Jan 08, 2025The Hacker NewsMalware Analysis / Threat Intelligence2024 had its fair share of high-profile cyber attacks, with companies as big as Dell and TicketMaster falling victim to data breaches and other infrastructure compromises. In 2025, this trend will continue. So, to be prepared for any kind of malware attack, every organization needs to know its cyber enemy in advance. Here are 5 common malware families that you can start preparing to counter right now.LummaLumma is a widely available malware designed to steal sensitive information. It has been openly sold on the Dark Web since 2022. This malware can effectively collect and exfiltrate data from targeted applications, including login credentials, financial information, and personal details.Lumma is regularly updated to enhance its capabilities. It can log detailed information from compromised systems, such as browsing history and cryptocurrency wallet data. It can be used to install other malicious software on infected devices. In 2024, Lumma was distributed through various methods, including fake CAPTCHA pages, torrents, and targeted phishing emails.Analysis of a Lumma AttackProactive analysis of suspicious files and URLs within a sandbox environment can effectively help you prevent Lumma infection. Let's see how you can do it using ANY.RUN's cloud-based sandbox. It not only delivers definitive verdicts on malware and phishing along with actionable indicators but also allows real-time interaction with the threat and the system.Take a look at this analysis of a Lumma attack.ANY.RUN lets you manually open files and launch executablesIt starts with an archive which contains an executable. Once we launch the .exe file, the sandbox automatically logs all processes and network activities, showing Lumma's actions.Suricata IDS informs us about a malicious connection to Lumma's C2 serverIt connects to its command-and-control (C2) server. Malicious process responsible for stealing data from the systemNext, it begins to collect and exfiltrate data from the machine.You can use the IOCs extracted by the sandbox to enhance your detection systemsAfter finishing the analysis, we can export a report on this sample, featuring all the important indicators of compromise (IOCs) and TTPs that can be used to enrich defenses against possible Lumma attacks in your organization.Try all features of ANY.RUN's Interactive Sandbox for free with a 14-day trialXWormXWorm is a malicious program that gives cybercriminals remote control over infected computers. First appearing in July 2022, it can collect a wide range of sensitive information, including financial details, browsing history, saved passwords, and cryptocurrency wallet data. XWorm allows attackers to monitor victims' activities by tracking keystrokes, capturing webcam images, listening to audio input, scanning network connections, and viewing open windows. It can also access and manipulate the computer's clipboard, potentially stealing cryptocurrency wallet credentials. In 2024, XWorm was involved in many large-scale attacks, including ones that exploited CloudFlare tunnels and legitimate digital certificates.Analysis of a XWorm AttackPhishing emails are often the initial stage of XWorm attacksIn this attack, we can see the original phishing email, which features a link to a Google drive.A Google Drive page with a download link to a malicious archiveOnce we follow the link, we are offered to download an archive which is protected with a password.Opened malicious archive with a .vbs fileThe password can be found in the email. After entering it, we can access a .vbs script inside the .zip file. XWorm uses MSBuild.exe to persist on the systemAs soon as we launch the script, the sandbox instantly detects malicious activities, which eventually lead to the deployment of XWorm on the machine.AsyncRATAsyncRAT is another remote access trojan on the list. First seen in 2019, it was initially spread through spam emails, often exploiting the COVID-19 pandemic as a lure. Since then, the malware has gained popularity and been used in various cyber attacks.AsyncRAT has evolved over time to include a wide range of malicious capabilities. It can secretly record a victim's screen activity, log keystrokes, install additional malware, steal files, maintain a persistent presence on infected systems, disable security software, and launch attacks that overwhelm targeted websites.In 2024, AsyncRAT remained a significant threat, often disguised as pirated software. It was also one of the first malware families to be distributed as part of complex attacks involving scripts generated by AI.Analysis of an AsyncRAT AttackThe initial archive with an .exe fileIn this analysis session, we can see another archive with a malicious executable inside.A PowerShell process used for downloading a payloadDetonating the file kicks off the execution chain of XWorm, which involves the use of PowerShell scripts to fetch additional files needed to facilitate the infection.Once the analysis is finished, the sandbox displays the final verdict on the sample.RemcosRemcos is a malware that has been marketed by its creators as a legitimate remote access tool. Since its launch in 2019, it has been used in numerous attacks to perform a wide range of malicious activities, including stealing sensitive information, remotely controlling the system, recording keystrokes, capturing screen activity, etc.In 2024, campaigns to distribute Remcos used techniques like script-based attacks, which often start with a VBScript that launches a PowerShell script to deploy the malware, and exploited vulnerabilities like CVE-2017-11882 by leveraging malicious XML files.Analysis of a Remcos AttackPhishing email opened in ANY.RUN's Interactive SandboxIn this example, we are met with another phishing email that features a .zip attachment and a password for it.cmd process used during the infection chainThe final payload leverages Command Prompt and Windows system processes to load and execute Remcos.MITRE ATT&CK matrix provides a comprehensive view of the malware's techniquesThe ANY.RUN sandbox maps the entire chain of attack to the MITRE ATT&CK matrix for convenience. LockBitLockBit is a ransomware primarily targeting Windows devices. It is considered one of the biggest ransomware threats, accounting for a substantial portion of all Ransomware-as-a-Service (RaaS) attacks. The decentralized nature of the LockBit group has allowed it to compromise numerous high-profile organizations worldwide, including the UK's Royal Mail and India's National Aerospace Laboratories (in 2024).Law enforcement agencies have taken steps to combat the LockBit group, leading to the arrest of several developers and partners. Despite these efforts, the group continues to operate, with plans to release a new version, LockBit 4.0, in 2025.Analysis of a LockBit AttackLockBit ransomware launched in the safe environment of the ANY.RUN sandboxCheck out this sandbox session, showing how fast LockBit infects and encrypts files on a system.ANY.RUN's Interactive Sandbox lets you see static analysis of every modified file on the systemBy tracking file system changes, we can see it modified 300 files in less than a minute.Ransom note tells victims to contact attackersThe malware also drops a ransom note, detailing the instructions for getting the data back.Improve Your Proactive Security with ANY.RUN's Interactive SandboxAnalyzing cyber threats proactively instead of reacting to them once they become a problem for your organization is the best course of action any business can take. Simplify it with ANY.RUN's Interactive sandbox by examining all suspicious files and URLs inside a safe virtual environment that helps you identify malicious content with ease. With the ANY.RUN sandbox, your company can:Swiftly detect and confirm harmful files and links during scheduled checks.Investigate how malware operates on a deeper level to reveal its tactics and strategies.Respond to security incidents more effectively by collecting important threat insights through sandbox analysis.Try all features of ANY.RUN with a 14-day free trial.Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter and LinkedIn to read more exclusive content we post.SHARE

Jan 08, 2025Ravie LakshmananMalware / VulnerabilityA Mirai botnet variant has been found exploiting a newly disclosed security flaw impacting Four-Faith industrial routers since early November 2024 with the goal of conducting distributed denial-of-service (DDoS) attacks.The botnet maintains approximately 15,000 daily active IP addresses, with the infections primarily scattered across China, Iran, Russia, Turkey, and the United States.Exploiting an arsenal of over 20 known security vulnerabilities and weak Telnet credentials for initial access, the malware is known to have been active since February 2024. The botnet has been dubbed "gayfemboy" in reference to the offensive term present in the source code.QiAnXin XLab said it observed the malware leveraging a zero-day vulnerability in industrial routers manufactured by China-based Four-Faith to deliver the artifacts as early as November 9, 2024.The vulnerability in question is CVE-2024-12856 (CVSS score: 7.2), which refers to an operating system (OS) command injection bug affecting router models F3x24 and F3x36 by taking advantage of unchanged default credentials.Late last month, VulnCheck told The Hacker News that the vulnerability has been exploited in the wild to drop reverse shells and a Mirai-like payload on compromised devices.Some of the other security flaws exploited by the botnet to extend its reach and scale include CVE-2013-3307, CVE-2013-7471, CVE-2014-8361, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2020-25499, CVE-2020-9054, CVE-2021-35394, CVE-2023-26801, CVE-2024-8956, and CVE-2024-8957.Once launched, the malware attempts to hide malicious processes and implements a Mirai-based command format to scan for vulnerable devices, update itself, and launch DDoS attacks against targets of interest.DDoS attacks leveraging the botnet have targeted hundreds of different entities on a daily basis, with the activity scaling a new peak in October and November 2024. The attacks, while lasting between 10 and 30 seconds, generate traffic around 100 Gbps.The disclosure comes weeks after Juniper Networks warned that Session Smart Router (SSR) products with default passwords are being targeted by malicious actors to drop the Mirai botnet malware. Akamai has also revealed Mirai malware infections that weaponize a remote code execution flaw in DigiEver DVRs."DDoS has become one of the most common and destructive forms of cyber attacks," XLab researchers said. "Its attack modes are diverse, attack paths are highly concealed, and it can employ continuously evolving strategies and techniques to conduct precise strikes against various industries and systems, posing a significant threat to enterprises, government organizations, and individual users."The development also comes as threat actors are leveraging susceptible and misconfigured PHP servers (e.g., CVE-2024-4577) to deploy a cryptocurrency miner called PacketCrypt.Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.SHARE

Drew Firment, Chief Cloud Strategist, PluralsightJanuary 8, 20254 Min ReadPixabaySpurred by the rapid adoption of generative AI, cloud computings 20% year-over-year growth is driving its status as todays default operating model. However, the workforce skills gap has many organizations struggling to leverage the clouds full potential. While security and cost controls are key challenges to cloud adoption, the skills gap continues to vex enterprises seeking to maximize their investments in cloud computing, as more than 75% of organizations have abandoned projects due to skills gaps.Many companies hire new talent to address the cloud skills gap, which is only a temporary solution. To implement a sustainable transition to the cloud, leaders must adopt a long-term strategic approach to upskill existing employees with a comprehensive workforce development plan. Continuous learning programs can help companies close their cloud computing skills gap and evolve the workforce to stay ahead of technology. These programs should also include non-technical employees to ensure enterprise-wide cloud literacy.Impact of AI and the Cloud on Security, Compliance, and UpskillingAIs rapid evolution and influence on the cloud are game changers for businesses innovation and management of the complex security and compliance landscapes that come with this shift. Addressing these challenges through upskilling is vital to ensuring companies can navigate the new era of AI and cloud computing confidently and securely.Related:Companies can use AI to automate routine tasks, improve customer experiences through chatbots and recommendations, and analyze large datasets to derive actionable insights. AI also helps cloud environments to be more adaptive and self-optimizing, enabling them to scale based on real-time demand and usage patterns. This integration of AI and the cloud enhances efficiency and innovation but also creates new challenges related to security, compliance, and the need for specialized skills.AI can be a powerful tool to enhance cloud security through advanced threat detection and real-time risk analysis. However, using AI in cloud systems makes these environments more complex, creating more entry points for potential security threats. AI-driven systems that are not properly secured could become targets for malicious actors seeking to exploit vulnerabilities. For example, adversarial AI techniques in which data is manipulated to deceive AI models are an emerging threat to cloud security.To mitigate these risks, businesses need cloud security professionals with expertise in both cloud infrastructure and AI-driven tools. These professionals must know how to use AI to strengthen security measures while also being vigilant about the unique security challenges that AI introduces. Through continuous learning and targeted upskilling programs, organizations can equip their workforce with the knowledge needed to navigate these challenges and unlock the