S.J. Fisher – Digital IT News

Energy Producer Total Taps Cloud Computing Company Nutanix to Power Digital Transformation

S.J. Fisher — Tue, 24 Nov 2020 22:16:12 +0000

French energy producer Total has implemented solutions from cloud computing company, Nutanix. Solutions include Nutanix hyperconverged infrastructure (HCI) software, AHV, Files, Flow, Prism, and Xi Frame to develop a unified IT environment supporting the majority of its global operations.

Total selected Nutanix to deliver the reliability and performance its users expect, while ensuring the necessary flexibility for the company to adapt to the fast-changing oil and gas industry. Additionally, the company selected Nutanix to support its goal of dramatically minimizing its datacenter footprint as part of its environmental initiatives to reduce greenhouse emissions.

One of the largest energy producers in the world, Total S.A. is a French multinational company whose businesses cover the entire oil and gas supply chain. Its global operations encompass everything from crude oil and natural gas exploration and production, to power generation, transportation, refining, petroleum product marketing, and international crude oil and product trading.

To power its global, distributed operations, Total needed an IT environment that could support its 7,000 applications across the organization, as well as to help increase the reliability and flexibility of their IT infrastructure. In addition, Total also needed a solution that would help them modernize their siloed datacenter and provide a consistent platform and management for all the company’s sites, regardless of the size of each site.

“Over the past few years, we have standardized the majority of our IT infrastructure on Nutanix and have migrated our operations to several clusters throughout North America,” said Guillaume Brocard, Senior Operations Advisor at Total. “These 11 clusters are 100 percent Nutanix, with no other on-premises infrastructure. Standardizing on Nutanix has enabled us to dramatically reduce our total cost of ownership, while helping us make our operations more efficient.”

Nutanix solutions help enable Total to streamline administration and enhance automations, including maintenance, as well as optimize costs. Nutanix solutions also contribute to providing the reliability and performance required to maintain its business leadership in the challenging energy production space, as any loss of services could have significant repercussions. With Nutanix software powering its IT infrastructure in North America, Total has experienced no loss of services for its affiliates in the past three years.

With a wide variety of Nutanix solutions supporting key infrastructure operations, Total now has an extensible foundation that can bring new efficiencies to their operations. Over the next three years, Total plans to continue ramping up its Nutanix environment to enable additional sites and services, optimizing costs using Nutanix solutions together with other technologies.

Image licensed by Adobe.com

SHIELD Announces DeviceSHIELD to Protect Small Businesses from Cyber Fraud

The post Energy Producer Total Taps Cloud Computing Company Nutanix to Power Digital Transformation appeared first on Digital IT News.

Forrester Recognizes Thycotic as a Leader in Privileged Identity Management

S.J. Fisher — Tue, 24 Nov 2020 18:16:44 +0000

Thycotic has been named a leader in The Forrester Wave: Privileged Identity Management (PIM), Q4 2020 Report*. The report evaluated 10 vendors based on 24 criteria across three high level categories: Current Offering, Strategy, and Market Presence.

“PIM solutions should support DevOps teams, IT admins configuring cloud infrastructure, bots, IoT, and API-driven workloads. CISOs are burning a lot of calories trying to secure privileged access for these use cases right now. Our clients tell us that machine identities are growing at twice the rate of human identities. Furthermore, the definition of a privileged user is expanding to include non-IT users,” according to the report.

Thycotic received the highest possible score in 11 criteria including SaaS/Cloud, Innovation Roadmap, and Integrations. Thycotic also received the highest possible score for the following criteria: Deployment, Supporting Products and Services, Commercial Model, and PIM Installed Base.

“We believe Thycotic’s recognition as a leader in the Forrester Wave for privileged identity management signifies and validates the strong product strategy that we have developed and implemented in recent years which focuses heavily on cloud innovations and end-user experience,” said James Legg, president and CEO at Thycotic. “We are continually expanding our range of PIM solutions to secure access to all different types of platforms, from SaaS to cloud to IaaS and have unveiled four new products this year alone.”

