The malware has affected thousands of VMware ESXi hypervisors in the last few days.

The US Cybersecurity and Infrastructure Security Agency (CISA) has released a recovery script for victims of the ESXiArgs ransomware variant that affected thousands of organizations worldwide this week.

CISA's ESXiArgs-Recover tool is available for free on GitHub and organizations can use it to attempt the recovery of configuration files on vulnerable VMware ESXi servers that the ransomware variant might have encrypted. Some organizations that used the tool have successfully recovered their encrypted files without having to pay a ransom, the agency noted.

However, any cybersecurity team that plans to use the tool should first make sure they understand how it works before attempting to recover files that EXSIArgs might have encrypted, CISA cautioned. "CISA recommends organizations impacted by ESXiArgs evaluate the script and guidance provided in the accompanying README file to determine if it is \[a\] fit," for their environments, it noted.

ESXiArgs is a ransomware variant that France's Computer Emergency Response Team (CERT) first spotted Feb. 3 targeting VMware ESXi hypervisors worldwide. The malware exploits a 2-year old — and long-patched — remote code execution vulnerability (CVE-2021-21974) in Open Service Location Protocol (OpenSLP), an ESXi service for resolving network addresses.

**What is ESXiArgs?**

ESXiArgs has already infected more than 3,000 unpatched servers in the US, Canada, and multiple other countries. Victims have reported receiving a ransom demand of around 2 Bitcoin (or around $22,800 at press time) for the decryption key. Affected organizations have also reported the threat actor behind the campaign warning them to pay up within three days or risk having their sensitive information released publicly.

Security researchers that have analyzed ESXiArgs describe the malware's encryption process as specifically targeting virtual machine files so as to render the system unusable. In an alert earlier this week, Rapid 7 reported the malware was trying to shut down virtual machines by killing a specific process in the virtual machine kernel that handles I/O commands. In some cases, though, the malware was only partially successful in encrypting files and gave victims a chance to recover data, according to Rapid7.

In a Feb. 8 update, Rapid7 said its threat intelligence shows that multiple ransomware groups, in addition to the operator of ESXiArg, are targeting CVE-2021-21974 and other VMware ESXi vulnerabilities.

**Recovery Tool Based on Published Information**

CISA's recovery script is based on the work of two security researchers — Enes Sonmez and Ahmet Aykac — who showed how victims of ESXiArgs could reconstruct virtual machine metadata from disks that the ransomware might have failed to encrypt.

"This script does not seek to delete the encrypted config files, but instead seeks to create new config files that enable access to the VMs," CISA said. "While CISA works to ensure that scripts like this one are safe and effective, this script is delivered without warranty, either implicit or explicit."

VMware itself has urged organizations to implement the patch it issued two years ago for the flaw that ESXiArgs is exploiting. As a temporary measure, organizations that have not patched the flaw should disable ESXi's service location protocol (SLP) to mitigate the risk of attack via ESXiArgs, VMware said. Another measure: Disable port 427 (the one SLP uses), where possible, Singapore's SingCERT advised in a notice.

CISA Releases Recovery Script for Victims of ESXiArgs Ransomware

Jailbreak command creates ChatGPT alter ego DAN, willing to create content outside of its own content restriction controls.

Users have already found a way to work around ChatGPT's programming controls that restricts it from creating certain content deemed too violent, illegal, and more.

The prompt, called DAN (Do Anything Now), uses ChatGPT's token system against it, according to a report by CNBC. The command creates a scenario for ChatGPT it can't resolve, allowing DAN to bypass content restrictions in ChatGPT.

Although DAN isn't successful all of the time, a subreddit devoted to the DAN prompt's ability to work around ChatGPT's content policies has already racked up more than 200,000 subscribers.

Besides its uncanny ability to write malware, ChatGPT itself presents a new attack vector for threat actors.

"I love how people are gaslighting an AI," a user named Kyledude95 wrote about the discovery.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Jailbreak Trick Breaks ChatGPT Content Safeguards

In the cloud-first world, the security goal is to ensure only qualified users can access information across clouds.

The rise of multicloud environments brings with it the need to understand how to implement security policies across each cloud provider. The fact that each of the big three — Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) — uses different nomenclature and configurations makes it that much more complicated to create a seamless and secure virtual network.

A pair of researchers shared their practical advice on how to secure one piece, identity and access management (IAM), at Black Hat USA 2022.

