Attackers are using custom malware to exploit drivers and terminate security processes so they can deploy ransomware.

The "AuKill" cybercrime tool has emerged, which threat actors are using to disable endpoint detection and response (EDR) defenses used by enterprises before deploying ransomware. It makes use of malicious device drivers to infiltrate systems.

In two recent incidents, researchers from Sophos observed an adversary using AuKill prior to deploying Medusa Locker ransomware; another time, the security vendor discovered an attacker using the EDR killer on an already compromised system before installing the LockBit ransomware.

Christopher Budd, senior manager of threat research at Sophos, says the trend is a response to the growing effectiveness of EDR tools. "Threat actors are starting to recognize that EDR agents provide security vendors a significant advantage in spotting attacks," he says. "Threat actors are targeting the tools causing them the most trouble."

The attacks are similar to a flurry of incidents that Sophos, Microsoft, Mandiant, and SentinelOne reported in December, where threat actors used custom-built drivers to disable security products on already compromised systems, leaving them open to other exploits.

In those attacks, threat actors used malicious drivers that they tricked Microsoft into digitally signing, therefore making them appear legitimate. In other driver attacks, threat actors have exploited a vulnerability in a legitimate device driver to execute ransomware, escalate privileges, and bypass security controls. Some security vendors and researchers commonly refer to the technique as a "bring your own vulnerable driver" or BYOVD attack.

Aukill itself is a tool that falls into the BYVOD category. It takes advantage of a legitimate but outdated and exploitable version of a driver that Microsoft's Process Explorer 16.32 uses, to disable EDR processes.

**Bring Your Own Vulnerable Driver**

The vulnerable Process Explorer driver that AuKill leverages — like other drivers — has privileged access on installed systems and can interact with and terminate running processes.

It's a free tool that allows users to get detailed information on all running processes on a system, their executable paths, performance metrics, and other information. It offers multiple features for monitoring real-time system activity, prioritizing processes and identity, terminating processes, and executing other functions.

Budd says that in the recent ransomware attacks that Sophos observed, the threat actor injected the tool into systems on which they had already gained access. Once on a system, AuKill drops a driver named PROCEXP.SYS from release version 16.32 of Process Explorer into the same location as the legitimate version of the Process Explorer driver (PROCEXP152.sys).

"The \[legitimate\] Process Explorer driver v.16.32 does not limit its functionality to working with the main Process Explorer executable," Budd says. "So other programs may send API calls to the driver to take advantage of its functionality." In AuKill's case, the tool abuses the legitimate driver to execute instructions to shut down EDR and other security controls on the compromised computer. "They leverage the existing functionality in the Process Explorer driver that permits Process Explorer to terminate running programs," he says.

Sophos has so far analyzed six different versions of AuKill and noticed some substantial changes with each new version. Newer versions, for instance, now target more EDR processes and services for termination. They also include a feature that continuously probes EDR processes and services to ensure that terminated processes remain that way through restart attempts. The malware authors have also added features to make AuKill more robust by having AuKill run multiple threads at once to protect itself from being terminated in response, Budd says.

Sophos' analysis of AuKill showed it to contain similarities in code with BackStab, an open source tool that surfaced in June 2021 that also abused the Process Explorer driver to kill EDR tools. The company's researchers spotted a LockBit actor using BackStab to disable EDR on systems as recently as last November.

'AuKill' Malware Hunts & Kills EDR Processes

Campaigns that wielded NSO Group's Pegasus against high-risk users over a six-month period demonstrate the growing sophistication and relentless nature of spyware actors.

Attackers have been targeting iPhone users around the globe in ongoing Pegasus spyware attacks. They show that cyber-threat actors are targeting both new exploits and older, unupdated devices to circumvent new preventative measures from Apple, researchers have found.

One of the multiple targeted campaigns observed over the last six months involved an iPhone user in the Middle East, and another a journalist in Europe using an iPhone 6 that is not supported by the latest iOS updates, researchers at Jamf Threat Labs reported in a recent blog post. Those updates include new threat "Lockdown Mode" notifications by Apple that can help warn someone if there is unusual activity that could be related to spyware on their devices.

The attacks demonstrate how threat actors continue to evolve and grow in sophistication even as there is more awareness about spyware and prevention against these attacks, which are often used with malicious intent by governments to target dissidents or others who investigate or are unsupportive of policies or regimes, the researchers said.

"Modern spyware is very advanced and, as evidenced by the continued evolution of commercial spyware, continues to leverage zero-day vulnerabilities in both old and new devices to ensure any user can be effectively targeted," the researchers wrote in the post.

