Phosphorus LIVE Recap: Akira Ransomware & the IoT Attack Surface

On April 3, 2025, Phosphorus LIVE tackled one of the most eye-opening cyber events of the year: the Akira ransomware attack that bypassed endpoint security and exploited an unsecured IoT camera to breach a corporate network. Hosted by James McCarthy with special guest and staff engineer Chris Prest, the session dissected this real-world attack and what it reveals about the urgent need to rethink IoT security as ransomware tactics rapidly evolve.

From credential-based initial access to a swift pivot onto a vulnerable webcam, the conversation highlights how modern ransomware gangs are evolving beyond traditional tactics – and why endpoint detection and response (EDR) alone isn’t enough.

The transcript below has been edited for clarity and flow, but we strongly encourage you to watch the session’s on-demand video embedded below to experience the full discussion, complete with technical context, visuals, and expert analysis.

👉 For a detailed breakdown of the Akira ransomware attack and how it unfolded, be sure to read our in-depth blog: How a Single IP Webcam Brought Down a Network: The Akira Ransomware Playbook.

Transcript. Phosphorus LIVE:  Akira & the IoT Blind Spot. EDR Won’t Save You.

James McCarthy: Hello, everyone! I’m your device-obsessed host James McCarthy, and today I am joined by Chris Prest, our staff engineer and all around IoT Guru. Today’s topic is a big one. As we’re planning to deep dive into the Akira ransomware attack that just recently was announced.

This is one that hits a little bit closer to home than I think your average ransomware attack because this is something where an attacker was able to leverage a basically neglected IoT infrastructure at a large company and use it to their advantage to ultimately cause harm.

So,  Chris is going to walk us through some of the details on how that happened. Give us some of the technical understandings kind of walk through. You know the chain of attack and how we got to the place that we’re at now, and then I’m going to end with a quick walkthrough of Phosphorus and how our platform, in combination with a well-formed IoT management practice, could have easily prevented this type of an attack. And really, prevented the outcome that the company had to go through.

So, and with that, Chris, I do have to ask is this, do you think this is an isolated incident? Is this something we’re gonna start seeing more of? Walk me through what your thoughts are. Somebody who kind of sees you know what’s out there in the world and in the wild from a cybersecurity standpoint.

 

Chris Prest: Well, that’s a great question. And today we’re gonna be talking about specifically a webcam that was used. But the IoT space is so large. There’s a lot of different types of devices.

So starting with, do you think this is gonna be more prevalent? Definitely, especially since this was actually a successful case. Unfortunately for the threat actor, threat actors love to kind of copy each other. They look at different playbooks, they like to look at what was successful, what wasn’t, and they definitely use trends to determine what they should do next.

And that may be a threat actor that is sophisticated, or maybe a threat actor that is a little bit less sophisticated, that is maybe just an affiliate or getting started. They will look at these scenarios, and they will expand upon them.

And since web cameras are so prevalent, they’re everywhere, as you mentioned, neglected. IoT that is going to continue to flourish. Because there are so many devices, they’re difficult to manage traditionally.

They’re exposed, or maybe they’re not monitored as well. So, I fully expect that you will see an expansion upon this type of attack.

 

James McCarthy: Yeah, that makes sense, and especially what you said. As soon as the cyber-criminal space picks up on one of these attacks becoming, you know, really successful. The attack method starts to get copied and you start to see it start. You know, popping up in other places, and with just how mature and how good some of these endpoint detection tools are like your Crowdstrikes of the world.

It’s getting harder and harder for these attackers to break through on the endpoint, so they’re naturally getting kind of squeezed to the to the corners of the network, and they’re trying to find other places to pivot. And it’s just a matter of time before it becomes commonplace, unfortunately.

And you know, hopefully, we can get out there and spread the good word. And get these companies protected ahead of time so that it doesn’t happen. But unfortunately, we know that those things take time, and unfortunately we may not be able to move as quickly as the attackers, but at least we do have a solution for that.

So that said I’d love for you to dive in. Let’s get started reviewing this attack here and dig into those technical details. I’m pretty excited for that.

 

Chris Prest: Excellent sounds good. Let me just share just a second.

Alright. Let me know if you can see the slide deck. There.

