Former Facebook teammates raise $10.4M in Sequoia-led round to launch features development

/0 Comments/in /by

Statsig is taking the A/B testing applications that drive Facebook’s growth and putting similar functionalities into the hands of any product team so that they, too, can make faster, data-informed decisions on building products customers want.

The Seattle-based company on Thursday announced $10.4 million in Series A funding, led by Sequoia Capital, with participation from Madrona Venture Group and a group of individual investors, including Robinhood CPO Aparna Chennapragada, Segment co-founder Calvin French-Owen, Figma CEO Dylan Field, Instacart CEO Fidji Simo, DoorDash exec Gokul Rajaram, Code.org CEO Hadi Partovi and a16z general partner Sriram Krishnan.

Co-founder and CEO Vijaye Raji started the company with seven other former Facebook colleagues in February, but the idea for the company started more than a year ago.

He told TechCrunch that while working at Facebook, A/B testing applications, like Gatekeeper, Quick Experiments and Deltoid, were successfully built internally. The Statsig team saw an opportunity to rebuild these features from scratch outside of Facebook so that other companies that have products to build — but no time to build their own quick testing capabilities — can be just as successful.

Statsig’s platform enables product developers to run quick product experiments and analyze how users respond to new features and functionalities. Tools like Pulse, Experiments+ and AutoTune allow for hundreds of experiments every week, while business metrics guide product teams to build and ship the right products to their customers.

Raji intends to use the new funding to hire folks in the area of design, product, data science, sales and marketing. The team is already up to 14 since February.

“We already have a set of customers asking for features, and that is a good problem, but now we want to scale and build them out,” he added.

Statsig has no subscription or upfront fees and is already serving millions of end-users every month for customers like Clutter, Common Room and Take App. The company will always offer a free tier so customers can try out features, but also offers a Pro tier for 5 cents per event so that when the customer grows, so does Statsig.

Raji sees adoption of Statsig coming from a few different places: developers and engineers that are downloading it and using it to serve a few million people a month, and then through referrals. In fact, the adoption the company is getting is “bottom up,” which is what Statsig wants, he said. Now the company is talking to bigger customers.

There are plenty of competitors for this product, including incumbents in the market, according to Raji, but they mostly focus on features, while Statsig provides insights and ties metrics back to features. In addition, the company has automated analysis where other products require manual set up and analysis.

Sequoia partner Mike Vernal worked at Facebook prior to joining the venture capital firm and had worked with Raji, calling him “a top 1% engineer” that he was happy to work with.

Having sat on many company boards, he has found that many companies spend a long time talking about sales and marketing, but very little on product because there is not an easy way to get precise numbers for planning purposes, just a discussion about what they did and plan to do.

What Vernal said he likes about Statsig is that the company is bringing that measurement aspect to the table so that companies don’t have to hack together a poorer version.

“What Statsig can do, uniquely, is not only set up an experiment and tell if someone likes green or blue buttons, but to answer questions like what the impact this is of the experiment on new user growth, retention and monitorization,” he added. “That they can also answer holistic questions and understand the impact on any single feature on every metric is really novel and not possible before the maturation of the data stack.”

The truth about SDK integrations and their impact on developers

 

Ransomware Gangs and the Name Game Distraction

/0 Comments/in /by

It’s nice when ransomware gangs have their bitcoin stolen, malware servers shut down, or are otherwise forced to disband. We hang on to these occasional victories because history tells us that most ransomware moneymaking collectives don’t go away so much as reinvent themselves under a new name, with new rules, targets and weaponry. Indeed, some of the most destructive and costly ransomware groups are now in their third incarnation.

A rough timeline of major ransomware operations and their reputed links over time.

Reinvention is a basic survival skill in the cybercrime business. Among the oldest tricks in the book is to fake one’s demise or retirement and invent a new identity. A key goal of such subterfuge is to throw investigators off the scent or to temporarily direct their attention elsewhere.

Cybercriminal syndicates also perform similar disappearing acts whenever it suits them. These organizational reboots are an opportunity for ransomware program leaders to set new ground rules for their members — such as which types of victims aren’t allowed (e.g., hospitals, governments, critical infrastructure), or how much of a ransom payment an affiliate should expect for bringing the group access to a new victim network.

I put together the above graphic to illustrate some of the more notable ransom gang reinventions over the past five years. What it doesn’t show is what we already know about the cybercriminals behind many of these seemingly disparate ransomware groups, some of whom were pioneers in the ransomware space almost a decade ago. We’ll explore that more in the latter half of this story.

One of the more intriguing and recent revamps involves DarkSide, the group that extracted a $5 million ransom from Colonial Pipeline earlier this year, only to watch much of it get clawed back in an operation by the U.S. Department of Justice.

After acknowledging someone had also seized their Internet servers, DarkSide announced it was folding. But a little more than a month later, a new ransomware affiliate program called BlackMatter emerged, and experts quickly determined BlackMatter was using the same unique encryption methods that DarkSide had used in their attacks.

DarkSide’s demise roughly coincided with that of REvil, a long-running ransomware group that claims to have extorted more than $100 million from victims. REvil’s last big victim was Kaseya, a Miami-based company whose products help system administrators manage large networks remotely. That attack let REvil deploy ransomware to as many as 1,500 organizations that used Kaseya.

REvil demanded a whopping $70 million to release a universal decryptor for all victims of the Kaseya attack. Just days later, President Biden reportedly told Russian President Vladimir Putin that he expects Russia to act when the United States shares information on specific Russians involved in ransomware activity.

A REvil ransom note.

