Shields Up, Smooth Criminals, A Delicate Balancing Act, UK Legal Exposure, How the Venerated are Fallen, and Smashing Smishing. It's CISO Intelligence for Wednesday 7th May 2025.
Eternal vigilance is the price of security, the art of persuasion, from Russia with...what? A massive faux pas, sad endings, and staying alert.
💡
"Gives me everything I need to be informed about a topic" - __UK.Gov__
Table of Contents
1. Why EASM is Vital to Modern Digital Risk Protection
2. Vishing: Now They’re Coming for Your Voice
3. The Russian Open Source Project That We Can't Live Without
4. Cyber Armageddon: When Legal Aid Gets Hacked
5. The Perils of Aged Grace: A 160-Year-Old Firm Upended by Ransomware
6. Smishing on a Massive Scale: Enter the "Panda Shop" Chinese Carding Syndicate
Sign up for CISO Intelligence.
21st century industry insights for the modern CISO
It won't hurt, I promise.
Email sent! Check your inbox to complete your signup.
No spam. Unsubscribe anytime.
Why EASM is Vital to Modern Digital Risk Protection
_Because ignoring your digital risk is like ignoring a fire in your server room—hot, dangerous, and definitely not going away on its own._
What You Need to Know
Understanding the importance of External Attack Surface Management (EASM) is crucial for businesses in safeguarding their digital assets and ensuring robust cyber resilience. Executives should prioritize investments in EASM solutions to protect their organization’s expanding digital footprint from potential threats. This involves allocating resources for more comprehensive monitoring and vulnerability assessments. An active posture in managing the attack surface can significantly reduce risks from unexpected cyber threats.
CISO focus: External Attack Surface Management
Sentiment: Strong Positive
Time to Impact: Immediate
*
External Attack Surface Management: A Crucial Component of Cybersecurity
In today's era of Digital Darwinism, organizations are wrestling with ever-expanding digital ecosystems. As they grow, so does their attack surface, multiplied by new digital assets, partner integrations, and widespread cloud adoption. This expansion necessitates a pivot to proactive digital risk protection strategies, of which External Attack Surface Management (EASM) forms the core.
The Expanding Digital Landscape
The digital evolution is relentless. Organizations that thrive are those that not only embrace these changes but also adjust their cybersecurity paradigms accordingly. Gartner predicts that by 2025, 60% of organizations will have adopted a digital transformation strategy that includes EASM. This proactive approach is necessary to manage the external attack surface and stay ahead of threats.
Why EASM?
* Visibility: EASM provides comprehensive visibility into an organization's internet-facing assets. This level of insight helps to identify unknown or unmanaged assets that could prove to be vulnerable entry points for attackers.
* Risk Minimization: By continuously assessing and reducing potential attack vectors, EASM minimizes exposure to cybersecurity threats. Through regular monitoring and threat intelligence, EASM solutions can pinpoint vulnerabilities before they are exploited.
* Proactive Defence: Unlike traditional security measures that react to threats post-factum, EASM enables anticipatory action—identifying and neutralizing risks in advance.
Case Studies and Industry Examples
1. Case Study 1: Retail Industry
In a large retail organization, EASM implementation resulted in the discovery of several unsecured endpoints, allowing preemptive measures to be taken. As a result, potential breaches and data exposure were averted.
2. Case Study 2: Financial Services
A multinational bank adopted EASM and experienced a 40% decrease in phishing incidents. Enhanced visibility into their digital assets enabled the organization to swiftly patch vulnerabilities and improve their response time to emerging threats.
The Technical Components of EASM
EASM solutions typically encompass several technical measures:
Continuous Asset Discovery: Identifying all public-facing digital assets across various environments.
Vulnerability Assessment: Evaluating these assets for security gaps that can be exploited.
Threat Intelligence Integration: Leveraging threat intelligence for ongoing monitoring and prioritization of vulnerabilities.
Remediation Guidance: Providing detailed insights and pathways to secure vulnerable assets.
Challenges and Potential Stumbling Blocks
While EASM offers powerful benefits, several challenges can impede its implementation:
Integration Complexity: Organizations often face difficulties integrating EASM solutions with existing cybersecurity frameworks.
Resource Allocation: Deploying EASM requires sufficient resources and skilled personnel, which some companies may lack.
