User blogs

Hackers are exploiting recently discovered vulnerabilities in Exchange email servers to drop ransomware, Microsoft has warned, a move that puts tens of thousands of email servers at risk of destructive attacks.

In a tweet late Thursday, the tech giant said it had detected the new kind of file-encrypting malware called DoejoCrypt — or DearCry — which uses the same four vulnerabilities that Microsoft linked to a new China-backed hacking group called Hafnium.

When chained together, the vulnerabilities allow a hacker to take full control of a vulnerable system.

Microsoft said Hafnium was the “primary” group exploiting these flaws, likely for espionage and intelligence gathering. But other security firms say they’ve seen other hacking groups exploit the same flaws. ESET said at least 10 groups are actively compromising Exchange servers.

Michael Gillespie, a ransomware expert who develops ransomware decryption tools, said many vulnerable Exchange servers in the U.S., Canada, and Australia had been infected with DearCry.

The new ransomware comes less than a day after a security researcher published proof-of-concept exploit code for the vulnerabilities to Microsoft-owned GitHub. The code was swiftly removed a short time later for violating the company’s policies.

Marcus Hutchins, a security researcher at Kryptos Logic, said in a tweet that the code worked, albeit with some fixes.

Threat intelligence company RiskIQ says it has detected over 82,000 vulnerable servers as of Thursday, but that the number is declining. The company said hundreds of servers belonging to banks and healthcare companies are still affected, as well as more than 150 servers in the U.S. federal government.

That’s a rapid drop compared to close to 400,000 vulnerable servers when Microsoft first disclosed the vulnerabilities on March 2, the company said.

Microsoft published security fixes last week, but the patches do not expel the hackers from already-breached servers. Both the FBI and CISA, the federal government’s cybersecurity advisory unit, have warned that the vulnerabilities present a major risk to businesses across the United States.

John Hultquist, vice president of analysis at FireEye’s Mandiant threat intelligence unit, said he anticipates more ransomware groups trying to cash in.

“Though many of the still unpatched organizations may have been exploited by cyber espionage actors, criminal ransomware operations may pose a greater risk as they disrupt organizations and even extort victims by releasing stolen emails,” said Hultquist.

There has been an unprecedented IPO boom of tech companies in the Brazilian stock exchange, which is transformative for a market that was traditionally dominated by utilities, mining, oil and financial companies.

The trend continues to be strong; in February alone, growth companies like Bemobi, Westwing, Mobly and Mosaico went public. Mosaico, for example, was 20x oversubscribed and went up 70% on its first trading day. The same is true for other companies like Meliuz, Enjoei and Neogrid, up 173%, 53% and 74%, respectively, since their listing just a few months ago.

But what is even more surprising is that now, new special-purpose acquisition companies (SPACs) are raising money in Nasdaq with a mandate to buy Latin American private growth companies, which would be completely unthinkable just a year ago.

The opportunity for SPAC mergers in the U.S. has become quite competitive, as almost 300 SPACs, which raised over $90 billion, are now competing to find deals before the deadline. As a result, it has become more common to see SPACs with global mandates seeking to acquire foreign growth companies and list them in the U.S. to benefit from better multiples.

Just in 2021, eight Asian-sponsored SPACs raised over $2.3 billion in the Nasdaq/New York Stock Exchange, already surpassing the entire volume of 2020. More recently, it looks like the activity level may pick up in Brazil, and, potentially, in other Latin American countries, with $1.1 billion of Brazil-focused SPACs coming into fruition.

BMW has joined the cohort of investors that are backing Boston Metal’s carbon dioxide-free production technology for steel.

The Boston-based startup had targeted a $50 million raise earlier in the year, as TechCrunch reported, and BMW’s addition closes out that round, according to a person familiar with the company.

Through a commitment from BMW iVentures, the automaker’s investment arm, Boston Metal will have an in to a company with massive demands for more sustainably manufactured metal. For instance, BMW Group press plants in Europe process more than half a million tonnes of steel per year, the company said.