full potential of AI and the cloud.Related:Upskilling Teams, Optimizing Cloud Usage, and AlignmentAcross industries, the cloud is now table stakes, but its successful adoption requires more than just implementing a cloud infrastructure. It demands a holistic approach that optimizes cloud usage and aligns its strategies with business objectives. When done right, cloud computing allows teams to enhance agility and speed, drive innovation, and improve cross-team collaboration. To operationalize cloud computing effectively, businesses must focus on leadership and organizational alignment, cloud governance and security, and continuous upskilling of employees.Cloud adoption should be an integral part of the businesss overall strategy rather than an isolated IT initiative. Key considerations include creating a cloud-first mindset and culture across the organization, from leadership to front-line employees. By utilizing the cloud, organizations can pivot quickly based on market conditions and leverage data analytics and AI to make more informed, data-driven decisions.Related:Cloud computing is a highly specialized skill that requires a deep understanding of cloud platforms, security, DevOps practices, and data management. Training that includes AWS, Microsoft Azure, or Google Cloud certifications helps employees stay current on the latest cloud technologies and best practices. As cloud computing affects many aspects of a business, from IT and development teams to marketing and operations, a cross-functional collaboration ensures that cloud capabilities are utilized as effectively as possible across the enterprise.Fostering a Culture of Continuous LearningAs the cloud continues to evolve, the need for workforces with the skills to use it will intensify. To remain competitive, organizations must foster a culture in which employees are empowered to update their skills through a mix of formal training, hands-on experience, and knowledge sharing.Organizations that fail to address the skills gap risk falling behind in the race to leverage cloud technologies effectively. By investing in cloud training programs, certifications, and continuous learning, businesses can ensure they have the talent to innovate, scale, and secure their operations in the cloud.About the AuthorDrew FirmentChief Cloud Strategist, PluralsightDrew Firment works closely with business and technology leaders to accelerate cloud adoption by migrating talent to the cloud. Drew was previously Director of Cloud Engineering at Capital One where he led enterprise cloud operations within their Cloud Center of Excellence and migrated the early adopters of Amazon Web Services (AWS) into production. He founded Capital One's cloud engineering college that drove a large-scale talent transformation and earned a patent for measuring cloud adoption and maturity. Drew is recognized by Amazon as an AWS Community Hero for his ongoing efforts to build inclusive and sustainable learning communities.See more from Drew FirmentNever Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.SIGN-UPYou May Also LikeWebinarsMore WebinarsReportsMore Reports

Time zones: EST (UTC -5), CST (UTC -6), MST (UTC -7), PST (UTC -8), ART (UTC -3), UTC -4, UTC -4:30, UTC -3, UTC -2, SBT (UTC +11), GMT (UTC +0), CET (UTC +1), EET (UTC +2), MSK (UTC +3), AST (UTC -4), NST (UTC -3:30), JST (UTC +9), CST (UTC +8), WIB (UTC +7), MMT (UTC +6:30), BST (UTC +6), NPT (UTC +5:45), IST (UTC +5:30), UZT (UTC +5), IRDT (UTC +4:30), GST (UTC +4), LINT (UTC +14), TOT (UTC +13), CHAST (UTC +12:45), LHST (UTC +10:30), AEST (UTC +10), ACST (UTC +9:30), ACWST (UTC +8:45), MART (UTC -9:30), NUT (UTC -11)Are you a talented Senior Developer looking for a remote job that lets you show your skills and get decent compensation? Look no further than Lemon.io the marketplace that connects you with hand-picked startups in the US and Europe.What we offer:Earn $5k$8k monthly: the rate depends on your seniority level, skills and experience. We've already paid out over $11M to our engineers.No more hunting for clients or negotiating rates let us handle the business side of things so you can focus on what you do best.We'll manually find the best project for you according to your skills and preferences.Choose a schedule that works best for you. Its possible to communicate async or minimally overlap within team working hours.We respect your seniority so you can expect no micromanagement or screen trackers.Communicate directly with the clients. Most of them have technical backgrounds. Sounds good, yeah?We will support you from the time you submit the application throughout all cooperation stages.Most of our projects involve working in a fast-paced startup environment. We hope you like it as much as we do.Through our community, we will connect you with the best developers from more than 50 countries.Requirements:4+ years of software development experience.3+ years of commercial experience with Angular3+ years of commercial experience with .NETHands-on experience with Vue.js, TypeScript, Azure would be a plusStrong technical skills: as a Senior Developer, you are expected to be able to create projects from scratch and have a deep understanding of application architecture.Clear and effective communication in English advanced ability to discuss business tasks, justify decisions, and communicate issues. Good self-presentation is also essential for upcoming client calls.Strong self-organizational skills ability to work full-time remotely with no supervision.Reliability we want to trust you and expect that you wont let us and the client down.Adaptability and Flexibility the ability to onboard the project promptly after accepting it and start delivering results quickly.Sounds good for you? Apply now and join the Lemon.io community!NOT YOUR TECH STACK?We have different projects for Senior Developers, so if you have 4+ years of commercial experience in software development and you are fluent with React & Node.js, React & Python, AI Engineering, Android & iOS we would be happy to communicate and provide you with a project that matches your experience. Just apply, and we will share more details with you.If your experience matches our requirements, be ready for the next steps:VideoAsk watch a short video about our startup, up to 10 minutesComplete your profile on our website30-minute screening callTechnical interviewFeedbackMagic Box (we are looking for the best project for you).P.S. We work with developers from 50+ countries in different regions: Europe, LATAM, Asia (Philippines, Indonesia), Oceania (Australia, New Zealand, Papua New Guinea), Canada, and the UK. However, we have some exceptions.At the moment, we dont have a legal basis to accept applicants from the following countries:European: Iceland, Liechtenstein, Kosovo, Belarus, Russia, and Serbia.Latin America: Cuba and NicaraguaMost Asian countries and Africa.We expand and shorten the list of exemptions regularly.Do you represent a company with engineers who match the description and want to collaborate with us through staff augmentation? Then register here.