They also indicate that though the researchers were able to take a deep dive into devices involved in some of the recent attacks, there is no consistency in terms of how the individuals or organizations targeted investigate attacks after the fact. This makes it difficult to respond or prevent further attacks in a timely or comprehensive way, the researchers said.

Moreover, "not all users impacted by spyware have been contacted by Apple, illustrating the challenges with maintaining a comprehensive list of indicators of compromise (IoCs) and with extracting relevant data remotely," they wrote.

**Mideast Activist Targeted**

Researchers specifically detailed two separate attacks that demonstrate how no iPhone is safe from being targeted, despite Apple's bolstering of preventative measures in its most recent updates to iOS.

One attack targeted an iPhone 12 Pro Max user in the Middle East who eventually was notified by Apple of suspicious activity on the device, which showed IoCs that Pegasus — the notorious spyware from Israel's NSO Group — was running.

Subsequent analysis from Jamf Threat Labs revealed traces of the "libtouchregd" process on the device, which Amnesty International has identified as an IoC associated with Pegasus spyware, the researchers said.

The device also yielded additional IoCs via subsequent analysis of the com.apple.CrashReporter.plist file, which is located within a root folder on iOS and serves as a configuration file for the system daemon, ReportCrash, according to the researchers.

"Under normal operating conditions, applications are not granted permission to access or modify this file," the researchers wrote. "Alteration of this file could potentially impede the reporting of crash report logs to Apple. Additionally, the existence of the file is rare for normal users."

Apple sent a threat notification to the Middle East user late last year that a potential attack was occurring on the device and recommended updating it to iOS 16.2. The user subsequently engaged with security researchers to better understand the attack timeline and details, which resulted in a determination that Pegasus was used in the attack.

"These findings have allowed Jamf Threat Labs to build a more robust profile on a device with 'proven' compromise status," the researchers wrote.

**Targeting an Outdated Device**

Another spyware attack targeted an iPhone 6 — currently unsupported by the latest version of iOS — used by a journalist in Europe working for a global news agency, the researchers reported. The device also showed evidence of system crashes, similar to the phone in the Middle East scenario, that indicated it had been compromised.

However, even more suspiciously, investigators discovered files at an atypical location within iPhone’s strict file system, with one that was "clearly masquerading as a built-in binary," the researchers wrote.

"Based on this path and filename, we have strong reason to believe this may be a new indicator that can be used to assess if a device has been targeted," by a specific threat actor, they wrote. Though they could not conclusively identify the threat actor or the use of Pegasus, they said they notified Apple of a potential new IoC by the actor.

Moreover, an attack on an older device that's clearly unsupported by the latest Apple updates — including its enhanced threat-notification program — demonstrates the relentless nature of spyware actors, the researchers said.

"The continued targeting of older devices, such as the iPhone 6s, serves as a reminder that malicious threat actors will exploit any vulnerabilities in an organization's infrastructure, attacking wherever possible," they wrote.

**Mitigations & Prevention**

Given the advanced and evolving knowledge base around spyware, there are numerous ways that organizations can protect users from being attacks. The latest campaigns demonstrate the most basic mitigation tactic, which is to ensure that all devices are running the most current OS and have all available security patches applied, the researchers said.

At the same time, organizations should practice similar hygiene on the corporate network, keeping all applications — both business oriented and personal — up to date and fully patched, as "mobile application vulnerabilities are easily exploited and frequently overlooked by security teams," the researchers wrote.

Jamf also recommends running security software to monitor for suspicious activity on mobile devices and reporting it alongside all other endpoint monitoring dashboards to ensure they are treated with the same attention and urgency as desktops, laptops, and servers.

Other steps organizations can take to protect users include: monitoring communications for suspicious downloads, command-and-control (C2) indicators, and data exfiltration, and utilizing automated policy controls to block known bad activity before it can cause further damage.

High-risk users also should receive separate education about the symptoms of spyware — such as performance issues and frequent crashes — and be encouraged to use an iPhone's Lockdown Mode if necessary, the researchers said. This protects devices against these extremely rare and highly sophisticated cyberattacks.

Global Spyware Attacks Spotted Against Both New & Old iPhones

As is typical with emerging technologies, both innovators and regulators struggle with developments in generative AI, much less the rules that should govern its use.

It has been a busy time in the world of large language models. In late March, OpenAI disclosed a breach of users' personal data. ChatGPT does not appear to have issued an independent apology. As a mere algorithm, how could it? "Right" and "wrong" are only known to it by the artifice of its content filters.