 

James McCarthy: Looks great.

 

Chris Prest: Alright, perfect. So, let’s get into a bit of the attack structure. And generally, who we’re speaking about. So, in this case, we’re going to be covering the Akira Ransomware Group. They’re fairly well-known group. They’ve been around since 2023. Pretty prevalent.

And they’ve typically seen action in North America, in Europe, in Australia, and targeting manufacturing finance and education sectors. They have some members on it that are suspected of the old Conti gang. This group is very prevalent, have a long background in ransomware and cybercrime.

In general, this group does have a number of advisories that were written out by the FBI, by CISA, by Europol. So their tactics and techniques are fairly well-documented over the years up until now. But in this case we’re going to be covering kind of a new tactic that they employed as part of this this incident.

And in this case we’re going to be talking about, as we mentioned, a webcam that was compromised, and it becomes part of their attack chain.

But leading up to that, we’re going to discuss kind of like how they got into that situation and why they chose to go after an IoT deployed based device for their ransomware. But naturally, when you do get into those situations you’re no longer looking at, you know, on edge EDR systems to be able to detect what’s happening on that webcam. So at least some blind spots, unfortunately for the victim. But it’s fortunate for the threat actor.

So, I’d like to walk through here just kind of a general attack scenario that occurred, and kind of expand upon those different steps.

In this case,  when they first attacked this victim, they had access to a remote desktop instance most likely, and this is pretty common. They got this information from an access broker. It’s a super common situation. This group is known for doing that as well, and that’s most likely. Unfortunately, the incident doesn’t exactly describe how that [they got in the system] occurred, but that’s what we suspect in this case specifically.

 

James McCarthy: Let’s kind of double click on that. This is kind of a standard walk through the front door. You know? They didn’t do anything sophisticated to get onto the network, you know, which is, I think the majority of most cyber-attacks start in that place. And this one was no different. They walked through the front door, had some credentials, and managed to kind of snake their way through the network.

 

Chris Prest: You got it. Sometimes this happens through either leaked credentials or a compromised system, phishing email, etc., or maybe even an inside job as well. Unfortunately, a bad actor. There’s lots of different ways that these credentials unfortunately get leaked, and then they get sold through an access broker and they get picked up by either affiliates or the ransomware gangs to make use of in an attack. So that’s most likely what happened here. And unfortunately, yes, you’re right. That is a very common tactic. It’s a low technical barrier, but it still is incredibly effective.

 

James McCarthy: The human is the weakest point of a cyber security program. In most cases.

 

Chris Prest: That is true. That is true.

But in this case, once they got onto the system, they realize they’re on a Windows-based environment. So they’re on a Windows server.

The first thing that they’re gonna do before they do any type of encryption on the network, they’re gonna scan the network. And they’re gonna see what they’re working with, right?

What they’re trying to identify is different types of maybe share drives or local drives or other devices to potentially pivot to. And they’re looking for what they want to obviously encrypt or what they want to exfiltrate.

In this case, when they scan the network, they identified a share drive through an SMB service. And they decided to say, okay, you know what? We’re going to deploy our Windows-based encryptor.

Now to back up a second. Akira has multiple types of encryptors that they can make use of. One of them is developed for Windows and Windows-based systems. Another one is for Linux, and they have one for ESXi Hypervisors as well, so they can work in different types of environments depending on what they need to do.

In this case, they deployed or wanted to deploy their Windows-based encryptor first, and that’s a natural step that most ransomware actors will take when you know that they’ve already compromised the system.

When they pushed over their binary, their encrypted zip file to the actual target system that they were going to run the ransomware from the local EDR system actually picked it up in quarantine. The file.

The reason why that happened is a little bit unknown. But what that does is it causes kind of like their ransomware clock to start to tick. So, the threat actor knows that they’ve unfortunately alerted the system to some degree. Now, whether somebody is aware of this yet or not is not known to the threat actor, but they do know they’re on the clock at this point.

 

James McCarthy: Signals out there, and somebody, if they’re watching close enough they could have seen it, or at least started their investigation.

How long that could take? Who knows? But at least that was there. Yeah.

