Two Mideast nations that were at odds until recently have announced the "Crystal Ball" project, aimed at better protecting against cyberattacks via collaboration and knowledge sharing.

In a watershed moment for two once-fractious regional neighbors, the United Arab Emirates (UAE) and Israel are to work together on a threat intelligence-sharing platform to battle cybersecurity threats.

Announced this week, the “Crystal Ball” project is a digital platform for detecting and repelling hackers via collaboration and knowledge sharing around national-level cyberthreats. It was described as being enabled to "design, deploy and enable regional intelligence enhancement," according to a presentation slide seen during this week's Tel Aviv Cyber Week.

The project will be backed by Microsoft, Israel's Rafael Advanced Defense Systems, and Abu Dhabi's CPX, and an unspecified number of countries will also participate, according to The Circuit.

**The Need for a Joined-up Response**

Emirati cybersecurity chief Mohamed Al Kuwaiti said the platform will enable partner countries to "easily and seamlessly share information," and will be strengthened by the combination of the countries' joint abilities, processing power, and a high volume of data.

In an address to the Cyber Week conference, Al Kuwaiti said, "Cyber threats do not distinguish between nations, do not distinguish between entities or people, and that is why we need to unite against those threats. The Crystal Ball that we are aiming for the whole community will be the first step toward that."

Nadir Izrael, co-founder and CTO of Armis, says he welcomes the joint effort in the Middle East because he is "a strong believer that nations need to work together to develop a comprehensive and effective response to cyber warfare, in order to build a more secure and resilient world."

He adds: "As we saw with the cyberattacks on Israel this late April, coordinated efforts from groups associated with Iran and Russia are looking to increase geopolitical tensions and create instability amongst citizens. In a world that has become polarized, it is a must to invest in cybersecurity measures to protect whole nations from these kinds of attacks."

Izrael also noted that the Crystal Ball project should be a model for others. "Governments and organizations need to take threats seriously, and allocate resources to build robust and resilient cybersecurity systems," he says. "Those advanced systems will allow for threat intelligence, which can help detect malicious behavior and stop an attack even before it happens."

**Improved Diplomatic Relations**

Al Kuwaiti said the UAE's connection with Israeli tech companies has been especially helpful in his country's transition to a digital economy, after the UAE and Israel normalized diplomatic relations as part of the September 2020 Abraham Accords, leading to the bolstering of both commercial and strategic ties between the countries.

Ryan Westman, senior manager of threat intelligence at eSentire, says the collaboration of threat intelligence sharing between Israel and the UAE will be key to better securing the region. "In general, any information-sharing agreement will likely benefit organizations in the countries covered, as the more insights we have on threats and vulnerabilities to organizations, the better the job we can do at responding to those the risk those threats and vulnerabilities present," he says. "By sharing information on those threats and vulnerabilities, the easier it is for security teams to respond to the risks." 

He notes that while information sharing and analysis centers (ISACs) have existed for some time now and are not novel, the collaboration between two states that used to be at geopolitical odds is notable.

"Partnerships like this can have a wider impact, improving the security posture for everyone, because it makes it easier to detect potential issues in the wider threat landscape," he says. "Working together in this way benefits everyone, whether they are in the two countries concerned or in others within the region."

UAE, Israel Ink Pivotal Joint Cyber-Threat Intelligence Agreement

The North Korea-aligned threat actor known as Andariel leveraged a previously undocumented malware called EarlyRat in attacks exploiting the Log4j Log4Shell vulnerability last year.
"Andariel infects machines by executing a Log4j exploit, which, in turn, downloads further malware from the command-and-control (C2) server," Kaspersky said in a new report.
Also called Silent Chollima and Stonefly,

The North Korea-aligned threat actor known as **Andariel** leveraged a previously undocumented malware called **EarlyRat** in attacks exploiting the Log4j Log4Shell vulnerability last year.

"Andariel infects machines by executing a Log4j exploit, which, in turn, downloads further malware from the command-and-control (C2) server," Kaspersky said in a new report.

Also called Silent Chollima and Stonefly, Andariel is associated with North Korea's Lab 110, a primary hacking unit that also houses APT38 (aka BlueNoroff) and other subordinate elements collectively tracked under the umbrella name Lazarus Group.

The threat actor, besides conducting espionage attacks against foreign government and military entities that are of strategic interest, is known to carry out cyber crime as an extra source of income to the sanctions-hit nation.

Some of the key cyber weapons in its arsenal include a ransomware strain referred to as Maui and numerous remote access trojans and backdoors such as Dtrack (aka Valefor and Preft), NukeSped (aka Manuscrypt), MagicRAT, and YamaBot.

NukeSped contains a range of features to create and terminate processes and move, read, and write files on the infected host. The use of NukeSped overlaps with a campaign tracked by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) under the name TraderTraitor.

Andariel's weaponization of the Log4Shell vulnerability in unpatched VMware Horizon servers was previously documented by AhnLab Security Emergency Response Center (ASEC) and Cisco Talos in 2022.

The latest attack chain discovered by Kaspsersky shows that EarlyRat is propagated by means of phishing emails containing decoy Microsoft Word documents. The files, when opened, prompt the recipients to enable macros, leading to the execution of VBA code responsible for downloading the trojan.

Described as a simple but limited backdoor, EarlyRat is designed to collect and exfiltrate system information to a remote server as well as execute arbitrary commands. It also shares high-level similarities with MagicRAT, not to mention written using a framework called PureBasic. MagicRAT, on the other hand, employs the Qt Framework.

Another characteristic of the intrusion is the use of legitimate off-the-shelf tools like 3Proxy, ForkDump, NTDSDumpEx, Powerline, and PuTTY for further exploitation of the target.

"Despite being an APT group, Lazarus is known for performing typical cyber crime tasks, such as deploying ransomware, which makes the cybercrime landscape more complicated," Kaspersky said. "Moreover, the group uses a wide variety of custom tools, constantly updating existing and developing new malware."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

North Korean Hacker Group Andariel Strikes with New EarlyRat Malware

Microsoft Edge (Chromium-based) Spoofing Vulnerability

CVE-2022-23264

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

CVE-2022-26899

CVE-2022-29146

CVE-2022-29147

CVE-2022-29144

OpenShift API for Data Protection (OADP) 1.1.5 is now available.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:
* CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
* CVE-2023-24534: A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by memory exhaustion in the common function in HTTP and MIME header parsing. By sending a specially crafted request, a remote attacker can cause a denial of service.
* CVE-2023-24536: A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an issue during multipart form parsing. By sending a specially crafted input, a remote attacker can consume large amounts of CPU and memory, resulting in a denial of service.
* CVE-2023-24537: A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an infinite loop due to integer overflow when calling any of the Parse functions. By sending a specially crafted input, a remote attacker can cause a denial of service.
* CVE-2023-24538: A flaw was found in Golang Go. This flaw allows a remote attacker to execute arbitrary code on the system, caused by not properly considering backticks (`) as Javascript string delimiters. By sending a specially crafted request, an attacker execute arbitrary code on the system.
* CVE-2023-24539: A flaw was found in golang where angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in unexpectedly closing the CSS context and allowing for the injection of unexpected HMTL if executed with untrusted input.
* CVE-2023-24540: A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
* CVE-2023-29400: A flaw was found in golang, where templates containing actions in unquoted HTML attributes (for example, "attr={{.}}") executed with empty input could result in output that would have unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into tags.


Skip to navigation Skip to main content

**Utilities**

*   Subscriptions
*   Downloads
*   Containers
*   Support Cases

**Infrastructure and Management**

*   Red Hat Enterprise Linux
*   Red Hat Satellite
*   Red Hat Subscription Management
*   Red Hat Insights
*   Red Hat Ansible Automation Platform

**Cloud Computing**

*   Red Hat OpenShift
*   Red Hat OpenStack Platform
*   Red Hat OpenShift Container Platform
*   Red Hat OpenShift Data Science
*   Red Hat OpenShift Dedicated
*   Red Hat Advanced Cluster Security for Kubernetes
*   Red Hat Advanced Cluster Management for Kubernetes
*   Red Hat Quay
*   Red Hat CodeReady Workspaces
*   Red Hat OpenShift Service on AWS

**Storage**

*   Red Hat Gluster Storage
*   Red Hat Hyperconverged Infrastructure
*   Red Hat Ceph Storage
*   Red Hat OpenShift Data Foundation

**Runtimes**

*   Red Hat Runtimes
*   Red Hat JBoss Enterprise Application Platform
*   Red Hat Data Grid
*   Red Hat JBoss Web Server
*   Red Hat Single Sign On
*   Red Hat support for Spring Boot
*   Red Hat build of Node.js
*   Red Hat build of Quarkus

**Integration and Automation**

All Products

Issued:

2023-06-29

Updated:

2023-06-29

**RHSA-2023:3918 - Security Advisory**

*   Overview
*   Updated Images

**Synopsis**

Important: OpenShift API for Data Protection (OADP) 1.1.5 security and bug fix update

**Type/Severity**

Security Advisory: Important

**Topic**

OpenShift API for Data Protection (OADP) 1.1.5 is now available.  

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

**Description**

OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes.  

Security Fix(es):  

*   golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
*   net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
*   golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
*   golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
*   golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
*   golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
*   golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
*   golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

**Solution**

Before applying this update, make sure all previously released errata relevant to your system have been applied.  

For details on how to apply this update, refer to:  

https://access.redhat.com/articles/11258

**Affected Products**

*   OpenShift API for Data Protection 1 x86\_64

**Fixes**

*   BZ - 2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
*   BZ - 2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters
*   BZ - 2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
*   BZ - 2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
*   BZ - 2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing
*   BZ - 2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
*   BZ - 2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace
*   BZ - 2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes

**CVEs**

*   CVE-2022-3627
*   CVE-2022-3970
*   CVE-2022-36227
*   CVE-2022-41723
*   CVE-2023-2491
*   CVE-2023-24534
*   CVE-2023-24536
*   CVE-2023-24537
*   CVE-2023-24538
*   CVE-2023-24539
*   CVE-2023-24540
*   CVE-2023-27535
*   CVE-2023-29400

**ppc64le**

oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:232797593d0ea5323f913c902ac7bd25bbe1eacdb40b00deaf9bbcd9306bf4e9

oadp/oadp-mustgather-rhel8@sha256:b0215bed64f78192b9d7a8e4904efdbef9408296806d7fb6b86927b0cbd67a79

oadp/oadp-operator-bundle@sha256:91e02a2cd94a94354294e16b3a8495175907c9d07e1f7965febe1179d36c9940

oadp/oadp-rhel8-operator@sha256:36882e2b4183bd2d0e58acb59e49004db1c2accd1f4e6cc01dfc2ca10cbbda19

oadp/oadp-velero-plugin-for-aws-rhel8@sha256:a5702782be3fdf763b47c734d107d853c2b8f3f831c45d34dd686c19e2b295ff

oadp/oadp-velero-plugin-for-csi-rhel8@sha256:38e0bf9d9f589e93335d477e23fe2838ad2ef138472d66887d7343b720081c19

oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:195a154a41e6a7a4176475470aa1058e7ab171cb5ffd0c998009ac022ba810b2

oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:37d6701003b9e5f58795d85267d1ca1fd9687981abe784075d9c7ba5a7a036c5

oadp/oadp-velero-plugin-rhel8@sha256:17ae407841f29a5bbf3e72d25acc883150929ce91fc6384fc81e8d7977eecf42

oadp/oadp-velero-restic-restore-helper-rhel8@sha256:7e212da871132c319750a6513e9b98a836b6d670dfeeb0ca2050b0fe959bbb9e

oadp/oadp-velero-rhel8@sha256:b4ab733bfbf853bbac246530f1b4b0dafae2173ab93e32d1cebdd5b6c70dae29

oadp/oadp-volume-snapshot-mover-rhel8@sha256:72636e3e55f29a227092993151fba716f91d17812cd4b493cc2308823cbfb4a8

**s390x**

oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:aa58ca1500ddb603bc9f39eba981584cd38682eab092ce06ec951a078a3dc0a6

oadp/oadp-mustgather-rhel8@sha256:c0a9d5bbd97613ca2d26bd4315b55ffc6512fa429c0cdec5da77fe2fb8d254b9

oadp/oadp-operator-bundle@sha256:a3348b782dd897ef822bdf885db8c61e24278dde0520646e54270fec53d10f34

oadp/oadp-rhel8-operator@sha256:cdcb5d1b32410973779aed6cb760c016fe2035dbcae41dde6707045bbf4e97c6

oadp/oadp-velero-plugin-for-aws-rhel8@sha256:60a01a5762ea173f150f6ccd6f8bfd1f1e17aed1f4865f9161d0d06e3c490ca7

oadp/oadp-velero-plugin-for-csi-rhel8@sha256:2a8a8c64cb71f52559e53b9dddaeaee97b8067a7b2f996cde2e1ca2e14f25e55

oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:b3792c8e92add196de5d06cdd88eb8e9d02fcdb9ce15c1a9a362241018caf6db

oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1b8f8b7b03f5dc4ca2fbeec13eb4b99e5bec1f09daf7b04c982ba1324611c6f3

oadp/oadp-velero-plugin-rhel8@sha256:2d58a2e20d7a0553ce843a6b43b2df1e7924d5b2cb19372a276ebde6644e8eb5

oadp/oadp-velero-restic-restore-helper-rhel8@sha256:66bee327e86ddae9b69e362e520278bd8cb6a8b7f9756c3a55faf76d02486ab1

oadp/oadp-velero-rhel8@sha256:e583bed08cbd7e36f0f7a66bd18c41b62d4062fdb5d43ec8e191d37ecf23be11

oadp/oadp-volume-snapshot-mover-rhel8@sha256:294903bf15035ffc5c4f9f4fc546079de344875068f1188ddfdd4b4e435d01bd

**x86\_64**

oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:b5ac15e683479a1524dfa55db10a8c84e362e6734f0d82d62ce724dfd76779e2

oadp/oadp-mustgather-rhel8@sha256:83d13ab990fc72c63c51a008a13fe341a555dfaec96494d25f5b7cbd5a0eafb1

oadp/oadp-operator-bundle@sha256:174e673e1e9b09714ac89082c01e84bf9e77c7d52f65bbe3da156e4467ff6e07

oadp/oadp-rhel8-operator@sha256:5e9ef29577268fc0bafa30e84de8f79c5141df76eefe995da2a2a201a92e5aef

oadp/oadp-velero-plugin-for-aws-rhel8@sha256:3e4af775f289789e0dce2ac73c07d6d5a101c77970b5f70e88a4cff6e2fbc3dd

oadp/oadp-velero-plugin-for-csi-rhel8@sha256:37002fe133ff5853c97eb41e9d5e57dfb882f2b9150dfe945f965f78fbe3b1e4

oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:5e26431bc81545c21b1c3b87dd42e267773c4221213d478c04e0b8809559201c

oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:04c0ba8b1660eaa87f5e22291904b6e98442056270cfb134a243943742595e30

oadp/oadp-velero-plugin-rhel8@sha256:d695407dd931000091e7a19ea693608e99985c84bfae95a94d8d111313b8e542

oadp/oadp-velero-restic-restore-helper-rhel8@sha256:a8409a1d9a281711caae8d67d155a0aac5384f2ae736c3da728dc423b849b3fe

oadp/oadp-velero-rhel8@sha256:43c1b134f68e4b71f3a1a35769fb573a9c496ffc5ba188b13b97a52ee2ab8479

oadp/oadp-volume-snapshot-mover-rhel8@sha256:660e0ac7699c6c3ef59733bd3084bf0c8667e55bef1a36b13ee057fd4025bde7

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

RHSA-2023:3918: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.1.5 security and bug fix update

By Waqas
The report also raises concerns about the increasing influence of hyperscale companies like Amazon, Google, Meta, and Microsoft in the global cable network, potentially leading to market monopolies and challenges to digital sovereignty.
This is a post from HackRead.com Read the original post: Submarine Cables Face Escalating Cybersecurity Threats, Report

With an increasing number of Chinese-owned companies involved in operating cables and Russia’s interest in mapping the submarine cable system, the report suggests a strong likelihood of potential sabotage or disruption.

The backbone of the global economy and telecommunications, submarine cables, face an escalating threat environment, including geopolitical, physical, and cybersecurity risks, warns intelligence company Recorded Future.

It should not come as a surprise, as just last week, Hackread.com published an exclusive report revealing that hackers have been selling access to military satellites. This allows buyers to gain visibility into the military and strategic positioning within the United States. It indicates that hackers have become a critical threat to critical infrastructure, from the sky to the deep sea.

These fiber-optic cables, responsible for transmitting approximately 99% of all intercontinental internet traffic and crucial communications, are increasingly targeted for intelligence gathering and sabotage due to their involvement in $10 trillion worth of daily financial transactions and sensitive government and military exchanges.

The number of undersea cables has doubled over the past decade, now totalling an estimated 529 systems in operation, with their capacity expected to grow to accommodate the rising demand for internet connectivity worldwide.

Recorded Future’s report emphasizes intentional attacks as the most detrimental risk to submarine cables, surpassing accidental damage caused by ship anchors or fishing vessels. State-sponsored groups pose the greatest threat in terms of deliberate sabotage and spying.

With an increasing number of Chinese-owned companies involved in operating cables and Russia’s interest in mapping the submarine cable system, the report suggests a strong likelihood of potential sabotage or disruption.

The report further highlights major geopolitical developments, such as Russia’s conflict with Ukraine and China’s coercive actions towards Taiwan, as well as escalating tensions between Beijing and Washington, as key factors influencing the near-term risk environment.

China’s dominant role in the industry raises concerns about its ability to control digital flows and dictate the location of new cables, thereby creating new opportunities for intelligence collection through the landing stations it controls.

Meanwhile, Russia poses a physical security threat to submarine cables, particularly those in the North Sea region. Severing a cable can cause significant disruptions, and damage inflicted in deep water would be even more impactful due to longer repair times. State-sponsored threat actors possess the necessary resources to identify and target cables in deep water.

Intentional damage or sabotage represents a unique threat vector, as it can disproportionately affect countries and companies reliant on the affected cable system, although such incidents are less frequent.

The report (PDF) also raises concerns about the increasing influence of hyperscale companies like Amazon, Google, Meta, and Microsoft in the global cable network, potentially leading to market monopolies and challenges to digital sovereignty.

Landing stations, which connect submarine cables to terrestrial networks, present attractive targets for intelligence collection due to potentially inadequate security measures compared to deep underwater cables. These stations house network management equipment and power feeds, making them more accessible to threat actors.

The use of remote network management systems in monitoring and controlling infrastructure creates another vulnerability that state-sponsored adversaries, ransomware groups, and other threat actors are likely to exploit.

Recorded Future suggests that state actors seeking an espionage advantage will undoubtedly target the entire submarine cable ecosystem, including landing station infrastructure, the cables themselves, third-party providers, and the underlying hardware and software. Additionally, Russia is expected to intensify both overt and covert mapping of submarine cables and potentially engage in targeted sabotage on land and underwater.

1.  The US Submarines with Cyber Offensive Features
2.  Chinese hackers reportedly stole secret US Navy data
3.  DCNS submarine document leak exposes Indian naval secrets
4.  Sensitive Data of Australian Navy’s Vessels and Fighter Jets stolen
5.  Couple sold nuclear warship data hidden in peanut butter sandwich

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Submarine Cables Face Escalating Cybersecurity Threats, Report

The investment will allow enterprises to further secure non-human identities and safely leverage the soaring adoption of third-party apps and Generative AI services.

**New York, June 28, 2023** – Astrix Security, the enterprise’s trusted solution for securing non-human identities, has secured $25 million in Series A funding led by CRV with participation from existing investors Bessemer Venture Partners and F2 Venture Capital. This new investment brings Astrix’s total funding to almost $40 million. 

Fueled by the increased adoption of automation and generative AI initiatives, the enterprise’s connectivity to third-party applications is growing, resulting in an increase in cyber attacks targeting non-human app-to-app connections (via API keys, access tokens, service accounts, etc.) – as seen in high profile attacks against CircleCI, Mailchimp, GitHub, Microsoft, and Slack. 

Despite financial instability within the market, Astrix is experiencing exponential year-over-year growth and momentum as a leader in securing this growing threat vector. The company recently added Figma, Priceline, Bloomreach, Rapyd and many others to its customer roster and was recognized as a finalist in the 2023 RSA Innovation Sandbox contest. The business also doubled its headcount, and will use this funding to continue expanding the team in both the U.S. and Tel Aviv offices, including its research team who recently discovered GhostToken, a critical 0-day vulnerability in the Google Cloud Platform. 

“We founded Astrix to close a significant and unaddressed security gap, by allowing security teams to extend access management and threat detection to the non-human identity layer,” said Alon Jackson, CEO and co-founder at Astrix. “It’s amazing to experience the tremendous adoption by security teams, as well as see Astrix’s capabilities become essential to their every-day security arsenal. We look forward to continuing to expand our capabilities and partnerships, allowing organizations to truly reap the benefits of third-party services, especially Gen-AI apps, without compromising security.”

The enterprise environment depends on a vast web of interconnected apps, supported with an average of 10,000 app-connections for every 1,000 employees. More so, with AI-powered apps being downloaded 1506% more than last year, and often connected by employees across departments without the security team’s knowledge, having visibility and governance into every third-party connection is virtually impossible. While existing solutions focus on securing user-connections, Astrix is the first solution to focus on securing app-connections, allowing the enterprise to ensure their core systems are securely connected to each other and to third-party services.

“As a growing threat vector, there has been a shift in the market to focus on third-party connectivity,” said James Green, General Partner at CRV. “Astrix caught our eye for their innovative approach to extending IAM and threat detection to all non-human identities, giving unprecedented capabilities to manage the growing API-based third-party attack surface across all environments.”

“Partnering with Astrix from inception, we’ve seen the vast impact they’ve had on the industry in a short amount of time,” said Amit Karp, Partner at Bessemer Venture Partners. “From raising awareness to this growing attack surface to supporting some of the leading companies in the world, we’re excited for what’s to come as Astrix expands and continues protecting customers from the next supply chain attack.”

“The progress Astrix has made from seed funding to now is incredible,” said Jonathan Saacks, Managing Partner at F2 Venture Capital. “The company has made a mark on the industry already, and with the wealth of knowledge and experience from this team, we are confident they will continue to be the security asset every business needs and relies on in their toolbox.”

The Astrix Security Platform is the first solution to provide holistic visibility into all non-human connections and identities. Astrix provides a consolidated, comprehensive view of all the internal and third-party integrations within a business environment, as well as all access keys in use (i.e., API keys, OAuth tokens, service accounts, and webhooks) and the permissions and level of access granted to each one. With Astrix, businesses can extend their identity threat detection and response capabilities to non-human identities by continuously running behavioral analysis of internal and third-party apps connected to core SaaS, IaaS and PaaS systems to detect anomalies that may indicate compromised access tokens and automatically remediate risky connections.

**About Astrix Security**

Founded in Tel Aviv in 2021, Astrix Security helps cloud-first companies defend against a new generation of supply chain attacks. Astrix provides holistic visibility into all non-human connections and identities – automatically detecting and remediating over-privileged, unnecessary, misbehaving and malicious app-to-app connections to prevent supply chain attacks, data leaks and compliance violations. Led by two veterans of the Israel Defense Force 8200 military intelligence unit, CEO Alon Jackson and CTO Idan Gour, Astrix’s team is rapidly expanding. Astrix has raised nearly $40M in funding, with a Series A led by CRV, and additional investments from Bessemer Venture Partners, F2 Venture Capital, Venrock and Kmehin Ventures. Learn more at https://astrix.security or follow us on LinkedIn.

**About CRV**

CRV is a venture capital firm that invests in early-stage startups. Since 1970, the firm has invested in more than 500 startups at their most crucial stages, including Airtable, DoorDash and Vercel. Founders need more than capital to build a great company. It takes a partner who understands the entrepreneurial journey and knows what it takes to win. From founding to IPO and beyond, CRV is there every step of the way. Founders rely on CRV to be trusted, long-term, committed partners, which has helped make CRV into one of the longest-running venture capital firms in the world. Learn more about CRV and the companies shaping the future at https://www.crv.com.

**About Bessemer Venture Partners** 

Bessemer Venture Partners helps entrepreneurs lay strong foundations to build and forge long-standing companies. With more than 145 IPOs and 300 portfolio companies in the enterprise, consumer and healthcare spaces, Bessemer supports founders and CEOs from their early days through every stage of growth. Bessemer’s global portfolio has included Pinterest, Shopify, Twilio, Yelp, LinkedIn, PagerDuty, DocuSign, Wix, Fiverr, and Toast and has $20 billion of assets under management. Bessemer has teams of investors and partners located in Tel Aviv, Silicon Valley, San Francisco, New York, London, Hong Kong, Boston, and Bangalore. Born from innovations in steel more than a century ago, Bessemer’s storied history has afforded its partners the opportunity to celebrate and scrutinize its best investment decisions (see Memos) and also learn from its mistakes (see Anti-Portfolio). 

**About F2**  

F2 Venture Capital is a Tel Aviv-based VC firm that invests in early-stage technology companies on the cutting edge.

Our team members have been investors, operators, and engineers in startups and multinational giants that changed the game over the last twenty years. With $500 million assets under management and personalized support, F2 powers visionary founders on their bold missions.

F2 also operates Israel’s most active pre-seed investment platform, to back founders with guidance, network, and capital from day zero. More details @ www.f2vc.com

Tag

#microsoft