To download a complimentary copy of The Forrester Wave: Privileged Identity Management (PIM), Q4 2020 report, visit https://thycotic.com/forrester-wave-pim-report-2020.

*The Forrester Wave, Privileged Identity Management, Q4 2020 by Sean Ryan and Elsa Pikulik, November 19, 2020

FireEye Announces Acquisition of Respond Software for $186 Million

The post Forrester Recognizes Thycotic as a Leader in Privileged Identity Management appeared first on Digital IT News.

Security Champions Programs Can Improve Relationship Between Security and DevOps Teams, Says Survey

S.J. Fisher — Fri, 06 Nov 2020 23:11:46 +0000

A survey from ZeroNorth says 84 percent of security and development professionals believe that Security Champions efforts can both bolster application security (AppSec) and improve relationships between Security and DevOps teams.

As organizations embrace DevOps and accelerate software delivery, the notion of centralized control is fading away as DevOps teams are gaining increasing AppSec responsibilities. A recent Ponemon Institute Research report revealed the challenges these shifts are creating, indicating that 71% of AppSec professionals believe security is undermined by developers who don’t include proper security functionality early in the software development life cycle (SDLC).

In an effort to better prepare DevOps teams for their AppSec remit, Security Champions programs are being implemented by organizations looking to create a culture of security across the development process. The report, conducted by ZeroNorth, surveyed security and development professionals to learn about the state of Security Champions programs at their individual organizations.

The survey found that while the notion of a Security Champions program is not a new one, 67% of these programs have existed for less than two years, with almost 40% being in place less than one year. For organizations that have implemented a Security Champions Program, 78% of respondents said the program has strengthened security skills and knowledge of developers, and 77% said it improved the company’s overall AppSec posture.

“The challenge of securing applications against increasingly sophisticated attacks is larger than any single organization,” said ZeroNorth CEO, John Worrall. “The most successful approaches to creating a culture focused on security begin at the top, with CISOs and security leaders working to bridge internal divides and demonstrate that the security of applications is everyone’s responsibility.”

Among the key findings of the survey:

Security champions have the power to improve AppSec, with 84% of respondents agreeing or strongly agreeing.
Passion for security gives strength to a Security Champion, with 50% of respondents naming it the characteristic for a successful Security Champion.
Security Champions are a unifying force with 56% of respondents saying Corporate Security leadership was a top requirement for the success of Security Champion and 47% saying Engineering leadership support.
Corporate Security teams are vital to the success of security champions programs, with 57% of respondents saying they should play a role in defining security priorities and 47% saying they should be involved in training best practices.

Download a copy of the Security Champions: Empowering Heroes to Unite Security & DevOps report here.

The post Security Champions Programs Can Improve Relationship Between Security and DevOps Teams, Says Survey appeared first on Digital IT News.

AWS Says Amazon EC2 P4d Instances with EC2 UltraClusters Capability Now Available

S.J. Fisher — Fri, 06 Nov 2020 22:40:48 +0000

Amazon Web Services, Inc. (AWS) announced the general availability of Amazon Elastic Compute Cloud (Amazon EC2) P4d instances, the next generation of GPU-powered instances.

P4d instances feature eight NVIDIA A100 Tensor Core GPUs and 400 Gbps of network bandwidth (16x more than P3 instances). Using P4d instances with AWS’s Elastic Fabric Adapter (EFA) and NVIDIA GPUDirect RDMA (remote direct memory access), customers are able to create P4d instances with EC2 UltraClusters capability.

EC2 UltraClusters allow customers to scale P4d instances to over 4,000 A100 GPUs by making use of AWS-designed non-blocking petabit-scale networking infrastructure integrated with Amazon FSx for Lustre high performance storage, offering on-demand access to supercomputing-class performance to accelerate machine learning training and HPC.

