All-cash transaction deal that was first announced in April means SailPoint is no longer a publicly traded company.

Private equity giant Thoma Bravo has now completed its purchase of enterprise identity security vendor SailPoint in an all-cash deal estimated at $6.9 billion that was initially announced on April 11 of this year.

Thoma Bravo struck a similar deal earlier this month with another identity security provider, Ping Identity, which it acquired for $2.8 billion in cash. Ping went from a publicly traded company to a privately held firm under the Thoma Bravo umbrella.

SailPoint, which offers a software-as-a-service (SaaS) identity-security platform called IdentityNow, also now goes from publicly listed on the New York Stock Exchange to a privately held entity under Thoma Bravo. SailPoint stockholders are eligible for $65.25 in cash per share of SailPoint common stock now that the company has been delisted.

"SailPoint is at the forefront of the growing identity-security market and is well-positioned to further capitalize on the increasing demand from enterprises for innovative and trusted solutions," Seth Boro, a managing partner at Thoma Bravo, said in a statement about the deal.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Thoma Bravo Closes $6.9B Acquisition of Identity-Security Vendor SailPoint

Funds will support product development and market expansion for ThreatX, which delivers real-time protection for APIs and Web apps against complex botnets, DDoS, and multimode attacks.

**Boston – August 17, 2022** - ThreatX, the leading API protection platform, today announced it has raised $30 million in Series B funding led by Harbert Growth Partners, with participation from Vistara Growth. Existing ThreatX investors .406 Ventures, Grotech Ventures and Access Venture Partners also participated in the round. With these funds, ThreatX will accelerate investments in platform development and scale their global sales and marketing initiatives as companies seek to block complex attacks targeting APIs and web applications.

As organizations undergo digital transformation efforts and deliver new capabilities to connect with customers and partners, APIs have emerged as a strategic priority. Coupled with growth in web applications, the enterprise attack surface has exploded and is under constant threat from botnets, DDoS attacks and complex, multi-mode offensive attack campaigns. In this context, customers need API and web application protection capabilities that can identify and respond to attacks in real time, even as perpetrators evolve their techniques.

ThreatX stands in stark contrast to other API security solutions by providing organizations the ability to discover and visualize their attack surface; block attacks in real-time; and have access to 24/7 managed services to support resource-constrained security teams.

Recently, ThreatX announced the company has been acknowledged twice as a Sample Vendor in the Gartner® Hype CycleTM for Application Security, 2022 report. ThreatX was listed within the API Threat Protection and Cloud WAAP categories.

“While APIs bring rich opportunities to companies across nearly every market, they can also quickly devolve into business threats if not secured,” said Gene Fay, CEO, ThreatX. “The ThreatX platform delivers the one-two punch that modern organizations seek in API and web application protection by incorporating behavioral analytics and multiple detection methods within a single analytics engine. This funding will enable us to accelerate development of our platform’s capabilities and expand our global go-to-market strategy.”

In addition to the Series B funding, ThreatX also announced that Tom Roberts, General Partner at Harbert Growth Partners, will join the company’s Board of Directors.

“The rapidly growing API security market is on the cusp of making an aggressive pivot,” said Roberts. “When we met with the ThreatX team and saw the technology in action, we knew they were positioned to lead the shift toward real-time attack protection across both APIs and web applications. We are pleased to partner with Gene and the ThreatX team to build upon their already leading platform and run fast at the API protection opportunity.”

“As CISOs and their teams prioritize API security, the opportunity to think more broadly about API and web application protection is growing. A consolidated approach makes sense given the fact that DDoS attacks and botnets are often targeting both types of assets at the same time,” said John O’Donoghue, Principal at Vistara Growth. “We see huge potential in ThreatX to deliver an integrated platform that protects both APIs and web apps against complex attacks in real time and look forward to supporting the company’s growth in the coming years.”

**About ThreatX**

ThreatX’s API protection platform makes the world safer by protecting APIs from all threats, including DDoS attempts, bot attacks, API abuse, exploitations of known vulnerabilities, and zero-day attacks. Its multi-layered detection capabilities accurately identify malicious actors and dynamically initiate appropriate action. ThreatX effectively and efficiently protects APIs for companies in every industry across the globe. For more information, visit: https://www.threatx.com/.