Whether that conversation prompted actions is unclear. But REvil’s victim shaming blog would disappear from the dark web just four days later.

Mark Arena, CEO of cyber threat intelligence firm Intel 471, said it remains unclear whether BlackMatter is the REvil crew operating under a new banner, or if it is simply the reincarnation of DarkSide.

But one thing is clear, Arena said: “Likely we will see them again unless they’ve been arrested.”

Likely, indeed. REvil is widely considered a reboot of GandCrab, a prolific ransomware gang that boasted of extorting more than $2 billion over 12 months before abruptly closing up shop in June 2019. “We are living proof that you can do evil and get off scot-free,” Gandcrab bragged.

And wouldn’t you know it: Researchers have found GandCrab shared key behaviors with Cerber, an early ransomware-as-a-service operation that stopped claiming new victims at roughly the same time that GandCrab came on the scene.

GOOD GRIEF

The past few months have been a busy time for ransomware groups looking to rebrand. BleepingComputer recently reported that the new “Grief” ransomware startup was just the latest paintjob of DoppelPaymer, a ransomware strain that shared most of its code with an earlier iteration from 2016 called BitPaymer.

All three of these ransom operations stem from a prolific cybercrime group known variously as TA505, “Indrik Spider” and (perhaps most memorably) Evil Corp. According to security firm CrowdStrike, Indrik Spider was formed in 2014 by former affiliates of the GameOver Zeus criminal network who internally referred to themselves as “The Business Club.”

The Business Club was a notorious Eastern European organized cybercrime gang accused of stealing more than $100 million from banks and businesses worldwide. In 2015, the FBI offered a standing $3 million bounty for information leading to the capture of the Business Club’s leader — Evgeniy Mikhailovich Bogachev. By the time the FBI put a price on his head, Bogachev’s Zeus trojan and later variants had been infecting computers for nearly a decade.

The alleged ZeuS Trojan author, Evgeniy Mikhaylovich Bogachev. Source: FBI

Bogachev was way ahead of his colleagues in pursuing ransomware. His Gameover Zeus Botnet was a peer-to-peer crime machine that infected between 500,000 and a million Microsoft Windows computers. Throughout 2013 and 2014, PCs infected with Gameover were seeded with Cryptolocker, an early, much-copied ransomware strain allegedly authored by Bogachev himself.

CrowdStrike notes that shortly after the group’s inception, Indrik Spider developed their own custom malware known as Dridex, which has emerged as a major vector for deploying malware that lays the groundwork for ransomware attacks.

“Early versions of Dridex were primitive, but over the years the malware became increasingly professional and sophisticated,” CrowdStrike researchers wrote. “In fact, Dridex operations were significant throughout 2015 and 2016, making it one of the most prevalent eCrime malware families.”

That CrowdStrike report was from July 2019. In April 2021, security experts at Check Point Software found Dridex was still the most prevalent malware (for the second month running). Mainly distributed via well-crafted phishing emails — such as a recent campaign that spoofed QuickBooks — Dridex often serves as the attacker’s initial foothold in company-wide ransomware attacks, CheckPoint said.

REBRANDING TO AVOID SANCTIONS

Another ransomware family tied to Evil Corp. and the Dridex gang is WastedLocker, which is the latest name of a ransomware strain that has rebranded several times since 2019. That was when the Justice Department put a $5 million bounty on the head of Evil Corp., and the Treasury Department’s Office of Foreign Asset Control (OFAC) said it was prepared to impose hefty fines on anyone who paid a ransom to the cybercrime group.

Alleged Evil Corp leader Maksim “Aqua” Yakubets. Image: FBI

In early June 2021, researchers discovered the Dridex gang was once again trying to morph in an effort to evade U.S. sanctions. The drama began when the Babuk ransomware group announced in May that they were starting a new platform for data leak extortion, which was intended to appeal to ransomware groups that didn’t already have a blog where they can publicly shame victims into paying by gradually releasing stolen data.

On June 1, Babuk changed the name of its leaks site to payload[dot]bin, and began leaking victim data. Since then, multiple security experts have spotted what they believe is another version of WastedLocker dressed up as payload.bin-branded ransomware.

“Looks like EvilCorp is trying to pass off as Babuk this time,” wrote Fabian Wosar, chief technology officer at security firm Emsisoft. “As Babuk releases their PayloadBin leak portal, EvilCorp rebrands WastedLocker once again as PayloadBin in an attempt to trick victims into violating OFAC regulations.”

Experts are quick to point out that many cybercriminals involved in ransomware activity are affiliates of more than one distinct ransomware-as-a-service operation. In addition, it is common for a large number of affiliates to migrate to competing ransomware groups when their existing sponsor suddenly gets shut down.

All of the above would seem to suggest that the success of any strategy for countering the ransomware epidemic hinges heavily on the ability to disrupt or apprehend a relatively small number of cybercriminals who appear to wear many disguises.

Perhaps that’s why the Biden Administration said last month it was offering a $10 million reward for information that leads to the arrest of the gangs behind the extortion schemes, and for new approaches that make it easier to trace and block cryptocurrency payments.

Marvell nabs Innovium for $1.1B as it delves deeper into cloud ethernet switches

/0 Comments/in /by

Marvell announced this morning it has reached an agreement to acquire Innovium for $1.1 billion in an all-stock deal. The startup, which raised over $400 million according to Crunchbase data, makes networking ethernet switches optimized for the cloud.

Marvell president and CEO Matt Murphy sees Innovium as a complementary piece to the $10 billion Inphi acquisition last year, giving the company, which makes copper-based chips, more ways to work across modern cloud data centers.

