Seculert

Seculert

Type	Private company
Industry	IT Security
Founded	2010
Headquarters	Petah Tikva Israel
Key people	Dudi Matot - Co-founder and CEO Aviv Raff - Co-founder and CTO Alex Milstein - Co-founder and COO
Website	http://www.seculert.com

Seculert is a cloud-based cyber security technology company based in Israel. The company’s technology is designed to detect breaches and Advanced Persistent Threats (APTs), attacking networks. Seculert’s business is based on malware research and the ability to uncover malware that has gone undetected by other traditional measures.^[1]

In 2012, the company was named one of the hottest new security start-ups by The New York Times,^[2] and a finalist in the SC Magazine awards for Rookie Security Company of the Year.^[3]

History

Seculert was founded in 2010 by former RSA FraudAction Research Lab Manager Aviv Raff, former SanDisk Product Marketing Manager Dudi Matot and former Finjan VP of Operations Alex Milstein. In 2011, the company launched their first offering, Seculert Echo.^[4] Their Seculert Sense, traffic log analysis, was released in October 2012. At the RSA Conference in February 2013 Seculert unveiled the Beta version of Seculert Swamp, a malware analysis sandbox.

In August 2013, the company announced and updated version of their product.^[5]

Seculert is privately funded and headquartered in Petah Tikva, Israel. In July 2012, the company announced $5.35M in venture funding from YL Ventures and Norwest Venture Partners.^[6] In July 2013, Seculert announced that they raised an additional $10 million in Series B funding from Sequoia Capital.^[7]

Awards

Gartner "Cool Vendor" - selected by Gartner Inc., as a “Cool Vendor” in the May 2, 2014 report “Security Infrastructure Protection, 2014.”^[8]

Innovation in Enterprise Security- Bronze Award, 10th Annual 2014 Info Security's Global Excellence Awards^[9]

SINET 16 Innovator Finalist, SINET Workshops and Showcase^[10]

2013 Rookie Security Company, Awards Finalist - SC Magazine^[11]

2013 Red Herring, Europe Finalists^[12]

Advanced Threat Protection Product

Several detection and protection technologies are combined in a cloud-based solution that works to proactively identify new threats as they emerge.

Automated Traffic Log Analysis is a cloud-based analysis engine that leverages HTTP/S gateway traffic logs collected over time, analyzing petabytes of data to identify malware activity. It automatically identifies unknown malware by detecting malicious patterns and anomalies. Seculert Traffic Log Analysis pinpoints evidence of targeted attacks.^[13][14]

Proactive Botnet Interception tracks communication between live botnets and command and control servers, also known as C&Cs and C2s. It searches botnet traffic for mentions of company's IP address and domains. This product is also able to detect malware on devices belonging to a company's internal and external employees, partners, and customers. Seculert Botnet Interception analyzes botnet traffic to identify infected users and endpoints-inside and outside the corporate network. Device agnostic.^[15]

Elastic Sandbox is an elastic, cloud-based automated malware analysis environment. The Seculert Elastic sandbox includes automatic analysis and classification of suspicious files over time. It analyzes potentially malicious files on different platforms and can simulate different geographic regions. The Seculert Elastic Sandbox generates malware behavioral profiles by crunching over 40,000 malware samples on a daily basis and by leveraging data from its crowdsourced threat repository.^[16]

Protection API can integrate Seculert's Solution with pre-existing on-premises products and devices giving customers the ability to augment their current perimeter security defenses.

Ramnit

In January 2012, Seculert discovered that Ramnit^[17] started targeting Facebook accounts with considerable success, stealing over 45,000 Facebook login credentials worldwide, mostly from people in the UK and France.^[18][19][20]

Kelihos.B

In March 2012, Seculert reported that Kelihos botnet,^[21] which was distributed as a Facebook worm, was still active and spreading - even after the shutdown attempt by CrowdStrike and Kaspersky Labs.^[22][23][24]

Ma(h)di malware

In July 2012, Seculert, in conjunction with Kaspersky Labs uncovered an ongoing cyber espionage campaign targeting Iran and other Middle Eastern countries dubbed Mahdi (malware).^[25] This was the first such operation using communications tools written in Persian. The targets included critical infrastructure companies, engineering students, financial services firms and government embassies located in five Middle Eastern countries, with the majority of the infections in Iran.^[26][27][28]