OpenAI has reasserted its commitment to protecting users' privacy and keeping their data safe; however, it has since been reported that Samsung employees exposed confidential meeting minutes and source code via prompts sent to ChatGPT. OpenAI warns against the use of sensitive information in conversations, but there are clearly significant risks that the AI industry needs to address in the development of models and services. Garante, the Italian data protection authority, issued a ruling to prevent use of ChatGPT at the end of March, and the Office of the Privacy Commissioner of Canada has launched its own investigation into ChatGPT's privacy implications. The eventual consequences for OpenAI and the AI community remain to be seen.

Soon after reporting of the initial OpenAI breach came the Future of Life Institute's open letter, calling for a six-month halt to what they termed "giant AI experiments." The letter was signed by many of the signatories to a 2015 Future of Life Institute open letter, warning of the dangers of autonomous weapons equipped with AI to cause harm. The sentiments expressed in the letter are not universally held, with two doyens of the AI industry, Andrew Ng and Yann LeCun, jointly communicating their disagreement with calls for a pause in research.

With the Future Life Institute's open letter establishing a development threshold of AI systems "more powerful than GPT-4," there must have be some degree of anxiety among those working on Google's Bard and Microsoft's Copilot systems, which were overlooked. While it is fortunate that the generative pretrained transformer (GPT) class of models are, as yet, without ego, given the coverage they are receiving within the technical community and the popular press; it is appropriate to reflect on the ChatGPT data breaches, alongside the new capabilities announced in GPT-4.

**Wider Concerns**

The data breach reported by OpenAI occurred against a background of wider concern about the societal implications, regulatory oversight, governance, and practical application of powerful AI systems. Analysis from Goldman Sachs suggested that generative AI systems could deliver a 7% increase in global GDP over a 10-year period, while simultaneously affecting the jobs of 300 million people. The UK government's recent white paper (PDF) has also been contrasted to the interventionist approach reflected in the proposed EU Artificial Intelligence Act.

In OpenAI's disclosure of the ChatGPT data breach, it is important to note their observation that the bug "allowed some users to see titles from another active user's chat history," and, possibly, "the first message of a newly-created conversation was visible in someone else's chat history if both users were active around the same time."

While the bug is resolved, the risks to privacy and confidentiality in centralized AI systems have been exposed along with users' data. GPT-4's reported performance data is impressive, and the prospect of multi-modal prompts, comprising images and text, extends the scope of potential applications. But what happens to all that prompt data? What does it say about the user? What might that prompt data disclose? And, what are the implications of all that generated probabilistic output for the veracity of tomorrow's information domain?

**Questions Raised**

Important questions are also raised about the source of the massive volumes of training data required for initial development. Has informed consent been obtained for the use of this data? Are copyrights and other intellectual property protections respected? How is the veracity of training data established and the accuracy of predictions evaluated? None of these questions are easily answered by the current state of the art for predictive text sequencing, where their ethical foundation is at best opaque and the risk of future self-reference looms large as all the probabilistic and erroneous responses churned out by ChatGPT and GPT-4 enter the corpus of training data.

OpenAI openly states on the ChatGPT FAQs page that user conversations are retained for training and users should avoid including sensitive data in prompts, to avoid the problems experienced by Samsung. But what constitutes sensitive data, beyond the obvious information that is subject to regulatory control or that explicitly identifies the user? Well, every prompt discloses some information about the user sand their unique interests. The language, phraseology, and tone of prompts point to the personal characteristics and preferences of the user. Such characterizations can be used to finetune responses to either individual users or derived subsets of the overall user population.

Eventually, imperceptibly unique characteristics contained in the spelling and punctuation tics, image geometry, or source documentation of inputs to GPT services could discern sensitive information, or, worse, enable simulation of a human response that cannot be discriminated by either machine or human judgement.

In parallel, Ilya Sutskever, co-founder and chief scientist of OpenAI, caused another recent stir when he stated that the closed-source stance taken with respect to the architecture of GPT-4 was necessary in response to competitive threats and potential safety implications associated with disclosure of the technology. As is typically the case with processes of innovation, the regulatory environment today is disjointed and in a losing race to catch up with developments in the field. The new capabilities of GPT-4 and services based on the prior generation of GPT technology are imbued with significant risks, many of which remain unforeseen and unimagined. Reduced transparency in model development will not help.

