Name: The Cybercriminal in the Dark Web Mirror: Unmasking Identity Credential Compromise
Uploaded: 2025-04-22T16:30:05.979Z
Duration: 1 h 30 min
Description: The Cybercriminal in the Dark Web Mirror: Unmasking Identity Credential Compromise

Transcript for "The Cybercriminal in the Dark Web Mirror: Unmasking Identity Credential Compromise": Hi, everyone. Thanks for joining us for the cyber criminal and the dark web mirror, unmasking identity credential compromise. We have a great discussion to plan for you all today. I'm gonna cover a couple of quick housekeeping items before we get started. If you have any questions during the discussion, please submit them into the q and a box. We'll have time for the speaker to answer some of the questions throughout the presentation or at the end. And the second thing is this webinar is being recorded, and it will be sent through email in the next couple of days, so keep an eye on your inbox for that. With that, I'm excited to introduce today's speaker, Dor Gosher. Dor is the director of product management with Intelligent Intelligence here on the website. Dor collaborates closely with r and d, data science, and business stakeholders to deliver scalable intelligence driven solutions that helps cybersecurity teams mitigate risk and make informed decisions. With that, Dor, I'm gonna pass the mic to you, and you can take it away. Thank you, Sarah. Hey, guys. Happy to be here with you. Very, very excited about this session, and I hope we'll have a a nice thirty minutes together. What will we cover today? So we're gonna talk about three main topics on the agenda. So the idea is to try and take you from your day to day job and put you inside the mind of a hacker. We're trying to let you understand how do these hackers think, how do they operate, how do they monetize, how do they steal your credentials, how do they take that data and use that against you. Then the second part we'll try and cover on how do we recommend you guys to fight back against against the bad guys, basically. How can you use our tool or different capabilities to try and fight back against what these guys are doing? And we'll wrap up with summary and a few, questions in case we'll have any. So I'll start by, letting, the people that may have attended the previous episodes. We did have a webinar for our customers only, what we call the practitioner workshop a few weeks ago to talk about the identity intelligence module that we released. So just to cover a few of the questions that we heard there to to keep people calm here. First of all, for the SPM customer, for the security performance, customers that we have here, the credential exposure will not, affect your ratings. It is available already inside your SPM, but it will not affect your ratings. And we'll cover the rest of the questions that you see here in terms of integrations and the confidence level of the credentials that we collect during this session as well. So no worries. If somebody asked a question and didn't get an answer last time, you'll get it this time. I'll start by letting you know the bottom line of this, of this presentation. At the end of the day, stolen credentials are a big thing. It looks like a small thing, but it's a very big thing for your organization and for the hackers as well. For the hackers, this is basically the way into your organization. It's a combination of a username and a password that can allow them to go into your deepest secret as an organization, to see your Salesforce account, your customer database, your intellectual property. Everything is available usually via this combination of username and password. And for you guys, basically, one leaked password of your DevOps or of your CEO or any other VIP of your organization can snowball from just a small thing to a massive financial reputational damage to your organization. So this is a big thing. Okay? It seems small, but it's a very, very big thing. And, again, what I'm trying to do in the next twenty five, thirty minutes is to take you through the journey of how do these hackers gain access to these credentials, how do they monetize it, and then talk a little bit about how can we stop them and how can we fight back. So we'll start by going inside a hacker's mind and talk about the business of stolen credentials. So as we do and we try to to organize our way of working, these hackers also have a playbook. Now I'm gonna try and generalize the way that these hackers are working and place four main stages to the way that they're gaining access to the organization using stolen credentials. So the first phase will be the hunting phase, and we'll go down we'll we'll drill down to each one of these sections in a second. The second one, once they got the initial access, once they got the initial lead, they will use that to monetize that information. So there's two options. There's the hackers that are trying to use that data and get access to your organization, and there's the ones that are trying to monetize that to get a lot of lead credentials and then sell that to other hackers that will use it against you. So there's the monetization phase. This is an important phase because this is a lot of time the phase where we can catch them when they're trying to sell this data in the dark web or in different places. Then comes the exploiting phase, the phase where they're trying to use it against you. And usually, and this is something that we're seeing a lot lately using different LML tools, scaling of the operation. It worked one time. I wanna duplicate the success of that. I wanna try and do that again. So let's zoom into the first stage and the hunting for credentials. Generally speaking, what the hacker is saying right now is that they're trying to steal credential using different methods. When we look at the recent attacks in the last couple of years, we can identify four main types of attacks that these hackers are using. The first one or the most common one is what