ThreatX Raises $30 Million in Series B Funding to Accelerate Growth in Global API Protection Market

Solution streamlines the assessment, monitoring, and remediation of third-party risk for information security, compliance, and risk teams.

**LOS ANGELES, CA — August 16, 2022 —** AuditBoard, the leading cloud-based platform transforming audit, risk, and compliance management, today announced the availability of its Third-Party Risk Management solution. This powerful new extension of AuditBoard’s connected risk platform breaks down silos and engages relevant stakeholders inside and outside the organization, enabling third-party risk management programs to scale more efficiently and meet the growing needs of their business.

Managing the downstream risks posed by a large network of third parties, including cloud vendors, has become increasingly challenging as the COVID-19 pandemic has accelerated the global economy’s digital transformation and companies have come to rely more heavily on IT-related vendors. In this new era of dynamic digital risk, third-party breaches are now estimated to cost U.S. companies an average of $9.5 million per incident.

Information security, risk management, and compliance teams need the right solution to efficiently evaluate and mitigate third-party risk while managing ever-expanding cybersecurity and compliance obligations. Working in conjunction with AuditBoard’s innovative and award-winning CrossComply solution, which allows organizations to manage their information security compliance programs at scale, AuditBoard’s Third-Party Risk Management solution empowers teams to manage their overall IT risk and compliance posture more effectively.

“A wave of digital risk is rising as the global economy becomes ever more interconnected,” said Rajiv Makhijani, SVP of Emerging Products at AuditBoard. “We’ve created this purpose-built solution to empower our customers to get ahead of this wave by more efficiently and comprehensively managing the expanding third-party risk landscape.”

AuditBoard’s Third-Party Risk Management solution enables teams to save time, be better partners to the business, and scale through automated and collaborative workflows that enable more effective management of third-party risk. This purpose-built solution supports customizable assessments, automated risk scoring, issue management, ongoing monitoring, and centralized reporting and tracking.

To learn more about this new solution, visit AuditBoard.com.

**About AuditBoard**

AuditBoard is the leading cloud-based platform transforming audit, risk, and compliance management. More than 35% of the Fortune 500 leverage AuditBoard to move their businesses forward with greater clarity and agility. AuditBoard is top-rated by customers on G2, Capterra, and Gartner Peer Insights, and was recently ranked for the third year in a row as one of the fastest-growing technology companies in North America by Deloitte. To learn more, visit AuditBoard.com.

AuditBoard Launches Third-Party Risk Management Solution, Empowering Enterprises to Tackle IT Vendor Risk at Scale

Especially if your e-commerce and CMS platforms are integrated, you risk multiple potential sources of intrusion, and the integration points themselves may be vulnerable to attack.

Chances are your business has both an e-commerce platform and a content management system. Perhaps they're one and the same. Together, these technologies drive your business, empowering customers, sales staff, and partners. The content management system (CMS) gives them information; the e-commerce platform handles transactions. Easy.

However, these technologies can also be a target, providing everything that a bad actor wants, from trade secrets (such as inventories and price discount sheets), lists of partners and suppliers, discount codes, and even sensitive information about customers.

Whether your e-commerce platforms and CMSes are combined in an all-in-one comprehensive suite, or are disparate systems integrated together, the risks and potential weak spots are mainly the same. If you have integrated e-commerce and CMS platforms, not only does your tech now have multiple potential sources of intrusion, but the integration points themselves may be vulnerable to attack, or at least to snooping. If you have an all-in-one system, a single exploited vulnerability or phishing-enabled breach could give cybercriminals everything in one fell swoop.

For this discussion, let's assume that your company follows well-established cybersecurity best practices, such as applying patches and fixes to operating systems, applications, drivers, and libraries. Failure to make these updates in a timely fashion is a leading cause of breaches. Also, let's assume you employ state-of-the-art encryption for data in transit, and change all default access and admin passwords for your servers, routers, and services.

With that as a baseline, let's talk about seven specific steps that are particularly well-suited to CMS and e-commerce platforms.