Time zones: ART (UTC -3), UTC -3, UTC -2, GMT (UTC +0), CET (UTC +1), EET (UTC +2), MSK (UTC +3), FKST (UTC -3), CEST (UTC +2), BST (UTC +1), CVT (UTC -1), WAT (UTC +1), SAST (UTC +2), EAT (UTC +3)We start with the cliff notes about the position. If this appeals to you, continue reading for a longer text version about us and working at Silverfin further down. At Silverfin, we're an equal opportunity employer and value diversity at our company. We do not discriminate based on race, religion, colour, national origin, gender, sexual orientation, age, marital status, or disability status.Although we know were not perfect yet, we are working hard on it and are always open to your feedback.According to our vision to build a diverse, equitable, and inclusive organisation, our policy is to only start the interviewing process once underrepresented groups are sufficiently present in the list of candidates applying for the position. For this reason, its possible interviews will get slightly delayed until weve reached that goal.We're committed to elevating talent by creating an environment where we can all thrive together. So if you think you have what it takes, but don't necessarily check every single box, please consider applying. We'd love to hear how you might contribute to our mission and our team.What can we offer you?Join a distributed remote-first engineering team with 40 colleagues in 14 different countriesA refreshing work environment with professional, friendly, and welcoming peersActual, proper work-life balanceA salary range of 112.000 - 169.000 a yearFlexible working hours and 100% remote workParticipation in our Leadership Development Program and opportunities for personal growth and mentoringA 1200 yearly budget for conferences, courses, workshops, or other expenses that will improve your skillsTwo engineering retreats per year, somewhere in EuropeMonthly Company-wide Wellbeing Days off (Reviewed Annually)What are we looking for?You have at least 2 years of leadership experienceYoure up for managing and mentoring an engineering teamYou have recent experience as a Senior Software EngineerYou know or are interested in learning Ruby on RailsYou're interested in getting to know our customers to find the best solution for a given challenge.You're aware of the trade-offs involved in proper engineering and can make balanced business decisions, keeping in mind all the stakeholders of the project.You can communicate clearly in English, both verbally and in writing.Those were the cliff notes. In the next sections, we're going to dive a little bit deeper into explaining who we are and the teams that make up Silverfin Engineering.What does a Silverfin Engineering Lead do?As an engineering team lead, you're going to manage, inspire, and mentor a team of engineers to foster a culture of innovation, collaboration, and continuous improvement. You will furthermore act as the cohesive force between your team, the Engineering department, and the company as a whole. Operating in a "player-coach" model, you balance hands-on contributions with team management.Live the [Silverfin values](https://silverfin.com/careers/) and be a role model for the individual contributorsCollaborate with and support your fellow team leads (we're big believers in a well-aligned Team Number 1)Make sure your team is aligned with the other engineering teams and the rest of the organisation, focusing on the highest business prioritiesLead and mentor the team while closely coordinating with the product manager Embrace the "player-coach" model, with a significant portion of your time dedicated to direct technical contributionsHelp with discovery and delivery of the best way to solve a customer or business problemHelp with maintenance and support of existing functionalityWhats a Silverfin?At Silverfin, we apply the promise of software to the age-old industry of accounting. With our SaaS, were automating a large chunk of the busywork that accountants are currently handling manually and are building new tools so they can provide better services to their customers. We aim to optimise their workflow in such a way that accountants can spend more time on the much more impactful and rewarding work of advising their customers, the business owners.The good news is were succeeding in doing exactly that. Every week, more than 15.000 financial service professionals use Silverfin to help and advise more than 400.000 businesses. Our customers adore us! The even better news is theres still plenty left to work on, and thats where we hope you come in.Since November 2023, we are proudly part of Visma - the European leader in mission-critical cloud software, enjoying the power of the Visma brand and resources whilst retaining business autonomy and go-to-market freedom.What does working at Silverfin look like?Our product teams are cross-functional teams, with engineering, product design, and product management represented. They work very close to the users, trying to understand their problems and then discovering and implementing solutions that add the most value. We believe in very close collaboration between the three perspectives as early in the process as possible. The product teams are supported by other teams that provide core services, maintain complicated subsystems, or possess specialised expertise.We're proud of our in-house AI team, which is focused on the application of the newest developments in machine learning to address our users' most important challenges. Were pretty far on that journey already, since we have multiple AI-powered features that are solving actual client problems and are commercially successful.Our CloudOps team ensures things run smoothly and will happily work with you when issues arise. Were enthusiastic followers of the DevOps mindset, which means ops and developers work together to solve problems and empower each other to be self-sufficient, instead of throwing problems over the wall to the other side.We run an up-to-date Rails monolith on the backend, with PostgreSQL and Redis for persistence and caching, and everything is running on a Kubernetes cluster in Google Cloud. Our daily tools include GitLab, Quip, and Slack, with Google Meet as our remote conferencing tool of choice.No code gets deployed without a review by a peer, and testing is a must. Our pipeline automates deployment when the suite is green, and deploys happen dozens of times a day. Each team is currently doing Kanban, but theyre free to follow whatever process suits them best. There are regular retros held to work towards continuous improvement.Software for accountants is not considered to be very exciting, but we have our fair share of technical challenges. To give you a sense of scale: in our biggest stack, our database exceeds 17TB*, and our largest table has crossed the 10 billion row mark a long while back. We run stacks on multiple continents, and we interface with more than 30 different external APIs and provide third parties with an API of our own.