Coruna & DarkSword: What Happens When Nation-State Malware Goes Rogue

Great. Well, I think we will we’ll start today’s session, and people will continue to join, which is great. So firstly, I’d like to thank everybody for joining us here today. I think we’ve got a really impactful and informative webinar planned here for everybody. So welcome to our webinar today on Kuruna and DarkSword. A couple of housekeeping elements to cover up before we get started. So today’s session is gonna run for about forty five minutes. It will be recorded for those that who want to refer back to it, share it internally, or for those, of course, that can’t make it. We encourage questions throughout the sessions. Please just fill up the chat box with the the chat section with any questions that you might have. We will have a section at the end for q and a. Any questions that we don’t get to, we will aim to come back and respond to you after the session to make sure that everything’s covered off. And yeah. So we’re looking forward to a really good and impactful session. So it’s gonna be split into hours. Firstly, we’re gonna have Colm bring us through a bit of information regarding corona Corona and DarkSword. And at the end, then we’re gonna run a q and a. So with that, I would like to hand over to Colm to kick off the session. Thanks a lot, Matt. That’s that’s great. Delighted to be here today. Delighted to have so many people joining us. It’s a very interesting point in the evolution of mobile spyware with the emergence of these two recent exploit kits, Corona and DarkSword. And I think, you know, as the title of the webinar, makes very clear, we have a a major shift in the risk profile really facing enterprises as a result of the emergence of these, exploit kits and the way in which they have moved from the hands of the nation state, affiliated actors into those of cybercriminals. So what I’m going to do today is, firstly, I’m going to talk a little bit about, you know, where we were before, the I suppose the nature of the thrash before the emergence of Kuruna and DarkSword, then tell you give you some specifics about Kuruna and DarkSword, hopefully, everything you need to know about those. Look, then talk about the response from Apple, and finally, talk about what it is you as enterprise, security, professionals should be doing within your organizations to ensure that your, your enterprise is protected against this, this this new frankly, new threat, I think, is the is the only way we can describe it. So, you know, the the we’ve, as you can imagine, at Carata, as a mobile threat defense vendor, we’ve been engaged with the spyware threat really since it’s emerged in twenty sixteen. And the the nature of that threat, prior we prior to, to to now, prior to the emergence of Kuruna and DarkSword, really has had, the following sort of four characteristics. Firstly, it has been based on using, exploiting zero day vulnerabilities in iOS. Now these zero day vulnerabilities are quite rare. As a result, they’re very expensive and really have only been in the, I suppose, the price range, to put it that way, of a highly motivated actors, very well resourced actors. And those actors have been primarily governments, both the, I suppose, the traditionally strong, defensive cyber espionage players like the US, like the UK, the Five Eyes consortium, but also the people like the the North Koreans, the Iranians, the Russians, etcetera. So, you know, they have been they are the people who have the resources to pay for these kind of things, develop them themselves, develop the resources to them. And then they have been joined, I suppose, by the commercial surveillance vendors. The key the key thing and these are people who get, I suppose, an awful lot of a lot of coverage, a lot of press, people like the NSO group with Pegasus, the and their and Predator, for instance, from other groups. So the these have you know, we we hear a lot about these guys. And and what they essentially have done is they’ve made the, the kind of tech that was traditionally only only in the hands of the the global superpowers in a way. They’ve made it available to to other governments. So we see it we see it being used right across in in a number of countries in Europe. We see it being used in the Middle East. We see it being used in Asia as well by a range of governments. The it has been then targeted essentially at very high value targets or or or rather targets that are considered very high value by the, by the the nation state, the the the the sponsor, I suppose, of the, spyware the spying. So, you know, we’ve seen it being used. The the most high profile examples, the one we tend to hear about and read about, are the ones against, political dissidents, in excuse me, political distance in, authoritarian regimes or certainly governments that are inclined to, use this kind of spyware against against their political opponents. We also are aware that it is being used against senior officials, senior politicians, government officials, senior politicians for for the for espionage purposes as well by the the global superpowers. And as part of, obviously as part of, I guess, the the modus operandi of this whole system, the delivery of these these exploits or these attacks was highly targeted. So hyper targeted actually is is a better way of thinking about it. Because, you know, if you are spending a large amount of money with the NSO group for Pegasus, you are going to identify a small number of people that you want to target. And part of that is you don’t want to be discovered. So you don’t want to have a the exploit sitting there out on the web where it could be