CrowdStrike Inc. has been hired by the Democratic National Committee to halt a breach carried out by intelligence hackers from Russia, according to the Irvine-based security software maker.
The company said it thwarted two separate attackers—called Cozy Bear and Fancy Bear—that infiltrated DNC networks and obtained several types of documents, including research on Republican presidential candidate Donald Trump and confidential information taken from Democratic presidential nominee Hillary Clinton’s personal email server.
The Russian government’s involvement in the incident has been refuted by a hacker claiming responsibility for the attacks who released a 235-page opposition memo on the real estate mogul and contends the Clinton emails were delivered to WikiLeaks, which publishes classified information, such as the Edward Snowden disclosures that chronicled global surveillance programs run by the National Security Agency.
The hacker, which uses the alias Guccifer 2.0, has denied Russia’s involvement in public posts, but CrowdStrike “stands fully by its analysis and findings identifying two separate Russian intelligence-affiliated adversaries present in the DNC network in May 2016,” the company told the Business Journal in an emailed statement.
“Whether or not this posting is part of a Russian Intelligence disinformation campaign, we are exploring the documents’ authenticity and origin. Regardless, these claims do nothing to lessen our findings relating to the Russian government’s involvement.”
CrowdStrike said Cozy Bear last year infiltrated unclassified networks of the White House, State Department, and U.S. Joint Chiefs of Staff. The attacker has targeted the defense, energy, financial, insurance, law, manufacturing and media sectors in Western Europe, Brazil, China, Japan, Mexico, New Zealand, South Korea, Turkey and Central Asia through a targeted “spearphishing” campaign that typically baits users through web links that launch malicious viruses.
Fancy Bear, according to CrowdStrike, has been active for about a decade, targeting the aerospace, defense, energy, government and media industries in the U.S., Western Europe, Brazil, Canada, China, Georgia, Iran, Japan, Malaysia and South Korea. The group is known to register domain names that closely resemble those of legitimate organizations it plans to target through phishing sites that mimic the look and interface of the target’s email services, with the overarching goal of stealing credentials.
The group has been linked to network breaches at the German Bundestag, or parliament, and at French broadcaster TV5 Monde.
CrowdStrike is among a burgeoning group of Orange County software security makers getting strong demand as malicious cyberattacks wreak havoc in the public and private sectors across the world.
The company, which was established in 2011 by former executives at McAfee Inc. and Networks in Motion Inc., has boosted revenue past $50 million with a roster of hundreds of government agencies and Fortune 500 customers that pay a monthly subscription fee for software services delivered through the cloud. The software is designed to detect, prevent and respond to sophisticated security threats and attacks, as well as provide monitoring, cyber intelligence services, and big-data analytics.
CrowdStrike about a year ago raised $100 million in a Series C round led by Google Capital in one of the biggest venture rounds in OC tech history. The company has raised $156 million. It has doubled employment in the last year to 400 workers companywide, including about 60 in Irvine.
The $100 million benchmark round was hit this month by Irvine-based security software maker Cylance Inc. in a Series D round that attracted several prior investors, including lead backer Blackstone Tactical Opportunities.