*: Our CloudOps team noted that this actually isnt that hard to achieve if youre just indexing everything, but it still sounds impressive, right?What makes the engineering team at Silverfin special?Were a remote-first engineering team of 40 people distributed in 14 different countries over two continents. A priority for us is maintaining proper work-life balance. We avoid meetings as much as possible, accept deadlines only when absolutely necessary, and never expect anyone to work longer hours than theyve signed up for. A day in our working lives is pretty boring, and we feel thats exactly how it should be.Working with us means you can be flexible with your schedule. Its OK to disappear for a few hours in the middle of the day to run some errands, get a haircut, pick up the kids - whatever reason, you dont need to explain yourself. You also fully decide when you take time off: our team is sufficiently varied and well organised that there are always enough people around to handle the load, and in the rare cases its not, we will decrease the load instead of asking people to move their holiday.Being remote-first means we favour asynchronous communication. We dont shy away from chatting in Slack, but the important decisions or discussions are done in Gitlab issues, over email, or in Quip, our central wiki, so theres a written, persisted record. Were mindful of maintaining long chunks of focused time, which means we avoid @-mentions or PMs on Slack, and other triggers and interrupts. We encourage using Slacks DnD function, especially when youre not working!Wed be really happy to welcome you in our #engineering channel, but its not just virtual: we make sure we regularly get to see each other in real life too. Twice a year we fly the whole engineering team to a different location in Europe, and at least once a year we join up with the rest of the company so we can spend some time together with the other departments.What does your future look like?Personal growth is key to staying motivated. As a manager in Silverfin you will participate in our initial Leadership Development Program and regular Leadership Days. Of course, your manager is there for mentoring and coaching you in your role as well. In addition to that, everybody gets a 1200 yearly budget to spend on conferences, courses, workshops, or other training to improve their skills and level up. This also includes accommodation and travel costs. If the conference is on a workday, youll get paid like any normal day.RequirementsYou have at least 2 years of experience leading a teamYou have recent experience as a Senior Software EngineerYou know or are interested in learning Ruby on RailsYour work hours have some overlap with EU business hours (we require your local timezone to be within CET +/- 3h)You can communicate clearly in English, both in writing and verballyNice to havesThese would be nice but are definitely not necessary. Dont worry if none of the following applies to you.Experience with Ruby on RailsExperience as a remote worker in a fully remote teamExperience working with large datasets and the problems they bringExperience in API design is a strong plusSome experience using Javascript framework(s)Experience in FintechAccounting knowledge Related Jobs See more Back-End Programming jobs

Time zones: ART (UTC -3), UTC -3, UTC -2, GMT (UTC +0), CET (UTC +1), EET (UTC +2), MSK (UTC +3), FKST (UTC -3), CEST (UTC +2), BST (UTC +1), CVT (UTC -1), WAT (UTC +1), SAST (UTC +2), EAT (UTC +3)We start with the cliff notes about the position. If this appeals to you, continue reading for a longer text about working at Silverfin and your role At Silverfin, we're an equal opportunity employer and value diversity at our company. Although we know were not perfect yet, we are working hard on it and always open for your feedback.According to our vision to build a diverse, equitable and inclusive organisation, our policy is to only make a final hiring decision if underrepresented groups are sufficiently represented in the list of candidates applying for the position. For this reason its possible interviews get slightly delayed until weve reached that goal.We're committed to elevating talent by creating an environment where we can all thrive together. So if you think you have what it takes, but don't necessarily check every single box, please consider applying. We'd love to hear how you might contribute to our mission and our team.What can we offer you?Actual, proper work-life balanceA salary range of 99.000 - 134.000 a yearFlexible working hours and work 100% remotelyPersonal growth training and opportunitiesJoin a distributed remote-first engineering team with 40 colleagues in 14 different countries on two continentsA refreshing work environment with professional, friendly and welcoming colleaguesA 1200 yearly budget for conferences, courses, workshops or other expenses that will improve your skillsTwo engineering retreats per year, somewhere in EuropeTen company-wide Wellbeing Days per year for all employees (once a month, except in July and August)What will you work on?Building and maintaining integrations with accountancy software packages and APIsImproving and expanding our on-premise Ruby CLI/service which runs on hundreds of our customers systemsWork on user facing functionalitiesHelp with discovery and delivery of a solution for user or business problemsWhat are we looking for?Youre experienced in both Ruby and Rails, and also understand where the boundaries lie between them. You can code in Ruby without any of Rails training wheels if necessary.You have some experience using Javascript framework(s), understand the value of them, but also know when plain Javascript is enough.You enjoy integrating with APIs and arent easily dissuaded when encountering unreliable or poorly documented systems.You code with reason and can justify the important decisions you made during development.You can communicate clearly in English, both in writing and verbally.Youre up for mentoring coworkers and can give in-depth, productive feedback during code reviews. While you appreciate the small stuff, you recognise bike-shedding and can avoid its pitfalls.You know and can apply best practices when relevant. That means the usual like version control, testing, and refactoring; but also higher level concepts such as good object oriented design.You're aware of the trade-offs involved in proper engineering and can make balanced business decisions, keeping in mind all the stakeholders of the project.Youve got opinions on code design and you can discuss them, but youre professional enough to not let those opinions get in the way of a consensus if necessary.If youre any good at Ruby, this is probably not the first job ad youve seen, so weve done our best to stand out while also accurately presenting what were all about. If it sounds like you would enjoy working with us, dont hesitate to apply or drop us a line with questions on [emailprotected], or read on for the more detailed explanation ..Whats a Silverfin?At Silverfin were trying to apply the promise of software to the age-old industry of accounting. With our SaaS were automating a large chunk of the busy-work that accountants are currently handling manually, and are building new tools so they can provide better services to their customers. We aim to optimise their workflow in such a way that accountants can spend more time on the much more impactful and rewarding work of advising their customers, the business owners.The good news is were succeeding in doing exactly that. Every week more than 15.000 financial service professionals use Silverfin to help and advise more than 400.000 businesses. Our customers adore us! The even better news is theres still plenty left to work on, and thats where we hope you come in.Since November 2023 we are proudly part of Visma - the European leader in mission-critical cloud software, enjoying the power of the Visma brand and resources whilst retaining business autonomy and go-to-market freedom.Whats Team Syncs?One of the cornerstones of the Silverfin platform is the integration with bookkeeping software that accountants already work with, which allows us to seamlessly import their accounting data. We currently have integrations with over 40 different vendors, and we want to add more as we expand to different markets.Team Syncs is the team responsible for creating, maintaining and improving these integrations. Some APIs we need to use are poorly designed, badly documented or unreliable, and it can be challenging to build a robust integration. Yet solving those puzzles, and empowering our customers by importing gigabytes of data from their clunky bookkeeping software, makes it all worth it. Because once the data is in Silverfin, it's connected, standardised and can be easily worked with, which is what it's all about. If you're a tinkerer, love working with APIs and thrive in the face of uncertainty, this might be for you.What are the things you'll be working on?Improve the stability, performance and infrastructure cost of dozens of our current 3rd party integrations, through usage of different distributed systems patternsPractise your modelling & refactoring skills. You'll have the opportunity to think about