A network of more than 2,600 Telegram bots has helped exfiltrate one-time passwords and data from devices for more than two years.

Dynamically Evolving SMS Stealer Threatens Global Android Users

The nation-state espionage group known for attacking Pakistan has expanded its reach to targets in Egypt and Sri Lanka.

Source: Papilio via Alamy

A nation-state cyber-espionage group linked to India has broadened its targeting beyond regional rivals in Pakistan, Afghanistan, China, and Nepal and is focused on compromising computers and networks at maritime facilities in countries as far away as the Mediterranean Sea.

The group — known variously as SideWinder, Razor Tiger, and Rattlesnake — commonly wages spear-phishing attacks using images of official-looking documents. In its latest campaigns, SideWinder has falsified documents from specific ports, including the Port of Alexandria in Egypt, with high-interest topics such as job termination and salary reductions, researchers from BlackBerry said in a newly published advisory.

While the group has typically focused on rivals closer to home and is less prolific than other cyber spies, the current campaign suggests that they have expanded their targeting, says Ismael Valenzuela, vice president of threat research and intelligence at BlackBerry.

"It's the first time we have seen SideWinder targeting ports and maritime facilities in EMEA," he says. "We see a lot of geopolitical turbulence and \[changing\] environments across the globe on a variety of issues. This often galvanizes threat groups and state-sponsors to specifically strike down critical assets, like those within the maritime industry."

The maritime industry increasingly has become a target of cyberattacks, posing serious danger to ships and ports. In 2019, the US Coast Guard warned shipping companies that attacks on their systems could lead to accidents and catastrophes. In the past year, following increased Chinese cyber operations against critical infrastructure including maritime systems in and around the South China Sea, various countries in the Asia-Pacific region have banded together to protect their networks and systems.

The cyber warnings also come as physical threats to shipping increase as well. Piracy off the Atlantic coast of Africa and the Arabian Sea, and among the island nations of the Asia-Pacific, has escalated, while ship malfunctions — such as the one the caused a vessel to collide with the Baltimore bridge — have become more frequent.

**New Phishing Lures, Old Exploits**

SideWinder has conducted attacks since at least 2012. The group is relatively sophisticated, commonly using encrypted malware samples, various obfuscation techniques, and running code in memory to avoid file scanners, according to a presentation at Black Hat Asia in 2022. From 2020 to 2022, the group conducted more than 1,000 attacks, Noushin Shabab, senior security researcher with Kaspersky, said during that presentation.

"I think what truly makes them stand out among other APT \[advanced persistent threat\] actors is the large tool set they have with many different malware families, lots of new spear-phishing documents, and a very large infrastructure," Shabab said. "I haven't seen 1,000 attacks from a single APT" from another group thus far.

However, the current cyberattacks are, in many cases, using older vulnerabilities, such as a flaw in Microsoft Office dating back to 2017. The vulnerability (CVE-2017-0199) allows remote code execution against old versions of Microsoft Office and Windows, and has been a very popular vector of attack, with more than 5,600 malware samples exploiting the issue this year, including 15 malicious samples reported from Egypt, according to BlackBerry.

Like most groups, SideWinder does not like to waste a good exploit, even if it's seven years old, says Valenzuela.

"Why do we still see old CVEs like these exploited in the wild? Attackers know that many organizations don’t patch their Office software for many years," he says. "This is especially common in organizations with legacy systems, which are often used in ports and maritime facilities as well as other critical infrastructure."

BlackBerry documented the use of another very popular — and seven-year-old — vulnerability, in the Microsoft Office Equation Editor (CVE-2017-11882), with more than 9,500 samples of Office documents exploiting the issue since the start of 2024. Both of these vulnerabilities have made the Known Exploited Vulnerabilities list maintained by the Cybersecurity and Infrastructure Security Agency (CISA).

**Maritime Under Attack**

BlackBerry's threat researchers discovered a variety of domains in the first and second stages of the attack that are likely evidence of their targets, including a long list in South Asia including Pakistan, Sri Lanka, Bangladesh, Myanmar, Nepal, and the Maldives. Egyptian ports appear to be the only target outside of India's extended neighborhood.

While the country appears to be extending its reach to other regions of the world, the cyber operations are not actually targeting ports on a global scale, Valenzuela says.