Data scientists and engineers are continuing to push the boundaries of machine learning by creating larger and more-complex models that provide higher prediction accuracy for a broad range of use cases, including perception model training for autonomous vehicles, natural language processing, image classification, object detection, and predictive analytics. Training these complex models against large volumes of data is a very compute, network, and storage intensive task and often takes days or weeks. Customers not only want to cut down on the time-to-train their models, but they also want to lower their overall spend on training. Collectively, long training times and high costs limit how frequently customers can train their models, which translates into a slower pace of development and innovation for machine learning.

The increased performance of P4d instances speeds up the time to train machine learning models by up to 3x (reducing training time from days to hours) and the additional GPU memory helps customers train larger, more complex models. As data becomes more abundant, customers are training models with millions and sometimes billions of parameters, like those used for natural language processing for document summarization and question answering, object detection and classification for autonomous vehicles, image classification for large-scale content moderation, recommendation engines for e-commerce websites, and ranking algorithms for intelligent search engines—all of which require increasing network throughput and GPU memory. P4d instances feature 8 NVIDIA A100 Tensor Core GPUs capable of up to 2.5 petaflops of mixed-precision performance and 320 GB of high bandwidth GPU memory in one EC2 instance.

AWS says P4d instances are the first in the industry to offer 400 Gbps network bandwidth with Elastic Fabric Adapter (EFA) and NVIDIA GPUDirect RDMA network interfaces to enable direct communication between GPUs across servers for lower latency and higher scaling efficiency, helping to unblock scaling bottlenecks across multi-node distributed workloads. Each P4d instance also offers 96 Intel Xeon Scalable (Cascade Lake) vCPUs, 1.1 TB of system memory, and 8 TB of local NVMe storage to reduce single node training times.

By more than doubling the performance of previous generation of P3 instances, P4d instances can lower the cost to train machine learning models by up to 60%, providing customers greater efficiency over expensive and inflexible on-premises systems. HPC customers will also benefit from P4d’s increased processing performance and GPU memory for demanding workloads like seismic analysis, drug discovery, DNA sequencing, materials science, and financial and insurance risk modeling.

P4d instances are also built on the AWS Nitro System, AWS-designed hardware and software that has enabled AWS to deliver an ever-broadening selection of EC2 instances and configurations to customers, while offering performance that is indistinguishable from bare metal, providing fast storage and networking, and ensuring more secure multi-tenancy. P4d instances offload networking functions to dedicated Nitro Cards that accelerate data transfer between multiple P4d instances. Nitro Cards also enable EFA and GPUDirect, which allows for direct cross-server communication between GPUs, facilitating lower latency and better scaling performance across EC2 UltraClusters of P4d instances. These Nitro-powered capabilities make it possible for customers to launch P4d in EC2 UltraClusters with on-demand and scalable access to over 4,000 GPUs for supercomputer-class performance.

“The pace at which our customers have used AWS services to build, train, and deploy machine learning applications has been extraordinary. At the same time, we have heard from those customers that they want an even lower cost way to train their massive machine learning models,” said Dave Brown, Vice President, EC2, AWS. “Now, with EC2 UltraClusters of P4d instances powered by NVIDIA’s latest A100 GPUs and petabit-scale networking, we’re making supercomputing-class performance available to virtually everyone, while reducing the time to train machine learning models by 3x, and lowering the cost to train by up to 60% compared to previous generation instances.”

Customers can run containerized applications on P4d instances with AWS Deep Learning Containers with libraries for Amazon Elastic Kubernetes Service (Amazon EKS) or AmazonElastic Container Service (Amazon ECS). For a more fully managed experience, customers can use P4d instances via Amazon SageMaker, providing developers and data scientists with the ability to build, train, and deploy machine learning models quickly. HPC customers can leverage AWS Batch and AWS ParallelCluster with P4d instances to help orchestrate jobs and clusters efficiently. P4d instances support all major machine learning frameworks, including TensorFlow, PyTorch, and Apache MXNet, giving customers the flexibility to choose the framework that works best for their applications. P4d instances are available in US East (N. Virginia) and US West (Oregon), with availability planned for additional regions soon. P4d instances can be purchased as On-Demand, with Savings Plans, with Reserved Instances, or as Spot Instances.