we call the stealer malware. It's the infrastereos that they're spraying using different capabilities, that they're sitting on the Chrome browsers or on the browser of the user and just stealing all the login information that they can, the username, the password, the cookies, and all that kind of information from your users. A very, very common way of acting. We'll talk about that in a second. The second common thing that we saw in the past and that we're also seeing in recent days is phishing. So there's the spear phishing, where they're trying to target specific individuals inside your organization or just general phishing when they're targeting, you know, the wider audience. But, basically, trying to lure people into getting into websites that look like your website, putting their username and password, and then they steal that information from there. Third thing is the database leaks. So these hackers tend to try and hack organizations like LinkedIn and Facebook and Salesforce, people that have a lot of different credentials. Now as we know, people tend to recycle their credentials. Right? When I'm using a username and password, usually, I'm using it to a lot of different softwares. So once I got access to the username and password combination of somebody in Facebook, Usually, using that to get access to their Salesforce account or to their Okta account or to their Active Directory will be very easy and will probably work. So getting access to these big databases leaks is very, very important. And lastly, what we call credential stuffing. This is for the more sophisticated hackers, let's say, which is sort of like a DDoS attack using credentials. So, basically, I'm trying to use a lot of different combinations of credentials using the same username and then just a bunch of credentials and trying to get access to specific software. Let's zoom in to each one of them and talk about what do they do there specifically, and later on, we'll talk how can we help you protect against that. Steeler malware. I'm assuming a lot of you guys heard about it. It's something that is very, very common in the last three or four years. But, basically, Steeler is a malicious software or malicious malware that is designed to extract safe password from browsers. Basically, the way that it works is that hackers tend to send these malware on a wide spread, on a wide audience, via email attachments or pirated software or by clicking through download links, and then it's installed on the browser of the specific user. What happens from there on is that every time that that specific user is trying to get access to a specific software, whether it is a customer portal, the Okta organ the Okta of the organization, or any other thing that is available via the browser itself, they're just drinking these password combinations, these user and password, and sending that to the hacker itself for them to keep that information. A very, very famous stealer called Redline. I don't know if you guys heard about it. But what happens is that hackers also use these stealer, and they sell them as a malware as a service. So that's a I'm a a script. I'm a I'm a kiddie hacker. I just wanna start doing my hacking so I can buy a redline steerer and then just send it to a bunch of people. They install that, and then I'm getting all their credentials. So, usually, it's three main steps in the way. The user unknowingly downloads the malware. The malware extract the stored credentials, and then it send the stolen credentials through, you know, an external server. That's basically a serial network. Second option is the phishing. So as I said, you know, the traditional phishing is spear phishing when I'm trying to target specific audiences. So I'm sending specific emails to the CEO, to the DevOps engineer, trying to impersonate the brand or trying to impersonate other vendors. So banks, the IT department, the finance department, SaaS providers, telling them, click here to reset your password or click here to go to see the latest inbox that you get. They're getting into a website that looks exactly the same as the website that they're used to seeing. Sometimes it has a different URL. Sometimes it has the exact same logo, put in username password, and then getting blocked. What happens on the background is the password combination is being stolen. An example for that is Microsoft three sixty five phishing campaign that happened about two years ago with the update security settings link, but this is very, very common. So, basically, again, the steps here is that the attacker is sending an email, appearing from a trusted source. For example, your account has been locked or reset your password now. The user clicks on that link, getting into the web page, putting their credentials, and then the credentials are being stolen. Next in line is the database leak. So as I said, when we're talking about the playbook, this is the case where hackers gain access to a lot of different credentials. So they hack Salesforce or they hack LinkedIn or they hack Facebook or Anthony Madison or any big database of a lot of different users. And there, they're trying to use these combinations of username and password to get access to different systems, or they're just selling it. They're selling it for the highest bidder or for a very, very, low price for everybody to have access to these combinations of username and password and sometimes also the host, the domain or the website or the software that these combination of username and password were used to get access to. How does that work? Usually, the hackers reach a company's database, extract all the stored credentials, and then they saw it as a dump on side inside the underground markets, and then different attackers use that to cross check stolen credentials on other platforms. Right? So if you use this as for LinkedIn or for Spotify or for whatever, maybe you're also using that for, you know, your Okta device, for example. Lastly is