"They’re certainly targeting ports in key countries where this threat actor has geopolitical interests, and that includes the Indian Ocean and the Mediterranean, \[such as\] Egypt," he says. "We don’t have information about other targets in the Mediterranean Sea at this time."

The researchers have not captured the final payload in the attacks, but based on the group's previous actions, they believe the goal is intelligence-gathering and cyber espionage, the company stated in its advisory.

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

India-Linked SideWinder Group Pivots to Hacking Maritime Targets

Clutch Security is the latest cybersecurity startup looking to secure and manage non-human identity.

Source: Sasin Paraska via Alamy Stock Photo

Identity is more than just logins and passwords. Enterprise defenders now have to consider that attackers can target and breach their networks by stealing and abusing non-human identities, such as API keys, secrets, tokens, and service accounts.

Clutch Security has emerged from stealth with its Universal Non-Human Identity (NHI) Security platform to give security teams complete visibility into all of an organization's non-human identities. The platform allows security teams to understand which NHIs exist within the organization and identifies associated risks. The platform prioritizes the risks based on severity and business impact and provides tailored remediation advice to address those risks.

The modern technology stack spans cloud services, software-as-a-service applications, on-premises software, digital vaults, code repositories, continuous integration/continuous delivery pipelines, and data warehouses, which means identity and access management requires working with both human and non-human identities. Adversaries like to target NHIs because they are distributed — making them difficult to track — and usually have elevated privileges. Clutch estimated a 1-to-45 human-to-non-human ratio in many organizations.

As part of the launch, Clutch Security announced it has raised a $8.5 million seed funding round led by Lightspeed Venture Partners. The round included Merlin Ventures, Cyber Club London (CCL), and individual investors, including Exabeam co-founder Nir Polak, serial co-founder Shlomo Kramer (Imperva, Check Point, Cato Networks), and HashiCorp co-founder Armon Dadgar. Clutch CEO and co-founder Ofir Har-Chen was the former COO at Hunters.

Clutch Security Launches With NHI Platform

According to the study, around 400 stolen GenAI credentials are being sold by threat actors per day.

Source: AlexPhotoStock via Alamy Stock Photo

Cybercriminals are now able to purchase Generative AI (GenAI) account credentials on underground hacker markets along with other various illegal goods, according to new research.

The GenAI credentials include those that belong to users of ChatGPT, Quillbot, Notion, Huggingface, and Replit, among many others. eSentire's cybersecurity research team found that the hackers are selling the credentials for roughly 400 GenAI accounts per day, usually stolen from corporate end users' computers after they've been infected with an infostealer.

LLM Paradise was one underground service found to be selling stolen GenAI credentials, advertising GPT-4/Clause API keys at a starting price of $15 each (the market has since closed its doors). The threat actors also have leveraged legitimate outlets, at one point advertising the illegal products on social media platform TikTok.

Ultimately, the researchers also found that the threat actors are finding a variety of ways to monetize GenAI account credentials, whether that's by creating phishing campaigns or launching malware from the accounts, producing chatbots, or stealing sensitive corporate data such as financial information or customer information.

The researchers recommend that organizations monitor employee usage of cloud-based GenAI offerings, encourage GenAI vendors to implement WebAuth in their portals, use passkey security or password best practices, and use Dark Web monitoring services. 

**About the Author(s)**

Criminal Hackers Add GenAI Credentials to Underground Markets

With sufficient privileges in Active Directory, attackers only have to create an "ESX Admins" group in the targeted domain and add a user to it.

Source: Schoening via Alamy Stock Photo

Multiple ransomware groups have been weaponizing an authentication bypass bug in VMware ESXi hypervisors to quickly deploy malware across virtualized environments.

VMware assigned the bug (CVE-2024-37085) a "medium" 6.8 out of 10 score on the CVSS scale. The average score is largely due to the fact that it requires an attacker to have existing permissions in a target's Active Directory (AD).

If they do have AD access, however, attackers can cause significant damage. With no technical trickery whatsoever, they can use CVE-2024-37085 to instantly scale up their ESXi privileges to the max, opening the door to ransomware deployment, data exfiltration, lateral movement, and more. Groups like Storm-0506 (aka Black Basta), Storm-1175, Manatee Tempest (part of Evil Corp), and Octo Tempest (aka Scattered Spider) have already tried it out, deploying ransomware such as Black Basta and Akira.