 

Chris Prest: You got it, exactly. But in this case the reason why they first did that discovery that I talked about is because they need to look for potential pivot points, and when they look back through their different systems that they discovered when they first connected, they identified a webcam. And after looking at the webcam, they’re able to obviously identify the fact that it was vulnerable. It had an exploit that was out there, and in this case, it was a remote shell that they were able to get access onto the actual webcam itself.

So the fact that their EDR system kicked in and they got kind of not booted yet from the Windows system, but they know they’re not gonna be able to deploy their decryptor there. They need to then pivot.

Now, remember, they still have the target they want to go after. So, they want to go after that share drive, for instance, with all those files.

 

James McCarthy: Just to double click on that. You mentioned that when they found this IP camera they were able to in fairly rapid time because we know that they’re on the clock right? They don’t have unlimited time to do their discovery. And there’s, you know, kind of scoping of the network. So they’ve got this narrow window of time.

But even in that, you know, time is limited. They were able to not only discover the IP camera on the network, but then they were able to assess its vulnerability, find a vulnerability that they could leverage, build something to actually use that vulnerability and then actually gain access to the camera.

 

Chris Prest: You got it.

What is a common mechanism is when they first scan it, right? They’re gonna look at it. And they’re gonna say, okay, you know, let’s just let’s just do a quick curl request to it to see if it has a web management interface. And obviously a lot of IoT devices. They have a web management interface.

Sometimes those get compromised as well, and they have their own vulnerabilities. But one of the things that almost all of them have. They have a banner indicator that says what firmware version they’re on or they have an indicator that allows you to determine roughly, approximately, what firmware version it’s running. And if you know the version of firmware, well, you can just go to common locations on the Internet and find exploits for that version and then deploy those.

And that that probably is what happened here because, as you mentioned the time sensitivity, that is probably what they did. They identified quickly through one of its banner indicators. Which version it is, went out, got an exploit, tried it, and it worked.

At that point, the camera is now compromised. It’s a perfect pivot point away from that Windows system. But in the same network. So, whatever that Windows system had access to in a network that IP cameras in the same network will also have that similar potential access to.

 

James McCarthy: And now they’re sitting on the network. They’ve got a Linux operating system where they have admin or root access, and none of the customers’ tools or none of that. That company’s tools had the ability to see what they were doing on that camera because, of course, they don’t have anything monitoring the camera itself, right?

 

Chris Prest: Exactly, exactly. A lot of these IoT devices, not all of them, but a vast majority, are running a Linux or Linux-like environment. They have BusyBox running. So, their tool set that they’re typically used to working with on a on a traditional Linux system. It will work there as well, for the most part pretty much bang on and in this case that is, that is one of them.

But, as you mentioned, it’s a blind spot for unfortunately, the victim, because there is no EDR running on this thing, it’s an over-the-shelf webcam. So, unless you’re monitoring very specifically the traffic coming from that camera, it’s very easy to miss it.

Obviously, that thing is blind, and it gives the attacker a huge advantage that they’re sitting in your network potentially for a while. They could be persistent there. Who knows but they have the ability to access and function from there, almost like with imputed.

 

James McCarthy: And because it’s functionally a Linux system that looks and feels very, very similar to any other Linux system that they encounter as part of their day-to-day activities, it means that even if you’re monitoring that network traffic, they’re going to be able to pivot so quickly and take advantage of that with so much speed that your reaction time is unlikely to be fast enough to actually stop or thwart the attack before it happens, right? Because unless you’re literally looking at it in real time and know you know enough to know what’s happening, you’re probably not going to catch it until it’s too late.

 

Chris Prest: You got it, and the fact that they may not have pivoted in.

There’re many different systems that would have come up on the scan. The administrators would have to pinpoint, you know where they may have pivoted. They have to rule things in and out. Maybe they lock down that Windows box. But at that point they’ve already abandoned it. There’re somewhere else, right?

So, unless they’re willing to lock down the whole network completely. Unfortunately, you know. That’s not the case.

 

James McCarthy: And they likely found more than one web camera. They probably found 50 cameras or 100 cameras, all running the same version of firmware already on.

Probably in the same IP subnet right? So, there wasn’t. They just had one target.

 

Chris Prest: Exactly, exactly.