the credential stuffing. Again, this is for the more complicated for the more sophisticated hackers. This is basically doing some coding, taking a username that you're aware of. This is usually very, very simple because most companies, most, you know, big companies, enterprise customers have the same format or template for email addresses. So name dot last name at company domain, taking this username and just, you know, throwing a DDoS attack at that, meaning using a bunch of different password combinations from a database that they have or from just random code, trying to get access to, to this specific software. So, again, first step will be to get the list of lead credentials, meaning the usernames, and then using bots or using code to go across different platforms and use different combinations of password and username to get access to these kind of, devices. Okay. The first step, as I said, is hunting for credentials. So we found credentials, then it's time for the hackers that wanna make money out of this. I don't wanna hack into people's, environments. I just wanna make money out of it. How can I do that? So what we see in these cases are mainly free delivery vehicles where they can sell their goods. The first one is the traditional dark web marketplaces. So these are places, like forum breach that was closed last week, where hackers just dump a bunch of credentials there and sell it to the higher bidder to the highest bidder. So $50.5000 dollars, anything like that. I can go. I can put crypto wallets or anything else, and I'm getting all the credentials that they have inside the bigger database that they have there. Second thing, which is, I don't know, like, last three years, very, very trending is the initial access brokers market, like Russian market. These are places where they have auction for mostly ransomware gangs to get initial access to your specific organization using stealing malware. So, basically, it's a website. We'll take a look at it in a in a couple of minutes, where you have the ability to buy the access to a specific endpoint. Again, I'm taking you back, like, couple slides back when we're talking about the initial the initial access, or stealing malware, where I'm sitting on top of the browser, and then I know the combination of the username, the password, the cookies, the IP address, the endpoint that is being used in order to get access to this specific software. So, basically, what these hackers say is, listen. I have access to an IP address from Japan. This is the cookies that they will use, and these are all the domains that they used credentials in order to get into. You wanna buy that for $5? Yes. You'll get all the password and all the cookies and all the combination of information that they have inside that specific option. And lastly, for the commodity, Telegram channels. Right? So let's say, I don't wanna buy I don't wanna sell it. I just wanna, you know, pass it to other people for them to use it. So there's dozens of Telegram channels where they just share combinations of username, password, host names, etcetera, etcetera for people just to have you know, get it and do whatever they want with it. Let's zoom in and see a couple of examples. So marketplaces. So as I said, a very, very big marketplace where people used to get information from, forum breach was closed last week, but this is the way that it looks like. Basically, it has a website a web page saying, do you wanna buy access to 500 k combinations of username and password from Spotify, from LinkedIn, etcetera? Please pay us 20 k, 10 k, in crypto, and we will give you all that data. Very, very simple. Everybody can get access to that information. It's being solved. Very, very easy to see and get access. Second thing is the initial access broker initial access broker marketplaces. So this is an example of these kind of marketplaces. This is what's called Russian marketplace. Every line here represent an endpoint. So somebody installed a stealer on an endpoint, and then, as a hacker, I can come here, and I can buy that specific information about that specific endpoint. Basically, they're giving me basic data about it. They're saying, this is the IP address that is being used on that on that endpoint. This is the software or the website that the credentials are being used in order to get access to. You wanna buy that for $5, 10 dollars, and then you get information about that specific endpoints. Last option is the Telegram channels. So as I said, in this case, for the commodity, for the people. So, basically, once you're signed up to that channel, usually, it's from an invitation, but sometimes it's an open channel. You can either get information from stealing malware, like, for example, or just get zip files of Google password or output password or anything else that is available out there for free for the wider audience. Nobody's, looking at that. And this is one of the way for people to just share lead credentials for people to use them for free. So I got access to lead credentials, or I made money out of it. But never mind. I have now the combination of a username and a password for a specific organization. What can I do with it? Then comes, you know, MITRE TTPs, which is basically the ability to use these in order to get collateral lang collateral movement inside your organization. So I'm getting access to the IT individual, to the DevOps. And from there on, I'm inside your system, and I can see all the information. I can sometimes grant myself permissions as an admin to change password from different, for different users, etcetera, etcetera. Do you guys know how it works? Privilege escalation, privilege, capabilities, etcetera, etcetera. Very, very simple and very, very common. And the last thing is I saw that it's working. I saw that a phishing campaign is working. I saw that a typosquoting campaign is working in order to get credentials. I saw that something is working. Now I have the portal of scaling that. I wanna make more money out of it. So welcome AI. Welcome LLM models. I can just say, listen. This is something that already worked for me. Now create another email for the financial persona in the organization in another organization doing the same exact thing using the same exact link, but doing it at a wider scale and very, very easy to use. So to sum up the initial part of the presentation, we were talking about the hacker's hats. Right? We're talking about how do hackers look at these kind of things. First thing is the hunting phase. Right? So I'm trying to get access to a combination of a username and a password, mostly through stealing malware or from different website. For the people who wanna make money out of that, monetization phase, I'm putting it inside the initial access broker marketplaces in specific forums in Telegram, and the hackers that are using it, exploiting the exploiting phase, taking that data, using it to get access to your organization, and then scaling the operations. Cool. So what can we do against that? How can we protect ourselves from from these kind of things? I'll take you through the same journey, and we'll try and talk about the Defender's playbook. How can you protect your organization from it? We'll talk a little bit about, methodology, about enforcing stronger authentication, but we'll focus on this specific lecture or this specific presentation about how can you use software like the CTI, identity intelligence, to help you find these things, automate the remediation, and and, you know, keep your organization safe. So, basically, we're talking about three main steps for the defender's playbook. The first step is to identify that there is a problem, to know that there are credentials out there of my employees or of my customers that are being shared and that can be used against me. That's a very, very critical point. We'll talk about that in a second. The second thing is to have incident response workflows. For those of you who have played or buy or used these kind of software before, you know that there might be a lot of noise that is coming from this. Why? Because there might be employees, former employees that left the company and their credentials were stolen. There may might be credentials that people are sharing which are not true. So you gotta have specific workflows that will help you automate these procedure, keep your life easier, filter through the noise, and make automatic actions, and at the end, to have a continuous monitoring, not to do it just a onetime thing. You know? Let's do a dark web scan, see what's out there right now, change the password, reset these users, etcetera, and just finish that. You gotta have a continuous monitoring program because these things tend to, you know, bite you in the ass all the time. It it comes back all the time. So, again, same thing. We'll go over each one of the steps, and we'll talk about that in a little bit deeper. Identifying the stone credentials early. So the game here is a game of doing it as fast as possible. Right? Once it's out there, you're in the danger zone. So you need to find these things as as fast as possible. And the reason why you need to do it is because you won't know about it immediately. But once you do know about it, you gotta have you're gonna act upon it very, very quickly. So how can you do it? First thing is to continuously monitor all the different sources that we're talking about. Right? The initial access markets, the data dumps, the Telegram channels, the deep, the docker, etcetera, etcetera to try and find your specific credentials that are being shared there, to detect mentions of stolen credentials in these underground forums, in these Telegram, and to use different automate automations to alert you guys on these specific credentials that are being shared out there. Let's see a couple of examples for that. How do we do it in BitSight? What you see on the right side of the screen is initial access market, Russian market. K? This is the product that is selling access to a specific endpoint for $5. On the left side of the screen, we can see how will you see it inside the CTI portal. So, basically, there's two options for the more advanced users or for people who have more time. You can go inside the post itself and see all the information about it from there. So you will see a mention of your domain. So let's say it's login.beatsitech.com with an IP address, and then you can basically do two actions. One is to identify if this is indeed a potential customer or a potential employee of your company, or you could try and do some kind of a reverse engineering based on the data that is available there. See the cookies that were used, see the IP address, and try and identify the customer. Or a third option will be to use companies like BitSight CTI or other companies that can buy that can purchase these credentials for you. This is one of the services that we provide as an example. We go to these marketplaces, and we buy these credentials. And then it's basically some kind of a remediation action because once it's being bought, nobody can see it anymore there. So that's also one of the things to do. A couple of the a couple additional examples, what you see on the right side of the screen is three types of ways that we're seeing here. It's serial information. Serial information that is available in a specific telecom channel. So this is the way that they're doing it. They're basically putting here, the ZIP files or the JPEG files or the data itself coming from the sealer. Clicking on that will then download this kind of information, you know, know, the one that you see with the with the fox at the middle. This is all the endpoint data. And then inside of the CTI portal, you'll be able to see all the data that we collect. Again, we will identify and we will alert you about it. Because we identify that there is a specific domain that is related to your organization or there is a specific IP address that is related to your organization or any other mechanism that you place, any keyword that you wanna search for these specific dealers, and we will alert you about it, and we'll provide you with the information that we can collect automatically. So you can see here on the right side, the creditor information, the, username that we use, the IP address, the URLs in the specification. Sometimes we even get the hardware ID. So if you guys have access to the IT guys, they can identify the specific endpoint that is using that specific hardware ID and all that kind of information that is available. Another example, this is from a forum. So we collect that data. Some of the information is gotta be collected manually. So on top of all the automations that we have in order to collect the data from all these sources, we also have a team of analysts that is going manually into these places and downloading or buying these databases and then uploading it to the system automatically after parsing the password and the usernames, etcetera, etcetera. So, unfortunately, there's also a bit of a manual work here, but we do have a team that they're going manually into these spaces every every day and collect it manually and uploading it into the system. Then comes the second part, k? The incident response workflow. So I'll start by just talking about general things, and then I'll talk about what do we recommend doing inside the CTI portal. So in general, the first thing that I expect the security procure to do once they get a combination of a username and password to check if it's still active. K? What these hackers tend to do is to echo historical credentials. So first thing, check to see if this employee is already working is is still working in the company or check to see if this is the still customer of the company. Check and see the password policy of your organization because maybe there's a combination of, you know, first name, last name, domain as a as a username, and then the password is one two eight. And you guys know that the password policy of your organization does not allow to do these kind of credentials. So check to see if that's if that's one of the, the options there. Once you pass these two steps, go deeper. K? Try to investigate for any suspicious logins or activities using the stolen credentials. Try and see if this specific username password combination did some kind of a collateral movement inside your organization. Try to get access to software or to resources that they don't have access usually. And, obviously, educate the affected user and the security best practices after you reset their password, lock their accounts, etcetera, etcetera. So multifactor, you know, all these kind of things. What we offer in terms of automation in that, Roms, is a couple of things. So first of all is security playbooks. So we integrate with different companies, such as Torq and Tynes and Microsoft Defender and Jira. And we also provide this via API, which is basically the ability for you to consume this data in the places where it's more convenient for you guys to take immediate actions based on that. So you can basically create a playbooks inside Microsoft Defender or inside Talk or Times or using the API or consuming this via a SIEM or a or another store that you're using. And then every time that there's a combination of a username, password, we have a specific host, for example, run playbook a. So that's something that we recommend highly for our user to do directly from our portal or to use it via API or to use it via one of our integrations with one of these platform or any other partners. Then comes the last step, which is the continuous monitoring. Again, as I said, it's not enough to just block these things one time because these things tend to come back again and again. These hackers, they spray these steal them out. They do it all the time. So even if you did not notice yet that, you know, these credentials are being used against you, it can be used against you later on. So we recommend to continuously scan these criminal marketplaces, these IAB forums, and to use threat intelligence to try and anticipate these future attacks against to try and and find information about your organization. This is an example of how will an alert inside our system will look. So, basically, how does it work? We allow you guys to either automatically get your domains in it using our EASM engine, or you can manually add your domains. And then every time that we find a new lead credential of the organization, you will get a push alert. You will get an alert in the portal. You'll get an alert in the email, and you will see the combination of the email and the email, the username, the password, what's the type of the password, what's the host domain and the domain that these combination were used in order to, you know, get access. So Dolittle at Bitsight was used in order to get into Spotify, and then you'll be able to act upon it. One of the things that is very, very important when dealing with leaked credentials is filtering through the noise. So I wanna I wanna talk about this for five minutes, and then we'll wrap it up with a few recommendations. As I said, hackers tend to echo these credentials all the time to share that information even if it's not relevant. So we're trying to reduce your workload. We're not trying to provide you know, to bring you more work. And for that, we try to do three main filters to help you, you know, filter through that noise. The first one is what's called previously detected. This is basically telling you, do you wanna get only new sets of credentials that we found, or do you also wanna get all the historic credentials that we got? So for example, five years ago, there was a combination of dolbysidetracked.com with a password a. And then today, another factor shared that information. So this builder will enable you to define, I wanna get this new, or I do I I do not I do not wanna get this combination of username and password again. Second thing that we did in order to help you filter food and ice is to save you the trouble of checking if this employee is active or not. So we have an integration with Active Directory at the moment. We do plan on integrating with additional IDP providers like Okta. Basically, you're putting your API client ID and secret into our portal. And then inside this column, you'll get an indication if that user exists or not. And then you can, again, filter the table or filter the alerts and only see information about employees or credentials that are currently active. And lastly is the option to define a password policy. Again, this is one important tool that we have inside the system, which allows you to define a couple of aspects inside the password policy of your organization. First is the length of the password. So very, very simple. How many characters do you have inside your organization password policy? And the second thing is the complexity of that password. So how many letters, how many numbers, uppercase, lowercase, you know, non English letters, special characters, etcetera, and also the combination of that because we know that, you know, today, organization have the flexibility of defining a combination of aspects. So the length and letters and uppercase letters. So you have the ability to define the minimum complexity criteria and to identify exactly what you what's relevant for your specific organization. I'll wrap things up with a couple of key takeaways, and then we'll take a look at the q and a section to see if we can cover a few of the questions. So compromised credentials are one big challenge for security teams. K? It looks like a very, very simple or very small thing, but this is mainly the use for people to get initial access into your organization using these combinations between username and password and then going to your Okta, to your Salesforce, to other places. So So the first recommendation is to check, to see what's out there. Use Cybersecurity, B type, CTI, or use any additional tools that you may have used, and try and find all the credentials that are out there relevant to your organization. Second thing is to educate and enforce mechanism inside your organization to try and protect you in advance from these kind of threats. So multifactor authentication, teach your organization about phishing attacks and how do they use against that. And third is the preempting. That is the, is preempting that information. So using tool like Bitsight Identity Intelligence to create playbooks, to create automation. So once you've found these credentials, instead of waiting for the IT manager to reset his password or to lock that account, automatically do that because we're talking to you in scale. K? So for organizations that have a lot of employees, a lot of credentials, this can be, you know, hundreds or thousands of records on a monthly basis. So you gotta do some automations to to, you know, to make your lives a bit easier. That's it on my side. I'll take a look at the q and a section. I'll try and answer a couple of the, a couple of the questions. So I see there's a question about, does your AD module validate if the password you found matches the, password for that account currently in AD? So the answer is yes. There's basically two ways of going deeper with the AD module. One way is just to get the superficial, which is just, you know, user exists or not. And for some organization that wanna check go one step deeper, they can either do it inside the portal or most of the customers that I've seen, they do it externally of our portal. They do get inside the playbooks that they create, inside, you know, Torq, Times, Microsoft Defender, Excel, etcetera. That from there, they're questioning AD, first, whether this user is active or not. Second, is that specific password is being used to which resource inside my database or inside the software that I'm using. Are threat actors that are attacking credentials fighting ways around MFA? Some of them do, but MFA currently is a very, very big challenge because they gotta have access to, usually, to either cell phones or to any other, you know, iPads or iWatch or stuff like that to enable the MFA. So it's very, very hard for them. I think the more sophisticated ones sometimes get our way around it, but it's very, very uncommon. So, usually, MFA probably will do the trick in in protecting you from these guys. And I'm trying to look at the last question. We have accurate seats of compromised credentials and enforce immediate password reset when an account is flagged. If user within a peak another known bad password during rotation, technical controls to block these recycled credentials aren't an option in our environment. And our user education effort and KB articles haven't moved the needle. How would you approach breaking the cycle of compromised password reuse? Honestly, it's gonna sound like a cliche, but it's education and enforcement. And if that doesn't work, so you gotta have a a, you know, a stronger password policy. Otherwise, they will just use the same thing. Another option, and this is very irritating for the employees, I gotta say, and this is coming from an employee as well, Change the password policy. You know, every six months, every year, change the password policy for the organization. Instead of uppercase, do lowercase. Instead of, you know, two car two special characters, do three special characters. That will just, you know, make them change their their password and not reuse it. I think we're on time more or less. I thank you very much for, participating in this webinar. In case any of you have additional questions, this is my email here. As Sarah said, we'll share this presentation with everybody, and and that's it for me. I think Sarah? Yeah. Thanks everybody for joining in your participation. Great presentation, Dor Gosher. So, yeah, thanks everyone. Hope you have a nice day.