Broadcom recently published a fix, available on its website.

**How CVE-2024-37085 Works**

Some organizations configure their ESXi hypervisors to use AD for user management. It turns out that by doing this, organizations were exposing themselves to something unexpected. By default, ESXi hypervisors granted full administrative access to any member of an AD domain group named "ESX Admins."

It's unclear how the "ESX Admins" group vulnerability was introduced into ESXi in the first place—Broadcom declined to clarify when Dark Reading reached out on the question. As Microsoft noted in a blog post, there's no particular reason why the hypervisor should have expected such a domain group, or have had a rule for what to do with it. "This group is not a built-in group in Active Directory and does not exist by default. ESXi hypervisors do not validate that such a group exists when the server is joined to a domain and still treats any members of a group with this name with full administrative access, even if the group did not originally exist," the threat intel team wrote. "Additionally, the membership in the group is determined by name and not by security identifier (SID)."

Exploiting CVE-2024-37085 was entirely trivial. So long as an attacker had sufficient privileges in AD, all they'd have to do to gain ESXi admin privileges was to create an "ESX Admins" group in the targeted domain and add a user to it. They could also rename any existing group to "ESX Admins," and either wield one of its existing users or add a new one.

**The Risk with Hypervisors**

"Ransomware attacks targeting ESXi and VMs are increasingly common, especially since around 2020, when enterprises increased their move toward digital transformation and took advantage of modern hybrid cloud and virtualized on-premise environments," explains Jason Soroko, senior vice president of product at Sectigo.

For all the business sense they make, virtualized environments also afford hackers unique benefits. Hypervisors tend to run many VMs at once, making them a one-stop shop for blasting ransomware as widely as possible, and those VMs often host critical services and business data.

Their utility to hackers makes it all the more troubling that, as Microsoft noted in its blog, security products have limited visibility and protections for hypervisors. This, Soroko explains, is "due to their isolation, complexity, and the specialized knowledge required for their protection. This isolation makes it difficult for traditional security tools to monitor and protect the entire environment, and API integration limits further exacerbate this issue."

To cover for these shortcomings, Microsoft highlighted the importance of keeping up to date with patches, and practicing broader cyber hygiene around critical and vulnerable assets. "Attackers love using the path of least resistance that provides maximum opportunity," Soroko notes, adding that ransomware actors will only target these systems more and more in the future.

**About the Author(s)**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

Ransomware Gangs Exploit ESXi Bug for Instant, Mass Encryption of VMs

The incident serves as a stark reminder of the fragility of our digital infrastructure. By adopting a diversified, resilient approach to cybersecurity, we can mitigate the risks and build a more secure digital future.

Source: SOPA Images Limited via Alamy Stock Photo

COMMENTARY

On July 19, the world experienced one of the largest IT outages in history, affecting millions of users globally, and systems and people will be reeling from its impact for weeks. The cause? A faulty update on CrowdStrike's Falcon platform. This seemingly minor error in code cascaded into a major outage, affecting critical infrastructure worldwide. Airports, hospital systems, and other large enterprises relying on CrowdStrike were brought to a standstill, highlighting the vulnerabilities inherent in our increasingly digital world.

Falcon, a cloud-based security solution, functions like an advanced antivirus, updating threat intelligence and protecting systems automatically without user intervention. This automation is a boon for large enterprises, which can ensure all endpoints are protected and up to date without manual oversight. While efficient, this centralized system also introduces a fundamental risk: a single point of failure. When the update failed, it didn't just affect a few computers, but millions, all at once. The very feature that made Falcon attractive — its cloud-based, seamless, automated updates — became its Achilles' heel.

The Falcon failure exposed another fundamental flaw in our approach to cybersecurity and IT infrastructure. We tend to focus on protecting the most critical systems — flight control systems, cardiac machines in hospitals — while neglecting the everyday, mundane systems that are equally vital. In this case, it wasn't the high-stakes technology that failed but the routine systems like accounting, billing, and ticketing. These systems, often taken for granted, are the backbone of our daily operations, and their disruption can lead to chaos. 