**Gather the Least Amount of Customer Information Possible**

Then be careful where (and how) you store that data. If you steal customer credit card numbers or medical information, the market impact, civil lawsuit penalties, and adverse publicity could put you out of business. Oh, don't forget HIPAA and GDPR fines, depending on what and where your data is stolen.

**Careful What You Store On Internet-Facing Servers**

Yes, your e-commerce platform needs to be aware of inventory levels and pricing discounts in order to facilitate e-commerce. What if competitors can retrieve that information in a tidy bundle? They might be able to use your business data against you.

**Monitor Lists of Zero-Day Threats and Other Vulnerabilities**

You can start with the one published by organizations like the Cybersecurity & Infrastructure Security Agency. It's not enough to receive threat-assessment reports, of course. They need to be read and acted upon. An issue with a very large impact appeared, for example, in the popular Log4j library not long ago. Every organization that uses Log4j needed to update to version 2.16 or later immediately. Is there someone in your organization responsible for knowing about that sort of incident? If not, there's a vulnerability right there.

**Use Penetration Testing Tools and Services**

No matter whether your software is off the shelf, tailored by consultants, or homegrown, you don't know how secure it is unless you test, test, test. Conduct pen tests regularly and thoroughly; not only do systems become less secure if not maintained properly (see the first point), also your service landscape changes and attackers are becoming more sophisticated as well. If you haven't pen tested recently, or used a white-hat firm to assess your defenses, you don't know what you don't know.

**Vet Software Suppliers, and Insist They Follow Secure Coding Practices**

If you are using cloud services, examine those carefully. Consider everything. For example, the CMS company I work for is certified at the highest level for its security practices, conforming to ISO 27001 security protocols. These protocols include regular code reviews, strict access control, anomaly detection and rigorous security testing. You should expect nothing less from every supplier.

**Check With Banks, Payment Processors to Ensure You're Doing It Right**

There are many practices for working with ACH transfers and credit-card payments. Some of these appear obvious, such as using CVV values on credit cards, and verifying that shipping addresses match the bank account's address — but e-commerce platforms may not enable those extra levels of validation by default. I would also highly suggest using a service that specializes in payment transactions. These services will be certified according to PCI DSS requirements and you can focus on your core competencies.

**Log Everything and Analyze Those Logs for Anomalies, Attack Patterns**

Every transaction, every privileged login to the CMS or e-commerce platform, every error caused by someone entering a bad password, should be logged. Don't trust humans to be able to understand those logs, by the way; modern-day attacks can be both fast and subtle, and there's too much data to correlate for patterns. Use machine-learning tools to monitor events and logs, and as in the fourth point above, make sure someone is responsible for receiving, reading, and following up on those reports.

Follow these seven steps, and your CMS and e-commerce platforms will be more secure and more trustworthy than ever before. Are these steps reasonable? Yes. Are they easy? Once systems are in place to work safely and run securely, yes. Your customers, suppliers, and partners want your systems to be safe. Let's get to work.

7 Smart Ways to Secure Your E-Commerce Site

The new feature detects attempts to modify files and processes for Microsoft Defender for Endpoints on macOS.

Microsoft has announced general availability of tamper protection in Microsoft Defender for Endpoint on macOS. The feature, which has been in public preview since May, will be rolling out over the next few days.

Tamper protection allows administrators who deal with Apple hardware in their environments to block the unauthorized removal of Microsoft Defender for Endpoint on macOS systems, as well as prevent any attempts to tamper with Microsoft Defender for Endpoint files, processes, and configuration settings. The feature elevates the organization’s endpoint security posture, Microsoft said in a post on the Microsoft Tech Community.

“Enhanced tamper resilience across prevalent platforms is a great advantage for organizations seeking to continuously enhance their endpoint security,” the company said.

Tamper protection is a device-level setting, which means the protection will apply to all users on the device. Available settings are “disabled,” “audit,” and “block.” By default, Microsoft Defender for Endpoint on macOS will have Tamper protection set to “audit,” so actions to uninstall the agent, modify Microsoft Defender files, or creating new files in the location where Microsoft Defender is installed will be logged automatically. However, administrators will not see any alerts in the Security Center – they will need to check either on-device logs or under the Advanced Hunting feature.