The post AWS Says Amazon EC2 P4d Instances with EC2 UltraClusters Capability Now Available appeared first on Digital IT News.

Remote Workers Now Being Hired from All Over the US and Around the Globe

S.J. Fisher — Mon, 02 Nov 2020 21:25:00 +0000

Now that remote work is becoming the new normal, companies are more willing to make hires from anywhere. More than one third say they are willing to hire 100 percent remote workers anywhere in the US or internationally.

In a survey conducted by The Conference Board in September, more than 330 HR executives at primarily large US companies weighed in about remote work and hiring, productivity and well-being, workforce cost-reduction actions, and plans for returning to the workplace. This online survey is a follow up to one conducted in April.

The new findings also reveal that, after six months of adapting to the pandemic, many organizations continue to expect taking cost-reduction actions including layoffs and restructurings. On the upside, many companies have been able to fully or partially reverse some of the cost-cutting measures taken at the beginning of the pandemic, specifically around reducing salaries and wages. Key findings from the new survey include:

Companies are now three times more willing to hire remote workers from anywhere in the US or the world.

36 percent say they are willing to hire 100 percent remote workers anywhere in the US or internationally. Just 12 percent were receptive to that approach before COVID-19.

Warming up to remote work

Compared to before the pandemic, companies are now far more willing to hire remote workers (52 percent willing before COVID-19 vs. 88 percent now). However, half still prefer that employees live within commuting distance to the office location.

Post-pandemic, working primarily from home is more likely for many workers.

More than one third of respondents expect that 40 percent or more of their employees will work remotely (at least three days per week) 12 months post-pandemic. That is up from 5 percent prior to the pandemic.

Finding qualified workers remains a challenge, despite high unemployment and a willingness to hire remotely.

In the case of companies that employ mostly industry and manual services workers, almost twice as many organizations say it is now very difficult to find qualified workers compared to pre-pandemic (19 percent now vs. 10 percent pre-pandemic).

However, the percent of respondents who reported that it was somewhat difficult to find qualified workers decreased (64 percent pre-pandemic vs. 56 percent now), resulting in about 75 percent reporting difficulty overall both pre-pandemic and now.

“High unemployment typically means many job seekers per job opening. But so far in this crisis, that appears not to be the case,” said Frank Steemers, a report co-author and Economist at The Conference Board. “Many people listed as unemployed are not actively looking for a job at this point in time. Possible reasons for this pause in the job search include being furloughed and hoping to regain their old jobs, fears about being exposed to COVID-19 at work, or lack of available child care. As a result, many organizations are reporting that finding qualified workers is still a challenge.”

Nearly half of companies report a productivity increase…

In September, almost half of respondents (47 percent) believed that productivity had increased for their workforce, compared to only 23 percent in April. This productivity increase could be due in part to employees working longer hours since the COVID-19 outbreak.

More meetings and working hours

Many surveyed companies report that their employees are experiencing increased work hours (60 percent) and spending more time in meetings (63 percent), as well as suffering more burnouts (42 percent), decreased work-life balance (46 percent), and more mental health problems (40 percent).

“These sobering statistics beg the question of whether increased working hours are sustainable in the long term,” said Robin Erickson, PhD, a report co-author and Principal Researcher at The Conference Board. “To further support the health and well-being of their workers, companies can consider implementing quiet periods without email, mandating use of vacation time, or even offering more benefits related to health and wellness to mitigate stress.”

Despite some wage and salary restorations, cost-cutting measures are still planned for 2020’s final months.