discovered by by by cybersecurity defense companies. This is really what we we we we faced up until twenty twenty six, I guess. And the the key thing about that is that, you know, we’ve been following this market for for a long time, and it has been speculated for many years, that it would leak beyond that or that it might be used beyond this very, very narrow, target group. But, frankly, we had seen little and no evidence that that had happened. And so we were, you know, somewhat skeptical in hyping up this trash, to our to our customers, and to our prospects. So we tended to say, look, this is something that is of interest and of concern, but it’s not a mainstream cyber risk. That really has changed. And the discovery of, the disclosure of the corona and the dark sword exploit kits really changes the game here because what we’ve finally seen is clear evidence that the sophisticated spyware and exploit kits that were previously only available to, for a large price, frankly, to, to to governments effectively have now leaked into the cyber criminal, ecosystem. So we look firstly at, at the corona, the corona attack or threat. The first thing to to to note about this really is that it doesn’t it doesn’t use zero day vulnerabilities. It essentially targets vulnerabilities that we know about that have already been patched but haven’t been patched on earlier versions of the iPhone. So as long as you are running the latest version of the iPhone, off-site iPhone software or certainly a a recent version of iPhone software of iPhone software, iOS software, you weren’t, exposed. You could not be exposed to this particular this particular threat. So and, what’s interesting about that, of course, is that these are exploits or vulnerabilities which no longer have high value to the people who originally paid for them or developed them. Because the high value zero days are typically only gonna be used against the the hyper in the hyper targeted attacks that were characteristic of the earlier stage, this development. In this, the key thing here is the way in which this has leaked into the, the criminal cybersecurity ecosystem. So it went through it has gone from and originally, as we understand there is are the the the the on the belief is that it was originally developed by a nation state on behalf of a a nation state after the US. We believe the n the the NSA, by a contractor, and then was leaked by a an individual contractor into leaked was sold by that contractor to another nation state, we believe, Russia. And then in turn, for whatever reason, the Russians then passed it on to a a a Chinese criminal, group who for who then used it to target, cryptocurrency wallets. Again, an interesting thing about this, and we’ll see it also in DarkSword, is that the actual exploit was resident on a publicly accessible web page. So it wasn’t one of these zero click attacks that we’ve seen particularly used over WhatsApp or iMessage. It is something that was out there on the web. And, frankly, while there was a degree of targeting in terms of the delivery of the messages or targeting particular people to get them to that website, that website was was openly accessible to to anyone. Similar similar situation with DarkSword. Again again, not there were there was a one zero day vulnerability used in this, but really the the core of what was going on here was the use of existing vulnerabilities on operate against devices which hadn’t been, which hadn’t been patched. The I suppose the the the the journey of this particular piece of software into the, into the ecosystem is a little bit more convoluted, and we’ll go through that in in a moment. It’s important to understand that these these exploits these exploit kits, they’re highly sophisticated. They’re extremely expensive to develop, and they’re not something that your typical cyber criminal enterprise would be in a position to develop. Really, they have got it is it is because these exploit kits have been leaked out of the, the nation state world, I guess, that we see that that that is that’s what’s the new development. The other thing to note is that they in both cases, they highly compromise the device. Essentially, nothing is off limits. They were used specifically for crypto crypto theft, but they weren’t their capability was went well beyond that. They could get at your mic, at your photos, at your screen, and they could pick they could look at the details of WhatsApp messages. Essentially, everything that you have on your device would be accessible if you were compromised, by either of these attacks. So this timeline, is re I think it’s really interesting because, it explains the journey of the, the software, the exploit kit from the, the nation state. It’s sort of it’s gone through the species barrier nearly and crossed over from one species of actor into another species of actor. And you can see here with corona, you know, firstly, it’s being used by a commercial surveillance vendors customer, then it goes on to the, again, a suspected Russian, operative. Then we finally see it going to the Chinese criminal before it is, disclosed publicly by Google Threat Intelligence Group. Similar a similar a similar journey, actually, when we look at DarkSword. Again, initially, it is used by what in what looks like a nation state sponsored attack against dissidents within by the with against Saudi Saudi users’ case, likely to be dissidents or a street a ski sorry, or opponents of the the government. It’s then, it then falls into the hands of, powers defense who are a Russian commercial surveillance vendor, and it’s used against targets in Turkey and Malaysia. And then we see Russian reuse