This is not a new phenomenon. Often when hospitals and pipelines are hacked, attackers target accounting and billing systems, not the core refinery or processing plant. Without the ability to track and bill customers, operations came to a halt. Our reliance on digital solutions, coupled with the assumption that technology will always function flawlessly, leaves us unprepared for such disruptions.

Finally, we won't be able to fully recover for a while, even though mitigation guidance has already been released by CrowdStrike. It is because the system needs to be reset, and most endpoint users either lack the permissions (because IT has locked down systems by default) or because they don't know how to reset or revert systems. This is the third reason why the problem is persisting despite mitigation guidance already being released.

Such issues will only get worse as artificial intelligence (AI) gets integrated into systems. AI will centralize control further, automate complex tasks, and strip power and autonomy from users at the endpoint. Imagine a hospital where AI manages patient data, schedules, and even treatment plans. If such a system fails, frontline healthcare workers might find themselves unable to access crucial information or perform essential tasks, leading to potentially life-threatening delays. As AI becomes more integrated into our systems, the potential for large-scale disruptions increases. Our reliance on silicon-based systems will only deepen, making it imperative to address these vulnerabilities now.

**Blueprint for Resilience**

Fortunately, carbon-based systems in nature provides a blueprint for resilience. In the early 1900s, Buffalo, N.Y., where I live, had thousands of tree-lined streets designed by Frederick Law Olmsted. Many of these trees were the same species, with streets named for the trees that lined them. But it created a single point of failure. When Dutch elm disease struck in the 1950s, it wiped out most of the elm trees because they were planted too closely together, allowing the disease to spread rapidly. This lesson teaches us the importance of diversity — in this case, heterogeneous computing systems. Organizations must implement diverse IT systems, especially for their core functions. Just as a monoculture of trees can be decimated by a single disease, a uniform IT infrastructure can be crippled by a single point of failure. Introducing variety in hardware and software solutions can create a more resilient digital environment.

Nature also offers insights into protecting core functions. Just as the human body employs multiple layers of defense to protect vital organs, organizations should use a variety of software and operating systems to handle critical functions. For example, a hospital's patient management system could run on one platform while its diagnostic tools operate on another, ensuring that a failure in one system doesn't compromise the entire operation. This is akin to how different species of trees in a forest can prevent the spread of disease; if one species is affected, others can continue to thrive. Similarly, deploying diverse cybersecurity measures and segregating core functions can provide a buffer against widespread failure, enhancing overall system resilience.

Finally, to prevent future meltdowns like the CrowdStrike incident, we also need to invest in training and preparedness drills to equip IT teams to respond swiftly and effectively to emerging threats. This is not a minor issue. Fixing the current problem required computers to be reverted back to their pre-update stage or waiting to deploy an updated patch. Even as technology is being centralized and implemented, more of the core functionalities are being centrally administered or locked down. While this approach aims to prevent disruption, it also makes it harder for staff to reboot systems or have administrative access, such as needing to reboot the system in safe mode or revert systems to their older state.

The issue is that people aren't really given access or equipped to handle these things, even as more of the technological functionalities are being centrally administered and removed from the hands of users at the endpoint. People remain the weakest link in cybersecurity — whether it's the coders creating patches or the individuals installing or reverting systems. Thus, our solutions must also include comprehensive training and a focus on the human element to ensure robust security measures.

The CrowdStrike meltdown serves as a stark reminder of the fragility of our digital infrastructure. By learning from nature and adopting a diversified, resilient approach to cybersecurity, we can mitigate the risks and build a more secure digital future. As the saying goes, "Those who can't remember the past are condemned to repeat it." Let us collaborate, innovate, and learn from our mistakes to ensure that such a disruption never happens again. The future of our digital world depends on the lessons we learn from the past and the actions we take today.

This column was updated to clarify a reference to pipeline attacks, July 30, 2024.

**About the Author(s)**

Technologist

Arun Vishwanath, Ph.D., MBA, is among the foremost experts on the "people problem" of cybersecurity. He is the author of the book, The Weakest Link: How to Diagnose, Detect, and Defend Users from Phishing, published by MIT Press.

His research on the science of cybersecurity focuses on the biggest vulnerability in enterprise security: users. His body of work includes the development of methodologies to quantify human cyber-risk, approaches to diagnose how and why people are at risk through social engineering, and techniques to mitigate this risk.