From October through December 2020:

- 13 percent of surveyed companies plan to restructure the organization
- 11 percent plan to cut bonuses
- 9 percent plan to conduct permanent layoffs
- 8 percent plan to defer pay increases and bonuses

One quarter of companies that implemented salary/wage cuts during the pandemic had fully reversed this action by September.

Companies were likely to reverse wage cuts as quickly as possible; one quarter had fully reversed them by September, and another 23 percent had partially reversed this action.

A plurality of companies is planning to return to the workplace by March, but significant uncertainty remains.

About sixty percent of companies have either already returned or are currently planning to return to the workplace by March 2021. However, this date could change based on the severity of the second COVID-19 surge. A quarter of respondents are more uncertain, either awaiting a vaccine or noting other determining factors, such as trends in COVID-19 cases in the geographic area.

Only 19 percent of companies had remained open or returned to the workplace by the end of September 2020.

The post Remote Workers Now Being Hired from All Over the US and Around the Globe appeared first on Digital IT News.

SolarWinds to Acquire SentryOne

S.J. Fisher — Mon, 26 Oct 2020 17:57:07 +0000

SolarWinds announced it has signed a definitive agreement to acquire SentryOne, a leading technology provider of database performance monitoring and DataOps solutions on SQL Server, Azure SQL Database, and the Microsoft Data Platform. The SentryOne offering complements the on-premises and cloud-native database management offerings SolarWinds has today to serve the full needs of the mid-market and better serve larger organizations. The expected addition of the SentryOne products to the SolarWinds portfolio also will amplify the depth and breadth of support SolarWinds can offer for Microsoft and Microsoft Azure environments.

“For over 20 years, SolarWinds has been committed to ensuring that we bring to market a wide range of products designed to help IT pros solve the toughest IT infrastructure management challenges. As applications and data continue to grow in complexity and volume, database management has become a critical function to businesses of all sizes and types,” said Kevin B. Thompson, chief executive officer, SolarWinds. “We believe the explosion of business-critical applications, and their reliance on peak database performance, presents an opportunity for SolarWinds to continue to expand our support for IT organizations.”

Thompson continued, “We care about the database because we care about applications. Database performance is most often where the app goes wrong—whether on-premises or in the cloud. And, because databases are so critical to application performance, IT pros and business leaders from the dedicated database administrator to the ‘accidental DBA,’ from application developers and APM pros fueling their apps with data, to BI pros and business leaders who need insights to power their organizations—all rely on database performance to drive success.”

“SentryOne’s mission has been to empower the Microsoft Data Professional to achieve breakthrough performance across physical, virtual, and cloud environments. As we’ve grown, we’ve engaged with our users in much the same way SolarWinds does and expanded our offering to address the increasingly complex needs of today’s hybrid IT reality,” said Bob Potter, CEO, SentryOne. “Our focus on the needs of the Microsoft data professional empowers organizations who rely on SQL Server, Azure SQL Database, and the Microsoft Data Platform to run their organizations and ensure optimal performance, wherever their databases live.”

“We believe SentryOne’s powerful, market-leading database performance management offerings give us another compelling product to enhance our ability to serve IT professionals, particularly those who manage Microsoft environments,” Thompson said. “We believe the combination of SolarWinds and SentryOne will enable us to serve the entire spectrum of databases and related performance management challenges in a hybrid IT environment, from small businesses to the Fortune 500.”

The transaction is expected to close later this month.

The post SolarWinds to Acquire SentryOne appeared first on Digital IT News.

Kindred and VARGO Announce Strategic Partnership for E-Commerce Fulfillment Solutions

S.J. Fisher — Mon, 26 Oct 2020 17:32:01 +0000

Kindred announced an agreement with VARGO to incorporate its artificial intelligence (AI) pick and place robotic solutions with VARGO’s warehouse execution system (WES) to enhance both parties’ solutions for retail and e-commerce fulfillment. Kindred has been working with Hilliard, Ohio-based VARGO since 2017 and partnered on e-commerce fulfillment system design and integration for Gap Inc. Gap has deployed more than 100 Kindred SORT robotic systems in combination with VARGO’s WES.