**Risky Business**

While the risk to data privacy and confidentiality is evident at the implementation level, those risks are an intrinsic component of ChatGPT, GPT-4, and other centralized AI systems. How we address these risks as a society, to exploit the welcome benefits of AI without the sacrifice of cherished human rights, is one of the many questions posed by accelerating advancements in machine intelligence. If we are not sufficiently concerned about the information our human-machine conversations disclose about us today, we might worry more when, as a team of AI researchers have already demonstrated, one day soon, machines will possess the capability to actually read our minds. There is much for humanity and GPT-4 to ponder.

GPT-4 Provides Improved Answers While Posing New Questions

Organizations are planning on newer multifactor authentication methods, such as invisible MFA and passwordless, says SecureAuth in its "State of Authentication" report.

Authentication is one of the top priorities for organizations, as 84% of respondents in SecureAuth’s inaugural "State of Authentication" report placed authentication and access management in their top three to five security priorities.

SecureAuth grouped verification factors, such as one-time passwords and PINs transmitted over SMS text messages, emails, or phone calls, as “traditional multifactor authentication.” Organizations are increasingly exploring newer multifactor authentication (MFA) methods, such as invisible MFA and passwordless technologies, according to the report.

The biggest focus appears to be single sign-on (45%), followed by invisible MFA (38%), two-factor authentication (36%), and continuous authentication (35%). Invisible MFA refers to silently collecting information needed for verification without requiring any user action, such as entering a one-time password or approving a push notification on an app. Invisible MFA combines behavioral, environmental, and contextual signals to determine whether the user is logging in from an authorized device.

The major trend in security nowadays is consolidation. Organizations are trying to reduce the number of security tools in order to minimize integration challenges and reduce complexity. But that is not the case with identity when it comes to identity provider products. Three-quarters of the respondents (76%) say their organizations rely on multiple identity provider products for various reasons, including failover and use-case requirements (such as users on different operating systems). Failover makes a lot of sense – the last thing security teams want is users being unable to access the services and applications they need because the primary identity product is unexpectedly offline or compromised by an attack.

    

Source: State of Authentication, SecureAuth

Identity provider products named in the report include Microsoft (E3 and E5), Okta, Ping Identity, ForgeRock, and SecureAuth.

Most respondents have some form of MFA in their organizations, according to the report. This reflects the security team’s reality; The growing volume of credentials-based attacks means organizations cannot rely on passwords alone for authentication. Cyber insurance also plays a role, as many carriers make using MFA as a requirement for having a policy.

Nearly a third of respondents said they have plans to implement passwordless technologies in the next six months, while another third have plans within the next 12 to 24 months. The biggest barrier to implementation is having too many competing priorities (55%), lack of knowledge about the technology (46%), and budgetary constraints (24%).

Newer Authentication Tech a Priority for 2023

Killnet's leader outs the identity of the new Anonymous Russia leader, in an effort to consolidate power among pro-Russia cybercriminals.

There's drama brewing between various Kremlin-backed hacktivist groups, which percolated into public view this week with the move by Killnet group leader "Killmilk" to expose the identity of "Raty," the leader of seemingly aligned threat group Anonymous Russia.

Raty, outed as Arseni Yeliseyeu, was subsequently arrested in Belarus, Kellmilk said, according to new analysis from Flashpoint. Further, Killmilk decided to appoint a threat actor named "Radis" to head up Anonymous Russia in Raty's absence.

Following the announcement, the Anonymous Russia Telegram channel identified itself as steadfastly pro-Kremlin with a declaration of war against the "CIA rats," according to Flashpoint, and offered the group's distributed denial-of-service (DDoS) cyberattacks as a for-hire service, adding "anyone can purchase."

The episode is just the latest example of Killnet's attempts to consolidate power.

"The developing story highlights the twists and turns of pro-Kremlin hacktivism over the past approximately six months since Killnet first attempted to collect all major and minor groups under its own umbrella," Flashpoint's report said. "This endeavor has remained relatively unsuccessful."

Groups are pushing back against Killnet to strike out of their own, creating a more competitive hacktivist market, Flashpoint explained.

"In the past months several smaller groups, including Phoenix, announced the creation of their own alliances or business ventures, suggesting that the market of cybercrime services under the guise of hacktivism is getting crowded too," the report said.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Killnet Boss Exposes Rival Leader in Kremlin Hacktivist Beef

The nation-stage threat group deployed custom malware on archaic versions of Cisco's router operating system. Experts warn that such attacks targeting network infrastructure are on the rise.

As recently as 2021, the notorious Russian APT28 was exploiting network routers running outdated versions of Cisco's IOS and IOS XE operating system software, using them to deploy backdoors in networks across European and American government institutions.

