’ areas of expertise, and past profits among other things. To get started, affiliates were required to deposit 20 BTC (at the time, that amounted to around $300,000 USD).

DarkSide announces improved CDN

Over the following months, DarkSide continued to improve its services, while also expanding its affiliate network. By late November 2020, DarkSide launched a more advanced Content Delivery Network (CDN) that allowed their operators to more efficiently store and distribute stolen victim data. Many of their high-value targets found themselves listed on the victim blog, including a number of financial, accounting, and legal firms, as well as technology companies.

Initial access can take many forms depending on the affiliate involved, their needs, and timeline. A majority of the campaigns observed were initiated only after the enterprise had been thoroughly scouted via Cobalt Strike beacon infections. After the initial reconnaissance phase, the operators would deploy the DarkSide ransomware wherever it would cause the greatest disruption.

DarkSide Decryption Tool – Is it Working?

In January 2021, Bitdefender released a DarkSide decryption tool. This tool was also posted to the NoMoreRansom project website. The tool had a reportedly high success rate.

DarkSide 2.0 performance comparisons

By March, the group announced the launch of the new and improved DarkSide 2.0. The new iteration included many improvements for both their Windows and Linux variants and is no longer subject to the decryption tool. DarkSide 2.0 reportedly encrypts data on disk twice as fast as the original.

Other updated features include:

  • Expanded multi-processor support (parallel/simultaneous encryption across volumes)
  • EXE and DLL-based payloads
  • Updated SALSA20+RSA1024 implementation with “proprietary acceleration”
  • New operating modes (Fast / Full / Auto)
  • 19 total build settings
  • Active account impersonation
  • Active Directory support (discovery and traversal)
  • New CMD-line parameter support

On the Linux side, DarkSide 2.0 offers the following updates:

  • Updated multithreading support
  • Updated CHACHA20 + RSA 4096 implementation
  • 2 new operating modes (Fast / Space)
  • 14 Total build settings
  • Support for all major ESXi versions
  • NAS support (Synology, OMV)

Along with this expanded feature set, SentinelLabs researchers have seen a shift in the deployment of the DarkSide ransomware, from standard packers like VMProtect and UPX to a custom packer internally referred to as ‘encryptor2.’

A Battle for Territory

With the release of DarkSide 2.0, the group has continued to increase its footprint in the Ransomware landscape. Along with their territorial expansion throughout 2021, DarkSide also increased their ‘pressure campaigns’ on victims to include DDoS attacks along with the threat of data leakage. They are able to invoke L3/L7 DDoS attacks if their victims choose to resist ‘cooperation’.

More recently, DarkSide operators have been attempting to attract more expertise around assessing data and network value, along with seeking others to provide existing access or newer methods of initial access. These efforts are meant to make operations more streamlined and increase efficiency.

New methods and talent areas

The Colonial Pipeline attack is only the latest in a slew of increasingly daring ransomware attacks. The absolute best defense against a severe ransomware attack (and the nightmare that follows) is preparation and prevention. Technology is a huge part of that, but one must not discount user hygiene and education. It is vital to keep end users up to date on what threats are out there and how to spot them. Vigilant users, along with robust preventative controls are key. Business continuity planning and disaster recovery drills are not fun, but they are critical and necessary to ensure readiness and resilience against these threats.

The SentinelOne platform is fully capable of preventing and detecting the malware and artifacts associated with DarkSide ransomware. We hope that the pipeline starts flowing again soon; our society depends on it to live.