"If there is one thing we would like you to take from this specific session, it is that IAM is the backbone service. It is the core service. It is the gateway that controls every access to your cloud resources, and it must be protected," said Igal Gofman, Ermetic's head of security, who presented "IAM the One Who Knocks" with Noam Dahan, Ermetic's research lead.

**Multiple Strategies for Multiple Clouds**

Organizations have several reasons for using multiple clouds, as Gofman listed off: adding in redundancy for better stability, reducing costs, taking advantage of multiple vendors' marquee features, and having conflicting platform requirements from different projects. But when you split resources among various clouds, he added, you need to be aware of and accommodate for the differences between how the platforms function.

"It's hard enough to be an expert on one cloud platform," Gofman said. "But often we copy features and routines from one platform to another. And those may work differently from what we expect at the beginning."

Dahan then drilled down on the ins and outs of logging features from Azure, AWS, and GCP. Besides using logging for detection and incident response, he said it is good for improving the permissions process.

"In order to know whether you can take permissions away from someone, what you would usually do is try to examine the logs and see what they're actually using, a sort of 'use it or lose it' philosophy," he explained.

There are two main approaches to issuing permissions, Dahn said: sculpting from marble or sculpting from clay. Marble means starting with a full raft of permissions and then chipping away until you reach minimum necessary permissions; this can end up too permissive because you don't want to remove too much. Clay means building up permissions until you have enough. Security staff likes this model, Dahan said, but developers hate it because they don't know what permissions they will need down the road. He recommended a hybrid approach of starting with a smaller hunk of permissions and then building up in places as needed.

**Who's at the Door?**

The title of the talk comes from the TV series _Breaking Bad_, when science-teacher-turned-meth-kingpin Walter White reacts to a friend warning him that he's in danger of someone coming to his door and killing him. White, incensed, asserts that he is the dangerous one by saying, "I am the one who knocks." Perhaps IAM is the stand-in for White — it looks basic and unassuming, but underestimating its power is dangerous. Or maybe it's just a turn of phrase.

Building Up IAM in a Multicloud World

Apps like Telegram, WhatsApp, and Discord are a hotbed of cybercriminal communication and scams.

This week, the Dutch national police shut down the criminal messaging service Exclu in conjunction with a sweeping crackdown that included 79 searches and 42 arrests in the Netherlands, Germany, and Belgium. The shutdown highlights the efforts authorities are putting into disrupting the use of messaging apps in the cybercriminal ecosystem. This particular service was unique in that it was exclusively the domain of cybercriminals and drug dealers, but it offers a glimpse into the evolving communication methods of the cybercrime in 2023.

Over the last year, experts have increasingly found that cybercriminals are moving away from Dark Web forums in favor of messaging apps and encrypted communications channels. And more broadly, security analysts and researchers have released details showing how legitimate platforms like Telegram, WhatsApp, and Discord are becoming a hotbed of criminal activity — not only for cybercriminal communications but also for a wide range of scams and exploit campaigns.

**Exclu's Demise**

According to Dutch authorities, the action against Exclu, its creators, and its users was the culmination of an investigation that took nearly two years. The authorities estimated the app had about 3,000 users, those who utilized Exclu on smartphones through a licensing scheme for about €800 (approximately US $857) every six months. In exchange, they got access to a highly secure, encrypted platform that enabled them to privately exchange messages, photos, notes, chats, and other information to support their criminal activity.

Police in the Netherlands said they worked closely with different agencies across Europe, including Eurojust, Europol, and police forces in Italy, Sweden, France, and Germany. Dutch authorities particularly thanked the German Landeskriminalamt (LKA) Rheinland-Pfalz for its early investigations in June 2020 that first brought Exclu to their attention and provided key evidence for investigation. They say the longtime operation was able to crack Exclu using both hacking methods and traditional police investigative work.

The crackdown follows relatively closely on the heels of similar shutdowns of services like Sky ECC and EncroChat.

**The Messaging App Migration**

Many cybercriminals aren't resorting to private criminal messaging networks Exclu when they can just as easily (and cheaply) use and abuse legitimate messaging apps like Telegram, WhatsApp, and Discord.

Just last week, analysts with threat intelligence firm Flare ranked Telegram as one of the top illicit sources to monitor for cybercriminal activity in 2023. They report that cybercriminals are starting to utilize Telegram Groups as an extension of the reach of Dark Web forums for its anonymity and encrypted communications.