And now that they’re on this very familiar, more familiar based Linux system, they’re able to use a lot of the tooling that they’re familiar with. And in this case, as I mentioned earlier, they actually have a Linux encryptor ready to go. So, they push the Linux encryptor onto the webcam.

And at this point they said, Okay, how can we obviously continue on our attack? And if you remember, when I mentioned the original scan they did. There are thing like those SMB shares that are out there, these remote shared drives that they’re able to now potentially target.

And in this case, they did so. They remount the local file system so that they can read and write to the device itself, but then they can mount external, remote shares, and in this case they do mount the remote share itself to the device.

So, what that gives them is the ability to run an encryptor that wasn’t traditionally meant to run on that system. They can run it there, and they can attack another resource somewhere else in the network. And in this case that share.

Now, the key thing that you have to remember is obviously a camera is pretty low power, and you may think, well, how long is it gonna take to encrypt potentially a large share successfully, right?

A lot of ransomware over the years has obviously added new features, but a very common one that most ransomware has is being able to encrypt a percentage of a file. And what that gives them is the ability to say, I know I can sufficiently encrypt enough of this file to make it unusable for the victim, unfortunately, but it will reduce the amount of time it takes to do the whole file system, or as many files as you can get that are obviously high priority for you.

You can, a lot of them, prioritize based off file type as well. So, if they see a certain type of file, maybe a doc, they’ll encrypt the whole thing right away real fast. Or if they see something like what you typically get on ESXi host, maybe a VM disk, they won’t encrypt the whole thing, because that could take a really long time, and on a low powered device like a camera that’s not really feasible.

So, they have those ability and those options to increase their success rate when they are attacking a remote share, and in this case they would have most likely did that we don’t have any incident data that details exactly what happened. Because again, this is a blind spot. So, once they kind of pivoted, you’ll lose that. But in this case, they would have went after it in that manner, they would have realized, hey, we don’t have that much time. We’ve already alerted the EDR system on the Windows host we need to probably quickly encrypt that remote share.

 

James McCarthy: No, and they could have in future attacks. They could have done this, too. They could have just compromised multiple cameras and taken that attack on multiple fronts. Right? They didn’t need to just find one system. They could have done it to 50 of them. It was simple scripting. You could. You could do that pretty easily.

 

Chris Prest: Or they could use it for persistence they could. They could have potentially sat inside one of the cameras without attacking anything yet, and just waited for the remediation to happen, and then just pop back in later

That is definitely possible, especially when you’re dealing with a device that doesn’t have, you know, an EDR system. Potentially doesn’t have any real network traffic monitoring to it. Or you could slip into the traffic, and it gets unnoticed somehow. They could have used that for persistence and sat there, but instead, this case, they weaponized it and used it as the encryptor to target those remote share files specifically.

But in all that’s pretty much the overall attack that that occurred here. It’s quite remarkable. And as you asked earlier, at the beginning of the show: we expect this to happen more often. You can see how easy it is to pivot to a device like this to identify potentially what firmware they’re running, potentially identify an exploit that is already out there for that and then making use of that weaponizing it. It’s not that difficult. It is definitely something you’re gonna see other people do and learn from. And I would expect to see this happen more often

 

James McCarthy: Yeah, I think that’s the big. The big message here is that this was the market in the industry proving that the best endpoint. Protection on the market still isn’t enough, because it’s only part of a much larger cybersecurity hygiene program that should be employed, and part of that is, making sure that anything that’s capable of running applications or doing things like mapping and network share should be considered an endpoint, and should be treated with just as much, you know, focus and attention as anything that’s running a human interface device like an actual desktop or laptop.

These holes are everywhere on the network, and if you have the front door really well locked and secured, but your Windows are open, an attacker is gonna just go through the window with about the same amount of difficulty.

Thank you for walking through that. Is there anything else you can think of from an attack standpoint that was a little bit different or unique about this versus, you know, some of the other things that we’ve seen in the past?

 

Chris Prest: Well, obviously making use of the IT infrastructure was definitely uniqueness, and as you mentioned, the speed of being able to exploit a device on the fly, and that as well as under the gun at that point. Because remember, they triggered that EDR, that is, that is kind of a unique scenario they obviously were prepared to pivot. They must have had that in their playbook. That’s not something they probably thought of immediately on the spot, because the clock is running so I would say that is definitely different.