again against Ukrainian targets before it is before it is disclosed by by Google. The interesting thing one of the one of the the lots of questions sort of merge when you’re looking at this sort of stuff, but one of the things that’s most interesting is how how did how did Google find these these attacks? They have not they never they haven’t disclosed how they how they came across them. There are kind of two broad theories out there in terms of how this came about. The first is that they were given a tip-off potentially by the look by authorities. That authorities were aware that software that they had themselves developed have now gotten into the hands of bad actors, and they wanted this brought to the attention of the cyber intel the cyber community. A second theory is that they they discover these just through routine surveillance of the web. I think, as I mentioned earlier, you know, one of the key characteristics of, these attacks is that they are hosted on publicly accessible websites. And as we know, Google of all of all organizations on the planet is an expert at at at scanning the web. And, you know, with the right with the right tooling, I guess, and with the right indicators of compromise, they Google would would be in a position to uncover, these, exploit kits, the software running on these, on on websites. So, again, two two, two theories as to how they went about this. We would tend to believe it’s it’s as it’s as likely to be the second where Google are just stumbling across it as it is to be something where they’re getting a tip-off. But, again, very, very unclear as to which which of those it is. So we’ve covered this a little bit already. I mean, there’s a very strong cases being made that a, an Australian a contractor working for a US a a US government or sorry, US, company that provides services to the NSO. He was an Australian. He was part of a company that was acquired by that company. There is a strong suspicion that and he has been convicted of having, of having, revealed state secrets. And it is likely that we think that the that the exploit kit has was leaked. That it part as part of his leak, the this this is where the exploit kit came from. Now the again, he did it purely for financial reasons. He made, I believe, over a million dollars by selling this software to a a to to Russian actors, we believe. And and but this I suppose, what this tells us is as the ecosystem of a commercial spyware, whether it’s third party contractors working for a government or, commercial spyware vendors themselves, as it has expanded and there’s no question, but that has expanded since kind of when we first learned about it in twenty sixteen with the NSO and the Pegasus attacks. Since then, it has expanded, and and these kind of it’s clear it’s much more difficult, for the authorities to keep, this harmful software under control in in those circumstances. Again, you know, the once it gets out into and then there are, you know, there are certainly nation state actors who, once they have made use of, the exploit kits and where it’s null against those these for these highly targeted attacks, for state sponsored activity, there are appear to be some states who are then willing to offload, as it were, this secondhand case to the criminal underworld. So that appears to be the and, of course, we know that in in some, states that there is a strong connection between the criminal underworld, of cyber and the the the the national security and espionage arms of those governments. So if we look at how these the the specific attacks worked, one, we had a lure to SMS or WhatsApp to a URL. We then had a web kiss exploit. So really literally visiting the web page would cause your phone to be infected. Once infected, we have privilege escalation and the installation of of the spyware. So, you know, pretty straightforward. I think what’s most worrying about all of this from a information security practitioner’s perspective is there is no visible sign on the phone that something has got has happened. So an end user, one of your employees, if they ended up visiting one of these sites, there’d be no obvious evidence to the employer to you as a as a, an information security practitioner that something had happened. Now we’ll talk a little bit later about how it’s important to monitor what’s happening on your phones on an ongoing basis in order to be in a position to identify when an exploit like this has occurred. So what did Apple do? So, I mean, I think there were there were two stages to Apple’s response. I mean, the first, obviously, a a pretty obvious response was to immediately address the, the new zero days. But those initial, the initial updates were only to devices which were in life essentially. So they were to those who could be upgraded to twenty six point three. The subsequently so that, of course, that was fine. You know, initially, the attack and I remember when we when we spoke about this internally, you know, we’re very aware that in the enterprise space, in corporate owned devices, most devices but there’s a very high degree of, of compliance in terms of patch compliance. And and also the phones are generally relatively new. So they’re four or five year you know, the oldest tends to be in the four to five year range. However, the bigger risk here is really around BYOD, where the you can find far, far older phones being used by employees, and you also, there is a lower level of patch compliance. And for that reason, it was really good to see that Apple issued a follow-up follow on update for older devices right back to the iPhone eight. That’s really really important because as said, the the