"Telegram has no traditional admins monitoring its groups and one-to-one chats, which is attractive for anonymity. Threat actors can also hide their phone numbers on the service," according to Flare's analysis in a recent blog post. "Telegram offers end-to-end encryption for messages by default, which helps to avoid potential man-in-the-middle attacks that can snoop on messages in transit. Dark Web forums and marketplaces also have an encryption option but threat actors need to use something like Pretty Good Privacy (PGP) to ensure encryption, which is less convenient."

This echoes similar research out last summer by Intel 471, which noted that the cybercriminal groups it was observing were leaning toward Telegram as the preferred method of anonymous communication compared to in-forum messaging services.

"Of the cybercriminal groups Intel 471 has observed, Telegram is considered the preferred method of anonymous communication as opposed to in-forum messaging services monitored by administrators. Telegram provides actors with near real-time, encrypted communication if both parties are online simultaneously, whereas in-forum messaging requires waiting for unencrypted mail notifications," Intel471's researchers wrote. "This lag time, along with other security risks associated with forum communications, regularly encourage actors to provide other contact details in forum advertisements, such as email addresses and Telegram IDs."

This finding came directly on the heels of another one from these researchers, which pointed out that Telegram and Discord aren't just for communiques — they're also being hijacked to launch an array of cyberattacks. More recently, KELA researchers reported that Telegram in particular is being used to sell and leak stolen data, use it as a channel for selling other illegal products, publicize information about their attacks, and build bots to bolster their infrastructure that launches attacks and exfiltrates data.

The Telegram bot problem has particularly been growing in its profile on security analyst radars.

"Telegram bots have become a popular choice for threat actors as they are a low-cost or free, single-pane-of-glass solution," says Joe Gallop, intelligence analysis manager at Cofense, who points to his firm's recent report that noted that the use of Telegram bots as exfiltration destinations for phished information exploded by more than 800% between 2021 and 2022. "Telegram bots are easy to set up in private and group chats, are compatible with a wide range of programming languages, and are easy to integrate into malicious media such as malware or credential phishing kits."

Exclu Shutdown Underscores Outsized Role Messaging Apps Play in Cybercrime

Latest release gives small and mid-sized enterprises AI-driven analysis tools and unified visibility across IT environments for stronger ransomware protection.

**SAN FRANCISCO****,** **Feb. 8, 2023** **/PRNewswire/ —** ActZero®, a leading cybersecurity provider for small and mid-sized enterprises, announced the release of its next-generation Managed Detection and Response (MDR) platform. The ActZero MDR platform leverages its defense ingenuity and precision AI-detection to give customers an industry-leading ransomware block rate of 90 percent. Within this initial launch, security teams will gain unified real-time visibility across their environment with correlated threat insights, AI-driven tools to surface information faster for better decision making, and continuous protection against emerging ransomware threats.

Ransomware attacks are expected to cost businesses $30 billion in damages worldwide by this year. The speed and sophistication of these attacks are increasing, with adversaries now able to achieve breakout in under 43 minutes on average. ActZero successfully contains and eradicates ransomware threats within 17 minutes, compared to 98 minutes, based on assessments by an independent third-party evaluation platform. Speed to defend against a cyber threat is critical to saving a company's data, reputation, and business.

"Relying on a cybersecurity partner to protect against threats takes trust. With attackers frequently retooling to evade defenses, it's not enough to verify once; you need to continuously verify that systems are properly defended to build that trust. We thrive on that accountability," said ActZero President and Chief Revenue Officer Chris Finan. "Today, we are excited to announce the newest release of the ActZero MDR platform, making it easier for customers to continuously measure outcomes and interface seamlessly with our expert analysts. When every second counts, you need to have complete trust that your security partner will stop the threats to your business."

The newly designed ActZero MDR platform dashboard gives customers a real-time and holistic picture of their IT ecosystem and users. Critical metrics such as the ransomware block rate and average mean-time-to-first-response rate, along with real-time reporting provide the actionable intelligence for validating the cybersecurity team investment and continuous efforts to improve security.

"Businesses today need to operate at machine-speed to stop advanced cyber threats, but IT leaders and security teams also need complete visibility of their environment, which legacy SIEM and MDR approaches fail to deliver," said ActZero Chief Security Officer Adam Mansour. "We designed this new generation of our platform to give IT security teams the benefits of our market-leading, AI-driven detection, and response with purpose-built visibility and investigative tooling to empower them with complete control."

**About ActZero**

ActZero is a Gartner-recognized provider of Managed Detection and Response (MDR) services that delivers a powerful and affordable cybersecurity service to protect small and mid-sized enterprises against ransomware attacks. By  continuously testing defenses against the latest attack techniques and variants, ActZero ensures AI-detections and human threat hunters quickly stop threats. The company brings deep roots and expertise in cybersecurity to deliver measurable ransomware defense, reducing false alerts and responding quickly on a customer's behalf. Combined with exceptional service, ActZero empowers businesses with confidence that the company and customers are protected.

For more information on ActZero, please visit actzero.com.

SOURCE ActZero

ActZero Unveils Next-Generation MDR Platform

**ORLANDO, Fla.****,** **Feb. 8, 2023** **/PRNewswire/ --** The U.S. utilities industry is banding together to help suppliers identify and remediate vulnerabilities in software managing mission-critical applications for the U.S. energy industry. Several investor-owned utilities -- including American Electric Power and Avangrid Networks – today partnered with Fortress Information Security (Fortress) to launch the North America Energy Software Assurance Database (NAESAD) at the 2023 DistribuTECH Conference. NAESAD will provide the energy industry with a comprehensive Software Bill of Materials (SBOM) repository for every vendor.

Over the past several years, SolarWinds and Log4J vulnerabilities have highlighted the need to have a fundamental accounting for every software component used within the energy industry.

"The challenges for utilities and their supply chain partners are significant, but there is a clear path to mitigating critical risks," said Alex Santos, CEO of Fortress, the supply chain cybersecurity leader for critical infrastructure. "Industry players must collaborate – from the smallest supplier to the largest utility. The SBOM for every critical product needs to be carefully analyzed to reveal, prioritize, and eliminate the vulnerabilities that pose the greatest threat to the U.S. energy industry."

SBOMs provide the recipe of proprietary and open-source ingredients in software that run critical infrastructure technologies. SBOMs provide actionable information to purchasers so they can make informed decisions about software and help improve the security of applications. While many standards and guidelines require varying levels of software security, an effectively prepared and analyzed SBOM can be invaluable in meeting tomorrow's critical infrastructure application cybersecurity challenges.

NAESAD will securely aggregate SBOMs for every utility industry vendor. In close collaboration with forward-looking software providers, the repository will enable utilities to identify, triage, and remediate the most impactful and destructive risks. NAESAD is following the private-public partnership blueprint developed by the Cyberspace Solarium Commission.

Today's NAESAD launch comes as regulators, policymakers, and utilities focus more on SBOMs. A triad of SBOM regulations and recommendations from The Cybersecurity and Infrastructure Security Agency (CISA), The National Institute of Standards & Technology (NIST), The Office of Management and Budget (OMB), and a Presidential Executive Order has laid the groundwork for new SBOM requirements for companies that work with the U.S. Department of Energy, U.S. Department of Homeland Security, and other organizations responsible for U.S. critical infrastructure. Additional SBOM requirements for utilities and other critical industries are expected over the next year.

More details about how to join NAESAD and share SBOMs with utility partners can be found at NAESAD.com.

**About Fortress Information Security**  
Fortress secures North America's power and defense supply chains from cyberattacks on operational and critical enterprise technologies. Fortress' proprietary technology platform orchestrates North America'smost advanced cyber supply chain risk management and vulnerability management programs. Fortress operates the Asset to Vendor Network and the North American Energy Software Assurance Database, which give critical operators confidence that the products, services, and software they obtain from others are cyber-safe. Fortress is a Goldman Sachs portfolio Company.

SOURCE Fortress Information Security

Leading Energy Companies Tap Fortress to Build and Operate Industry Repository to Identify and Remediate Critical Software Vulnerabilities

Skybox closes $50 million in financing to drive growth of its SaaS-based security platform.

**SAN JOSE, Calif., Feb. 8, 2023–** Skybox Security, a global leader in Security Policy and Vulnerability Management, today announced the appointment of Mordecai (Mo) Rosen as Chief Executive Officer, and the closing of $50 million in financing from CVC Growth Funds, Pantheon, and J.P. Morgan. Mr. Rosen is a seasoned security technology executive with over 25 years of experience and will focus on driving company growth and accelerating the adoption of the industry’s first Software-as-a-Service (SaaS) solution for Security Policy and Vulnerability Management.  