solutions that will be applied in over 40 of our integrationsHelp design & build the new generic API based on more than a decade of our experience with building custom solutions for bookkeeping softwareRare opportunity to work on a CLI/service application which is currently deployed on hundreds of our customers' serversWhat does working at Silverfin look like?There are seven engineering teams working together to deliver the best value for our customers. Several product teams, collaborating closely with product managers and product designers, are solving customer facing problems. The other, more platformy teams, own complex subsystems, like syncs or AI, and or support the product teams with knowledge, frameworks and services.Our ops team ensures things run smoothly, deploys happen correctly, and will work with you when issues should arise. Were enthusiastic followers of the devops mindset, which means ops and developers work together to solve problems, and empower each-other to be self-sufficient, instead of throwing problems over the wall to the other side.We run an up-to-date Rails monolith on the backend, with PostgreSQL and Redis for persistence and caching, and everything is running on a Kubernetes cluster in Google Cloud. Our daily tools include GitLab, Quip and Slack, with Google Meet as our remote conferencing tool of choice.No code gets deployed without a code-review by a peer and testing is a must. Our pipeline automates deployment when the suite is green, and deploys happen dozens of times a day. Each team is currently doing Kanban, but theyre free to follow whatever process suits them best. There are regular retros held to work towards continuous improvement.Software for accountants is not considered to be very exciting, but we have our fair share of technical challenges. To give you a sense of scale: our database exceeds 17TB*, and our largest table has crossed the 10 billion row mark a long while back. We interface with more than 40 different external APIs, and provide third parties an API of our own.*: Our ops team noted that this actually isnt that hard to achieve if youre just indexing everything, but it still sounds impressive, right?What makes the engineering team at Silverfin special?Were a remote-first engineering team of 40 people distributed in 14 different countries over two continents. A priority for us is maintaining proper work-life balance. We avoid meetings as much as possible, accept deadlines only when absolutely necessary, and never expect anyone to work longer hours than theyve signed up for. A day in our working lives is pretty boring, and we feel thats exactly how it should be.Working with us means you can be flexible with your schedule. Its OK to disappear for a few hours in the middle of the day to run some errands, get a haircut, pick up the kids - whatever reason, you dont need to explain yourself. You also fully decide when you take time off: our team is sufficiently varied and well organised that there are always enough people around to handle the load, and in the rare cases its not, we will decrease the load instead of asking people to move their holiday.Being remote-first means we favour asynchronous communication. We dont shy away from chatting in Slack, but the important decisions or discussions are done in Gitlab issues, over email, or in Quip, so theres a written, persisted record. Were mindful of maintaining long chunks of focussed time, which means we avoid @-mentions or PMs on Slack, and other triggers and interrupts. We encourage using Slacks DnD function, especially when youre not working!Wed be really happy to welcome you in our #engineering channel, but its not just virtual: we make sure we regularly get to see each other in real life too. Twice a year we fly the whole engineering team together to a different location in Europe, and at least once a year we join up with the rest of the company so we can spend some time together with the other departments.What does your future look like?Personal growth is key to staying motivated. At Silverfin you dont need to move to management in order to advance. We see the individual contributor track and the management track as two different growth paths which every engineer can follow and switch between. You can be promoted, including pay raises, as a contributor just like as a manager.Everyone has a 1200 yearly budget to spend on conferences, courses, workshops or other training to improve their skills and level up. This also includes accommodation, travel costs. If the conference is on a workday youll get paid like any normal day.RequirementsYou have at least 4 years of experience working with Ruby, or 2 years of experience with Ruby and 4 years in one or more other programming languagesYou get RailsYou have experience with designing or integrating with APIsYour work hours have some overlap with EU business hours (we require your local timezone to be within CET +/- 3h)You can communicate clearly in English, both written and verballyNice to havesThese would be nice but are definitely not necessary. Dont worry if none of the following applies to you.Experience as a remote worker in a fully remote teamExperience working with large datasets and the problems they bringYou have some experience using Javascript framework(s), understand the value of them, but also know when plain Javascript is enoughExperience in FintechAccounting knowledge

Heatherwick Studio founder took home 1.4m last year, almost a third of the profit earned by the practiceHeatherwick Studios proposals for a luxury shopping centre in Seoul, South KoreaThomas Heatherwick increased his annual dividend last year despite profits at his practice Heatherwick Studio crashing by 73% following a collapse in revenue from the US.The firm reported pre-tax profit of 4.7m for the year to 31 March 2024, down from the 17.6m earned in the previous year, with turnover during the period falling from 49.6m to 42.3m.Heatherwicks 1.4m dividend was over 300,000 more than the 1.1m he received in 2023.Source: Tom CampbellThomas Heatherwick outside the firms new Kings Cross office, which it moved to in August 2023 following a two-year refurbishmentThe bulk of the years fall in revenue came from a lull in the firms work in the US, where income fell by 87% from 14.4m in 2023 to 1.85m the following year.All other key regions saw improved numbers, with income from Asia, the firms most lucrative market, increasing from 16.1m to 19.2m, and the Middle East rising to 16.5m from the 13.1m earned in the previous year.Turnover also increased in the UK from 1.8m to 2m and in the rest of Europe from 1.1m to 1.6m, although it fell across the rest of the world, outside of the firms five key regions, from 3m to 1.1m.The practice said the fall in turnover and profit was fully expected following an exceptional year in 2022 and 2023 when the studio won work on a string of large projects and several others that had stalled during the pandemic, restarted.Group staff numbers during the period edged up to a total of 234, from 225 the previous year, with the firms wage bill increasing from 18.9m to 20m.The accounts also revealed the firm owes creditors a total of 26.4m, including 11.1m within the next year. The firm is currently paying off a 20m bank loan from Barclays which it took out in March 2022 at a rate of around 1.3m a year.It is also owed 8.5m from debtors, including 6.2m from trade debtors, within the next year.Heatherwick Studio partner and group leaderStuart Wood said:The studios portfolio continues to grow both in terms of geography and the amazing range and scale of our projects.We are also bigger than ever as a team. Following astrongyear after the pandemic, turnover is now on a level with previous years, as anticipated, and we expect it to continue on a gradual upward trend.Major jobs which the firm picked up last year included a transformation of Londons BT Tower into a hotel for US hotel chain MCR Hotels and a luxury shopping centre in Seoul, South Korea.The firm also won its first job in South America, a seven-storey university building in Bogota, the capital of Colombia.