APT28 — aka Fancy Bear, Strontium, Tsar Team, and Sofacy Group — is best known for its campaigns against Ukraine and the 2016 US elections. The UK National Cyber Security Centre (NCSC) has attributed this group to the 85th Special Service Centre, Military Intelligence Unit 26165, part of Russia's General Staff Main Intelligence Directorate (GRU).

NCSC, National Security Agency, Cybersecurity and Infrastructure Security Agency (CISA), and FBI this week published a joint advisory outlining one of APT28's less technically impressive but more economic maneuvers. According to their findings, the group used unpatched Cisco routers to access "a small number" of EU and US government institutions, on top of "approximately 250 Ukrainian victims."

Though the campaign took place two years ago, Cisco Talos in a blog post expressed how "deeply concerned" it is "by an increase in the rate of high-sophistication attacks on network infrastructure" by nation-state actors.

"We certainly have seen an increase over the last several years — even over the last six to 12 months — in targeting this type of infrastructure," says JJ Cummings, national security principal at Cisco Talos. "I think this is probably only the tip of the iceberg."

**Taking Advantage of Vulnerable Routers**

On June 29, 2017, Cisco revealed a series of vulnerabilities in the Simple Network Management Protocol (SNMP), a communications protocol for network devices running IOS versions 12.0 through 12.4 and 15.0 through 15.6, and IOS XE 2.2 through 3.17.

A specially crafted SNMP packet, the company explained, could have allowed attackers to remotely execute code on affected devices, or cause them to reboot. The vulnerabilities were grouped under CVE-2017-6742 and assigned a "High" CVSS score of 8.8.

Though a patch for the SNMP vulnerabilities was released all those years ago, by 2021 APT28 was still exploiting Cisco routers to access US, EU, and primarily Ukrainian government networks.

In the same way administrators use SNMP to remotely monitor and configure network devices, APT28 used it to remotely access devices and penetrate networks.

"A number of software tools can scan the entire network using SNMP," the advisory explained, "meaning that poor configuration such as using default or easy-to-guess community strings, can make a network susceptible to attacks."

In particular, APT28 took advantage of weak passwords — "community strings," in Cisco parlance — such as the default public string in order to crack routers and, in some cases, deploy their "Jaguar Tooth" malware. Jaguar Tooth was specifically designed to exploit CVE-2017-6742, stealing device information and planting a backdoor for persistent access.

**Thousands of Routers Are Exposed Online**

A remarkable number of enterprise Internet routers in operation today are publicly exposed on the open Internet. And they're not only exposed — they're vulnerable. For scale, consider this:

After a series of vulnerabilities were discovered in multiple Cisco Small Business Routers earlier this year, software company Censys scanned for any potentially vulnerable devices online. The search returned over 20,000 results, the vast majority of which are still equally exposed to this day.

And just as a software company can identify these devices, so can hackers." Usually, cybercriminals will be using tools like Shodan or Nmap to scan and look for exposed devices connected to the internet," explains James McQuiggan, security awareness advocate at KnowBe4. "Organizations may try the 'security by obscurity' model, hoping they're not discovered running older legacy systems," he says, but hackers who can find and so easily exploit these devices "have opened the electronic front door."

Cisco regularly publishes information about new vulnerabilities and risks to IT infrastructure, such as this blog post published on April 18

**Why Routers Go Unpatched**

In IT environments, Cummings observes, there's one main reason why routing devices remain unpatched for years at a time. "Think about what the primary mission of a network operations team is: to keep the network up and running, right?" A byproduct of this prioritization of reliability and availability, he says, could be that "if a device is not broken, maybe they're not going to fix it."

Further, updating can sometimes come at a cost — albeit temporary — for operations. "We've seen in a couple of cases that, while the process to upgrade isn't necessarily difficult or arduous, it's also not always without risk for network availability." If availability is the primary goal, "if they're incentivized not to impact that, anything that gets in the way is something that they're going to shy away from."

Updating IOS and IOS XE is necessary for addressing CVE-2017-6742, but in cases where doing so is tricky, there are other simple changes IT administrators can make to harden against similar infrastructure breaches. "If updates are not possible," McQuiggan says, "network monitoring — even if it's by a third-party managed security service — can alert of intrusions and possible unauthorized logins to external-facing networking equipment."

In its blog post, Cisco emphasized more than anything the need to restrict infrastructure to trusted users. "Designed to prevent unauthorized direct communication to network devices, infrastructure access control lists (ACLs) are one of the most critical security controls that can be implemented in networks," they wrote. "Exploitation of these vulnerabilities is best prevented by restricting access to trusted administrators and IP addresses."

Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov't Agencies

Here are some of the most interesting, can't-miss sessions at the upcoming show in San Francisco.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

7 Sizzling Sessions to Check Out at RSA Conference 2023

New funding to drive aggressive growth of industry’s only cybersecurity platform that brings enterprise grade cybersecurity to the mid-market; 300% year-over-year growth projected for 5th year in a row.

**NEW** **YORK--(****BUSINESS** **WIRE****)** **—** Coro, the modern cybersecurity platform for mid-market organizations, today announced a $75M funding round, bringing the total funding raised in the last 12 months to $155M. Coro added Energy Impact Partners to its current investors, Balderton Capital and JVP.

Coro continues to experience dramatic growth across all aspects of its business. The Company’s modern approach to cybersecurity – delivering enterprise grade security through a single platform that unifies, simplifies and automates workloads -- has been validated by more than 5000 mid-market customers across every vertical industry. Over the past year, Coro tripled its revenue, customer and employee base, and signed more than 100 new channel partners. The Company also expanded its footprint in Chicago, where a new business enablement center is under development to support the company’s direct sales team and rapidly growing network of resellers. Coro projects it will again grow 300% year-over-year in 2023, extending its extraordinary record to a 5th year in a row.

Coro will use the new funding to support its rapidly growing customer base and drive aggressive growth across its R&D, channel, sales and service teams. The new capital will also enable Coro to continue to expand the capabilities of its cybersecurity platform, both organically and through strategic acquisitions.

“Coro’s phenomenal growth shows they have the right solution for a huge and underserved market,” said Shawn Cherian, Partner at Energy Impact Partners. “Mid-market companies need a comprehensive cyber solution that protects their vital business assets without spending outrageous sums or requiring hard to find cybersecurity experts. Coro’s AI-powered platform, based on a modern approach to solving cybersecurity challenges, is taking the market by storm. We’re thrilled to be a part of the Coro revolution as they help secure the nation’s mid-market businesses and enable them to grow and thrive.”

“The additional funding is a validation that Coro’s disruption of the cybersecurity industry is succeeding,” said Guy Moskowitz, CEO, Coro. “While many cybersecurity vendors tried to address the mid-market by selling traditional products that were designed for an enterprise cybersecurity team to manage, Coro took a completely different route. Our modern approach to cybersecurity, where one platform automatically addresses all aspects of cybersecurity, was built from the ground up to ensure that mid-market companies can get enterprise grade protection without the complexity, workload or inflated price tag.”

Coro has stepped up to protect the hundreds of thousands of companies neglected by the cyber security industry by removing the three barriers inherent to the status quo: price, complexity, and the need for a dedicated cyber security team. Unlike current cyber security solutions such as anti-malware or phishing protection, which are focused on specific threats, Coro is the first SaaS solution to include all the security needed for a mid-sized business to protect its users, devices, email, data, and cloud applications. The platform uses automation to offload 95% of the security workload from IT and is offered as an affordable monthly subscription, which makes enterprise-grade security available to any business.

Coro’s modern approach to cybersecurity has been validated by significant customer growth across every vertical industry, including financial services, transportation and logistics, education, healthcare, retail, manufacturing, professional services and more. The company continues to garner top reviews from industry users, and was most recently ranked in G2’s 2023 Top 50 Cybersecurity Products and G2's 2023 Top 100 Fastest Growing Products.

**About Energy Impact Partners**

Energy Impact Partners LP (EIP) is a global investment firm leading the transition to a sustainable future. EIP brings together entrepreneurs and the world’s most forward-looking energy and industrial companies to advance innovation. With over $3 billion in assets under management, EIP invests globally across venture, growth, credit, and infrastructure – and has a team of over 80 professionals based in its offices in New York, San Francisco, Washington D.C., Palm Beach, London, Cologne, and Oslo. For more information on EIP, please visit www.energyimpactpartners.com

**About Coro**

Coro provides modern cybersecurity that unifies comprehensive protection into a single platform. Coro empowers organizations to defend against malware, ransomware, phishing, data leakage, insider threats and bots across devices, users, and cloud applications. More than 5,000 businesses depend on Coro for holistic security protection, unrivaled ease of use, and unmatched affordability. Coro’s modern cybersecurity platform automatically detects and remediates the many security threats that today's distributed businesses face, without IT teams having to worry, investigate, or fix issues themselves. In addition to Energy Impact Partners, investors in Coro include Balderton Capital, JVP, and Ashton Kutcher’s Sound Ventures.

For more information, please visit Coro at coro.net, or via LinkedIn, Twitter, or Facebook.