Arun, an alumnus of the Berkman Klein Center at Harvard University, has held faculty positions at the University at Buffalo and Indiana University. He has authored close to 50 peer-reviewed research papers on the science of security and has written pieces for CNN, the Washington Post, and other leading media. His views on cybersecurity have also appeared in Wired Magazine and in reports such as the Verizon "Data Breach Investigations Report" (DBIR). You can read more about him on his website here.

The CrowdStrike Meltdown: A Wake-up Call for Cybersecurity

Data thieves heisted the HSA provider's data repository for 4.5 million people's HR information, including employer and dependents intel.

Source: Brian Jackson via Alamy Stock Photo

HealthEquity, a Utah-based health savings account (HSA) provider, has disclosed a data breach affecting 4.5 million customers across the US. The incident stemmed from a hack of a data repository maintained by a third party, a spokesperson confirmed.

The company said in the notice that a hacker managed to breach an "an unstructured data repository outside our core systems" containing customer data, making off with various kinds of personally identifiable information (PII). While the spokesperson confirmed that the repository was maintained by a third-party vendor, she declined to offer further details on the topography or supply chain implications beyond noting that internal systems, including transactional platforms and integrations, weren't impacted.

The stolen PII included a mix of benefits sign-up information that varied by customer. That mix could include name, address, phone number, employee ID, employer, Social Security number, and dependent information. In all, the heist offers crooks a treasure trove of social engineering information.

"By referencing a procedure or test that an individual might think is private and known only to medical professionals, bad actors can more easily build trust with potential victims," said Erich Kron, security awareness advocate at KnowBe4, in an emailed statement.  

**Dwell Time & Response Anatomy**

The initial access occurred on March 9, but it was only officially reported on June 26, according to a notice filed with the Maine Attorney General's Office. However, the dwell time for the cyberattackers before discovery was "much narrower" than that timeline would suggest, according to the company's spokesperson.

Rather than months, the attackers apparently went unnoticed for a little more than two weeks. The first inkling that there was a problem was a systems anomaly alert on March 25. HealthEquity said it took immediate action upon receiving the alert from its vendor, resolving the issue quickly and then kicking off an "extensive technical investigation and … data forensics" effort that lasted through June 10.

That was followed by a validation of the data theft that wrapped up June 26. After that, the company was finally able to file notifications with state authorities, and also notified the US Securities and Exchange Commission although it wasn't mandated to do so.

"We have taken immediate, proactive and prudent action since we first discovered an anomaly with our third-party vendor," the company said in a statement shared with Dark Reading. "This included quickly resolving the issue, bringing together a team of outside and internal experts to investigate, and preparing for response."

The spokesperson also noted that incident response is an ongoing effort: HealthEquity is now in the process of notifying partners, clients and members, and is working with its vendors to prevent future incidents.

**Protecting External Data Stores**

In this case, the type of repository "outside core systems" the attackers accessed was one hosted by a third-party cloud provider. But that's not the only kind of external storage that organizations need to worry about protecting. Data can also be hosted in an internally maintained container, or even in shadow databases that employees maintain on their own for productivity. In all cases, a comprehensive data protection strategy is necessary to prevent HealthEquity-type incidents, researchers note—starting with gaining visibility on where that data is.

"This is a lesson in the protection of data outside of the most common systems," Kron said. "It is not unusual to find that employees have used tools such as spreadsheets to collect information and process it without the knowledge of the IT and security staff. This is often not malicious but done to make work easier and more efficient, however these additional copies of data are difficult to protect if they are unknown."

Erfan Shadabi, cybersecurity expert at comforte AG, says that organizations should ensure they have processes in place to secure data across such hybrid storage footprints. This could include "comprehensive vetting processes, regular audits, and robust contractual agreements to enforce strict security standards," he said.

"Prioritizing data-centric security techniques — such as encryption, tokenization, and secure access controls — is essential to safeguard sensitive information effectively," he added.

Specifically for third-party risk, "organizations must recognize that their security posture is intricately linked to the practices of their third-party vendors," he adds. "By focusing on securing data itself and not just the network, companies can reduce the risk of exposure and limit the impact of breaches when they occur."