Awareness and Training: Ensuring that all stakeholders, from C-suite to IT teams, understand EASM's critical role in cybersecurity is paramount.
Closing the Digital Front Door
As organizations continue to expand digitally, protecting this larger attack surface becomes imperative. By implementing EASM, organizations enhance their cyber defenses, achieving greater protection for their digital assets. The future of digital security is not in waiting for the next threat to appear but in ensuring such threats never find a foothold.
*
Vendor Diligence Questions
1. Can the EASM solution seamlessly integrate with our current cybersecurity tools and systems?
2. How does the EASM platform facilitate asset discovery while ensuring continuous monitoring and threat intelligence updates?
3. What training and support do you provide to help our team maximize the effectiveness of your EASM solution?
Action Plan
1. Assess the current digital footprint and identify gaps that could be susceptible to unintended exposure.
2. Invest in a comprehensive EASM solution for proactive asset monitoring and management.
3. Implement training programs to educate IT and security teams on EASM tools and their operational aspects.
4. Establish a routine evaluation process to adapt and refine the EASM strategy as new threats and vulnerabilities emerge.
*
Source: "Why EASM is vital to modern digital risk protection" - BleepingComputer
[Original Source](https://www.bleepingcomputer.com/news/security/why-easm-is-vital-to-modern-digital-risk-protection/)
*
Vishing: Now They’re Coming for Your Voice
_When it rains data, it pours audio._
What You Need to Know
Vishing, or voice phishing, is on the rise with cybercriminals leveraging voice calls to extract sensitive information from unsuspecting targets. Executives need to invest in comprehensive training, build robust voice authentication systems, and update incident response plans. Protection of sensitive data and enhancing employee awareness will be key to mitigating this evolving threat.
CISO focus: Social Engineering & Awareness Training
Sentiment: Strong Negative
Time to Impact: Immediate
*
As digital transformation continuously evolves, so too do the tactics of cybercriminals. Lately, the spotlight is on vishing - a sophisticated breed of phishing that utilizes voice technology to deceive individuals into divulging sensitive information. In 2023, as more personal and business interactions shift to voice-activated solutions, cybercriminals are adapting, capitalizing on trust and psychological manipulation.
The Growing Menace of Vishing
Vishing incidents are stacking up faster than robocalls after business hours. It's no mere coincidence; the pandemic-fueled reliance on voice-activated services and remote communications has made it a lucrative channel for scammers. Unlike its email or text counterparts, vishing capitalizes heavily on the power of human voice – a potent carrier of authenticity and urgency.
Voice Recognition : Trust is instinctive when a familiar voice or convincingly professional tone is on the line, leading to an elevated success rate.
Remote Workforce Vulnerability : Employees are more susceptible to these attacks as boundaries blur between work and personal environments.
From Casual Chitchat to Data Heist
The anatomy of a vishing attack typically includes a seemingly innocuous call, perhaps from "IT Support," requesting authentication information or other sensitive data. The hook is the perceived urgency and authenticity of the caller, using personalized details to bait targets into compliance.
Riding the Trust Wave : Trust is exploited when attackers mimic known brands or authorities.
Exploiting Psychological Pressure : By inducing panic or urgency, attackers coerce victims to act impulsively and divulge information.
Fortify with Awareness and Technology
The rise in incidents underscores an urgent need for fortified defense strategies. Awareness and education are frontline defenses, while technology acts as the vigilant sentry.
Employee Training : Regular awareness sessions can demystify vishing techniques and reinforce skepticism towards unscheduled calls or requests.
Caller ID Technology : Automatically flagging unknown or suspicious numbers can prevent initial contact.
Voice Authentication : Implementing multi-factor authentication with voice recognition strengthens defense against unauthorized access.
Avoiding the Auditory Ambush
Flying beneath the radar, visher calls often claim loyalty to the very systems they intend to breach. Organizations can implement certain strategies to separate the wheat from the weeds.
Dual Confirmation Protocols : Encouraging validation of phone requests through alternative channels reduces reliance on verbal consent.
Incident Reporting Mechanisms : Establish simple channels for employees to report suspect calls, enabling faster incident responses and trend identification.
Simulated Attacks : Just as companies employ phishing simulations, voice simulation exercises can build resilience by facing staff with real-time vishing scenarios.