“This partnership between VARGO and Kindred further demonstrates the commitment of both of our companies to bring strategic and innovative distribution solutions to the industry that solve real fulfillment challenges brought about by limited labor availability and, most recently, COVID-19 social distancing requirements,” said Bart J. Cera, president and COO of VARGO. “The marriage of these application-based technologies, like Kindred’s pick and place robots, teamed with the appropriate distribution center design, equipment and execution software, provides our customers with highly efficient and industry-leading distribution solutions. We look forward to continuing to partner with Kindred in bringing the latest technologies to our customers.”

To create a safe working environment for its employees amid the COVID-19 outbreak, Kindred and VARGO customers use SORT AI-powered warehouse robots to increase social distancing measures. Rather than standing side-by-side with co-workers to conduct pick and place operations, one employee can manage three to four Kindred SORT robots simultaneously, keeping up with e-commerce fulfillment while maintaining social distancing.

VARGO’s Continuous Order Fulfillment Engine (COFE) – a waveless warehouse execution system (WES) – is the power behind the e-commerce fulfillment revolution and is pulling the industry into its advanced waveless order fulfillment system. COFE is a WES software that synchronizes and sequences all processes and resources – people and equipment – within a fulfillment center and responds instantaneously to dynamically changing environments. COFE’s waveless process continuously assigns new orders to a revolving batch of work and eliminates downtime created in wave-based environments. By creating a continuous flow of work, COFE provides a true, lean order fulfillment solution.

“We have been working side-by-side with VARGO as a valued partner since our market launch in 2017,” said Marin Tchakarov, CEO of Kindred. “We certainly value their technology as well as their collaboration in helping to build the warehouse of the future, powered by intelligent machines that ultimately augments the human workforce.”

Kindred’s AI data shows retailers are facing dramatic peaks in online orders since the COVID-19 pandemic forced retailers to close a number of brick and mortar stores. Since the outbreak of COVID-19 in March 2020, the number of units SORT picking robots process per day has increased by 45% across the installed base.

SORT pick-and-place robots utilize AutoGrasp, a robotics artificial intelligence platform that identifies items to pick, place and sort into complete end-customer orders. AutoGrasp combines AI-powered machine vision, grasping and manipulation algorithms that handle a range of merchandise, including deformable items such as polybagged items.

Kindred uses cutting-edge AI research and human-in-the-loop data methodology to continuously improve robot capabilities so that picking becomes smarter, faster and more accurate over time. Kindred SORT robots have picked more than 100 million units in production to date.

The post Kindred and VARGO Announce Strategic Partnership for E-Commerce Fulfillment Solutions appeared first on Digital IT News.

Blendid Opens Fourth Autonomous, Contactless, Food Kiosk at Bay Area Walmart

S.J. Fisher — Fri, 16 Oct 2020 23:03:07 +0000

Blendid is opening the company’s fourth food robotics kiosk at Walmart in Fremont, California. The Bay Area–based company offers an autonomous, and contactless food automation platform that leverages machine learning, robotics, and artificial intelligence to create smoothies, made on-demand, and customized to meet the preferences of individual consumers.

“The COVID-19 pandemic has increased the focus on food safety globally. At Blendid, we’re working with many essential businesses to help integrate a solution for safe, contactless food preparation and delivery,” said Vipin Jain, CEO and co-founder of Blendid. “Our newest location within Walmart is completely contactless from order to pickup and will be a healthy, quick, tasty, and affordable option for customers on-the-go. We are continuing to grow, learn, and adapt to the evolving needs of the future of foodservice.”

Blendid’s stand-alone, contactless kiosk includes a robotic arm, blenders, a refrigeration system, and numerous dispensers that store and dispense a variety of ingredients including solids (such as fruits and vegetables), liquids (such as coconut water), and superfoods (such as chia, flax, and ginger).