press, the risk is on older devices fundamentally, and being and Apple having extended the fixes to these older devices was really important. But there was a there was a delay. And you you can’t expect that Apple will respond as quickly all the time, for those older devices because, obviously, part of their business model is to persuade people to move to newer devices at all times. The if you were Apple has some telemetry, in terms of the ability to identify if devices have been, compromised. They’re it’s very, opaque as to exactly how they do this. It is based on the it’s based on what they can there’s some telemetry they pick up on the operating system, particularly around iMessage, for example, and seeing unusual patterns in that telemetry. In that case, they did, notify four thousand three hundred individuals across a wide range of countries, and they did those notifications through your Apple ID email and iMessage. But, you know, all of these all all that does is let you know that they think you’ve been affected. It certainly is not something that an enterprise cybersecurity team could rely on as a way of protecting their enterprise. So, essentially, you know, you’re getting you’re relying on pretty opaque telemetry from Apple, and you do do not know about how timely this telemetry is because it’s likely that it’s only after they see a certain level of misbehavior as it were in the data that they’re collecting that they’re going to actually issue notifications. So, you know, what does this mean for your organization? Now, you know, on the corporate owned devices side, you know, it’s we think the the risk is is is lower, typically because the devices are newer and are typically well up to date. That’s what the being newer is probably the important point here because they are upgradeable. And we know that there’s a pretty high degree of compliance around upgrades. The other good thing is that you you as a corporates are in a position to enforce policies. You you may not be in a position to actually upgrade the device to the latest version, but you can have conditional access policies, which mean that employees with unpatched devices can’t access your your your systems. I guess the the the the takeaway from this is really that is you know, that just has to become a baseline here. We know from dealing with customers that there’s obviously a relooked you don’t like locking people out of access to to their business applications because that clearly interferes with people’s productivity. But clearly, what we’ve seen here with with Corona and DarkSword means that that becomes more important. There’s a stronger case now for being, I suppose, bit more rigid in the way in which you enforce the the the patching of of iOS devices. Devices. The again, a good another another element that corporate devices have typically is that you can use quarantine, to auto isolate non compliant devices. And that again means that you encourage people effectively. You say, unless you upgrade, you’re not gonna be able to access your your corporate applications or any of the business applications. The I suppose the harder side of things is the BYOD. I’d rather the more the higher risk is BYOD. I mean, the the management of the risk is probably similar similar. You you sit again. You you want to say to employees that if they, want access their corporate resources, they really do need, they do need to have an updated device. And, of course, that brings in the problem that that’s a cost for the employee if they’re using an old phone. The, again, having a the ability to, getting, employees to buy into running security software on the device. We’ve certainly done that with lots of our customers even in the BYOD use case. That again is very a very good, a very strong mitigation that you can use. So where where is this going? Right? So I suppose there is definitely a heightened risk out there because of what we’ve seen here. It does, as I said earlier, mean that we need to classic cybersecurity hygiene, we need to be, enforcing patching and using conditional access in order to do that. There you know, a very recent even in the last week, we’ve seen, many of you will have been following the, flawed mythos story from Anthropic where they have, their latest, LLM. The latest model has been run against a a huge amount of open source software, has uncovered large numbers of vulnerabilities, in that software, but probably more more worryingly or more significantly has also shown that Midas has the capability to develop highly sophisticated highly sophisticated exploit kits to go to exploit those vulnerabilities. That’s a very significant development, we think. It means that the risk, again I suppose the the the speed at which vulnerabilities will be, subject to exploitation has has increased significantly. So, you know, you take that together with what we’ve seen, in relation to Corona and and DarkSword, and the the the risk level has certainly has been elevated by that development, notwithstanding the fact that well, we can anticipate that that kind of very powerful technology is going to be misused in the future. We’ve talked about patching. Obviously, web filtering on your mobile is really one zero one. Frankly, it’s it’s still surprises us how many companies don’t do that. But, you know, one way to avoid this problem is to make sure that your employees are not going to dodgy websites, frankly. So that’s your that is just one zero one, cybersecurity practice. Again, surprising how many companies, don’t today enforce that. It’s it has traditionally was regarded as difficult on mobile. There are good solutions. Obviously, Crowd is one of them