Listen Up and Lock Down
In an era where trust is a commodity, businesses can't afford to turn a deaf ear to the murmurs of vishing threats. The value lies in nurturing a culture of skepticism and vigilance. As cyber adversaries leverage the subtleties of human interaction, our defense must evolve similarly—embracing cunning instincts alongside advancements in technology.
*
Vendor Diligence Questions
1. What anti-vishing measures and technologies do you currently offer or recommend to enhance organizational security against voice phishes?
2. Can you provide a detailed report on how your solutions remain effective against the evolving tactics of vishing attackers?
3. How do your offerings integrate with existing cybersecurity frameworks and policies, especially in facilitating secure voice communications?
Action Plan
1. Task Force Formation : Establish a dedicated team within the cybersecurity division focused on combating social engineering threats, including vishing.
2. Training and Awareness : Launch a detailed training program for employees with a focus on identifying and responding to vishing attempts.
3. Review Security Policies : Evaluate and update current information security policies to include specific procedures for handling vishing threats.
4. Invest in Technology : Research and acquire advanced caller verification and voice authentication solutions to add another layer of defense.
*
Source: As Vishing Gains Momentum, It’s Time to Fight Back
*
The Russian Open Source Project That We Can't Live Without
_When JSON speeds up, who's steering the wheel?_
What You Need to Know
The Go package "easyjson," crucial for optimizing JSON serialization in cloud-native environments, is developed by a team linked to Russian security. This connection might pose a strategic risk to your software dependencies, especially in key cloud technologies like Kubernetes. The board should evaluate the leverage easyjson has in your software ecosystem and consider diversification options.
CISO Focus: Software Supply Chain Security
Sentiment: Strong Negative
Time to Impact: Immediate
*
The Intricate Web of Dependencies: A Hidden Threat
In the digital universe of software development dependencies drive efficiencies, but they also stealthily embed vulnerabilities. easyjson, an open-source Go package designed for swift JSON serialization and deserialization, has climbed to a critical status in this ecosystem. The twist? Its main architects hail from VK, a Russian company intertwined with entities under U.S. and EU sanctions, potentially tethered to Russian security services.
easyjson: A Must-Have or a Backdoor?
At its core, easyjson optimizes JSON handling processes, an essential function for cloud-native applications. JSON, a ubiquitous data interchange format, forms the backbone of many services—ranging from render-efficiencies in financial analytics platforms to scalable operations in cloud applications like Kubernetes and Istio.
Yet, this gain is counterbalanced by the geopolitical dimension. The apprehension stems not from easyjson's technical ingenuity but from affiliations—VK's leadership facing sanctions and the specter of Russian security implications.
Who's In the Crosshairs?
The use of easyjson isn't an isolated incident but a ripple affecting a suite of cloud tools. Helm—facilitator of Kubernetes packaging, Istio—enhancer of microservices communications, and Kubernetes itself are some of the implicated technologies.
This situation draws attention to the broader canvas of software-dependent entities, urging a meticulous review of one's Infrastructure-as-Code (IaC) and Kubernetes infrastructure to ascertain dependencies.
A Decisive Moment for Boards and Executives
The revelation about easyjson doesn't just demand a technical audit but a strategic pivot. For executives, the inquiry is twofold—does your software portfolio lean on easyjson, and what risk does this pose? The potential vulnerability makes it imperative to establish balance by diversifying dependencies and evolving a resilient architecture strategy.
As dependencies grow and software stacks interlink more complexly, the lesson remains clear: understand not just the source code but the sources of your code. Being vigilant about the origins of open-source contributions is not just caution; it's a frontline defense in your cybersecurity strategy.
*
Vendor Diligence
1. What is the provenance of software components integrated into our critical systems, and how frequently is this reviewed?
2. How do we assess geopolitical risks associated with our software supply chain, and are these assessments regularly updated?
3. What steps are in place to migrate from or mitigate risks associated with foreign-controlled software when vulnerabilities are discovered?
Action Plan
Inventory Audit : Immediately map all dependencies on easyjson within your systems.
Risk Analysis : Assess the threat posture associated with these dependencies and model scenarios of potential exploitations.
Contingency Strategy : Collaborate with development teams to identify alternative packages or strategies to replace or mitigate risks associated with easyjson.
Monitoring : Establish rigorous monitoring of easyjson updates and associated advisories regarding any security vulnerabilities.
*
Source: Hunted Labs
*
Cyber Armageddon: When Legal Aid Needs Aid - Badly
_Who knew that spreadsheets could be so scandalous?_
What You Need to Know
The UK Legal Aid Agency recently fell victim to a cybersecurity incident, igniting serious concerns over the security of sensitive and confidential information held by government bodies. The breach potentially exposed personal data, although the full impact is still under investigation. Boards and executive management teams should focus on understanding how such breaches could affect their organization’s reputation and compliance obligations. They must ensure their cybersecurity protocols are airtight and encourage collaboration with cybersecurity experts to mitigate possible damages.
CISO focus: Data Breach Management and Incident Response
Sentiment: Strong Negative
Time to Impact: Immediate
*
A Legal Tour de Force: UK Legal Aid Agency's Cyber Blunder
In a worrying sign of the times, the UK Legal Aid Agency has become the latest prey in a string of alarming cybersecurity incidents. Just when you thought government agencies were battening down the cyber hatches — boom, another breach.
The Gargantuan Oversight
The breach has left personal data dangling as if on a digital clothesline for the cyber criminals to snatch. While the specific types of data exposed have not been fully disclosed, such breaches often risk personal, financial, and legal information spiraling into the wrong hands. Speculation is ripe, but facts remain scant as investigations by UK authorities continue.
Governmental Response, or Lack Thereof?
The UK Legal Aid Agency has now initiated an investigation with some urgency. This episode stresses the quintessential need for rapid response plans, which, in this case, might be more about rescue than prevention. As is often the grim reality with these incidents, the question isn't merely about understanding what went wrong, but cataloging the layers of what absolutely should have been in place to stop it.
Unpacking the Details
Let's unbox the implications:
Immediate concern revolves around the integrity and confidentiality of the sensitive data involved.
There’s a looming threat to the public trust, a vital currency for any governmental agency.
The UK's public sector faces stern recruitment challenges in the global cybersecurity talent war, a crucial area of improvement.
There's a cascading effect of compliance repercussions, especially under a regime like the UK's Data Protection Act 2018.
The Cultural Meme: Reactive Over Proactive
If this incident sounds familiar, it’s because it adheres to a predictable, albeit frustrating, playbook. Government and private entities alike continue to act in reactionary rather than proactive measures, despite the precedent of data spills, hacks, and breaches. But why reactive? A diaspora of data, archaic systems, and possibly an underestimation of evolving cyber threats create a perfect storm.
And let's not forget the curious case of "software rot" — the slow degradation of software performance due to gradual neglect in updates or the Cinderella condition of maintenance. A briefing it may have been, but obviously, not a priority.
The Inevitable Wake-Up Call
Is this another shake-the-tree moment for governments worldwide? Surely! The debacle sets the tone for more robust defenses, urging an end to the age-old habit of treating cyber threats as “somebody else’s nightmare.” The agency claims to be working with cybersecurity experts; however, this acknowledgment comes post-factum, when realistically, these experts should be on the front lines, bridling crimes before they evolve from potential threats to realized crises.
What remains apparent is the critical need for incorporating cybersecurity education at every tier of government and deploying staunch encryption and safeguard methodologies.
The Bitter Irony
Perhaps the greatest irony is that the UK Legal Aid Agency, an institution trained and employed to deal with legal and sensitive matters, is dealing with a predicament so foundational — akin to a seasoned chef burning toast.
While this satire couldn't be more glaring, the reverberating concern, i.e., the safeguarding of sensitive information, stands as the subject of frantic dialogues around governmental boardrooms.
*
Vendor Diligence
1. What data encryption and protection measures do you actively use to prevent unauthorized access?
2. How frequently do you conduct penetration testing, and what recent mitigations have you implemented?
3. Can you provide a detailed account of how your incident response plan is structured?
Action Plan
1. Immediate Forensic Investigation: Conduct forensic analysis to understand the breach's entry point and scope.
2. Enhanced Data Encryption Measures: Deploy top-tier encryption technology to protect all sensitive data moving forward.
3. Incident Response Drill: Strengthen and test your cyber incident response plan with a comprehensive simulation.
4. Public Communication Strategy: Develop a transparent communication plan to update stakeholders and restore public trust.
5. Cybersecurity Training: Initiate mandatory cybersecurity training for all employees, with a focus on recognizing digital threats.
*
Source: UK Legal Aid Agency investigates cybersecurity incident
*
The Perils of Aged Grace: A 160-Year-Old Firm Upended by Ransomware
_Even Methuselah's firewalls need updating._
What You Need to Know
In a cautionary tale torn from the headlines, a 160-year-old firm has entered administration after a crippling ransomware attack. Executives need to understand the profound implications of advanced persistent threats on legacy systems and prioritize cybersecurity enhancements. Immediate risk assessments and audits of current defenses are critical.
CISO focus: Ransomware Preparedness
Sentiment: Strong Negative
Time to Impact: Immediate
*
The Shocking Case of Ransomware Devastation
In a stark illustration of digital vulnerability, a venerable institution celebrating its century-and-a-half legacy has succumbed to the increasingly frequent specter of ransomware. The venerable company, which has operated successfully for 160 years, is now facing administration after a devastating ransomware attack stretched its defenses too thin.
Apparent Vulnerabilities
Legacy Systems Under Siege: The antiquity and traditionalism that served as the bedrock of this company now likely became its Achilles' heel. With systems that may have been conserved rather than systematically updated, vulnerabilities presented an inviting entry-point for cybercriminals.
Human Error and Phishing Susceptibility: While technology may be the battleground, human behaviors continue to provide inadvertent support to cyber intruders. Recent studies indicate an increase in successful phishing attempts, highlighting the need for robust employee training programs (Verizon 2023 Data Breach Investigations Report).
Piper Paid in Full
The attack culminated in an expensive showdown, as is typical in ransomware incidents. When ransomware hits, companies are faced with the unpalatable choice of either paying a ransom or facing the collapse of their operating capabilities. In this instance, the ransom note forecasted not just monetary loss, but also reputational damage, stakeholder consternation, and eventual cessation of operations.
The Ripple Effects
The domino effect of such an attack transcends mere financial reports. From pause on employment to shaking industry confidence and disrupting client dependencies, the implications reverberate widely. This serves as a wake-up call to other established enterprises about the imperative of preemptive cybersecurity measures.
The State of Cyber Security
While technological defenses are critical, this incident underscored the importance of modern integrated security measures. According to a Gartner report, 70% of organizations will diversify their security investments across unified security solutions by 2025. The necessity for a multidimensional security approach has never been more pertinent.
The Aforementioned Inevitable
The road paved from this incident indicates a redirection towards updated cybersecurity practices and the crucial deployment of mature incident response plans. For businesses to persevere in today's digital-laden architecture, understanding the immediate importance of protecting your data is not just a technological step but a strategic mandate.
The startling occurrence with this aged enterprise serves as a modern parable. While the limbs may weaken over time, being fortified with the right protection and provisioning can wade off adversaries lurking in the shadows. In today's world of disruptive innovation, surely, it's better to be the one threatening the blade rather than being threatened by it.
*
Vendor Diligence
What measures do vendors currently use to protect against ransomware, and how are these solutions updated?
Can vendors provide case studies or reports indicating the success rate of their anti-ransomware solutions?
How does the vendor assure ongoing education and training for its clients regarding the latest cyber threat trends?
Action Plan
1. Conduct a Full Security Audit : Engage third-party specialists to examine current cybersecurity measures, focusing on identifying legacy system vulnerabilities.
2. Upgrade Legacy Systems : Transition critical operations from legacy systems to more secure and up-to-date platforms.
3. Enhance Employee Training : Develop comprehensive training programs that focus on recognizing and mitigating phishing attempts and other social engineering threats.
4. Implement Multi-layered Security Solutions : Invest in up-to-date ransomware protection and deploy a unified security strategy across all departments.
5. Establish an Incident Response Team : Develop and maintain an agile incident response plan underpinned by an internal cross-functional team equipped to address future ransomware threats.
*
Source: IT warning after 160-year-old firm goes into administration following a ransomware attack
*
Smishing on a Massive Scale: Enter the "Panda Shop" Chinese Carding Syndicate
_When the panda gets its paws on your data, bamboo isn't the only thing getting crunched._
What You Need to Know
The "Panda Shop" cybercriminal syndicate, dubbed the Smishing Triad, is aggressively targeting consumers worldwide using advanced smishing tactics. This daring syndicate, originating from China, has evolved its strategies, making them a more formidable threat. Executives must prioritize reinforcing cybersecurity protocols and communicating these risks to stakeholders.
CISO focus: Cybercrime Prevention
Sentiment: Strong Negative
Time to Impact: Immediate
*
Smishing Triad: A Global Threat with Local Consequences
In a bold new chapter of cybercrime, the Smishing Triad, operating under the guise of the "Panda Shop," is making headlines for its relentless assault on consumers through smishing—SMS phishing that tricks recipients into divulging personal information. This discovered network has escalated its operations, targeting millions globally, posing a substantial threat to personal data security and corporate networks alike.
Triad's Reach and Methodology
Operating with blatant disregard for U.S. and international law enforcement, the syndicate has so far avoided major deterrents, emboldening its operations. Communication intercepts reveal a chilling capability — a single operator can dispatch up to 2,000,000 smishing messages daily. This statistic underscores a grim reality: the Triad can potentially target 60,000,000 victims per month.
* The Smishing Kit: The group offers a robust 'Crime-as-a-Service' platform. This kit enables other threat actors to seamlessly launch attacks, thereby amplifying the scale at which these cybercrimes unfold.
* Technological Evolution: Initially identified in August 2023, the Triad has since refined its techniques. Using an elaborate infrastructure, they efficiently gather personal data to fuel extensive unauthorized financial operations.
Tactics, Techniques, and Procedures (TTPs)
From exploiting device vulnerabilities to manipulating unsuspecting users, the Smishing Triad’s TTPs are both aggressive and stealthy. Their approach involves establishing a faux sense of urgency in their messages, prompting immediate action from recipients — typically leading to compromised sensitive data.
* Sophisticated Social Engineering: Capitalizing on psychological triggers, victims are led through convincing scenarios urging them to click on malicious links.
* Geographic Agnosticism: While based in China, their operations transcend borders, a testament to the pervasive nature of modern cyber threats.
Implications for Business and Consumers
The implications of the Triad's activities are manifold. Due to its large-scale, indiscriminate approach, businesses worldwide face increased risks of data breaches, resulting in both financial losses and reputational damage. On a consumer level, individuals targeted can experience personal data theft, financial fraud, and emotional distress.
* Consumer Vigilance: Public awareness campaigns are crucial. Consumers must be educated to recognize and report suspicious communications.
* Organizational Responsibility: Companies must bolster their defenses. An emphasis on multi-factor authentication (MFA), constant monitoring, and employee training will aid in minimizing exposure.
Cracking the Cybercrime Code: The Way Forward
Combating the Smishing Triad necessitates a multi-pronged strategy coupling technology, policy, and international cooperation. As defenses strengthen against traditional threats, adaptability and vigilance must define cybersecurity protocols.
* Collaboration is Key: Cross-border cooperation among law enforcement agencies can thwart the extra-national nature of such syndicates. Information sharing and coordinated operations may diminish their operational bandwidth.
* Technological Countermeasures: Investment in machine learning and AI can preemptively identify and mitigate potential smishing attacks.
*
Vendor Diligence Questions
1. How does your technology address SMS phishing detection and prevention within our existing infrastructure?
2. Can you provide examples of past incidents where your service successfully neutralized smishing attempts?
3. What innovations are your company implementing to stay ahead of evolving smishing tactics?
Action Plan
Immediate Review: Conduct an audit of current smishing defenses and identify vulnerabilities.
Training Sessions: Organize workshops for employees focusing on the recognition of smishing attempts and appropriate responses.
Incident Protocol: Develop a robust incident response plan tailored to rapid containment and recovery post-smishing attack.
*
Source: Resecurity
*
In the realm of digital security, staying ahead of the cybercrime curve isn't just smart—it's essential. Be the one munching on data through insightful awareness, not the one crunched by a Panda.
*
Researched Sources:
Resecurity Blog on "Panda Shop" Chinese Carding Syndicate
Smishing Tactics: An In-Depth Analysis, Cybersecurity Journal
Global Cybercrime Trends Report 2023, Digital Shield Alliance
*
_CISO Intelligence is lovingly curated from open source intelligence newsfeeds and is aimed at helping cybersecurity professionals be better, no matter what their stage in their career._
_We’re a small startup, and your subscription and recommendation to others is really important to us._
*Thank you so much for your support!(