Shamoon malware

In August 2012, Seculert, Kaspersky Lab and Symantec revealed the discovery of Shamoon,^[29] a sophisticated malware that attacked Qatar's natural gas firm, Rasgas and the Saudi Arabian Oil Company, ARAMCO. U.S. Defense Secretary Leon Panetta later called Shamoon the most destructive attack the business sector has seen to date^[30][31][32]

Dexter malware

In December 2012, Seculert uncovered Dexter,^[33] a new malware that steals payment card data from point-of-sale terminals used by stores, hotels, and other businesses. Most of the victim businesses were English-speaking, with 42 percent based in North America, and 19 percent in the U.K. Dexter infected systems running a variety of different versions of Windows, including XP, Home Server, Server 2003, and Windows 7.^{[34][35][36][37]}

Read an analysis of the Dexter malware.

Red October Java Exploit

In January 2013, Kaspersky Labs (KL) revealed a cyber espionage operation dubbed Red October. The next day, Seculert identified a special folder used by the attackers for an additional attack vector.^[38] In this vector, the attackers sent an email with an embedded link to a specially crafted PHP web page. This webpage exploited a vulnerability in Java, and in the background downloaded and executed the malware automatically.^[39][40]

Read the blog post on Red October.

PinkStats

In June 2013, Researchers from Seculert have shared details on the malware behind a string of attacks used by several Chinese-speaking groups over the last four years to target different worldwide organizations and nation-states. The most recent set of attacks targeted dozens of organizations in South Korea.

Called "PinkStats", the malware is a downloader, or rather one of its primary functions is to act as a gateway for additional malicious payloads. Depending on the type of attack, PinkStats will communicate with the Command & Control server once installed and receive any additional malware that’s required.^[41]

Sazoora.B

In October 2013, the experts at Seculert’s Research Lab identified a new version of the malware known as Sazoora. The first variant, Sazoora.A, was first detected in August 2012. The new version of Sazoora- Sazoora.B has evolved, making it harder for traditional security solutions to detect by going through minor packing and technical changes aimed at avoiding on-premises sandboxes. Instead of immediately launching like Sazoora.A, Sazoora.B waits for 15 minutes before becoming active. This dormant phase makes it undetectable.^[42]

Report on Sazoora by the Research Lab.

DGA.Changer

Based on the extensive coverage of an October 24 a php.net hack where an exploit kit was deployed, which servered 5 different malware types, Seculert's Research Lab took a closer look at the malware used.

The investigation yielded new information about one of the types of malware used, DGA.Changer.^[43] The malware DGA.Changer uses an infinite Domain Generation Algorithm but has the ability to receive a command from a command and control server to change the DGA seed. This allows the malware to evade sandboxing.^{[44][45][46][47]}

More information on the new downloader called, "DGA.Changer."

Xtreme RAT

On January 15, the Seculert Research Lab identified a new targeted attack that used Xtreme RAT. This attack used spear phishing emails to target Israeli organizations and deploy the piece of advanced malware. To date, 15 machines have been compromised including ones belonging to the Civil Administration of Judea and Samaria.^{[48][49][50][51][52][53][54]}

Read the Research Lab's report here.

Geodo

The data stealing worm Cridex (a.k.a. Feodo, Bugat) crept out of the cyber underground and into threat bulletins back in 2012, after demonstrating an unnerving capacity to spread by copying itself to mapped and removable drives, and opening back doors and downloading potentially malicious files onto compromised computers.

Seculert’s Research Lab kept Cridex on the radar screen, and led the discovery of a new version — dubbed Geodo — that combined a self-spreading infection method, which effectively turned each bot within the botnet into a vehicle for infecting new targets. Plus through additional analysis, our researchers found that Geodo had provided its command and control (C&C) server with approximately 50,000 stolen account credentials.

Click here to learn more about Geodo.

Tinba Trojan

In the summer of 2014, the original source code and full documentation for the banking trojan Tinba (a.k.a. aka Tinybanker) was leaked to the public via an underground forum –raising fears that it would inspire bad actors to create new, more insidious versions.

Well, it didn’t take long for Seculert’s Research Lab to discover Tinba’s predecessor, which boasted some even nastier features including: new detection evasion tactics, the ability to 64 bit operating systems, new DGA (domain generating algorithm) capabilities, and the use of both signed and unsigned executables.

Learn more about this Seculert Research Lab finding here.

References

External links

• Blog on Cloud-based, Automated Breach Detection
• How it works
• Twitter
• Facebook
• LinkedIn
• Crunchbase
• YouTube