Tamper protection needs to be switched to “block” in order for administrators to see alerts and for tampering activities to be blocked. The company says a future rollout will automatically switch settings so that “block” becomes the default setting.

Administrators can enable the feature using a mobile device management platform, such as Endpoint Manager or Jamf. Tamper protection is available only for Microsoft Defender for Endpoint version 101.70.19 or above and on macOS versions Monterey, Big Sur, and Catalina.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Microsoft Rolls Out Tamper Protection for Macs

"Seaborgium" is a highly persistent threat actor that has been targeting organizations and individuals of likely interest to the Russian government since at least 2017, company says.

Microsoft's Threat Intelligence Center (MSTIC) has taken steps to disrupt the operations of "Seaborgium," a Russia-based threat actor that has been involved in persistent spear-phishing and credential-theft campaigns aimed at organizations and individuals in NATO countries since at least 2017.

The threat actor's primary motivation appears to be cyber espionage. Its victims include numerous organizations in the defense and intelligence communities, nongovernmental organizations, think tanks, higher-education institutions, and intergovernmental organizations, mainly in the US and UK. Microsoft said it has identified some 30 organizations that have been targeted in Seaborgium campaigns so far this year alone.

"Seaborgium has a high interest in targeting individuals as well, with 30% of Microsoft’s nation-state notifications related to Seaborgium activity being delivered to Microsoft consumer email accounts," Microsoft said in a blog post this week. Targeted individuals have included former intelligence officials, Russian experts, and Russian citizens outside the country that are of interest to Moscow. Available telemetry and tactics suggest overlaps between Seaborgium and threat groups that others are variously tracking as the Callisto Group, ColdRiver, and TA446, Microsoft said.

Seaborgium is just one of multiple Russia-based groups that are targeting US firms in cyber-espionage campaigns currently. Earlier this year, the US Cybersecurity and Infrastructure Security Agency (CISA) warned about Russian actors systematically stealing sensitive, but not classified, data on US weapons development and technologies used by the US military and government. The warning followed one from January about the potential for more Russian attacks on US targets in retaliation for US-led sanctions over the war in Ukraine.

**Sophisticated Impersonation**

In its blog post, Microsoft described Seaborgium actors as using mostly the same social-engineering tactics over the years to try and gain an initial foothold in a target organization. Before launching a campaign, the threat actor has typically tended to conduct extensive research on targeted individuals to identify their social and business contacts. The research has often involved the threat actor using social media platforms — including fraudulent profiles on LinkedIn — and publicly available information gather intel on individuals of interest.

They then have used the information to impersonate individuals known to the target and contacted them using new email accounts with email addresses or aliases configured to match the names or aliases of the impersonated individuals, Microsoft said. The tone of the initial contact is usually different depending on whether an individual is a personal/consumer target or someone working in a targeted organization. In the case of the former, Seaborgium actors have typically started with a benign email that exchanges pleasantries on topics of interest to the target and references a nonexistent attachment. Microsoft surmised that the goal of taking this approach is likely to establish a rapport with a target. If the phishing email recipient replies, the threat actor responds with an email containing a link to their credential-stealing infrastructure.

Seaborgium's phishing emails have a more businesslike and organizational tone to them for individuals within a target organization. In these situations, the threat actors have shown a tendency to take a more authoritative approach in directing email recipients to the credential-stealing site — for example, by taking cybersecurity-themed lures. In most campaigns, Seaborgium actors have embedded the URL to their credential-stealing site directly in the email body itself, Microsoft said. But of late, the threat actor has also been using PDF files and attachments spoofing a document or file-hosting service — often OneDrive — to distribute the link.

**Using Stolen Credentials to Steal Emails and Attachments**

Microsoft said its researchers have observed Seaborgium using stolen credentials to directly log in to victims' email accounts and steal their emails and attachments. In a few instances, the threat actor has also been observed configuring victim email accounts to forward emails to attacker-controlled addresses. 

"There have been several cases where Seaborgium has been observed using their impersonation accounts to facilitate dialogue with specific people of interest and, as a result, were included in conversations, sometimes unwittingly, involving multiple parties," Microsoft said, adding that often these conversations have involved potentially sensitive information.