Coro Raises an Additional $75M Bringing the Total Raised to $155M in 12 Months

**AUSTIN, Texas – April 19, 2023 –** CrowdStrike (Nasdaq: CRWD) today introduced CrowdStrike Falcon Complete XDR, a new Managed eXtended Detection and Response (MXDR) service from the MDR and endpoint security market leader. CrowdStrike Falcon Complete XDR extends the elite expertise of its industry-leading MDR service, which includes 24/7 expert management, threat hunting, monitoring and end-to-end remediation, across all key attack surfaces to close the cybersecurity skills gap. Built on the CrowdStrike Falcon platform, CrowdStrike Falcon Complete XDR unifies human expertise with AI-powered automation and threat intelligence across security and IT categories to operationalize XDR for customers of any security maturity. CrowdStrike Falcon Complete XDR augments in-house teams of all skill levels, breaking down data and organizational silos to stop adversaries. Additionally, CrowdStrike is working with a broad ecosystem of leading partners who have built MXDR services on the CrowdStrike Falcon platform, providing customers a choice in a service delivered by CrowdStrike or managed capabilities offered by a global network of leading partners.

According to an Enterprise Strategy Group (ESG) report1, 47% of organizations believe they don’t have adequate skills for security operations. In addition, there’s an estimated cybersecurity workforce gap of 3.4 million people — and it’s holding organizations back from implementing a mature security program. Meanwhile, the CrowdStrike 2023 Global Threat Report revealed that 71% of cyber attacks detected in 2022 were malware-free (up from 62% in 2021) and interactive intrusions (hands on keyboard activity) increased 50% in 2022 – outlining how sophisticated human adversaries increasingly look to evade legacy antivirus and outsmart machine-only defenses.

“With MDR, CrowdStrike pioneered the idea of creating a seamless union between the technology, human expertise and an organization’s security team to close the gap between detection and response and deliver the outcome of stopping breaches. With Managed XDR services, organizations can entrust the implementation, management, response and end-to-end remediation of advanced threats across multiple vendors and attack surfaces — all without the burden, overhead or costs of deploying and managing a 24/7 threat detection and response function on their own,” said Tom Etheridge, chief global services officer at CrowdStrike.

**Partner-Delivered Managed XDR Services, Powered by CrowdStrike**

Today, CrowdStrike’s partners leverage the CrowdStrike Falcon platform to deliver MXDR services to customers. This unique collaboration, which has proven successful in the MDR market, has become the hallmark of CrowdStrike’s better-together strategy for bringing the value of XDR to organizations of all sizes. Leading Global System Integrators (GSIs) and Managed Security Service Providers (MSSPs) have taken advantage of delivering MXDR services powered by CrowdStrike, including:

*   **Damien Childs, BT’s Director of Cyber & Security Operations:** “The new Managed CrowdStrike Falcon XDR service from BT will allow our customers to reap the benefits of the industry-leading CrowdStrike Falcon platform, while also taking advantage of BT’s extensive managed security service capabilities. The service enables holistic threat protection that extends beyond the endpoint to also include identity and cloud security.”
*   **Rahul Bakshi, Chief Product Officer at eSentire:** “As CrowdStrike’s 2022 Global MSSP Partner of the Year, we provide 24/7 protection to small-to-medium businesses globally who lack the resources and expertise to manage the complexity of multiple points of security telemetry, including the industry-leading CrowdStrike Falcon platform. With eSentire MXDR service powered by CrowdStrike, our customers benefit from advanced protection with proactive threat hunting, deep multi-signal investigation and complete, rapid threat response, with a Mean Time to Contain of only 15 minutes.”
*   **Zeina Zakhour, CTO Digital Security, Eviden, Atos Group:** “CrowdStrike is a strategic partner for Eviden. We are excited to be once again the managed security partner of choice for CrowdStrike’s MXDR program. CrowdStrike EDR is closely integrated with Eviden’s AIsaac platform for delivering first-rate MXDR services. As the #1 MSSP worldwide, Eviden offers customers the ability to integrate existing security technologies in their environment, including XDR platforms like CrowdStrike, which independent analysts recognize as a leader.”
*   **Chris Rothe, CTO and Co-Founder at Red Canary:** “Red Canary MDR seamlessly integrates with the industry-leading CrowdStrike Falcon platform for increased protection against cyberattacks. Using CrowdStrike’s world-class XDR as the foundation, Red Canary monitors an organization’s environment 24×7 to stop more threats, reduce alert noise and speed up response.”
*   **Colin O’Connor, President of Field Operations at ReliaQuest:** “CrowdStrike is a valued partner and our integration with CrowdStrike Falcon Complete further enables us to deliver better security outcomes for joint customers. ReliaQuest GreyMatter, a security operations platform, takes telemetry from the CrowdStrike Falcon platform and combines it with data from other technologies such as SIEMs, CASBs and threat feeds to provide better context, enrich investigations and drive faster responses for proactive protection.”
*   **Alberto Sempere, VP Product & Innovation at Telefonica Tech:** “Telefonica Tech and CrowdStrike have a successful partnership. We are thrilled to have been selected as a preferred Managed Security Service Provider for the CrowdStrike MXDR program. The integration between CrowdStrike technology and Telefonica’s Tech services ensures the provision of exceptional MXDR services and is already a reality for many of our customers.”