“We systematically identify the raw materials and components in our supplier network with the highest CO₂ emissions from production,” said Dr Andreas Wendt, member of the Board of Management of BMW AG responsible for Purchasing and Supplier Network, in a statement. “Steel is one of them, but it is vital to car production. For this reason, we have set ourselves the goal of continuously reducing CO₂ emissions in the steel supply chain. By 2030, CO₂ emissions should be about two million tonnes lower than today’s figure.”

Conventional steel production requires blast furnaces that generate carbon dioxide emissions, but using Boston Metal’s process, an electrolysis cell produces the pig iron that gets processed into steel, the company said.

The addition of BMW to its investor group, which already includes Bill Gates’ Breakthrough Energy Ventures and other strategic and financial investors, caps the fundraising process with another corporate partner wielding incredible industry influence.

“Our investors span across the steel value chain, from the upstream mining and iron ore companies to the downstream end customer, and validate Boston Metal’s innovative process to produce high-quality steel, cost-competitively, and at scale,” said chief executive officer and founder, Tadeu Carneiro.

Madrid-based TaxDown, which automates income tax filing by calculating regional deductions due to users so they don’t have to navigate complex tax rules themselves, has raised €2.4 million (~$3M) in seed funding.

US-based FJ Labs has joined TaxDown’s investment board as it closes the seed round. It says all its previous investors participated in the round, including James Argalas (Presidio Union); Abac Nest, Abac’s venture capital business; Baldomero Falcones, the former Chairman at Mastercard; and the founders of Jobandtalent, Juan Urdiales and Felipe Navío (another Madrid-based startup).

For the past three years TaxDown been offering a service in Spain but is now eyeing international expansion, as well as further growth in its home market.

Last year, it says it managed more than €29M in taxes for users — delivering savings of €4M+ to users.

Its target is to hit 500,000 users in Spain this year. While international expansion is planned for the second half of 2021, with TaxDown saying it’s focused on other European and Latin American markets.

“From the beginning, our ambition has been to help people fill in their taxes all over the world. That is why we developed our proprietary software/tax language that allows a tax expert with no coding capabilities to translate the tax law into calculation and logic that can be interpreted by our backend seamlessly,” says Enrique García, CEO and co-founder. “This tax language allowed us to launch in Spain in 4 months with only one tax consultant. We are confident that we can launch a new country in only 6 months.”

“The tax filing process is far from being simple,” he goes on, explaining how its tech simplifies income tax filing in Spain. “Currently, when using the Spanish Tax Agency tax-filling tool, taxpayers need to manually apply deductions on their tax forms. The problem is, with national regional deductions being different in each region in Spain, taxpayers often do not even know they’re entitled to those deductions. Thus, by not applying them to their tax form, they lose money. What TaxDown does is leverage the advanced Spanish Tax Agency technology, which offers an API to request the financial data related to a taxpayer — always with prior authorization from the user — with 2.000+ datapoints.

“Once we have that, our algorithm ‘RITA’ is capable of understanding the user’s personal and financial data, select the optimum questions that the user needs to answer — an average of 9 over a database of 3.000+ – and precisely calculate the tax return, with no errors.”

“Technology is the heart of TaxDown,” he adds. “Besides our algorithm RITA that has been trained with over 40.000+ tax returns, today we also use AI to help our ‘taxers’ with tips on how to lower future tax bills, and we have started working on live income tax simulation for our users throughout the entire year.”

García says TaxDown calculated more than 42,000 tax returns last year with a team of just two in-house tax experts — thanks to proprietary internal tools which allow them to handle this scale (by being “80x more efficient than the Spanish average”, as he puts it). He adds that further efficiency gains are expected.

“We have developed a machine-learning tool that flags the tax returns that need to be reviewed before filing based on historical data. Thus, we continuously increase the percentage of tax returns that are automatically submitted with no manual intervention,” he tells TechCrunch, adding: “Thanks to this feature, we expect to improve our efficiency at least 5x versus last year.”