**Under Scrutiny**

As far as the disruption goes, the computing giant has now disabled accounts that Seaborgium actors have been using for victim reconnaissance, phishing, and other malicious activities. This includes multiple LinkedIn accounts. It has also developed detections for phishing domains associated with Seaborgium.

F-Secure, which refers to the threat actor as the Callisto Group, has been tracking its activities since 2015. In a 2017 report, the security vendor had described Callisto Group as a sophisticated actor targeting governments, journalists, and think tanks in the EU and parts of eastern Europe. F-Secure had described the group's campaigns as involving highly convincing spear-phishing emails often sent from legitimate email accounts to which the threat actor had previously gained access, using stolen credentials.

More recently, Google warned about the threat actor in a broader update on malicious cyber activity in eastern Europe since the start of the Ukraine war in February. The company said it had observed ColdRiver — its name for Seaborgium — continuing to use Gmail accounts to send credential-phishing emails to Google and non-Google email accounts belonging to politicians, defense and government officials, journalists, and think tanks. "The group's tactics, techniques and procedures (TTPs) for these campaigns have shifted slightly from including phishing links directly in the email, to also linking to PDFs and/or DOCs hosted on Google Drive and Microsoft One Drive," Google said. The files have contained a link to a credential-phishing domain, according to Google.

Microsoft Disrupts Russian Group's Multiyear Cyber-Espionage Campaign

Omdia Senior Analyst Hollie Hennessy goes over her first experience of DEF CON as a woman in cybersecurity.

If you asked me how I was feeling on Thursday night about attending DEF CON, I would have said "nervous." After a week of preparing for and attending Black Hat — which I'm used to, for the most part — I wasn't sure how different DEF CON would be or what to expect.

I'd heard a lot. Switch your phone off, don't take credit cards, leave your laptop behind …some people asked why I was staying, warned I'd be exhausted, but assured me I'd have fun. And fun was an understatement.

Being able to attend these events in person has massively helped me with confidence and "imposter syndrome." This was mentioned in the opening DEF CON talk on Friday, and I've heard so many women share a similar worry. But in reality, the cybersecurity community is diverse in its talent. Although it may not always feel this way, being in Las Vegas for Black Hat and DEF CON has shown me that all you need is the enthusiasm to become an expert in your chosen specialty. With a community so willing to share knowledge, that's more than enough. I don't need to know everything, and I'm trying to stop myself from thinking that.

As a woman in tech — in cybersecurity even, networking can be difficult to navigate. Luckily, I had the most wonderful experience and genuinely can't say that I've been to many other events (social, work, or otherwise) where people are so kind, welcoming, and eager to teach and learn.

I know this experience is not the same for all women attending, but it's great to see progress made and a zero-tolerance policy toward sexual harassment from both DEF CON and Black Hat and the willingness to enforce this. I was pleasantly surprised to make friends in the girls' restrooms (who would've thought it!) and hope to make many more in years to come.

So, what are my tips?

1.  **Don't try to do too much.** There's so much to do and see and you're better off taking your time to focus on the areas that interest you most. I spent most of my time in the IoT Village (I'm all about the things) and Car Hacking Village. I missed a few that I wanted to get to, but there's always next time!
2.  **Save the talks for post-conference.** A colleague gave me some great advice to spend most of my time in the villages, as the talks are accessible after the event. Unless you want to attend a talk that isn't recorded, or have some burning questions for the speakers, make the most of walking around and seeing all the wonderful things the event has to offer in the flesh.
3.  **Talk to people!** It can be daunting to pluck up the courage to say hi, but one of the best things about attending in-person events (especially after COVID) is meeting others face to face. I guarantee you'll learn something new, and even make some new friends and connections.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

DEF CON: A Woman's First Experience

South Staffordshire in the UK has acknowledged it was targeted in a cyberattack, but Clop ransomware appears to be shaking down the wrong water company.

South Staffordshire plc, a UK water-supply company, has acknowledged it was the victim of a cyberattack. Around the same time, the Clop ransomware group started threatening Thames Water that it would release data it has stolen from the utility unless Thames Water paid up.

The problem? Thames Water wasn't breached. 

Apparently, Clop got its UK water companies confused. 