Stanton Williams' RIBA competition-winning design for a new Fleming Centre at St Marys Hospital, in Londons Paddington Source:&nbsp Stanton WilliamsStanton Williams has seen off major names to win the competition to design a new Fleming Centre for St Marys Hospital in Londons Paddington The proposed 30 million research and public engagement centre on the historic west London hospital campus forms part of the wider Fleming Initiative plans, which aims to tackle antimicrobial resistance (AMR) around the world.Stanton Williams beat four other finalists in the two-stage contest for the job, organised by the RIBA on behalf of Imperial College Healthcare NHS Trust.Also shortlisted were Allford Hall Monaghan Morris, Allies and Morrison, Grimshaw and WilkinsonEyre partnering with White Architekter.AdvertisementA three-day design exhibition in November showcased the five shortlisted concept designs. The RIBA said that feedback from more than 300 visitors helped guide the final selection.It added that Stanton Williams concept design for the Fleming Centre embraces the heritage of its proposed location on the site of The Bays, a set of industrial warehouses from around the 1850s which were used for transport and distribution before being incorporated into the hospital in 1983. Source:Stanton Williams Stanton Williams competition-winning design for a new Fleming Centre at St Marys Hospital, in Londons PaddingtonThe Stanton Williams design retains and adapts The Bays while inserting new elements, including the Fleming Discovery Centre, and offering views into laboratories and curated exhibition spaces for the public. It also prioritises sustainability, with a water-source heat pump, PV panels, biodiverse landscaping and a low-carbon structure.The RIBA said the next phase of the project will involve detailed design development, public consultations, and submission of a planning application to Westminster City Council.The new building will occupy a waterfront site overlooking the Regents Canal and will be the first new building to open at St Marys as part of ongoing plans for the sites wider redevelopment, under the governments New Hospital Programme..AdvertisementIts opening date is scheduled for 2028, marking 100 years sinceAlexander Fleming discovered penicillin at St Marys.Ara Darzi, executive chair of the Fleming Initiative, led jointly by Imperial College Healthcare and Imperial College London, said Stanton Williams bold vision for the new Fleming Centre had brought [the initiatives] ambitions to life.He said the concept reflected the centres unique purpose and global significance and could make the building a global beacon for change in healthcare.Imperials president Hugh Brady said that, as well as bringing together world-leading researchers to tackle AMR head-on, the Fleming Centre would form a key part of the Paddington Life Sciences development and Imperial WestTech Corridor vision.St Marys Hospital, a mix of historic and post-war buildings, is located immediately next to Paddington station. Allford Hall Monaghan Morris and HOK became the latest architects to be appointed to work on a planned 1.7 billion redevelopment of the site two years ago.The hospital redevelopment was one of the 40 new hospitals the previous government committed to rebuilding by 2030. Farrells drew up a masterplan for a new Paddington Health Campus on the site in the late 1990s, but the proposed PFI project was scrapped in 2005 after more than 15 million of public money had been spent on it. David Morley Architects later drew up a new masterplan but this project also never came to fruition.In September 2024, a search was launched for an architecture and landscape architecture team to work with site owner Imperial College Healthcare NHS Trust to win planning permission for a major mixed-use development at the campus.The competitions judges included Darzi, Jo Wright of Perkins & Will, acting as RIBA architect adviser; Lisa Jamieson, public engagement consultant and former head of engaging science at Wellcome; and David Halpern, director and chief executive of the Behavioural Insights Team.2025-01-08Anna Highfieldcomment and share

The buildings, on Farringdon Road within the Clerkenwell Green Conservation Area, were originally four Victorian warehouses, housing a printworks and shops selling bicycles and printing ink. Incremental conversions over the years had left the warehouses with a confusing array of tenancies contained within an inefficient, leaky envelope. Source:Martina FerreraFathom has extended the workspace area by 920m2, while upgrading the fabric to reduce the carbon footprint, as well as create a new modern identity for the buildings, celebrating their industrial heritage.The ground-floor entrance was designed in collaboration with interior design firm Fettle around a communal area with a co-working lounge and other facilities. The scheme also includes two retail units. Above, six floors of workspace have a series of private and communal roof terraces leading off from them.Advertisement Source:Martina FerreraThe design looks to retain the qualities of the original fabric and balance these with new elements and materials. Circularity and material reuse were key to the project, including the repurposing of 3 tonnes of glass into terrazzo-style worktops and the recycling of 5,000 bricks, 185m2 of timber flooring and 2.3 tonnes of structural steel within the build. Source:Martina FerreraArchitects viewViewed collectively, this series of buildings offered a unique opportunity as a characterful heritage workplace. The challenge was to unify the individual buildings and unlock additional floor space within the constraints of the existing fabric and the conservation area setting.Our design response was to form new connections to create large light-filled floorplates as close to open-plan as its possible to make a Victorian load-bearing masonry structure.The topography of Farringdon Road means that the four buildings step down the hill, with a level change of approximately 0.75m between each. To mitigate this, two of the original circulation cores were removed, with the remaining two reconfigured to incorporate dual-sided lifts providing step-free access to each part of the floor plate.A set of 1970s mansard roof extensions were removed, and in their place, a new attic storey replicates the language of the existing building frontage. Above this is a set-back contemporary sixth floor with a three-sided wrap-around terrace. We worked hard to create external amenity space for every floor of the building as well as a communal roof terrace on level seven.At ground floor, a new centralised reception and co-working space was formed by connecting the separate spaces via a series of large steel-framed openings in the original party walls and lowering the floor levels to create a unified space.Much of the aesthetic comes from the character of the existing building. Exposed brickwork, expressed structural steelwork and concrete are complemented by replacement timber sash windows and an exposed services strategy as a backdrop to the Cat A floorplates.Materials and colours were selected to create a refined industrial language. Handsome late-Victorian tones are complemented by a consistent use of black architectural metalwork, with robust finishes such as glazed tiles adding texture and ensuring longevity.The project has demanded ingenuity, persistence and a collaborative spirit from everyone in the design and delivery teams. The Waterman has become one of the largest heritage workplace buildings in Farringdon and we are proud to have contributed to the next stage of its history.Tom Bulmer, project associate, Fathom Architects Source:Martina FerreraInterior designers viewOur brief was to design Alfreds Club on the ground floor of the Waterman, the main arrival and communal space of the building, and to create an inviting, elevated yet comfortable environment. We wanted to create a space that felt more akin to a hotel lounge or members club than a traditional office lobby, whilst maintaining functionality and flexibility as the space needed to support a variety of daily uses and events.Alfreds Club includes a feature terrazzo-topped coffee counter and events bar, which creates a focal theatre element, as well as a lounge, co-working areas and meeting rooms to serve the buildings tenants. Our design has successfully activated the ground floor and ensured a warm and inviting arrival