Indicators of Compromise

SHA256

b9d60d450664c1e8fbfd6b2ec58fdeb2fd81797e183906a4536b59bc4f79846f
0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9
b09cb9d531931fb4725b0e49d85bb81cfc2691ce19ff3567ca0f7b44af6594a1
ca77f63a08f4e01e7e7294695eb300610e65f22333256d547d0125075bed2cc8
6184e4c8915a3924a9a12e26c42cffef35a1d1380a8c0a236ef65df71b20c217
7375adedb82fd62cefc6b6fd20a704a164e056022f3b8c2e1b94f3a9b8361478
f7eda7111ac0f95dfbd817bd0962defe35412de12964f178421122e96c72495b
b43bde75780244aeee719ae926c1f901291574c9400b5e6d0c2fdc135d0c6fe5
2b214bddaab130c274de6204af6dba5aeec7433da99aa950022fa306421a6d32
9cee5522a7ca2bfca7cd3d9daba23e9a30deb6205f56c12045839075f7627297
459d655c416cc429a7661c0dddc3826a6b34cce0c662ccd8db735934858aa010
68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7
bafa2efff234303166d663f967037dae43701e7d63d914efc8c894b3e5be9408
48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a
3337e3875b05e0bfba69ab926532e3f179e8cfbf162ebb60ce58a0281437a7ef
b1c7872598053eb2fd07b0eabe223cbccef2edd2e403255b5ab8646e32124862
156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673
4d9432e8a0ceb64c34b13d550251b8d9478ca784e50105dc0d729490fb861d1a
61ca175c2f04cb5279f8507e69385577cf04e4e896a01d0b5357746a241c7846
bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893
a11cc5051e3a88428db495f6d8e4b6381a1cb3fa5946a525ef5c00bfcb44e210
2dcac9f48c3989619e0abd200beaae901852f751c239006886ac3ec56d89e3ef
243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60
12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975
5860f2415aa9a30c045099e3071f099313f653ae1806d6bcdb5f47d5da96c6d7
78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134
dc4b8dfff72ff08ec4daa8db4c096a350a9a1bf5434ba7796ab10ec1322ac38c
8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc
4edb883d1ac97824ee42d9f92917cc84b52995abcd17b2852a7e3d5bb567ffbe
e9417cb1baec2826e3f5a6f64ade26c1374d74d8aa41bfabd29ea20ea5894b14
fb76b4a667c6d790c39fcc93a3aac8cd2a224f0eb9ece4ecfd7825f606c2a8b6
36bc32becf287402bf0e9c918de22d886a74c501a33aa08dcb9be2f222fa6e24
2aa1bbbe47f04627a8ea4e8718ad21f0d50adf6a32ba4e6133ee46ce2cd13780
7d57e0ba8b36ec221b16807ce4e13a1125d53922fa50c3827a5ebd6811736ffd
e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173

SHA1

08d1da979f8d568b62701d7cedf1d0e81b7bab4d
c511ae4d80aaa281c610190aa13630de61ca714c
ff9da8ec309210e2324dbe4a79d416f90de285c0
2269cdc706b412d55749dd7b8a8b7cc14ce83532
06856cab5b85104788d679bbbb75d270a90eabb0
e5b0a0f4a59d6d5377332eece20f8f3df5cebe4e
3ed7c6f0f90e176eeca091ebe8528fba10603d51
62d8735539d102f92a8a30b15a94e242bff3613e
5f1cbc3d99558307bc1250d084fa968521482025
d1dfe82775c1d698dd7861d6dfa1352a74551d35
9d39c0d21b96ebb210fe467ad50604f05543db8e
e6b47869caa776840ab79856b04096152103c71d
666a451867ce40c1bd9442271ef3be424e2d9b17
4bd6437cd1dc77097a7951466531674f80c866c6
e50d9e3bd91908e13a26b3e23edeaf577fb3a095
142ab367d5f83018d30c3d17b9dd87f2e35eba08
2715340f82426f840cf7e460f53a36fc3aad52aa
86ca4973a98072c32db97c9433c16d405e4154ac
7944ae1d281bbeeb6f317e2ececf6b4c83e63a06
a4e2deb65f97f657b50e48707b883ce2b138e787
f90f83c3dbcbe9b5437316a67a8abe6a101ef4c3
483c894ee5786704019873b0fc99080fdf1a0976
7ae73b5e1622049380c9b615ce3b7f636665584b
2fc8514367d4799d90311b1b1f277b3fca5ca731
d3495ac3b708caeceffab59949dbf8a9fa24ccef
7a29a8f5e14da1ce40365849eb59487dbb389d08
1f90eb879580faef3c37e10d0a0345465eebd4ee
88fc623483f7ffe57f986ed10789e6723083fcd8
996567f5e84b7666ff3182699da0de894e7ea662
21145fd2cc8767878edbd7d1900c4c4f926a6d5b
076d0d8d07368ef680aeb0c08f7f2e624c46cbc5
33a6b39fbe8ec45afab14af88fd6fa8e96885bf1
47ee1b6f495db98143f821f9f8dd49448fe607c8
b16a1eb8bc2e5d4ded04bfaa9ee2b861ead143ba
539c228b6b332f5aa523e5ce358c16647d8bbe57

MITRE ATT&CK

T1112 Modify Registry
T1012 Query Registry
T1082 System Information Discovery
T1120 Peripheral Device Discovery
T1005 Data from Local System
T1486 Data Encrypted for Impact
T1543.003 Create or Modify System Process: Windows Service
T1490 Inhibit System Recovery
T1553.004 Subvert Trust Controls: Install Root Certificate
T1078 Valid Accounts


Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security