“The CrowdStrike Falcon platform is quickly emerging as cybersecurity’s de facto XDR ecosystem. Our partners are foundational in helping organizations of all sizes on their XDR journeys. XDR is a team sport and our partner-friendly, customer-choice approach demonstrates our commitment,” said Daniel Bernard, chief business officer at CrowdStrike. “Partners have the same challenges as customers, which is finding the cybersecurity staff to deliver their services. That’s where the value proposition of CrowdStrike Falcon Complete XDR becomes extremely compelling with partners, such as BT, eSentire, Eviden, Red Canary, ReliaQuest and Telefonica Tech, who are turning to us to augment their own SOCs with CrowdStrike-powered offerings.” 

**MDR’s Market Leader Delivers World’s Best MXDR**

Ranked #1 in MDR market share by Gartner2, and recognized as a leader by IDC3 and Forrester4, CrowdStrike pioneered the MDR category with the CrowdStrike Falcon Complete offering. In the recent and first-ever MITRE Engenuity ATT&CK Evaluations for Security Service Providers, which evaluated 16 MDR providers, CrowdStrike Falcon Complete achieved the highest detection coverage, detecting 75 of 76 (or 99%) adversary techniques.

With CrowdStrike Falcon Complete XDR, CrowdStrike extends these industry-leading MDR capabilities across all supported CrowdStrike Falcon modules and third-party vendors including CrowdXDR Alliance partners.

“Organizations that are looking for a follow-the-sun coverage model and full hands-on remote triage, investigation and end-to-end remediation actions should strongly consider a managed XDR service. CrowdStrike showed in the most recent IDC MarketScape on U.S. MDR that they are well-positioned to meet the needs of organizations that are looking to implement solutions that fulfill their detection and response needs, but do not have the resources to appropriately implement, operate and maintain it,” said Craig Robinson, IDC Research VP of Security Services.

**Additional Resources**

*   For more information on CrowdStrike Falcon Complete XDR, please visit the website.

**About CrowdStrike**

CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with one of the world’s most advanced cloud-native platforms for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.

Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities.

Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value.

CrowdStrike: We stop breaches.

CrowdStrike Announces Managed XDR to Close the Cybersecurity Skills Gap, Expands MDR Portfolio

Originally sentenced to 40 months in prison, the former Nintendo Switch hacker is being released early due to good behavior but still owes millions.

Gary Bowser, who was indicted in 2020 and sentenced in 2021 to 40 months in prison for being a part of a hacking ring known as Team Xecuter, has been released.

Team Xecuter was a Nintendo hacking group whose activities included selling chips that allowed users to play in pirated games. Though Bowser played a relatively smaller role in the hacking operations compared with the other members of the ring (Max Louarn and Yuanning Chen), he was the only one who was tried and convicted in the US. Bowser was charged with 11 felonies: wire fraud, conspiracy to circumvent technological measures, trafficking in circumvention devices, and conspiracy to commit money laundering.

The piracy and hacking operations cost Nintendo more than $65 million over a decade-long period of time, it was determined.

After pleading guilty to two of the charges, Bowser was fined $14.5 million and sentenced, but he is being released early due to good behavior. He has paid just $175 of the fine from his time in prison, with the help of his prison library job, meaning he still has a long way to go, to say the least. Until the full amount of his fine is paid off, his pay will continue to be docked — although only 25% to 30% can be docked at a time, as per his agreement with Nintendo.

The extremity of Bowser's sentence comes from the intended message to deter other hackers from committing similar crimes. "It's the purchase of video games that sustains Nintendo and the Nintendo ecosystem, and it is the games that make the people smile," Nintendo lawyer Ajay Singh told the court back in 2022. "It's for that reason that we do all we can to prevent games on Nintendo systems from being stolen."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading