Company type | Public |
---|---|
| |
Industry | Information security |
Founded | 2011 |
Founders |
|
Headquarters | , United States |
Key people | |
Revenue | US$3.06 billion (FY24) |
US$−2 million (FY24) | |
US$89.3 million (FY24) | |
Total assets | US$6.65 billion (FY24) |
Total equity | US$2.30 billion (FY24) |
Number of employees | 7,925 (FY24) |
Website | www |
Footnotes /references Financials as of fiscal year endedJanuary 31,2024 [update] . References: [2] |
CrowdStrike Holdings, Inc. is an American cybersecurity technology company based in Austin, Texas. It provides endpoint security, threat intelligence, and cyberattack response services.
The company has been involved in investigations of several high-profile cyberattacks, including the 2014 Sony Pictures hack, the 2015–16 cyberattacks on the Democratic National Committee (DNC), and the 2016 email leak involving the DNC. [3] [4] On July 19, 2024, it issued a faulty update to its security software that caused global computer outages that disrupted air travel, banking, broadcasting, and other services. [5] [6] [7]
CrowdStrike is an American cybersecurity technology company based in Austin, Texas. It provides endpoint security, threat intelligence, and cyberattack response services. [8] Until July 2024 it was "best known for deploying immediate updates upon detecting threats, distributing as many as 10-12 per day." [9] Since then it has been offering phased or staggered update rollout. [9]
CrowdStrike was co-founded in 2011 by George Kurtz (CEO), Dmitri Alperovitch (former CTO), and Gregg Marston (CFO, retired). [10] [11] [12] [13] The following year, they hired Shawn Henry, a former Federal Bureau of Investigation (FBI) official, to lead the subsidiary CrowdStrike Services, Inc., which offered security and response services. [14] [15] The company launched CrowdStrike Falcon, an antivirus package, as its first product in June 2013. [16] [17]
In May 2014, CrowdStrike's reports helped the United States Department of Justice to charge five Chinese military hackers with economic cyber espionage against U.S. corporations. [18] CrowdStrike also uncovered the activities of Energetic Bear, a group connected to Russia's Federal Security Service that conducted intelligence operations against global targets, primarily in the energy sector. [19]
After the Sony Pictures hack, CrowdStrike uncovered evidence implicating the government of North Korea and demonstrated how the attack was carried out. [20] In 2014, CrowdStrike helped identify members of Putter Panda, the state-sponsored Chinese group of hackers also known as PLA Unit 61486. [21] [22]
In May 2015, the company released information about VENOM, a critical flaw in an open-source hypervisor called Quick Emulator (QEMU) that allowed attackers to access sensitive personal information. [23] [24] In October 2015, CrowdStrike announced that it had identified Chinese hackers attacking technology and pharmaceutical companies around the time that U.S. President Barack Obama and China's leader Xi Jinping publicly agreed not to conduct economic espionage against each other. The alleged hacking would have been in violation of that agreement. [25]
In July 2015, Google invested in the company's Series C funding round, which was followed by Series D and Series E, raising a total of $480 million as of May 2019. [26] [27] [28]
In 2017, the company reached a valuation of more than $1 billion with an estimated annual revenue of $100 million. [29] In June 2018, the company said it was valued at more than $3 billion. [27] Investors include Telstra, March Capital Partners, Rackspace, Accel Partners and Warburg Pincus. [30] [31]
In June 2019, the company made an initial public offering on the Nasdaq. [32] [33]
In September 2020, CrowdStrike acquired zero trust and conditional access technology provider Preempt Security for $96 million. [34] In February 2021, the company acquired Danish log management platform Humio for $400 million with plans to integrate Humio's log aggregation into CrowdStrike's XDR offering. [35] Later that November, CrowdStrike acquired SecureCircle, a SaaS-based cybersecurity service that extends zero trust endpoint security to include data. [36] In December 2021, the company moved its headquarters location from Sunnyvale, California, to Austin, Texas. [37] In 2023, CrowdStrike introduced CrowdStream service in collaboration with Cribl.io. [38] CrowdStrike has also focused on working with the U.S. government and selling its services to government agencies. [39] CrowdStrike joined the S&P 500 index in June 2024. [40] In 2023, CrowdStrike acquired Israeli cybersecurity startup Bionic.ai. [41] In 2024, CrowdStrike acquired Israeli cloud security startups Flow Security for $200 million [42] and Adaptive Shield for $300 million [43] .
On 19 July 2024, CrowdStrike released a software configuration file update to the Falcon endpoint detection and response agent. Flaws in the update caused blue screens of death on Microsoft Windows machines, disrupting millions of Windows computers worldwide. [44] [45] Affected machines were forced into a bootloop, making them unusable. This was caused by an update to a configuration file, Channel File 291, which CrowdStrike says triggered a logic error and caused the operating system to crash. [46] The downtime caused a widespread global impact, grounding commercial airline flights, temporarily taking Sky News and other broadcasters offline, and disrupting banking and healthcare services as well as 911 emergency call centers. [7] [47]
By the end of the day, CrowdStrike shares closed trading at a price of $304.96, down $38.09 or 11.10%. [48]
Although CrowdStrike issued a patch to fix the error, computers stuck in a bootloop were unable to connect to the Internet to download the patch before Falcon would be loaded and crash the device again. The recommended solution from CrowdStrike was to boot into safe mode or Windows Recovery Mode and manually delete Channel File 291. [49] This requires local administrator access and if the device was encrypted by BitLocker, also required a recovery key. [50] Microsoft reported that some customers were able to remediate the issue solely by rebooting impacted devices up to 15 times. [51] On 22 July 2024, CrowdStrike shares closed the trading day at a price of $263.91, with a loss of $41.05 or 13.46%. [52] On 24 July 2024, CrowdStrike reportedly contacted affected channel partners with apology emails containing Uber Eats gift cards worth $10. [53] [54] [55] The CrowdStrike incident cost Fortune 500 companies $5.4 billion. [9]
As of 2024, CrowdStrike spent more than $360,000 on federal lobbying in the first half of 2024, according to OpenSecrets and $620,000 during 2023. [9]
In 2024, total revenue was $3.06 billion, a 36% increase. [9]
CrowdStrike helped investigate the Democratic National Committee cyberattacks and a connection to Russian intelligence services. [56] On 20 March 2017, James Comey testified before congress stating, "CrowdStrike, Mandiant, and ThreatConnect review[ed] the evidence of the hack and conclude[d] with high certainty that it was the work of APT 28 and APT 29 who are known to be Russian intelligence services." [57] Comey previously testified in January 2017 that a request for FBI forensics investigators to access the DNC servers was denied, saying "Ultimately what was agreed to is the private company [CrowdStrike] would share with us what they saw." [58]
In December 2016, CrowdStrike released a report stating that Russian government-affiliated group Fancy Bear had hacked a Ukrainian artillery app. [59] They concluded that Russia had used the hack to cause large losses to Ukrainian artillery units. The app (called ArtOS) is installed on tablet PCs and used for fire-control. [60] CrowdStrike also found a hacked variation of POPR-D30 being distributed on Ukrainian military forums that utilized an X-Agent implant. [61]
The International Institute for Strategic Studies rejected CrowdStrike's assessment that claimed hacking caused losses to Ukrainian artillery units, saying that their data on Ukrainian D30 howitzer losses was misused in CrowdStrike's report. The Ukrainian Ministry of Defense also rejected the CrowdStrike report, stating that actual artillery losses were much smaller than what was reported by CrowdStrike and were not associated with Russian hacking. [62] Prior to this, CrowdStrike had published a report claiming that malware used in Ukraine and against the Democratic National Committee (DNC) appeared to be unique and identical, further evidence for a Russian origin of the DNC attack. [63]
Cybersecurity firm SecureWorks discovered a list of email addresses targeted by Fancy Bear in phishing attacks. The list included the email address of Yaroslav Sherstyuk, the developer of ArtOS. [64] Additional Associated Press research supports CrowdStrike's conclusions about Fancy Bear. [65] Radio Free Europe notes that the AP report "lends some credence to the original CrowdStrike report, showing that the app had, in fact, been targeted." [66]
In the Trump–Ukraine scandal, Donald Trump, then the president of the United States, held a 25 July 2019, phone call with Volodymyr Zelensky, the president of Ukraine, in which Trump asked Zelensky to look into a conspiracy theory that was being promoted on far-right websites such as Breitbart News and Russian state media outlets such as Russia Today and Sputnik. [67] The theory held that namely, that the Ukrainian government used CrowdStrike to hack into the Democratic National Committee's servers in 2016 and frame Russia for the crime to undermine Trump in the 2016 presidential election. [68] [69] The conspiracy theory has been repeatedly debunked. [70] [71] [72]
Cyberwarfare by Russia includes denial of service attacks, hacker attacks, dissemination of disinformation and propaganda, participation of state-sponsored teams in political blogs, internet surveillance using SORM technology, persecution of cyber-dissidents and other active measures. According to investigative journalist Andrei Soldatov, some of these activities were coordinated by the Russian signals intelligence, which was part of the FSB and formerly a part of the 16th KGB department. An analysis by the Defense Intelligence Agency in 2017 outlines Russia's view of "Information Countermeasures" or IPb as "strategically decisive and critically important to control its domestic populace and influence adversary states", dividing 'Information Countermeasures' into two categories of "Informational-Technical" and "Informational-Psychological" groups. The former encompasses network operations relating to defense, attack, and exploitation and the latter to "attempts to change people's behavior or beliefs in favor of Russian governmental objectives."