According to García, TaxDown has never had any filings rejected for inaccuracies because he says its algorithms continually run tests and validate the information with the authorities. “Furthermore, our technology can flag errors in real time in case that there is a discrepancy, so our tax experts can manually check the tax return form if needed,” he adds.

Its business model — currently — is a sort of twist on freemium, in that it will only charge users if the income tax savings it calculates for them exceed €35.

García says that so far an average of three out of 10 users see financial savings from using its tool — but he suggests it’s not only savings that motivate users; he says they also want reassurance that they are taking “the best approach with their taxes: doing them effortlessly, correctly, with all the guarantees, tapping for experts’ live help at any time, ensuring the best result they can get, and of course knowing that we have their backs in case of an audit”.

Given that wider relationship it’s building with users, TaxDown sees potential to evolve its business model by expanding to offer additional fintech services, such as financial advice, in the future.

“Our vision goes far beyond income tax return preparation, we believe that tax data is becoming one of the most valuable data assets for people (take Trump’s tax returns for example), and we want to assess our ’taxers’ based on the best and more qualitative information that we can get,” says García. “Therefore, in the future we want to be a trusted financial advisor not just for taxes, but for personal finances as well. We believe we are well positioned to be an intermediary between our users and financial institutions.”

St. Louis-based voice assistant startup Disruptel is announcing that it has raised $1.1 million in seed funding.

The money comes from an impressive group of investors who seem well-aligned with what the startup is aiming to do — namely, build a voice assistant that can provide detailed information about what’s happening on your TV screen. Those investors include PJC and Progress Ventures (which led the round), along with DataXu co-founder and former CEO Mike Baker, Siri co-founder Adam Cheyer, Sky executive Andrew Olson and DataXu co-founder Bill Simmons.

Disruptel CEO Alex Quinn told me that he began to pursue the idea in high school — the initial idea was more focused on TV gesture controls, but he decided that there was a bigger opportunity in the fact that “smart TVs don’t know what’s going on on their own screen.”

So he said Disruptel has built technology that has “a contextual understanding of everything that’s happening on the screen — every product, all of that data.” So for example, you could use the technology to ask your TV, “Who is the person in the brown shirt?”

Quinn’s description reminded me of Amazon’s X-Ray technology, which can tell you about the actors on-screen, as well as additional trivia about whatever movie or TV you’re watching on Amazon Prime. But he said that Amazon’s solution (as well as a similar one from Google) involves “static data — the videos have all been pre-processed.” With Disruptel, on the other hand, “everything is happening in real time,” which means it could theoretically work with any piece of content.

Disruptel’s flagship product Context is a voice assistant designed to work with smart TVs and their remotes. Quinn said he’s hoping to partner with smart TV manufacturers and streaming services and get this into the hands of viewers in the second half of this year.

In the meantime, the company has already created a Smart Screen extension for Google Chrome that you can try right now (using the extension, I successfully identified the actors on-screen during multiple scenes of an episode of “The Flash”). Quinn said the company is using the extension as way to test the product and gather engagement data.

Baker (who sold his adtech company dataxu to Roku in 2019)  said that he was convinced to back the company after seeing a demo of the product: “It was interesting to see the power, the fluidity fo the experience.”

He also suggested that Disruptel’s tech creates new opportunities to improve on the smart TV advertising experience, which he described as largely consisting of “crap” — though he also pointed to Hulu as an example of a service that can be successful with “non-intrusive advertising and interstitial ads.”

Asked how a high school student could create this kind of technology, Quinn (who is now 21) said, “We had to learn. Our team is very focused on machine learning, and our machine learning engineers were reading research paper after research paper. We think that we have found the best research solutions.”

He added that if Disruptel had followed the leads of the big players and focused on pre-processing content, “We would never even have begun that journey.”