“Innovium has established itself as a strong cloud data center merchant switch silicon provider with a proven platform, and we look forward to working with their talented team who have a strong track record in the industry for delivering multiple generations of highly successful products,” Marvell CEO Matt Murphy said in a statement.

Innovium founder and CEO Rajiv Khemani, who will remain as an advisor post-close, told a familiar tale from a startup CEO being acquired, seeing the sale as a way to accelerate more quickly as part of a larger organization than it could on its own. “As we engaged with Marvell, it became clear that our data center optimized portfolio combined with Marvell’s scale, leading technology platform and complementary portfolio, can accelerate our growth and vision of delivering breakthrough switch silicon for the cloud and edge,” he wrote in a company blog post announcing the deal.

2021 will be a calmer year for semiconductors and chips (except for Intel)

The company, which was founded in 2014, raised more than $143 million last year on a post-money valuation of $1.3 billion, according to PitchBook data. The question is, was this a reasonable deal for the company given that valuation?

No company wants to sell for less than it was last valued by its investors. In some cases, such deals can still be accretive for early backers of the selling concern, but not always. In this case TechCrunch is not privy to all the details of the Innovium cap table and what its later investors may have built into their deals with the company in the form of downside protection; such measures can tilt the value of the sale of a company more toward its later and final investors. This is usually managed at the expense of its earlier backers and employees.

Still, the Innovium deal should not be seen as a failure. Building a company that sells for north of $1 billion in equity value is impressive. The deal appears to be slightly smaller in enterprise value terms. In the business world, enterprise value is a useful method of valuing the true cost of an acquisition. In the case of Innovium, a large cash position, what was described as “Innovium cash and exercise proceeds expected at closing of approximately $145 million,” lowered the cost of the transaction to a more modest $955 million in net outlays.

Our general perspective is that the sale is probably not the outcome that Innovium’s backers had hoped for, but that it may still prove lucrative to early workers and early investors, and still works at that lower figure. It’s also notable how in today’s market of mega-rounds and surfeit unicorns, an exit north of the $1 billion mark in equity terms can be viewed as a disappointment in any terms. Innovium is selling for around the price that Facebook paid for Instagram in 2012, a deal that at the time was so large that it dominated technology headlines around the world.

But with so much capital available today, private valuations are soaring and mega deals abound. And recent rounds north of $100 million, much like Innovium’s 2020-era, $143 million round, can set companies up with rich valuations and a narrow path in front of them to beat those heightened expectations.

What likely happened? Perhaps Innovium found itself with more cash than opportunities to spend it; perhaps it simply needed a large partner to help it better sell into its market. With expected revenues of $150 million in Marvell’s fiscal 2023, its next fiscal period, Innovium did not fail to reach scale. It may have simply grown well as a private, independent company, and stalled out after its last round.

Regardless, a billion-dollar exit is a billion-dollar exit. The deal is expected to close by the end of this year. While both company boards have approved the deal, it still must clear regular closing hurdles, including approval by Innovium’s private stock holders.

More chip industry action as Marvell is acquiring Inphi for $10B

Product-led revenue startup Correlated launches with $8.3M seed

/0 Comments/in /by

Correlated on Wednesday announced it raised $8.3 million in seed funding to launch its product-led growth platform for sales teams.

NextView Ventures and Harrison Metal co-led the round and were joined by Apollo Projects, Attentive co-founders Brian Long and Andrew Jones, Cockroach Labs co-founder Ben Darnell and Atrium’s Pete Kazanjy. The round includes funding raised last year and more recent follow-on funding from both NextView and Harrison, co-founder and CEO Tim Geisenheimer told TechCrunch.

The New York-based company was founded in 2020 by Geisenheimer and Diana Hsieh, who overlapped at TimescaleDB, and John Pena, who Geisenheimer met at Facet. In their previous roles, they saw a need to connect product data to sales tools.

While at Timescale, Geisenheimer said there were thousands of free users to talk to, and he and Hsieh built a similar version of a product-led growth platform there, but secretly wished there was something more like Correlated available.

What they saw was data across multiple tools being stored manually on spreadsheets so that actionable insights could be generated. The data would quickly become outdated. Add in that the way customers use products now is different. Traditionally, customers would not be able to use a product until they talked to the sales team. Today, customers start using products for free and either get value from it or not, but sales teams don’t have real-time data on their experience.

“Sales needs to know how customers are using the product and the right time for sales to engage based on maturity of the experience,” Geisenheimer said. “That was the missing piece of it and sales teams ended up talking to the wrong people. With Correlated, they can close more deals efficiently.”

Startups have never had it so good

Correlated’s technology pulls in product usage data from tools and data warehouses and connects to a management platform like Salesforce or HubSpot, stitching it together into a data graph to show how customers are using a product. For example, within a company of 200 to 500 employees, a salesperson can see the frequency employees logged in and be alerted of when the best opportunity is to make the sale.

The company has a SaaS pricing model and is already working with mid-market companies like Ally, Pulumi, ReadMe and LaunchNotes. To support its launch out of beta, Geisenheimer intends to use the new funding for hiring across functions like engineering and go-to-market. The company has 11 employees currently.

There are other product-led growth platforms out there that raised venture capital funding recently, for example, Endgame, and similarly Geisenheimer said the competition is often in-house product teams building their own systems. Correlated’s differentiator is that it has taken on that task itself and enables customers to quickly see value once they are up-and-running, he added.

David Beisel, co-founder and partner at NextView Ventures, said his firm invests in category stage companies and is currently operating out of its fourth fund, infusing business-to-business SaaS and e-commerce companies. Beisel has known Geisenheimer for nearly a decade now, having met him when NextView invested in one of Geisenheimer’s previous companies, TapCommerce.