Kaspersky Lab is a Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in the United Kingdom. It was founded in 1997 by Eugene Kaspersky, Natalya Kaspersky and Alexey De-Monderik. Kaspersky Lab develops and sells antivirus, internet security, password management, endpoint security, and other cybersecurity products and services.
Jeffrey Carr is a cybersecurity author, researcher, entrepreneur and consultant, who focuses on cyber warfare.
Dmitri Alperovitch is an American think-tank founder, author, philanthropist, podcast host and former computer security industry executive. He is the chairman of Silverado Policy Accelerator, a geopolitics think-tank in Washington, D.C., and a co-founder and former chief technology officer of CrowdStrike. Alperovitch is a naturalized U.S. citizen born in Russia who came to the United States in 1994 with his family.
The Indian Computer Emergency Response Team is an office within the Ministry of Electronics and Information Technology of the Government of India. It is the nodal agency to deal with cyber security incidents. It strengthens security-related defence of the Indian Internet domain.
Cozy Bear is a Russian advanced persistent threat hacker group believed to be associated with Russian foreign intelligence by United States intelligence agencies and those of allied countries. Dutch signals intelligence (AIVD) and American intelligence had been monitoring the group since 2014 and was able to link the hacker group to the Russian foreign intelligence agency (SVR) after compromising security cameras in their office. CrowdStrike and Estonian intelligence reported a tentative link to the Russian domestic/foreign intelligence agency (FSB). Various groups designate it CozyCar, CozyDuke, Dark Halo, The Dukes, Midnight Blizzard, NOBELIUM, Office Monkeys, StellarParticle, UNC2452 with a tentative connection to Russian hacker group YTTRIUM. Symantec reported that Cozy Bear had been compromising diplomatic organizations and national governments since at least 2010. Der Spiegel published documents in 2023 purporting to link Russian IT firm NTC Vulkan to Cozy Bear operations.
Fancy Bear is a Russian cyber espionage group. Cybersecurity firm CrowdStrike has said with a medium level of confidence that it is associated with the Russian military intelligence agency GRU. The UK's Foreign and Commonwealth Office as well as security firms SecureWorks, ThreatConnect, and Mandiant, have also said the group is sponsored by the Russian government. In 2018, an indictment by the United States Special Counsel identified Fancy Bear as GRU Unit 26165. This refers to its unified Military Unit Number of the Russian army regiments. The headquarters of Fancy Bear and the entire military unit, which reportedly specializes in state-sponsored cyberattacks and decryption of hacked data, were targeted by Ukrainian drones on July 24, 2023, the rooftop on an adjacent building collapsed as a result of the explosion.
The Democratic National Committee cyber attacks took place in 2015 and 2016, in which two groups of Russian computer hackers infiltrated the Democratic National Committee (DNC) computer network, leading to a data breach. Cybersecurity experts, as well as the U.S. government, determined that the cyberespionage was the work of Russian intelligence agencies.
The 2016 Democratic National Committee email leak is a collection of Democratic National Committee (DNC) emails stolen by one or more hackers operating under the pseudonym "Guccifer 2.0" who are alleged to be Russian intelligence agency hackers, according to indictments carried out by the Mueller investigation. These emails were subsequently leaked by DCLeaks in June and July 2016 and by WikiLeaks on July 22, 2016, just before the 2016 Democratic National Convention. This collection included 19,252 emails and 8,034 attachments from the DNC, the governing body of the United States Democratic Party. The leak includes emails from seven key DNC staff members dating from January 2015 to May 2016. On November 6, 2016, WikiLeaks released a second batch of DNC emails, adding 8,263 emails to its collection. The emails and documents showed that the Democratic Party's national committee favored Hillary Clinton over her rival Bernie Sanders in the primaries. These releases caused significant harm to the Clinton campaign, and have been cited as a potential contributing factor to her loss in the general election against Donald Trump.
"Guccifer 2.0" is a persona which claimed to be the hacker(s) who gained unauthorized access to the Democratic National Committee (DNC) computer network and then leaked its documents to the media, the website WikiLeaks, and a conference event. Some of the documents "Guccifer 2.0" released to the media appear to be forgeries cobbled together from public information and previous hacks, which had been mixed with disinformation. According to indictments in February 2018, the persona is operated by Russian military intelligence agency GRU. On July 13, 2018, Special Counsel Robert Mueller indicted 12 GRU agents for allegedly perpetrating the cyberattacks.
On Friday July 29, 2016 the Democratic Congressional Campaign Committee reported that its computer systems had been infiltrated. It is strongly believed by US intelligence sources that the infiltrator groups are Russian foreign intelligence groups that breached the Democratic National Committee's computer systems. These groups are known as Fancy Bear and Cozy Bear.
DCLeaks was a website that was established in June 2016. It was responsible for publishing leaks of emails belonging to multiple prominent figures in the United States government and military. Cybersecurity research firms determined the site is a front for the Russian cyber-espionage group Fancy Bear. On July 13, 2018, an indictment was made against 12 Russian GRU military officers; it alleged that DCLeaks is part of a Russian military operation to interfere in the 2016 U.S. presidential election.
ThreatConnect is a cyber-security firm based in Arlington, Virginia. They provide a Threat Intelligence Platform for companies to aggregate and act upon threat intelligence.
Petya is a family of encrypting malware that was first discovered in 2016. The malware targets Microsoft Windows–based systems, infecting the master boot record to execute a payload that encrypts a hard drive's file system table and prevents Windows from booting. It subsequently demands that the user make a payment in Bitcoin in order to regain access to the system.
George Kurtz is an American businessman. He is the CEO and founder of the cybersecurity technology company CrowdStrike, and the founder and former CEO of Foundstone, a worldwide security products and anti-virus software company. He is also the author of the best-selling book of all time on cybersecuirty, Hacking Exposed: Network Security Secrets & Solutions.
Since 2016, then-presidential candidate Donald Trump and his allies have promoted several conspiracy theories related to the Trump–Ukraine scandal. One such theory seeks to blame Ukraine, instead of Russia, for interference in the 2016 United States presidential election. Also among the conspiracy theories are accusations against Joe Biden and his son Hunter Biden, and several elements of the right-wing Russia investigation origins counter-narrative. American intelligence believes that Russia engaged in a years long campaign to frame Ukraine for the 2016 election interference, that the Kremlin is the prime mover behind promotion of the fictitious alternative narratives, and that these are harmful to the United States. FBI director Christopher A. Wray stated to ABC News that "We have no information that indicates that Ukraine interfered with the 2016 presidential election" and that "as far as the [2020] election itself goes, we think Russia represents the most significant threat."
Sandworm is an advanced persistent threat operated by Military Unit 74455, a cyberwarfare unit of the GRU, Russia's military intelligence service. Other names for the group, given by cybersecurity researchers, include APT44, Telebots, Voodoo Bear, IRIDIUM, Seashell Blizzard, and Iron Viking.
In 2020, a major cyberattack suspected to have been committed by a group backed by the Russian government penetrated thousands of organizations globally including multiple parts of the United States federal government, leading to a series of data breaches. The cyberattack and data breach were reported to be among the worst cyber-espionage incidents ever suffered by the U.S., due to the sensitivity and high profile of the targets and the long duration in which the hackers had access. Within days of its discovery, at least 200 organizations around the world had been reported to be affected by the attack, and some of these may also have suffered data breaches. Affected organizations worldwide included NATO, the U.K. government, the European Parliament, Microsoft and others.
Michael A. Sussmann is an American former federal prosecutor and a former partner at the law firm Perkins Coie, who focused on privacy and cybersecurity law. Sussmann represented the Democratic National Committee (DNC) and retained CrowdStrike to examine its servers after two Russian hacker groups penetrated DNC networks and stole information during the 2016 U.S. elections.
A cyberattack is any unauthorized effort against computer infrastructure that compromises the confidentiality, integrity, or availability of its content.
{{cite news}}
: |last2=
has generic name (help)