that you can do that can address that today. And, you know, the other side of it, if, you know, the you can’t assume that even with good web filtering, you can’t assume that there won’t be a breach as it were that your phone won’t get infected. But knowing what’s the the one way the one kind of reliable way to be able to know if an iPhone or any phone has been infected with malware is to be able to monitor the, the network traffic to see, communications with command and control servers. So that’s, that’s kind of a quick run through. I hope people found that helpful, but we’re delighted now to to take some, take some questions. Yeah. Thank you so much for that, Colm. A really comprehensive, overview there with a huge amount covered. So just to remind everybody that today’s deck and recording will be, included as part of the follow-up. So, yeah, a lot to take in there. I think, hopefully, some of the questions now that we’re gonna take and that we’ve received will help bring a lot of it into life. Just for as a reminder, we are joined by Matthew, our CTO, part of this session as well. He’s gonna help answer some of these questions. So let’s jump into it and see what has come in. Perfect. So the first one I can see here, so you mentioned that sorry. You mentioned that DarkSword is written in JavaScript and that this makes it easier to work with. Can you explain the can you explain why this is? Matt, we might go to you for this one first. Yeah. Sure. So, traditionally, those those exploits would be written in in c or or c plus plus Swift on iOS. Those languages tend to be to be harder to work with and and therefore would require specialists. JavaScript is a much easier language, which is which is much more widespread. That’s what every single web app you use is is using. And, therefore, that makes it much more accessible to to to general developer developers. And so that, of course, increases the risk that someone will use that that exploit kit that’s been released to to roll out their own. Okay. Great. Thanks so much for that. Colm, do you have anything to add on top of that? Yeah. I mean, I think it’s it’s it’s a really important point. It really speaks to the whole democratization of this sophisticated spyware. Great. Okay. Thank you so much for that. Moving on to the next one. Do we know how these attacks were detected? Again, Matthew will come to you first. Yeah. Well, the Tom mentioned earlier that there’s considerable uncertainty about just exactly how they were detected. We do know that Apple is is running telemetry on the devices, and that allows them to to detect unusual behavior. We also know that the likes of Google Mandiant and so on score score the the web for for questionable sites. Okay? They have considerable intelligence through telemetry. Their browsers, for instance, okay, they get notifications of newly reached domains, and they can they can see where the network traffic is going on on their devices. But the the details ask count. Great. Thanks so much. And, again, Colin, would you like to add anything to that as a response? Yeah. I mean, it it is it is a very important question. And because it it speaks to the to the whole issue of how how how soon would we know if this was going on. It would be reassuring if it if we knew it was because Google and other other large technology companies were scouring the web generally or or as Matt and Matthew pointed out, capturing telemetry from their, you know, wide from their browsers because, you know, they’re in such wide use. It kinda be reassuring if that’s how it was found because it would tell us that, you know, there’s there’s there are people out there who are watching our back on this. Less it’ll be I’d be less reassure I mean, if I discovered that they’ve gotten the tip-off from the NSA, I would be less I’d be much less reassured because then clearly the NSA can use their discretion as to whether it suits them to release that that information to to into the public domain effectively. And to to add a bit to that on the on on the on the positive side, of course, by running software such as ours or some of the competitors, of course, you do implicitly get some of that network protection. Right? This this this intelligence that is made available to to the big actors is, to a certain extent, available to you by running the appropriate software on your devices. Yeah. And you’re welcome. Thanks for that, Matthew. So these attacks are all about iOS. What is your assessment of the threat against Android devices? Again, Matthew, start on your side. Yeah. So so what we know, and that’s been true for five to five in excess of five years. Think first time I heard it was eight years ago, is that the price of a zero day is to save on iOS and on Android. Right? Okay. So that’s that’s that’s reality. On Android, however, the situation is quite different for two reasons. The first one is that on the low end side of things, I Android has a vulnerability, if you want to call it that, that doesn’t exist on the US, which is the accessibility API. So it makes it makes it rather easy for unsophisticated actors to target the the low end of of the the the the targets. And indeed, that’s what we that’s what we’re seeing. Most most most malware on iOS oh, sorry, on Android will be using those accessibility APIs. And on the on the high value targets, well, the reality is that a lot of them are using AOS. And that gives a lower incentive to sophisticated actors to target, to target higher you target on Android. Right? Which brings us to to the the the the third point, which is that and that’s why all this came to came as a shock, which is that a lot of high value targets in the past, I’ve been using iOS, and I’ve felt safe and secure simply by virtue of running iOS. And and now, suddenly, it’s not true anymore. And they realized that they were vulnerable because now okay. So it’s it’s been patched, and it’s attacking, old version of iOS. They’re not vulnerable anymore. But at some point in the past, they were. K. Thanks for that, Matthew. Colin, would you like to add anything to that before we move on? No. No. That’s that’s really good. Spot on. I’ll go reach out there. Great. Great. Okay. So malware detection on iOS is notoriously difficult to do. How do you detect the reuse of Corona and DarkSword by other actors when the initially published IOCs are no longer relevant to the detection? Yeah. I I I’ll give an kind of an initial response on that and Yeah. Then maybe Matthew might come in on it. It’s a great question. And I think the short answer is with great with with reasonable difficulty. Now our approach and we think our approach is pretty robust as we think we we we would we don’t see anything better out there, frankly, or even equivalent. And our approach is through careful monitoring of the metadata associated with network all network connections. So we know for our analysis of attacks in the past that are certain this was traffic patterns. And for example, the the the using high port numbers, you know, very rarely used ports are in fact port numbers that we don’t see used at all. For communicating with the CNC server, we we often see we look at those kind of anomalous patterns that give you a clue that there may be something there. And now that is essentially, that generates a suspicion. Now that’s not based on the documented IOCs. That’s based on a set of heuristics, which we have, which would set tell us that, look, you combine a never before seen domain or never before seen an IP address that is in a is not in the kind of range of IP addresses we typically see on this device. You combine that with a number of other indicators. There’s a potential here that you have an infection. Then at that point, you know, it the the the job is to collect the forensic evidence from the file. Now we have, you know, remote tooling in our app that allows you generate diagnostic files on the iOS device, do a packet capture on the traffic for further investigation. So, you know, our recommendation or or sorry. Our instant response approach here is suspicion that there’s some very highly questionable traffic coming from the device combined with then a subsequent you know, quarantining the device then and then collecting the forensic data, remotely initially to for further analysis and then potentially actually getting your hands physically on the device for a more in-depth, in-depth review. Thank you so much for that. Matthew, would you like to add anything for that response? Yeah. No. I mean, that’s that’s that’s fundamentally it. Mobile devices are inherently connected devices. Everything that’s happening to them is something most of it is something that’s happening through the network connection to the Internet. If you’re in a good place to look at what this this device is doing on on its per on its own perimeter, okay, then you’re in a great position to to detect or even outright blocks attacks as they are happening. Column mentioned ports, IP addresses, unencrypted traffic. It’s quite popular for malware to to use plain HTTP, unencrypted HTTP, and to roll out their own encrypt their own encryption. It avoids leaving traces by by inserts, this sort of thing. So if you just block HTTP traffic, well, then your device is going to work fine, but you just blocked an entire avenue of of traffic. Yeah. Okay. Thanks so much for that. I know we have one minute left, but there is a common question that’s being asked at the end. And just to see if we can touch on it really quickly, Colm, because spoke a few times. As you mentioned that BYOD piece being a problematic area, can you quickly elaborate on that for the for the audience? Yeah. It’s the eight it’s it’s literally so new devices, and we’re talking four four years and younger, I guess, are inevitably are able to be patched right up to the the current level. And The older and and tend to be patched up to the up to the the the the newest version. Older devices, you know, eventually fall out of support. And therefore, there’s an inherently much more exposed to particularly to software which exploits known or sorry, already dislo known vulnerabilities already disclosed vulnerabilities. So, you know, if you think about it, if you’re the if you’re a criminal actor, you you now have a list of vulnerabilities that are, say, on iOS seventeen. You have a list of these which are unpatched on iOS seventeen, let’s say, for argument’s sake. And then you take an l l a tool like an LLM, and you ask it to go and write a sophisticated exploit against those vulnerabilities. That’s a much lower barrier to to to creating an attack than what we’ve seen previously. And and it is the BYOD that’s likely to be most as I said, it’s because of the age of the devices. People, they’re paying for themselves. They keep them for as long as they can, frankly, in most cases. Great. Thank you so much. I think with that then, we will we’ll wrap up. We’re a minute over. Again, we’d like to thank everybody for attending today’s webinar. As a third reminder, you will have the deck and the recording in your inbox as part of the follow-up. If any questions come up post, please don’t hesitate to reach out. We’ll be happy to align and to answer any further further questions off this webinar. So thank you all very much. Have a great day, and we will see you next time.