**About the Author(s)**

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

Cyberattackers Accessed HealthEquity Customer Info via Third Party

Despite getting help, NIST is not keeping up with new vulnerability reports for the National Vulnerabilities Database, according to an analysis from Fortress Information Security.

Source: Fortress Information Security

The backlog of unanalyzed vulnerabilities for the National Vulnerability Database continues to grow, with new estimates suggesting the backlog could reach nearly 30,000 unanalyzed vulnerabilities by the end of 2024.

The National Vulnerability Database (NVD), maintained by the National Institute of Standards and Technology (NIST), is the United States' official repository for common vulnerabilities and exposures. Many scanners, analysts, and vendors depend on the NVD to determine what software has been affected by a vulnerability. When vulnerabilities are not added to the database in a timely manner, it impacts an enterprise defender's ability to prioritize vulnerabilities that need immediate patching or to identify issues that affect multiple applications.

NVD currently has a backlog of 16,974 vulnerabilities and receives, on average, about 111 additional security flaws daily. Data from Fortress Information Security suggests that analysts would need to process more than 217 vulnerabilities each day just to clear the backlog and keep up with the new ones being reported. Currently, NIST is averaging just over 30 new vulnerabilities per day, according to Fortress.

Resource challenges, an increase in the volume of vulnerabilities being disclosed, and other constraints have hampered NIST's ability to process vulnerabilities in a timely manner, NIST said earlier this year. The agency announced a partnership with the Cybersecurity and Infrastructure Security Agency as well as a contract with a private cybersecurity company for help clearing the backlog. The aim was to reduce the backlog by Sept. 30, the end of the government's fiscal year.

According to Fortress, NIST has analyzed just a little over a quarter of new CVEs discovered in 2024. At the current pace, Fortress estimates 29,569 vulnerabilities will still be awaiting analysis by the end of 2024 — and that calculation is based on the assumption that analysts are working seven days a week.

With 155 days left in 2024 (and just 62 days to the end of the fiscal year), NIST would have to significantly increase resources even more to make a reasonable dent in the backlog.

**About the Author(s)**

Dark Reading

The Edge is Dark Reading's home for features, threat data and in-depth perspectives on cybersecurity.

NVD Backlog Continues to Grow

PRESS RELEASE

PLEASANTON, Calif., and ZURICH, July 26, 2024 /PRNewswire/ -- Cowbell, a leading provider of cyber insurance for small and medium-sized enterprises (SMEs), announced today that it has closed a $60 million Series C equity investment from Zurich Insurance Group (Zurich), a leading global multi-line insurer.

With the $60 million investment, Cowbell plans to scale operations to meet growing demand, extend its presence in key international markets, bolster cyber resilience services, introduce new cutting-edge products to the market, and further strengthen strategic partnerships. Leveraging existing advances in AI and GenerativeAI (GenAI), the company aims to expand its technological infrastructure to drive further efficiencies and support expedited policyholder and broker decision-making across traditional, digital and API-driven channels.

Zurich's investment in Cowbell underscores its commitment to supporting businesses with state-of-the-art cyber protection and resilience solutions, particularly within the SME and middle market segments, where companies are exposed to cyber risk more than ever. It also aligns with Zurich's ambition to leverage best-in-class technology and expertise to address the evolving complexities of cyber risk management.

The global cost of cybercrime is estimated to reach $24 trillion by 2027, and ransomware attacks alone cost small businesses $1.7 million per incident on average.

Sierra Signorelli, CEO Commercial Insurance at Zurich said: "Cyber threats remain a major concern for business leaders due to their constantly evolving nature. To address this, we continue to invest in enhancing our cyber capabilities and building a strong support system for our customers. Cowbell is an excellent partner for managing cyber risks. They use a data-centric approach to risk management, provide continuous risk assessments, actively monitor threats, and have strong underwriting expertise. And all of this is centered around a highly advanced digital platform designed to boost cyber resilience for their customers."

Jack Kudale, founder and CEO, Cowbell said, "This investment from Zurich is the strongest endorsement of Cowbell's vision and capabilities yet and deepens our footprint in the global cyber insurance market. With a refined focus on product expansion, we will accelerate our efforts to deliver advanced and efficient cyber insurance solutions to SMEs and mid-market businesses globally, ensuring they have the protection and tools they need to navigate the rising threats in the evolving cyber landscape."

Cowbell's broker-first approach and reputation for its easy-to-use platform and effective education experience for the broker community are gaining worldwide traction and trust, with licensed producer growth of nearly 3x over the last two years. With better outcomes for customers at its core, reinvestment back into the business will see Cowbell double down on advancements in AI and GenAI to bring greater transparency to cyber risk. In doing so, Cowbell will facilitate smarter decision-making and raise cyber resiliency standards for brokers and businesses worldwide.

This latest investment marks a major milestone in Cowbell's fast-scaling journey, following a year of rapid geographic and product expansion, technological growth, and the onboarding of industry-heavyweight experts, further solidifying its position in the global cyber insurance market.

With $202 million raised to-date, Cowbell has remained capital-efficient throughout its journey. Cowbell has remained steadfast in its clear vision to protect, educate and empower SMEs and mid-market businesses, and the broker community serving them - from today's and tomorrow's threats.

J.P. Morgan Securities LLC acted as financial advisor and Gunderson Dettmer Stough Villeneuve Franklin & Hachigian, LLP provided legal counsel to Cowbell in this transaction.

About Cowbell  
Cowbell is a pioneer of Adaptive Cyber Insurance, leading the way in providing small and medium-sized enterprises (SMEs) with coverage adaptable to today's and tomorrow's threats and the advanced warning of cyber risk exposures. With its unique AI-based approach in risk selection and pricing, Cowbell's continuous underwriting platform, powered by Cowbell Factors, compresses the insurance process from submission to issue in less than 5 minutes. Backed by 25 prominent global (re)insurance partners, Cowbell serves SMEs across 50 U.S. states, the District of Columbia, and the United Kingdom, assessing businesses with revenues up to $1Bglobally. Founded in 2019, Cowbell is based in the San Francisco Bay Area and has employees across the U.S., Canada, India, and the U.K.

For more information, please visit https://cowbell.insure/.    

About Zurich Insurance Group  
Zurich Insurance Group (Zurich) is a leading multi-line insurer serving people and businesses in more than 200 countries and territories. Founded 150 years ago, Zurich is transforming insurance. In addition to providing insurance protection, Zurich is increasingly offering prevention services such as those that promote wellbeing and enhance climate resilience. Reflecting its purpose to 'create a brighter future together,' Zurich aspires to be one of the most responsible and impactful businesses in the world. It is targeting net-zero emissions by 2050 and has the highest-possible ESG rating from MSCI. In 2020, Zurich launched the Zurich Forest project to support reforestation and biodiversity restoration in Brazil. The Group has about 60,000 employees and is headquartered in Zurich, Switzerland. Zurich Insurance Group Ltd (ZURN), is listed on the SIX Swiss Exchange and has a level I American Depositary Receipt (ZURVY) program, which is traded over-the-counter on OTCQX. Further information is available at www.zurich.com.

Cowbell Secures $60 Million Series C Funding From Zurich Insurance Group

PRESS RELEASE

Lakera, the world's leading real-time Generative AI (GenAI) Security company, has raised $20 million in a Series A funding round. Led by European VC Atomico, with participation from Citi Ventures, Dropbox Ventures, and existing investors including redalpine, this investment brings Lakera's total funding to $30 million. This funding positions Lakera at the forefront of the global economy's race to secure GenAI applications. As part of this round, Atomico Partner Sasha Vidiborskiy will join Lakera's board.

It's been predicted that by 2026, 80% of enterprises will have used GenAI or GenAI-enabled applications in production environments, up from less than 5% in 2023. As businesses worldwide scramble to harness the power of GenAI without exposing themselves to AI-specific risks, the demand for Lakera's platform is expected to continue growing at a rapid clip.

While GenAI could add an estimated $4.4 trillion annually to global GDP, cybersecurity remains the second most-cited risk associated with its adoption as traditional cyber tools are ill-equipped to address the novel dangers it poses. This creates a critical need for security solutions that address GenAI-specific risks, without which businesses are unable to unlock the benefits of AI.

David Haber, Founder and CEO of Lakera, explains the urgency: "With the advent of GenAI, the old cybersecurity techniques aren't sufficient. Enterprises now operate in a world where anyone who knows how to talk knows how to hack. Security solutions need to change but they can't get in the way of user experience. There is a need for real-time AI security solutions that continuously evolve and enable amazing user experiences."

David elaborates in his blog published today.

Cybersecurity-risks posed by LLMs

The spectrum of LLM vulnerabilities is both diverse and severe:

*   GenAI introduces prompt attacks as the most widely accessible hacking method. In the past, hackers needed to be able to code - but now, the only barrier to entry is being able to talk.
    
*   Prompt attacks can easily be used to manipulate GenAI so that a malicious actor can gain unauthorized access to a company's systems, steal confidential data, take unauthorized actions, and generate harmful content.
    
*   AI "sleeper agents" can lie dormant until activated for malicious purposes. Jailbreaking techniques can compromise powerful models in mere minutes.
    
*   AI-targeted worms can bypass security measures, harvesting data and launching widespread attacks.
    

Lakera's comprehensive approach to AI security delivers three key benefits for enterprises: protection that doesn't slow down their AI applications; the ability to stay ahead of AI threats with continuously evolving intelligence; and centralized implementation of AI security controls.

The company's growth comes at a pivotal moment in AI development. With the adoption of GenAI, users now direct software applications using natural language, and Lakera's real-time AI security does not compromise application interactivity. To make implementation effortless for developers, the company's API can be integrated with a single line of code, providing an ultra-low-latency security layer compatible with any GenAI model. Centralized controls allow security teams to customize application-specific policies and address emerging threats without code changes.

Lakera is uniquely positioned to tackle these fast-changing challenges, in part thanks to Gandalf - an AI educational platform created by the company which serves as the world's largest AI red team. With over 250 thousand unique users worldwide, including companies such as Microsoft where it's used in security training, Gandalf generates a real-time database of AI threats which is growing by 100 thousands of uniquely new attacks every day and keeps Lakera's software up to date, ensuring continuous protection for customers. The 50+ million data points generated by Gandalf, combined with the founding team's deep experience in building AI systems with real-time requirements, means Lakera's customers are able to stay ahead of threats and deliver amazing user experiences.

Atomico Partner Sasha Vidoborskiy, who will join Lakera's board, said: "Lakera has seen impressive commercial pull, winning customers such as Dropbox and a top 3 US bank, and already having more than 35% of Fortune 100 companies knock on their door. All those clients have an urgency to deploy GenAI applications into production, but can't do it without protection in place. Easy integration, best-in-class performance, and low latency are why they pick Lakera. But most importantly, the company is led by David and his team, who are thought leaders in the space and have a deep understanding of what the adoption of AI means for new cybersecurity risks."

"At Dropbox, ensuring the security of our systems and customers' data is a top priority," said Donald Tucker, Head of Corporate Development and Ventures at Dropbox. "Lakera's team has extensive expertise and a deep understanding of the complex security challenges companies are facing with LLMs and Generative AI. Their advanced technology is helping companies like Dropbox safeguard against vulnerabilities these new technologies pose. We're thrilled to strengthen our existing relationship with Lakera by investing in the future of the company and AI security."

Lakera plans to use this funding round to invest further in its product development and expand its presence in the US, where it already has a foothold in Silicon Valley.

About Lakera  
Lakera is the world's leading real-time GenAI security company. Customers rely on Lakera for security that doesn't slow down their AI applications. To accelerate secure adoption of AI, the company created Gandalf, an educational tool, where more than one million users have learned about AI security. Lakera uses AI to continuously evolve defenses, so customers can stay ahead of emerging threats. Lakera was founded by David Haber, Mateo Rojas-Carulla and Matthias Kraft in 2021.

About Atomico  
Atomico invests in ambitious tech founders from Seed through to IPO with a particular focus on Europe, leveraging deep operational experience to supercharge their growth. Founded in 2006, Atomico has partnered with over 100 ambitious teams - including those at Klarna, Supercell, Graphcore, Compass, MessageBird, Masterclass, Attentive Mobile, Pipedrive and Hinge Health. Atomico's team of founders, investors and operational leaders have been responsible for global expansion, hiring and marketing at companies from Skype and Google to Twitter and Uber. The firm currently has $5B in assets under management.

Source

DARKReading