South Staffordshire serves about 1.6 million customers and recently reported that it was targeted in a cyberattack and was "experiencing a disruption to out corporate IT network and our teams are working to resolve this as quickly as possible." It added there has been no disruption on service. 

"This incident has not affected our ability to supply safe water, and we can confirm we are still supplying safe water to all of our Cambridge Water and South Staffs Water customers," the water company said. 

Meanwhile, Thames Water, the UK's largest water supplier to more than 15 million people, was forced to deny it was breached by Clop ransomware attackers, who threatened they now had the ability to tamper with the water supply, according to reports. 

"As providers of critical national infrastructure, we take the security of our networks and systems very seriously and are focused on protecting them, so that we can continue to provide resilient services to our customers and the environment,” the larger water company told the UK Mirror. 

While Clop seems to have its records all wrong, both water utilities mounted capable responses to the ransomware group's attack on critical infrastructure, according to Edward Liebig, global director of cyber ecosystem at Hexagon Asset Lifecycle Intelligence. 

"I’m impressed by South Staffordshire Water’s ability to defend against the cyberattack in the IT systems and buffer the OT systems from impact," Liebig said. "And had Thames Water not done an investigation of the 'proof of compromise,' they may very well have decided to negotiate further. In both instances, each organization did their due diligence."

Clop Ransomware Gang Breaches Water Utility, Just Not the Right One

Just as one crop of malware-laced software packages is taken down from the popular Python code repository, a new host arrives, looking to steal a raft of data.

Just a week after 10 malicious software packages were found nesting in the Python Package Index (PyPI) repository, several more have come to light, uncovered by different firms. It's becoming a bit of a whack-a-mole exercise, snuffing out bad code only to find more taking its place.

In last week's disclosure, researchers at Check Point found Trojanized packages mimicking popular legitimate components, containing droppers for information-stealing malware. That prompted Kaspersky analysts to scour the open source repository further, which led to the discovery of two more rogue offerings, dubbed "pyrequests" and "ultrarequests," that purported to be one of the most popular packages in PyPI (which is simply named “requests“).

"The attacker used a description of the legitimate 'requests' package in order to trick victims into installing a malicious one," according to Kaspersky's Tuesday analysis. "The description contains faked statistics, as if the package was installed 230 million times in a month and has more than 48,000 stars on GitHub. The project description also references the web pages of the original requests package, as well as the author’s email. All mentions of the legitimate package's name have been replaced with the name of the malicious one."

If installed, the result is a W4SP Stealer infection, through which attackers can steal Discord tokens, saved cookies, and passwords from browsers in separate threads.

Meanwhile, researchers at Synk on Tuesday published findings around a dozen malicious PyPI packages aimed at stealing Discord and Roblox users’ credentials and payment info. According to Kyle Suero, Snyk's lead researcher on the report, the malware will also attempt to steal Google Chrome data or pilfer passwords and bookmarks from Windows machines to pivot throughout all accounts.

All of the offending packages have been removed from PyPI; however, it's unclear how many times they were downloaded before that.

Attacks on code repositories continue to snowball. According to ReversingLabs, attacks on npm and PyPI have collectively spiked from 259 in 2018 to 1,010 in 2021 — a 290% increase.

"As long as we keep ignoring the core of the problem — which is how do you trust code — we are not handling software supply chain security," said Tomislav Peričin, co-founder and chief software architect at ReversingLabs, said in a recent report.

Whack-a-Mole: More Malicious PyPI Packages Spring Up Targeting Discord, Roblox

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Come up with a cybersecurity-themed caption for the cartoon above, and you could win a $25 Amazon gift card if it's chosen as Dark Reading editors' favorite. Here are four convenient ways to submit your idea:

*   Email _\[email protected\]_ with the subject line "Dark Reading August Toon."
*   Via social media: Twitter, Facebook, and LinkedIn.

The contest ends Wednesday, Sept. 7, 2022. We look forward to your submissions.

**Last Month's Winner**

July's "Modern-Day Fable" caption contest now how a modern-day twist that would even make Aesop laugh. Congratulations go to winner Dana Morrow, director of security services at Foresite MSP. A $25 Amazon gift card is on the way.  

    

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading