Criminal Community-Sponsored Contests Mirror Cybercrime Trends, Such as Disabling AV/EDR, Cryptocurrency Fraud, and C2 Frameworks

 Sophos, a global leader in innovating and delivering cybersecurity as a service, today announced that it has uncovered how research contests run by cybercrime forums are helping to inspire new methods of attack and detection evasion. The contests mirror legitimate security conference ‘Call For Papers’ and provide the winners considerable financial rewards and recognition from peers and also potential jobs. As outlined in Sophos X-Ops latest report, “For the Win? Offensive Research Contests on Criminal Forums,” these contests are designed to drive innovation, and when analyzed, the entries provide invaluable insight into how cybercriminals attempt to overcome security obstacles.

Despite the long-standing nature of competitions on criminal forums, they have evolved over the years. Early cybercrime contests involved trivia quizzes, graphic design competitions and guessing games. Now criminal forums are inviting attackers to ‘submit’ articles on technical topics, complete with source code, videos, and/or screenshots. Once submitted, all forum users are invited to vote for the contest winner. However, the judging is not completely transparent as the forum owners and contest sponsors have their own votes in the matter.

“The fact that cybercriminals are running, participating, and even sponsoring these contests, suggests that there is a community goal to advance their tactics and techniques. There is even evidence to suggest that these competitions act as a tool for recruitment amongst prominent threat actor groups,” said Christopher Budd, director of threat research, Sophos. “While our research shows an increased focus on Web-3 related topics such as cryptocurrency, smart contracts and NFTs, many of the winning entries had a broader appeal and could be put to practical use, even if they weren’t particularly novel. This may be reflective of the priorities of the community but could indicate that attackers keep their best research to themselves as they can profit more from using them in real-world attacks.”

Sophos X-Ops explored two prominent annual contests: one run by the Russian-language cybercrime forum Exploit, offering a total prize fund of $80,000 to the winner of its contest in 2021, and another run on the XSS forum, with a prize pool of $40,000 in 2022. For several years, prominent members of the cybercriminal community have sponsored these events, including All World Cards and Lockbit.

In the most recent contests, Exploit themed its competition around cryptocurrencies, while XSS opened its contest up to a range of topics from social engineering and attack vectors to evasion and scam proposals. Many of the winning entries focused on abusing legitimate tools such as Cobalt Strike. One runner-up shared a tutorial on targeting initial coin offerings (ICOs) to raise funds for a new cryptocurrency and another on manipulating privilege tokens to disable Windows Defender.  

Galxe, the leading platform for building Web3 communities, today announced the upcoming launch of Galxe Protocol, a permissionless self-sovereign identity infrastructure that will grant users full control over their private data and identity, redefining the issuance and verification of credentials in Web3.

With a remarkable journey spanning two years, Galxe has fostered the growth of over 3,000 partners, such as Optimism, Arbitrum, Polygon, and more, and issued more than 100 million credentials to over 12 million unique users through reward-based campaigns and on-chain loyalty programs. Building upon its existing frameworks, Galxe introduces Galxe Protocol–an innovative system enabling individuals and developers to securely own, manage, and share verifiable credentials.

"Galxe has pioneered a groundbreaking system for cross-platform interaction, participation verification, and reward issuance that authentically connects global citizens and brands,” said Charles Wayn, Co-Founder of Galxe. “The Galxe Protocol is a significant milestone in the evolution of decentralized identity ownership, and it is bound to take this one step further, ushering in a new era of decentralization, privacy, and security in the Web3 landscape."

Galxe Protocol: Where Identity Meets Privacy, Where You Take Control
The Galxe Protocol empowers individuals by transforming their identity and private data into tangible assets. No longer confined to specific platforms, these assets become tradable and transferable, establishing a novel mode of value exchange. Users can buy, sell, and transfer accounts and assets across platforms, as true ownership prevails.

A combination of on-chain smart contracts and off-chain SDK tools, the Galxe Protocol empowers developers to deploy and use contracts for secure credential issuance and authentication across diverse applications. Furthermore, the protocol opens avenues for developers to construct Sybil prevention algorithms, reputation systems, credit frameworks, decentralized review systems, and beyond.

Moreover, the incorporation of Zero-Knowledge Proofs (zkPs) introduces enhanced privacy by enabling selective disclosure and proof without exposure, ensuring users can prove their eligibility while maintaining confidentiality and security.

Galxe Protocol launch partners to date include the following: Fusionist, Coordinape, SPACE ID, Project Twelve (P12), Kleros, Rarimo, Trusta Labs, and Clover Wallet.

This partnership allows financial market participants to incorporate ESG and impact considerations into their investment and compliance processes

Global sustainability technology company, Clarity AI, announces the integration of its data offering into SimCorp’s investment management platform.

This partnership with SimCorp, the world’s leading provider of investment management solutions, provides institutional investors with access to AI-powered datasets allowing them to effectively align with the EU sustainable finance regulations and execute on impact investing strategies.

The European Union is at the forefront of sustainable finance, with 20% of the region's fund assets classified as sustainable. Additionally, the EU accounts for 83% of global assets invested in sustainable funds, according to the 2022 Global Sustainable Fund Flows report. Despite stringent regulations like the Sustainable Finance Disclosure Regulation (SFDR) and the EU Taxonomy designed to combat greenwashing and ensure greater transparency, challenges around data availability, reliability, and comparability persist. These challenges put institutional investors at risk of using inaccurate or outdated company evaluations, thereby exposing them to potential reputational and investment risks.

“Amid the rapid evolution and diversification of regulatory frameworks and increasing demand for access to high quality, accurate, timely sustainability data, Clarity AI stands out by delivering a flexible, and scalable solution. Our approach is comprehensive, providing the required data, methodologies, and tools to comply with all regulatory requirements,” said David Silver, Head of Solutions at Clarity AI. “We are thrilled to partner with SimCorp to expand the use of reliable, accurate data to meet regulatory requirements and drive more capital into sustainable finance without adding unnecessary complexity.”

“With Clarity AI’s data seamlessly integrated into SimCorp’s investment management platform, sustainability analysis becomes an integral part of the complete end-to-end investment process. Our mutual clients benefit from advanced process automation, rigorous control checks of their sustainability-related policies, and effortless access to ESG analytics,” said Carl Balslev Clausen, Director and Head of ESG Product Management at SimCorp.

Clarity AI’s award-winning solutions for SFDR and EU Taxonomy are based on methodologies built from the ground up, that leverage advanced technology to streamline data collection and processing and reduce errors associated with manual work.

“Through the use of AI-powered reliability checks, trained and supervised by a global team of data science and sustainability experts, we ensure our data is of the highest quality and consistent throughout all areas of sustainability, such as regulatory compliance or impact measurement,” said Silver.

The adoption of the United Nations Sustainable Development Goals (SDGs) framework has become a crucial tool to report on impact, develop engagement strategies, or create new revenue opportunities through thematic funds, for example.

A recent survey by BNP Paribas Asset Management found that more than 50% of investors are currently using or are planning to use thematic investing, and 70% of thematic investors plan to increase their focus over the next three years. In Europe, one of the main drivers of this trend is being able to market products as Article 8 or Article 9 under SFDR.

To meet this growing demand, SimCorp’s investment management platform offers its users Clarity AI's SDGs dataset with the ability to customize scores based on intended sustainability outcomes. Clarity AI analyzes more than 70,000 companies, 420,000 funds, 201 countries, and 199 local governments, which represents more breadth than any other player in the market.

"Institutional investors are increasingly prioritizing their ability to accurately measure and oversee the societal effects of their investments. Aligning with the SDGs has now become an established norm within the industry. Clarity AI's extensive SDG dataset brings a high level of completeness, and we are thrilled to seamlessly integrate it into our ESG and sustainable investment solutions. This integration offers SimCorp clients effortless access to top-quality data, further enhancing their investment decisions,” said Balslev Clausen.

Better personalization and user experience open new opportunities for streamers amid overabundant program and platform choice, shifting content distribution strategies

Nielsen, a global leader in audience measurement, data, and analytics, today released its 2023 State of Play report outlining new findings on the fast-evolving streaming video landscape highlighting data and insights from Gracenote, Nielsen's content solutions business unit. The new report illuminates the surging number of program titles and streaming video services, as well as the resulting challenges for viewers who now spend 10.5 minutes per session deciding what to watch.

Content creators, distributors, streaming services and aggregators will benefit from a clear picture of the current streaming landscape presented in the report and actionable recommendations on how to differentiate their offerings under the existing market conditions.

According to Gracenote data analysis, there were 1.9 million video titles available to viewers in the U.S., U.K., Canada, Mexico and Germany in July 2021. This number had swelled to 2.7 million titles by June 2023. Of the total count, a whopping 86.7% were available on streaming services. Compounding complexity, many popular shows appear in multiple streaming catalogs, highlighting an industry pivot away from content exclusivity to broader distribution in search of better monetization.

The Gracenote analysis also found that audiences now have nearly 40,000 individual FAST channels, streaming providers and aggregators to choose from. Adding more context, new Nielsen data from The Gauge revealed that streaming accounted for 38.7% of total TV usage in July, a new record high. Concurrently, traditional TV viewing across broadcast and cable dropped below 50% for the first time.

But the wealth of available content and the proliferation of streaming choices has led to difficulties for viewers. When consumers could not find something compelling to watch, the report notes that one in five abandoned the viewing session and turned to another activity. 

As all industry players seek to position themselves for success in the evolving streaming marketplace, the keys to audience engagement are increased personalization and better user experience. Those that leverage content metadata and connected IDs to present the most compelling programming and relevant advertising to the right viewers through merchandising, curation and data science can gain a competitive edge.

"As it was during the age of broadcast television, content is the lifeblood of the digital, streaming-first media ecosystem," said Filiz Bahmanpour, VP of Product at Gracenote. "So a clear understanding of content – where it's available, what it's about and whom it's attracting – is more critical than ever."

Gracenote is the content solutions business unit of Nielsen providing entertainment metadata, content IDs and related offerings to the world's leading creators, distributors and platforms. Gracenote technology enables advanced content navigation and discovery capabilities helping individuals to easily connect to the TV shows, movies, music and sports they love while delivering powerful content analytics making complex business decisions simpler.

Rackspace Technology and Google Cloud's cutting-edge Generative AI Services and Solutions using the FAIR Practice will be on display

Rackspace Technology a leading end-to-end, multicloud solutions company, today announced its participation at Google Cloud Next, held August 29-31 in San Francisco. Google Cloud Next brings together over 15,000 developers, IT professionals, and CXOs worldwide for three days of immersive content and networking opportunities.

Event Attendees can visit Rackspace at booth #217 to learn more about Rackspace’s partnership with Google Cloud and the cutting-edge generative AI services and solutions using the Foundry for Generative AI by Rackspace (FAIR™) Practice. In addition, attendees will be able to learn more about the Rackspace and Aible partnership to further the adoption of generative AI solutions and enable enterprise-scale data analysis and data storytelling at an unprecedented speed. Aible’s solutions are built on Google Cloud, while Rackspace provides end-to-end services to manage and deploy in the customer’s environment. FAIR powered by Aible is dedicated to accelerating the secure, responsible, and sustainable adoption of generative AI and data solutions in enterprises across all industries.

By visiting Rackspace at booth #217, attendees can participate in an interactive generative AI activity, StickerVerse, to receive a custom sticker and a live interactive Rackspace ICE demonstration.

In addition, Sriram Rajan, Senior Principal Architect, will hold a theater session on Tuesday, August 29th, at 4:30 PT​, “Taking Anthos and AlloyDB for a Multicloud Ride” on how to run applications across Google Cloud using Kubernetes, Anthos, and AlloyDB. Participants will walk away with a reference architecture, use cases, sample deployments, and key considerations.

Rackspace top talent backed by recognized Google Cloud expertise

• Three-time winner of the Google Cloud Partner of the Year Awards: 2020 Breakthrough Partner of the Year - North America; 2019 Specialization Partner of the Year - Infrastructure; 2018 Cloud Migration Partner of the Year
• ISG Provider Lens™ 2023 Leader in Managed Services and Implementation and Integration Services on Google Cloud
• Employs over 3,000 Cloud Professionals
• Holds three Google Cloud Specializations for Infrastructure - Services, Cloud Migration - Services, and SAP on Google Cloud - Services

Foundry for Generative AI by Rackspace (FAIR)
FAIR is a groundbreaking global practice dedicated to advancing business transformation, improving customer experience, increasing the quality of service, and accelerating value creation through the secure and pragmatic use of AI technologies. FAIR has identified over 100 use cases across multiple industries and is working on several first-of-a-kind implementations for our customers across the globe. FAIR provides three unique services to help lean into the transformative power of generative AI:

• FAIR Ideate: An interactive and collaborative ideation workshop that helps organizations uncover actionable use cases for generative AI with defined business impacts. AI readiness diagnostics provide critical considerations for successful AI adoption.
• FAIR Incubate: An agile and iterative program that co-creates an enterprise’s first generative AI solution. It establishes the technology stack and assesses the viability of AI, ensuring seamless integration into organizational processes.
• FAIR Industrialize: A systematic effort to transform the AI solution into a product, implementing governance, defining metrics, and optimizing the AI model and Distributed Cloud Infrastructure for continuous improvement.

Rackspace has used FAIR to implement Rackspace ICE. Rackspace ICE is an AI Duet that boosts the productivity and effectiveness of go-to-market teams. It harnesses the power of AI to automate routine tasks, identify warm leads, surface relevant data and content, and provide real-time contextualized analytics for hyper-personalized customer interactions.

Rackspace is also using FAIR to develop RITA™ (Rackspace’s Intelligent Technology Assistant).
RITA is an interactive chatbot that uses the latest language models to answer text IT service requests, enhance self-service capabilities for inquiries, request new hardware or software, reset forgotten passwords, and answer questions on IT and security policies. In addition, the solution links the response to the specific sections of the source documents for resolution.

New research into billions of open programmatic ad transactions and over 10 million clicks reveals invalid click trends - inclusive of fraud - across desktop web, mobile web, and mobile in-app: Desktop web (21% invalid click rate) appears to be the top target for ad fraudsters

Pixalate, the market-leading fraud protection, privacy, and compliance analytics platform for Connected TV (CTV) and Mobile Advertising, today released the Q2 2023 Global Click Fraud Benchmarks Reports for desktop web, mobile web, and mobile app advertising.

The reports examine how many clicks on open programmatic advertisements were invalid or fraudulent - i.e., generated by invalid traffic (IVT) - in June 2023. Advertisers often optimize their campaigns for clicks. Fraudsters take advantage of this by generating fake clicks in an attempt to make their supply appear more valuable.

Key Findings:

• 17% invalid click rate for all open programmatic advertising across desktop web, mobile web, and mobile in-app in June 2023
• 21% invalid click rate for desktop web open programmatic advertising - the highest individual channel
• 16% invalid click rate for mobile web open programmatic ads
• 13% invalid click rate for mobile app open programmatic ads
• 20% of all invalid clicks on mobile apps are generated by click farms - sophisticated fraud schemes solely designed to generate fake clicks
• The 729x90 Leaderboard ad size had an invalid click rate of 26% on mobile apps - 2x higher than the total mobile app invalid click average (13%)

"The sophisticated schemes deployed by ad fraudsters are not just generating fake traffic but fake clicks as well,"  said Amit Shetty, VP of Product, Ad Fraud, at Pixalate. "Advertisers are willing to spend more for higher click-through rates. But this mindset should come with a heightened sense of scrutiny, as fraudsters always follow the money."

61% of executives are confident that AI will help their companies reach their objectives – more accessible tools and training are key to realizing the full potential of AI in the workplace

Asana, Inc. (NYSE: ASAN) (LTSE: ASAN), a leading work management platform, today released The State of AI at Work Report, powered by insights from its Work Innovation Lab. The report underscores the growing role of artificial intelligence (AI) in the workplace, revealing that 36% of employees in the United States (U.S.) and United Kingdom (U.K.) now use AI at work at least weekly.

Workers embrace AI as a strategic tool

Employees are recognizing AI's strategic value. More than half (55%) of executives expect their companies to use AI for goal-setting, and 61% are confident that AI will help their companies reach their objectives more effectively than traditional methods. This confidence in AI’s strategic importance is further highlighted by the more than half (51%) of executives who are willing to pay a premium for workplace tools if they are powered by AI.

AI’s use cases in the workplace are versatile and expanding rapidly. Workers are increasingly turning to AI to automate tasks and reduce busywork. 30% of employees currently use AI for data analysis, and 25% for administrative functions, but there's demand for even more: 62% and 57% of employees, respectively, are eager to use AI for these tasks. AI even has a role to play in creative tasks—in the U.S., 45% of employees say they are keen to use AI for brainstorming, compared to 32% in the U.K.

There’s also a growing call for AI tools to be more accessible at work. 60% of employees want to democratize AI within their organizations so that it is accessible to all employees, highlighting the need for intuitive tools that cater to different use cases and technical proficiencies.

Employees are even open to AI assessing their performance at work, especially in the U.S., where 38% of employees are receptive to the idea, compared to 28% in the U.K. A notable 15% of U.S. workers would entertain the idea of AI being their boss—nearly double the percentage in the U.K.

More AI guidance and training is essential

Despite employees gravitating toward AI to enhance their work, many are concerned about how they may be viewed for doing so. 26% of workers are worried they will be viewed as lazy for using AI, and 1 in 5 workers share that they feel like a fraud for using AI—with a higher percentage of workers in the U.K. expressing such concerns.

To realize AI's full potential, workers need clearer guidelines, more training, and accessible AI tools that enhance, not replace, the work of humans. Concerningly, only 24% of companies provide policies or guidance on AI usage at work, and just 17% of employees say they’ve received training on how to use AI in their day-to-day work. The U.S. is notably ahead in this regard, with 23% of companies offering training, compared to 13% in the U.K.

There’s strong urgency to bridge these gaps. Almost half (48%) of employees want more guidance from their employers on how to use AI, and 39% say that the lack of AI training impacts their decisions to join a company. 59% of employees consider a company's transparency about its use of AI as a key factor when joining a new organization.

“We are moving into a new phase of AI’s role in our workplaces,” commented Saket Srivastava, Chief Information Officer at Asana. “Our study shows that more employees are now embracing AI at work. Employees see the potential of AI to save time and help them focus on more strategic tasks. However, there are clear obstacles, with some employees harboring concerns about how their AI use could be perceived by peers and managers. Employees can’t navigate this AI shift alone. They need clear guidelines to understand AI's role in their functions, along with tailored training and accessible technologies to fully harness AI's capabilities. Organizations that get this right will leverage AI in a way that unlocks new levels of human ingenuity.”

New features allow joint customers to innovate rapidly in Google Cloud with confidence their environment is secure

Lacework, the data-driven cloud security company, today announced an expansion of its partnership with Google Cloud. Several new features will allow joint customers to innovate even faster in Google Cloud environments with the confidence that their cloud environment is even more secure. Customers can now choose to have the full Lacework platform, which provides data-driven protection from code to cloud from a single location, on Google Cloud to leverage its unique benefits. Further enhancements like low latency ingestion of Google Cloud audit logs events activity, Lacework Query Language (LQL) for Google Cloud logs, Agentless Scanning for Google Cloud, Attack Path Analysis for Google Cloud, Composite alerts specifically for Google Cloud, and Google Eventarc integration allow enterprises to increase their innovation velocity, securely, on Google Cloud. 

"Enterprise customers are increasingly using Google Cloud to drive their business and the capabilities we are announcing today give them even more confidence to move fast in Google Cloud with the Lacework platform," said Brian Lanigan, Vice President, Worldwide Channel and Alliances, Lacework. "We are committed to giving our customers flexibility in how they leverage Lacework so they can stay focused on serving their customers, while knowing that they are secure in their cloud of choice or across multiple clouds."

Enterprise Flexibility to Take Advantage of the Benefits of Lacework and Google Cloud

The announcement includes several enhancements that strengthen the partnership with Google Cloud and give customers flexibility in how they leverage Lacework, including support for Google Cloud Audit Log on a pub/sub architecture. This new method enables customers to ingest, process, and alert on Google Cloud audit logs with lower and more predictable latency. Additionally, Lacework is releasing new detection rules and composite alerts, and Google Cloud users can now write custom LQL policies. These new composite alerts include the "Potentially Compromised Google Cloud Identity". This alert uses multiple detections to correlate into a higher-level alert when Lacework suspects an intrusion into their cloud environment, giving Google Cloud customers greater context and reduced investigation time. 

"Businesses seek security solutions that can adapt to their technology stack and enable them to monitor and protect their organizations," said Vineet Bhan, Global Head of Security Partnerships, Google Cloud. "With Lacework's platform, Google Cloud customers have tools to help them secure their applications, including the ability to process audit logs faster and more effectively." 

Attack Path Analysis, which combines a visual representation of potential attack paths with deep runtime insight from Lacework's Polygraph Data Platform, is now extended to Google Cloud support, enhancing Google Cloud users' visibility into potential threats and allowing proactive risk mitigation. Customers like Cognite, a global leader in industrial software, are already seeing benefits from attack path analysis.

"It provides an invaluable means of identifying potential configuration problems before they escalate into more significant security breaches," said Simon Eriksen, Security Engineer, Cognite. "My colleague already had the chance to identify configuration issues, it immediately flagged something we had to look at — giving us the opportunity to fix it."

Agentless scanning for Google Cloud streamlines security assessments and provides a comprehensive view of vulnerabilities and misconfigurations within the cloud environment. Agentless workload scanning can be implemented for a single Google Cloud project or at the Organization level to apply to any/all Google Cloud projects with one integration. Additionally, for customers using Lacework multi-tenancy, the results from individual Google Cloud projects can be routed automatically to their mapped Lacework accounts. 

Finally, Lacework, in partnership with Google Cloud, is strengthening its Google Cloud Eventarc integration, which allows security professionals to build event-driven architectures without having to implement, customize, or maintain the underlying infrastructure. It offers a standardized solution to manage the flow of state changes, which Google Cloud calls events, between decoupled microservices. With events sent from the Lacework Polygraph Data Platform to Eventarc, an organization can easily manage the workflow of these events; whether routing the event to a specific group, sending information to an internal tool, or performing remediation on the affected resource.

At a time when enterprises are seeking flexibility in how they run their cloud business, Lacework is delivering more optionality for customers to innovate securely in Google Cloud.