“CVC is incredibly pleased to bring on Mo as the new CEO of Skybox and to continue our long-standing financial support of the company. Skybox is the cornerstone of the security infrastructure of hundreds of the largest enterprises around the globe. With its new SaaS platform, Skybox Cloud, the company is well positioned for significant market growth,” said Jason Glass, Partner at CVC. “Mo brings a wealth of knowledge and a track record of success in leading cybersecurity and SaaS companies, and we have every confidence that he will lead Skybox to its next level of long-term growth and profitability.” 

Before joining Skybox, Mr. Rosen was the President and CEO of Digital Guardian, a data loss prevention software company, where he significantly grew recurring revenue while simultaneously leading the organization to profitability. Before Digital Guardian, he served as the Corporate Senior Vice President and General Manager for Security at CA Technologies, now a Broadcom company.  

“I was drawn to Skybox by its disruptive technology platform, blue chip customer base, and seasoned cybersecurity team,” said Mr. Rosen. “With our first to market SaaS offering, Skybox Cloud, we are well positioned to disrupt both the Security Policy and Vulnerability Management markets with a single integrated SaaS platform. I am thrilled to join Skybox at this exciting inflection point and lead the company to its next level of growth.” 

To learn more about Skybox Security, visit https://www.skyboxsecurity.com/.  

**About Skybox Security**

Over 500 of the largest and most security-conscious enterprises in the world rely on Skybox for the insights and assurance required to stay ahead of dynamically changing attack surfaces. Our SaaS-based Security Posture Management Platform delivers complete visibility, analytics, and automation to quickly map, prioritize and remediate vulnerabilities across your organization. The vendor-agnostic solution intelligently optimizes security policies, actions, and change processes across all corporate networks and cloud environments. With Skybox, security teams can now focus on the most strategic business initiatives while ensuring enterprises remain protected.

Skybox Security Appoints Cybersecurity Veteran Mordecai Rosen as CEO

Platform opens new opportunities for managed service providers to manage, visualize, and secure customer devices from a single pane of glass, including automated maintenance and other operations.

**TEL AVIV, Israel****,** **Feb. 8, 2023** **/PRNewswire/ --** Leading IoTOps solution provider SecuriThings has announced the launch of a new Managed Service Platform for the physical security space that enables managed service providers to manage, visualize and maintain customer environments from a single pane of glass. This new offering comes in addition to SecuriThings' Enterprise solution, which is already used by Fortune 100 companies, including some of the world's largest enterprises across different industries.

Organizations across the globe invest extensively in buying and installing fleets of physical security devices – often across multiple sites, countries and continents. These assets require regular maintenance to stay operational, compliant and secure from cyber attacks: from password rotations and firmware upgrades, to general availability checks and more.          

With SecuriThings' Managed Service Platform, managed service providers (MSPs) can now offer customers the option of outsourcing the management and maintenance of their physical security devices to a dedicated team of experts. This includes automating critical maintenance tasks like firmware upgrades, password rotations, vulnerability detection and more – while leveraging alerts and root cause analysis to detect, diagnose, and resolve operational issues rapidly and efficiently with real-time data.

The platform also enables MSPs to increase their top and bottom lines by introducing additional revenue streams, cutting costs such as truck rolls and maintenance callouts, and providing a competitive, cost-effective service for customers. This new offering is currently only available to select partners, and will become generally available in the coming months.

"Our newly-introduced Managed Service Platform opens an exciting opportunity for our partners," said SecuriThings CEO and Co-Founder Roy Dagan. "They can now offer a remote managed service to maintain and secure their customers' physical security environments throughout their life cycle. And of course, for customers looking to outsource device management operations, it offers a convenient and cost-effective way to ensure their physical security devices are properly maintained, protected from cyber threats, and fully compliant with IT policies and standards."

**ABOUT SECURITHINGS**

Founded by leading security and IoT experts, SecuriThings empowers operations and IT professionals to automate the operational management of physical security devices, while also ensuring full compliance and security within their organization. The solution is trusted by Fortune 100 companies and has been deployed by numerous large enterprises such as technology companies, financial institutions, manufacturing companies, major airports, universities, hospitals and more. SecuriThings partners with key systems integrators and device manufacturers to provide unmatched insights, coverage and reliability.