experience for all buildings users and visitors.Andy Goodwin, creative director and co-founder, Fettle Source:Michele CadeiClients viewBGO tasked Fathom with transforming a complicated and inefficient series of heritage warehouses into a single desirable workplace.Through its analytical and considered approach to the existing Victorian structure, Fathom unlocked net area on every level, improving average net/gross ratio from 79 per cent to 85 per cent. It carved out high-end amenity space and vastly improved the buildings efficiency in operation.Fathoms reimagination has created a distinct identity for the Waterman, celebrating its heritage but very much appealing to the workplace demands of today. Were incredibly proud of whats been achieved on this truly collaborative project.Emma Foster, principal, BGO Source:Fathom ArchitectsProject dataStart on site October 2022Completion date October 2024Gross internal floor area (GIA) 8,614m2Form of contract or procurement route Design & buildConstruction cost UndisclosedConstruction cost per m2 UndisclosedClient BGOArchitect Fathom ArchitectsInterior design (Alfreds Club) Fettle DesignPlanning consultant DP9 and Rolfe Judd PlanningProject manager B&CoContractor AmbitStructure Bridges PoundM&E consultantGDMHeritage consultant The Heritage PracticeQuantity surveyor RLBTransport consultant The Steer GroupLandscape architect Bowles & WyerFire consultant Sweco & SemperApproved inspector SwecoRights of light GIAPrincipal designerFathom ArchitectsPrincipal designer adviser Goddard ConsultingSustainability consultant SwecoBREEAM assessor JAWEcology consultant Greengage EnvironmentalAcoustic consultant EECCAD software used AutoCADEnvironmental performance / sustainability dataPercentage of floor area with daylight factor >2% Not currently assessedPercentage of floor area with daylight factor >5% Not currently assessedOn-site energy generation 0%Annual mains water consumption 6.12 m3/occupant/yearAirtightness at 50Pa 3.43 m3/h.m2Heating and hot water load 21.98 kWh/m2/yrArea-weighted U-values walls: 1.3 W/m2K; roof: 0.12 W/m2K; windows: 1.3 W/m2K; floors: 0.74 W/m2K (NB weighted averages across existing and new build fabric)Design life 60 yearsEmbodied / whole-life carbon Awaiting final assessmentAnnual CO2 emissions 23.4 kgCO2eq/m2

If there's one highlight of tax season for most of us, it's receiving a tax refund. Although the tax filing season hasn't officially started yet -- we expect it will open by the end of the month -- you might want your tax refund sooner to pay off holiday debt or fund an upcoming trip or expense.Some tax software companies advertise tax refund advances, a short-term loan that can give you access to your tax refund even sooner. Getting your money now may seem tempting, but most experts don't recommend applying for one. This story is part of Taxes 2025, CNET's coverage of the best tax software, tax tips and everything else you need to file your return and track your refund. "While tax refund advances may seem appealing when finances are tight, I only recommend taking them out if necessary," said Dana Ronald, president of the Tax Crisis Institute. "They often come with high interest rates and fees, which can add to the overall cost of borrowing."If you take out a tax refund advance loan, you might end up paying for it, either upfront or in the long run. Before you apply for a tax refund advance, make sure you know how they work and what the risks are.Read more:Child Tax Credit: Find Out If You're EligibleWhat are tax refund advances and how do they work?A tax refund advance (also called a refund anticipation loan) is a short-term loan that offers you a portion of your expected tax refund amount weeks or months ahead of your actual refund. The premise may seem compelling, especially if you're still catching up on bills from the holidays. You can typically borrow between $100 and $4,000 until February with a tax refund advance."Tax refund advances are not free money and should be cautiously approached," said Ronald. "It's always best to carefully consider all potential risks and alternative options before deciding."You'll apply for a tax refund advance on a tax preparation company's website. You may need to provide proof of income, your pay stub or W-2 (if available) and other financial records.Tax refund advance loans typically don't have the same credit score requirements as other loans do, and the amount you're approved for may depend on your expected refund amount. So even if a service advertises $3,000 advances, and you expect a $3,000 refund, it doesn't mean you'll qualify to receive this full amount.You typically receive your funds within a few business days, and sometimes as fast as the same day. If you're required to file your taxes with a tax preparation company, the amount owed may be automatically taken from your refund once the IRS submits it. Otherwise, you'll need to repay your loan by the agreed-upon due date.How much do tax refund advances cost?Having extra funds at your disposal could be helpful, but a high-interest tax refund advance is generally not the way to go. Interest for this type of loan is high, with annual percentage rates upward of 35%. For context, average credit card APRs hover around 20%, while personal loan APRs are around 11.56%.Some tax filing services don't charge interest for this service as long as you agree to file your taxes with them, but that could mean you end up paying a fee to file your taxes. There are also other fees you should look out for, even if the loan has a 0% APR. When it comes time to repay your loan, for example, if you choose to repay it directly from your refund, fees could apply.What are the risks of taking out a tax refund advance?There are a few reasons why you should be wary of tax refund advance loans."One of the biggest risks is that your tax refund could end up being less than the amount you borrowed," said Ronald. Since these loans are based on an expected refund, there's always the possibility that your refund is smaller than expected. In this case, you'll be responsible for paying the full balance.Secondly, a refund advance may cost you, even if it's advertised as 0% APR. There could be hidden fees, including a requirement to pay for tax filing services, which can be pricey. Plus, some services may charge high interest rates, making this a more expensive type of loan.Note: Be careful of payday lenders that may advertise similar loans during this time of year. These companies often have extraordinarily high interest rates and fees. In some states, payday loan rates can average as high as 400% (yes, you read that correctly). Personal finance experts recommend avoiding payday loans at all costs.Where to get a tax refund advance in 2025Most of the large tax preparation companies offer some sort of tax refund advance, although the terms, conditions, qualifications and amounts vary from company to company. Here's a quick look at the products offered by some of the larger tax preparation firms:Jackson Hewittoffers two products: an Early Refund Advance, which you can get with just your pay stubs and comes with an APR as high as 35.96%, and a No Fee Refund Advance, which is a no-fee, 0% APR loan available at most Jackson Hewitt locations.H&R Blockhas a 0% APR refund advance loan for up to $4,000 through Feb. 28. You'll be charged a $42 fee if you decide to repay your loan with your refund from your H&R Block refund transfer account.TurboTaxoffers a refund advance of up to $4,000 with no loan fees and a 0% APR until Feb. 28 if you meet certain eligibility requirements. If you choose to repay your loan with your federal refund, separate fees may apply.Alternatives to tax refund advancesIf you can, wait until your tax refund comes through in 2025. This can prevent you from receiving a larger loan than you can afford to pay back when your refund hits. To get your refund as quickly as possible, the IRS recommends filing online early in the tax season and opting for direct deposit delivery.You can also tap your emergency savings account, then replenish it when your tax refund arrives. If you're still working on getting your emergency fund set up, there are other, more affordable options to consider.If you need your refund money faster to cover a surprise expense or necessity, consider a personal loan or 0% APR credit card. Just make sure you can make monthly payments to minimize interest, late fees and other penalties. More tax advice