“At the end of the day with Tim, he knows sales and the company is selling a product that has a strong founder market fit,” Beisel said. “We are moving toward a world where end-user adoption of software — not the initial engagement — is growing over time. Instead, Correlated empowers that initial sale and account expansion and that will align with where the industry is going.”

Bootstrapping, managing product-led growth and knowing when to fundraise

 

FullStory raises $103M at a $1.8B valuation to combat rage clicks on websites and apps

/0 Comments/in /by

Even with all the years of work that have been put into improving how screen-based interfaces work, our experiences with websites, mobile apps, and any other interactive service you might use still often come up short: we can’t find what we want, we’re bombarded with exactly what we don’t need, or the flow is just buggy in one way or another.

Now, FullStory, one of the startups that’s built a platform to identify when all of the above happens and provide suggestions to publishers for fixing it — it’s obsessed enough with the issue that it went so far as to trademark the phrase “Rage Clicks”, the focus of its mission — is announcing a big round of funding, a sign of its success and ambitions to do more.

The Atlanta-based company has closed a Series D round of $103 million, an oversubscribed round that actually was still growing between me interviewing the company and publishing this story (when we talked last week the figure was $100 million). Permira’s growth fund — which has previously invested in other customer experience startups like Klarna and Nexthink — is leading this round, with previous investors Kleiner Perkins, GV, Stripes, Dell Technologies Capital, Salesforce Ventures, and Glynn Capital also participating.

FullStory, which has raised close to $170 million to date, has confirmed that the investment values the company at $1.8 billion.

Scott Voigt, FullStory’s founder and CEO, tells me that FullStory currently has some 3,100 paying customers on its books across verticals like retail, SaaS, finance, and travel (customers include Peloton, the Financial Times, VMware and JetBlue), which collectively are on course to rack up more than 15 billion user sessions this year — working out to 1 trillion interactions involving clicks, navigations, highlights, scrolls, and frustration signals. It says that annual recurring revenue has to date risen by more than 70% year-on-year.

The plan now will be to continue investing in R&D to bring more real-time intelligence into its products, “and pass those insights on to customers,” and also to “move more aggressively into Europe and Asia Pacific,” he added.

FullStory competes with others like Glassbox and Decibel, although it also claims its tools have more presence on websites than its three biggest competitors combined.

Working across different divisions like product, customer success and marketing, and engineering, FullStory uses machine learning algorithms to analyze how people navigate websites and other digital interfaces.

If approved as part of the “consent gate” you might encounter because of, say, GDPR regulations, it then tracks things like when they are clicking in areas excessively over a short period of time because of delays (the so-called “rage clicks”); or when a click leads nowhere because of, for example, a blip in a piece of JavaScript; or when a person is just scrolling or moving their mouse or cursor or finger in a frustrated (fast) way — again with little or no subsequent activity (or activity from the customer ceasing altogether) resulting from it. It doesn’t use — nor does it have plans to — use eye tracking, or anything like sentiment analysis around data that customers put into, say, customer response windows.

FullStory then packages up the insights that it does collect into data streams that can be used with various visualization tools (having Salesforce as a strategic backer is interesting in this regard, given that it owns Tableau), or spreadsheets, or whatever a customer chooses to put them into. While it doesn’t offer direct remediation (perhaps an area it could tackle in the future), it does offer suggestions for alternative actions to fix whatever problems are arising.

Part of what has given FullStory a big boost in recent times (this round is by far the biggest fundraise the company has ever done) is the fact that, in today’s world, digital business has become the centerpiece of all business. Because of Covid-19 and the need for social distancing that have taken away some of the traffic of in-person experiences like going to stores, organizations that have natively or built experiences online are seeing unprecedented amounts of traffic; and they are now joined by organizations that have shifted into digital experiences simply to stay in business.

All of that has contributed to a huge amount of content online, and a big shift in mindset to making it better (and in the most urgent of cases, even more basically, simply usable), and that has resulted in the stars aligning for companies like FullStory.

“The category was so nascent to begin with that we had to explain the concept to customers,” Voigt told me of the company’s early days, where selling meant selling would-be customers on to the very idea of digital experience insights. “But digital experience, in the wake of Covid-19, suddenly mattered more than it ever has before, and the continued amount of inbound interest has been afterburner for us.” He noted that demand is increasing among mid-market and enterprise organizations, and something that has also helped FullStory grow is the general movement of talent in the industry.

“Our customers tend to take their tools with them when they change their jobs,” he said. Those tools include FullStory’s analytics.

The evolution of bringing more AI into the world of basically structuring what might otherwise be unstructured data has been a big boost to the world of analytics, and investors are interested in FullStory because of how it’s taken that trend and grown its business on top of it.

“We are very excited to partner with the FullStory team as they continue to expand and build a truly extraordinary technology brand that improves the digital experience for all stakeholders,” said Alex Melamud, who led the transaction on behalf of Permira Growth, in a statement.

“Traditional analytics have been upended by AI- and ML-enabled approaches that can instantly uncover nuanced patterns and anomalies in customer behavior,” said Bruce Chizen, a senior advisor at Permira, in a statement. “Leveraging both structured and unstructured data, FullStory has rapidly established itself as the market and technology leader in DXI and is now the fastest-growing company in the category and the de facto system of record for all digital experience data.” Chizen is joining the FullStory Board with this round.

How Today’s Supply Chain Attacks Are Changing Enterprise Security

/0 Comments/in /by

Exploiting Trust

When we think of the word ‘trust’, what thoughts jump to the forefront of our minds? It initially evokes thoughts of personal relationships, with our closest family members and long term friendships or colleagues, where you know those individuals are consistently and reliably there for you. They are trusted for their authenticity, their integrity and honesty, they listen to you and ultimately are discreet with your information. However, that trust as we have often experienced is something that is fragile and easily damaged. While it is implicit for some relationships, for others, it is easier to lose that feeling of trust.

If we relate trust to the information security industry and the third party tools and systems that we implement to help secure our organisations, then the same concepts hold true. We place our trust in security systems that have earned trust by proving to be reliable and consistent, by demonstrating integrity, value and confidentiality, through a trusted network of recommendations amongst many other data points.

That trust is used to help us manage and mitigate risk and in turn helps other business relationships place their trust in us, and so trust is chained together from business to business, supplier to supplier, vendor to vendor.

However, when we select a security system to help protect ourselves, we are also accepting hidden areas of trust: relationships that you are unaware that you have agreed to, ones that were made on your behalf in a chain of relationships beyond your immediate control. These chains sometimes have weak points, areas where a gap has been identified, where a process or tool might not be quite as robust as yours, and this is what the supply chain attackers in the last 10 years have looked to exploit.

Supply chain attacks look to areas of trust that are fragile. Weaknesses in these chains can be used to bypass the implicit trust you have in your own security systems, processes and organisations. Something you were, until that point, completely unaware of.

In this post, we will explore some of the high-profile examples of where these chains have been compromised and look to learn lessons from these incidents, to help identify trust weaknesses and help mitigate potential future problems.

RSA Security – 2011

Back in 2011, RSA – the security division of EMC – was attacked and critical SecurID product secrets were stolen. These secrets would allow an attacker to clone and replicate the two factor authentication system supplied by RSA.

RSA SecurID token at the time was a very popular hardware based (something you have), six digit, one-time token-based password system used by companies to reduce the reliance and insecurity of static usernames and passwords. By breaking into RSA, the attacker accessed product seed data that compromised up to 40 million tokens in the field.

The attackers’ ultimate goal was to target military secrets held by Lockheed Martin and Northrop Grumman, but they had been prevented from doing so by those organizations’ use of the strong authentication token supplied by RSA.

Organizations had placed their trust in the RSA SecurID system to provide an additional layer of security, and the attackers bypassed the trust of this system by targeting the supplier of the tokens directly.

At the time, the attacker employed a zero day vulnerability in Adobe Flash Player to inject their backdoor, delivered by a phishing email to an RSA employee.

CCleaner March 2017

In March 2017, the hugely popular computer cleaning software called CCleaner was compromised by an attacker to help distribute their malicious code to unsuspecting victims that used CCleaner as a trustworthy tool. It was a devastatingly successful attack, which reportedly led to approximately 1.6 million downloads of the infected copy of CCleaner.

The attackers compromised the maker of CCleaner’s network to inject their software, known as ShadowPad, into the application. The attackers were specifically targeting a smaller group of companies and some eleven of those targeted were successfully compromised by the backdoored CCleaner application.

NotPetya June 2017

The NotPeyta attack of summer 2017 involved a ransomware-style attack which encrypted data and in some cases also destroyed the MBR (Master Boot Record) of infected computers.

This attack leveraged the Shadowbrokers recently released Eternalblue and EternalRomance exploits, which took advantage of vulnerabilities within the SMBv1 (Server Message Block) protocols for computers running MS Windows. These were the same vulnerabilities that were used in the WannaCry outbreak earlier that year.

A similar theme of leveraging the trust in the supply chain was implemented. The attackers used a legitimate software package update mechanism of a company called M.E.Doc, a financial software package predominantly used by Ukrainian financial institutions, to launch their attack. While it was clear the target of the attack was Ukraine, the attack quickly spread elsewhere.

What became most interesting was that the encrypted computers were not designed to be decrypted; therefore, the purpose of the attack was solely destructive rather than a financially-motivated ransomware attack. It is widely accepted that the financial impact of this attack was in the region of $10bn.

ASUS Software Update 2019

In 2019, computer manufacturing giant ASUSTek Computer – more commonly known as ASUS – identified a problem with its live update service, learning as a result that it had been compromised earlier in 2018. The compromise allowed this supposedly legitimate and trusted software to deliver malware to thousands of ASUS customers.

According to one report, it impacted 13,000 computers; 80% were consumer customers, and the remainder were businesses. However, the 2nd stage malware was highly targeted via a list of specific MAC addresses. Malicious versions of ASUS’ Live Update software (normally used to deliver updates to ASUS components and applications), was found to be installed and used to deliver a secondary payload of malware.

What was most interesting about this attack was that the version of ASUS Live Update that was compromised to deliver malware was legitimately signed by an ASUSTek Computer certificate. By obtaining access to the signing authority for this application, the attackers were able to effectively bypass the trust relationship that had been placed in the certificate infrastructure.

In 2020, responsibility for the ASUS supply chain attack was attributed to APT41.

SolarWinds December 2020

While there seemed to be a temporary lull in supply chain attacks after those mentioned above, the Solarwinds attack put them firmly back on the map back in December 2020.

SolarWinds is a widely trusted software vendor with some 300,000 customers, but as the story unfolded it became clear that their Orion software had been severely compromised. The attackers managed to incorporate their malware into a legitimate Symantec certificate, which was used to update the SolarWinds software.

After further investigation, SolarWinds reported that there was evidence that the malicious code was placed into their software and updates between March and June 2020. They also reported that they believed it to impact some 18,000 of their customers.

The SolarWinds attack was highly sophisticated. For example, the malware was sandbox aware and only activated after 14 days of dormancy. Given the nature of the targets impacted, such as US government institutions, and the attackers level of sophistication, it was rapidly apparent that the threat actor was APT in nature, and now widely attributed to the Russian Foreign Intelligence Service (SVR).

Kayesa July 2021

Fast forward to summer 2021 and the discovery that Kaseya VSA software, responsible for monitoring and troubleshooting endpoint computers and widely used by Managed Service Providers to help support their customers, had also been compromised. An update to the VSA software included a ransomware component that went on to compromise some 1500 customers. The attackers leveraged two vulnerabilities, one known since April 2021 and the other since July 2015, in the VSA software.

What is most interesting about this particular attack is that the motivation seemed to be purely financial as the attackers were initially asking $70M for the recovery of the decrypted data of their victims.

This attack leveraged the REvil group’s ransomware. It is also worth noting that the delivery vehicle of the ransomware was only the externally facing Kaseya VSA infrastructure, exploited by known vulnerabilities rather than through an internal breach.

Supply Chain Attack Commonalities

Analysis of these examples shows that adversaries are often either manipulating the code signing procedures via compromised but legitimate digital signing of certificates, hijacking the update distribution network of an ISV solution, or compromising original source code.

The majority of the attackers have a high sophistication level, with the exception of the recent Kayesa attack, which leveraged an external facing service with known vulnerabilities.

Preventing and Mitigating Supply Chain Attacks

Attackers always attempt to take the least path of resistence. Today, it’s often done by first compromising one of the end targets’ upstream suppliers and then abusing the trust relationship that they have to the true target to obtain their goals.

Naturally when we think of our technology defenses, we expect to be facing out, expecting the attackers from the outside, whereas, these supply chain attacks exploit a trusted component within our environments: just where we are most vulnerable and where we have the least visibility.

As part of any organization’s risk management program, supply chain attacks must be factored in, so what are the typical processes for compliance, governance and technology areas that could be bolstered to help mitigate these problems?

  1. Develop and implement a vendor risk management program to evaluate, track, and measure 3rd-party risk.
  2. Enforce through contractual requirements vendor cybersecurity assessments, including for the vendors own supply chain risk.
  3. Require ISO 27001 certification or CMMI and/or comply with cybersecurity frameworks like NIST or CIS
  4. Plan to move to a zero trust network (ZTA) architecture ensuring that all identities and endpoints are no longer trusted by default but instead continuously validated for each access request.
  5. Deploy a modern, platform-agnostic XDR platform capable of detecting and remediating sophisticated attacks across your endpoints, cloud and network infrastructure.
  6. Enforce multi factor authentication (MFA) to prevent the most typical of authentication brute forcing attacks
  7. Increase your network and endpoint visibility retention rates so that long lasting attacks can be identified. (the SolarWinds attackers were present for at least 5 months before launching their outward-facing attack)
  8. Be exceptionally careful as to how and where you configure your endpoint tool exceptions. Being overly permissive here with tools that you supposedly trust could lead to detection gaps.
  9. If you are an ISV then ensure best practices for Secure Development Lifecycle (SDL), vulnerability assessment and patch management programs to address identified issues.

Conclusion

The real challenge with these sophisticated supply chain attacks are that they leverage the implicit trust we place into our 3rd parties and also the implicit trust we place in the tools we use to support our businesses.

The real benefit to the attacker is that if they are successful, they have potentially increased their ability to scale the targets that they can infect, as well as allowing them the benefit of going completely undetected for potentially many weeks or months in length, depending on the goal of the attack.

It is essential that organizations review their cybersecurity requirements, gain visibility into supply chain dependencies, and deploy a modern XDR platform that can identify and contain a breach even if it originates deep within the company’s own supply chain.

Want to know more about how SentinelOne can help? Contact us for more information, or request a free demo.

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Yaydoo secures $20M, aims to simplify B2B collections, payments

/0 Comments/in /by

It’s no secret that the technology for easy business-to-business payments has not yet caught up to its peer-to-peer counterparts, but Yaydoo thinks it has the answer.

The Mexico City-based B2B software and payments company provides three products, VendorPlace, P-Card and PorCobrar, for managing cash flow, optimizing access to smart liquidity, and connecting small, midsize and large businesses to an ecosystem of digital tools.

Sergio Almaguer, Guillermo Treviño and Roberto Flores founded Yaydoo — the name combines “yay” and “do” to show the happiness of doing something — in 2017. Today, the company announced the close of a $20.4 million Series A round co-led by Base10 Partners and monashees.

Joining them in the round were SoftBank’s Latin America Fund and Leap Global Partners. In total, Yaydoo has raised $21.5 million, Almaguer told TechCrunch.

Prior to starting the company, Almaguer was working at another company in Mexico doing point-of-sale. His large enterprise customers wanted automation for their payments, but he noticed that the same tools were too expensive for small businesses.

The co-founders started Yaydoo to provide procurement, accounts payable and accounts receivables, but in a simpler format so that the collection and payment of B2B transactions was affordable for small businesses.

Image Credits: Yaydoo

The idea is taking off, and vendors are adding their own customers so that they are all part of the network to better link invoices to purchase orders and then connect to accounts payable, Almaguer said. Yaydoo estimates that the automation workflows reduced 80% of time wasted paying vendors, on average.

Yaydoo is joining a sector of fintech that is heating up — the global B2B payments market is valued at $120 trillion annually. Last week, B2B payments platform Nium announced a $200 million in Series D funding on a $1 billion valuation. Others attracting funding recently include Paystand, which raised $50 million in Series C funding to make B2B payments cashless, while Dwolla raised $21 million for its API that allows companies to build and facilitate fast payments.

The new funding will enable the company to attract new hires in Mexico and when the company expands into other Latin American countries. Yaydoo is also looking at future opportunities for its working capital business, like understanding how many invoices customers are setting, the access to actual payments, and how money flows out and in so that it can provide insights on working capital funding gaps. The company will also invest in product development.

The company has grown to over 800 customers, up from 200 in the first quarter of 2020. Its headcount also grew to 100 from 30 during the same time. In the last 12 months, over 70,000 companies have transacted on the Yaydoo network, and total payment volume grew to hundreds of millions of dollars.

Yaydoo is a SaaS subscription model, but the new funding will also enable the company to create a pool of potential customers with a “freemium” offering with the goal of converting those customers into the subscription model as they grow, Almaguer said.

Rexhi Dollaku, partner at Base10 Partners, said the firm saw the way B2B payments were becoming modernized and “was impressed” by the Yaydoo team and how it built a complicated infrastructure, but made it easy to use.

He believes Latin America is 10 years behind in terms of B2B payments but will catch up sooner than later because of the digital transformation going on in the region.

“We are starting to see early signs of the network being built out of the payments product, and that is a good indication,” Dollaku said. “With the funding, Yaydoo will be also able to provide more financial services options for businesses to address a working fund gap.”

All B2B startups are in the payments business

Cloud infrastructure market kept growing in Q2, reaching $42B

/0 Comments/in /by

It’s often said in baseball that a prospect has a high ceiling, reflecting the tremendous potential of a young player with plenty of room to get better. The same could be said for the cloud infrastructure market, which just keeps growing, with little sign of slowing down any time soon. The market hit $42 billion in total revenue with all major vendors reporting, up $2 billion from Q1.

Synergy Research reports that the revenue grew at a speedy 39% clip, the fourth consecutive quarter that it has increased. AWS led the way per usual, but Microsoft continued growing at a rapid pace and Google also kept the momentum going.

AWS continues to defy market logic, actually increasing growth by 5% over the previous quarter at 37%, an amazing feat for a company with the market maturity of AWS. That accounted for $14.81 billion in revenue for Amazon’s cloud division, putting it close to a $60 billion run rate, good for a market leading 33% share. While that share has remained fairly steady for a number of years, the revenue continues to grow as the market pie grows ever larger.

Microsoft grew even faster at 51%, and while Microsoft cloud infrastructure data isn’t always easy to nail down, with 20% of market share according to Synergy Research, that puts it at $8.4 billion as it continues to push upward with revenue up from $7.8 billion last quarter.

Google too continued its slow and steady progress under the leadership of Thomas Kurian, leading the growth numbers with a 54% increase in cloud revenue in Q2 on revenue of $4.2 billion, good for 10% market share, the first time Google Cloud has reached double figures in Synergy’s quarterly tracking data. That’s up from $3.5 billion last quarter.

Synergy Research cloud infrastructure market share chart.

Image Credits: Synergy Research

After the Big 3, Alibaba held steady over Q1 at 6% (but will only report this week), with IBM falling a point from Q1 to 4% as Big Blue continues to struggle in pure infrastructure as it makes the transition to more of a hybrid cloud management player.

John Dinsdale, chief analyst at Synergy, says that the Big 3 are spending big to help fuel this growth. “Amazon, Microsoft and Google in aggregate are typically investing over $25 billion in capex per quarter, much of which is going towards building and equipping their fleet of over 340 hyperscale data centers,” he said in a statement.

Meanwhile, Canalys had similar numbers, but saw the overall market slightly higher at $47 billion. Their market share broke down to Amazon with 31%, Microsoft with 22% and Google with 8% of that total number.

Canalys analyst Blake Murray says that part of the reason companies are shifting workloads to the cloud is to help achieve environmental sustainability goals as the cloud vendors are working toward using more renewable energy to run their massive data centers.

“The best practices and technology utilized by these companies will filter to the rest of the industry, while customers will increasingly use cloud services to relieve some of their environmental responsibilities and meet sustainability goals,” Murray said in a statement.

Regardless of whether companies are moving to the cloud to get out of the data center business or because they hope to piggyback on the sustainability efforts of the Big 3, companies are continuing a steady march to the cloud. With some estimates of worldwide cloud usage at around 25%, the potential for continued growth remains strong, especially with many markets still untapped outside the U.S.

That bodes well for the Big 3 and for other smaller operators who can find a way to tap into slices of market share that add up to big revenue. “There remains a wealth of opportunity for smaller, more focused cloud providers, but it can be hard to look away from the eye-popping numbers coming out of the Big 3,” Dinsdale said.

In fact, it’s hard to see the ceiling for these companies any time in the foreseeable future.

With a $50B run rate in reach, can anyone stop AWS?

Salesforce steps into RPA buying Servicetrace and teaming it with Mulesoft

/0 Comments/in /by

Over the last couple of years, robotic process automation or RPA has been red hot with tons of investor activity and M&A from companies like SAP, IBM and ServiceNow. UIPath had a major IPO in April and has a market cap over $30 billion. I wondered when Salesforce would get involved and today the company dipped its toe into the RPA pool, announcing its intent to buy German RPA company Servicetrace.

Salesforce intends to make Servicetrace part of Mulesoft, the company it bought in 2018 for $6.5 billion. The companies aren’t divulging the purchase price, suggesting it’s a much smaller deal. When Servicetrace is in the fold, it should fit in well with Mulesoft’s API integration, helping to add an automation layer to Mulesoft’s tool kit.

“With the addition of Servicetrace, MuleSoft will be able to deliver a leading unified integration, API management and RPA platform, which will further enrich the Salesforce Customer 360 — empowering organizations to deliver connected experiences from anywhere. The new RPA capabilities will enhance Salesforce’s Einstein Automate solution, enabling end-to-end workflow automation across any system for service, sales, industries, and more,” Mulesoft CEO Brent Hayward wrote in a blog post announcing the deal.

No code, workflow and RPA line up for their automation moment

While Einstein, Salesforce’s artificial intelligence layer, gives companies with more modern tooling the ability to automate certain tasks, RPA is suited to more legacy operations, and this acquisition could be another step in helping Salesforce bridge the gap between older on-prem tools and more modern cloud software.

Brent Leary, founder and principal analyst at CRM Essentials says that it brings another dimension to Salesforce’s digital transformation tools. “It didn’t take Salesforce long to move to the next acquisition after closing their biggest purchase with Slack. But automation of processes and workflows fueled by real-time data coming from a growing variety of sources is becoming a key to finding success with digital transformation. And this adds a critical piece to that puzzle for Salesforce/MuleSoft,” he said.

While it feels like Salesforce is joining the market late, in an investor survey we published in May, Laela Sturdy, general partner at CapitalG, told us that we are just skimming the surface so far when it comes to RPA’s potential.

“We’re a long way from needing to think about the space maturing. In fact, RPA adoption is still in its early infancy when you consider its immense potential. Most companies are only now just beginning to explore the numerous use cases that exist across industries. The more enterprises dip their toes into RPA, the more use cases they envision,” Sturdy responded in the survey.

Servicetrace was founded in 2004, long before the notion of RPA even existed. Neither Crunchbase nor PitchBook shows any money raised, but the website suggests a mature company with a rich product set. Customers include Fujitsu, Siemens, Merck and Deutsche Telekom.

5 investors discuss the future of RPA after UiPath’s IPO

Mixlab raises $20M to provide purrfect pharmacy experience for pet parents

/0 Comments/in /by

Pet pharmacy Mixlab has developed a digital platform enabling veterinarians to prescribe medications and have them delivered — sometimes on the same day — to pet parents.

The New York-based company raised a $20 million Series A in a round of funding led by Sonoma Brands and including Global Founders Capital, Monogram Capital, Lakehouse Ventures and Brand Foundry. The new investment gives Mixlab total funding of $30 million, said Fred Dijols, co-founder and CEO of Mixlab.

Dijols and Stella Kim, chief experience officer, co-founded Mixlab in 2017 to provide a better pharmacy experience, with the veterinarian at the center.

Dijols’ background is in medical devices as well as healthcare investment banking, where he became interested in the pharmacy industry, following TruePill and PillPack, which he told TechCrunch were “creating a modern pharmacy model.”

As more pharmacy experiences revolved around at-home delivery, he found the veterinary side of pharmacy was not keeping up. He met Kim, a user experience expert, whose family owns a pharmacy, and wanted to bring technology into the industry.

“The pharmacy industry is changing a lot, and technology allows us to personalize the care and experience for the veterinarian, pet parent and the pet,” Kim said. “Customer service is important in healthcare as is dignity and empathy. We kept that in mind when starting Mixlab. Many companies use technology to remove the human element, but we use it to elevate it.”

Where top VCs are investing in digital health

Mixlab’s technology includes a digital service for veterinarians to streamline their daily medication workflow and gives them back time to spend with patient care. The platform manages the home delivery of medications across branded, generic and over-the-counter medications, as well as reduces a clinic’s on-site pharmacy inventories. Veterinarians can write prescriptions in seconds and track medication progress and therapy compliance.

The company also operates its own compound pharmacy where it specializes in making medications on-demand that are flavored and dosed.

On the pet parent side, they no longer have to wait up to a week for medications nor have to drive over to the clinic to pick them up. Medications come in a personalized care package that includes a note from the pharmacist, clear and easy-to-read instructions and a new toy.

Over the past year, adoptions of pets spiked as more people were at home, also leading to an increase in vet visits. This also caused the global pet care industry to boom, and it is now projected to reach $343 billion by 2030, when it had been valued at $208 billion in 2020.

Pet parents are also spending more on their pets, and a Morgan Stanley report showed that they see pets as part of their family, and as a result, 37% of people said they would take on debt to pay for a pet’s medical expenses, while 29% would put a pet’s needs before their own.

To meet the increased demand in veterinary care, the company will use the new funding to improve its technology and expand into more locations where it can provide same-day delivery. Currently it is shipping to 47 states and Dijols expects to be completely national by the end of the year. He also expects to hire more people on both the sales team and in executive leadership positions.

The company is already operating in New York and Los Angeles and growing 3x year over year, though Dijols admits operating during the pandemic was a bit challenging due to “a massive surge of orders” that came in as veterinarians had to shut down their offices.

As part of the investment, Keith Levy, operating partner at Sonoma Brands and former president of pet food manufacturer Royal Canin USA, will join Mixlab’s board of directors. Sonoma Brands is focused on growth sectors of the consumer economy, and pets was one of the areas that investors were interested in.

Over time, Sonoma found that within the veterinary community, there was space for a lot of players. However, veterinarians want to home in on one company they trust, and Mixlab fit that description for many because they were getting medication out faster, Levy said.

“What Mixlab is doing isn’t completely unique, but they are doing it better,” he added. “When we looked at their customer service metrics, we saw they had a good reputation and were relentlessly focused on providing a better experience.”

SoftBank-backed Embark Veterinary valued at $700M after $75M Series B