SOURCE SecuriThings

SecuriThings Brings Managed Service Capabilities to Physical Security, With New Managed Service Platform

Enhanced industrial control systems cybersecurity for energy and communications sector among top recommendations in new GAO cybersecurity assessment.

A new US Government Accountability Office (GAO) assessment of the cybersecurity of the nation's critical infrastructure recommends a more robust role for the federal government in protecting industrial control systems (ICS) — particularly those operating the country's energy grid and communications networks.

The GAO in its report noted that the US Department of Energy's cybersecurity plan does not address vulnerabilities in individual energy grids' distribution systems.

"We recommended that, in developing plans to implement the national cybersecurity strategy for the grid, DOE coordinate with DHS, states, and industry to more fully address risks to the grid’s distribution systems from cyberattacks," the report said.

The GAO's assessment also calls on the Cybersecurity and Infrastructure Agency (CISA) to improve coordination and incident management among all levels of government — local, regional, and national — to protect against ransomware cyberattacks.

CISA is also called out by the GAO for its lack of attention on US communications network cybersecurity. The report added CISA has not updated its Communications Sector-Specific plan since 2015. CISA should also engage with the US Secret Service to respond to ransomware attacks on tribal, state, local, and territorial governments, the GAO report recommends.

This latest audit of infrastructure and industrial control systems is the third from the GAO on the cybersecurity of the nation. In the new report, GAO calls out the federal government for its slow response to previous recommendations by the agency.

"We've made 106 public recommendations in this area since 2010," the report said. "Nearly 57% of those recommendations had not been implemented as of December 2022."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

GAO Calls for Action to Protect Cybersecurity of Critical Energy, Communications Networks

**SAN FRANCISCO, Feb. 8, 2023 --** Corelight, the leader in open network detection and response (NDR), today announced it has expanded its partnership with CrowdStrike, a leader in cloud-delivered protection of endpoints, cloud workloads, identity and data. Under the agreement, CrowdStrike will have the ability to deploy Corelight NDR technology in customer engagements when delivering Incident Response, Compromise Assessment, and Network Security Monitoring services.

"We are honored to enter into this expanded partnership with CrowdStrike, a brand that's trusted and respected throughout the security space," said Brian Dye, CEO of Corelight. "We share a passion for using evidence to help customers find and disrupt advanced attacks, and we are excited about delivering this benefit to customers."

CrowdStrike Services will have the ability to leverage Corelight's NDR solution to enhance visibility, accelerate investigations, expand threat hunting, and understand the mechanism of advanced attacks across the full spectrum of endpoints, cloud platforms and the network – including unmanaged devices.

CrowdStrike Services delivers industry-leading incident response, technical assessments, training, and advisory services that help organizations prepare to defend against advanced threats, respond to widespread attacks, and enhance cybersecurity practices and controls. Harnessing the power of the CrowdStrike Security Cloud and the CrowdStrike Falcon platform, Services help protect critical areas of enterprise risk and hunt for threats using adversary-focused cyber threat intelligence to identify, track and prevent attacks from impacting our customer's business and brand.

"Corelight is a natural and highly complementary technology partner," said Thomas Etheridge, chief global professional services officer at CrowdStrike. "Better security outcomes require world-class and timely data. Because Corelight also seamlessly integrates with a range of CrowdStrike products, including CrowdStrike Falcon XDR and CrowdStrike Falcon LogScale, our mutual customers can hunt for unknown attacks, close visibility gaps, and even disrupt future threats faster by seeing everything that matters on the network – including unmanaged endpoints and IoT devices."

The agreement is the latest evidence of ongoing collaboration between the two companies: CrowdStrike's Falcon Fund is an investor in Corelight, and CrowdStrike was recently named Corelight's Apex Awards Alliance Partner of the Year for Innovation.

**About Corelight**

Corelight transforms network and cloud activity into evidence that security teams use to proactively hunt for threats, accelerate response to incidents, gain complete network visibility and create powerful analytics. Corelight's global customers include Fortune 500 companies, major government agencies, and large universities. Based in San Francisco, Corelight is an open-core security company founded by the creators of Zeek®, the widely-used network security technology. For more information, visit https://corelight.com or follow @corelight\_inc.

Source

DARKReading