Blendid’s proprietary food operating system (foodOS) processes the orders and payment, measures and dispenses precise amounts of ingredients for customized drinks, and blends, pours, and stores each smoothie until a consumer is ready for pickup. The Blendid system can process up to 45 drinks an hour and nine drinks

The post Blendid Opens Fourth Autonomous, Contactless, Food Kiosk at Bay Area Walmart appeared first on Digital IT News.

Parents Say Kids’ Screen Time Has Skyrocketed During Pandemic

S.J. Fisher — Thu, 15 Oct 2020 00:04:04 +0000

New study commissioned by NortonLifeLock reveals how the current pandemic has impacted children’s at-home screen time, device access and parents’ concerns around Cyber Safety.

The study underscored that nearly 7 out of 10 parents (69%) said that their child’s screen time has heightened during the pandemic, with around 3 in 5 feeling they have no choice but to allow it (60%) and that they accept certain risks to their child’s online safety to keep them entertained and occupied (57%).

“This study shows parents like me are not alone in struggling to find ways to keep our children safe and entertained during the pandemic,” says Kevin Roundy, technical director, NortonLifeLock. “With fewer social gatherings, schools adopting distance learning, and many parents working from home, it comes as little surprise that parents have had to shift their kids’ activities to digital devices. However, all of this unsupervised time spent on devices leads to an influx of Cyber Safety risks that parents should be aware of, including device hacking, location tracking, and risk from online predators.”

Conducted in partnership with The Harris Poll, more than 1,000 U.S. parents of children ages 5-17 were interviewed for the study, revealing nearly half (49%) have had to abandon some, if not all, of their previous rules for screen time. The study found children are spending roughly 1.5 more hours in front of screens per day on school days, excluding time spent for school purposes – a 52% increase1 in screen time compared to prior to the outbreak.

Almost 7 in 10 parents (67%) indicated that their child’s unsupervised screen time has increased due to the pandemic’s effect on work and school. Among those who said their child’s screen time has skyrocketed during the pandemic, prominent reasons include keeping their child entertained and occupied (70%) and giving their child a way to connect with friends and family (52%).

The post Parents Say Kids’ Screen Time Has Skyrocketed During Pandemic appeared first on Digital IT News.

ESET Discovers New APT Group That Has Been Stealing Government Secrets Since 2011

S.J. Fisher — Wed, 07 Oct 2020 22:55:58 +0000

ESET researchers uncovered a new APT group that has been stealing sensitive documents from several governments in Eastern Europe and the Balkans since 2011. Named XDSpy by ESET, the APT group has gone largely undetected for nine years, which is rare. The espionage group has compromised many government agencies and private companies. The findings were presented today at the VB2020 localhost conference.

“The group has attracted very little public attention so far, with the exception of an advisory from the Belarusian CERT in February 2020,” says Mathieu Faou, ESET researcher who analyzed the malware.

XDSpy operators use spear phishing emails in order to compromise their targets. The emails display a slight variance, as some contain an attachment, while others contain a link to a malicious file. The first layer of the malicious file or attachment is generally a ZIP or RAR archive. At the end of June 2020, the operators stepped up their game by using a vulnerability in Internet Explorer, CVE-2020-0968, which had been patched in April 2020. “The group jumped on the COVID-19 bandwagon at least twice in 2020, including an instance only a month ago, in their ongoing spear phishing campaigns,” adds Faou.

“Since we did not find any code similarities with other malware families, and we did not observe any overlap in the network infrastructure, we conclude that XDSpy is a previously undocumented group,” concludes Faou.

Targets of the XDSpy group are located in Eastern Europe and the Balkans; they are primarily government entities, including militaries, Ministries of Foreign Affairs and private companies.

For more technical details about this spyware, read the blog post, “XDSpy: stealing government secrets since 2011” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

Image licensed from Adobe Stock.

The post ESET Discovers New APT Group That Has Been Stealing Government Secrets Since 2011 appeared first on Digital IT News.