But also the fact that they were able to very easily, you know, mount a remote share like that share? Did they have credentials for? Did it not have credentials? We don’t have the details of what exactly was what that share was doing and how it was secured.

But again, it goes to the overall just because you’re inside the network doesn’t mean you can trust every single device and every single connection within it. Right? So those, almost maybe not super unique. But it’s obviously something that was very interesting in the combination that they used here to weaponize. This, you know, overall attack chain. So

 

James McCarthy: Yeah. Great, great stuff, great intelligence here on this.

I really appreciate you taking the time to share this with us. It’s obviously the IoT world. It hits. It hits pretty close to home. Right? We talk about how important the hygiene of these things is. With all of our customers and all of our prospects. But it’s hard sometimes, because you get a lot of that. Well, it’s just a camera.

Well, unfortunately, we’ve learned it in smaller attacks in the past. But I think this is a big one that really highlights just how important the hygiene is of your IoT infrastructure, and having something in place to help maintain that and maintain that scale is incredibly important.

It does lead me right into this slide here that we have on the screen. Because I want to take a moment and just highlight how big of a problem this is that we see, right? We have a bit of a unique lens, I’d say, in terms of the market and being able to talk to customers because we look at everything through that lens of you know IoT right in devices that are on the network that don’t have EDR deployed to them, but they do have an IP address, and every single customer we interact with without fail has kind of a state of their IoT like.

You see it here on the screen, which is the majority of devices, are running default credentials even in your more mature, you know, more advanced, you know, infrastructures. You still see just a huge chunk of devices running default credentials, and I don’t care how up to date your cameras are if they’re still running root and pass. Your attackers are gonna get in because I can guarantee that the Akira ransomware gang probably tried to log in with root and pass on that thing first.

And it would have saved them time. Right? But more important though, it’s not just about any one thing. It’s also about: yeah, yeah, change those default credentials, get them up to date, but also update that firmware, right? Don’t let those things sit there for 10-12 years, which we see, unfortunately, far too commonly having devices with vulnerabilities that have been out so long that they are so easy to take advantage of that in this case right here.

This is what happened. An attacker got on the network pivoted and was able to adapt and take advantage of a CVE so quickly because it’s probably been out there and posted in the world for everyone to know about for years. Right?

And so, we see this all the time. Our customers are running vulnerable firmware. We see an, I think, an average age of 7 plus years in terms of how old these devices are in the last time they were updated.

So, the state of that problem is significant, and we even see to the point where devices don’t even are on such old firmware versions that you couldn’t get support from the firmware manufacturer at that point anymore. Right? They’re so far out of date that they’re end-of-life.

And so, we’re talking about huge things that no organization would ever allow on the IT side of the house. Could you imagine, Chris, walking into an average enterprise environment with a Windows XP laptop and just connecting and having full network access?

You’d get walked out the front door. Yet, we’re doing that with IoT all the time. I do want to take a moment, though. If you could go ahead and pass me control because I want to talk a little bit here. I’m not gonna go too far into this, like, just as you know, for time. But I do want to talk a little bit about how we can help now.

This is a little shameless plug on our part here from Phosphorus. But I think it’s really important, because the scale of the problem is significant. And it’s really hard to solve this with just human labor, right? Because locking into and managing and maintaining all of your IoT in an environment is such a daunting task. And it’s a big part of why, I think most companies just don’t do it. They either take the hey? Let’s just stick it on its own Vlan and hope for the best, or they just turn a blind eye to the problem completely, and don’t do anything about it.

And so I want to take just a quick moment. I think it’s important here to show with Phosphorus as a platform. How quick and easy it is to improve in a dramatic way. The hygiene of your IoT infrastructure. And we’ll talk about an IP camera here specifically because, you know, that was the whole, you know, kind of root of the problem here today.

We’ve got this AXIS camera. We see these all over the place, ubiquitous as a manufacturer. They’re great, they make good hardware, they make good firmware, but as we know, it doesn’t matter how good the firmware is maintained by the manufacturer, the customer has to actually do the maintenance. They actually have to take the time to upgrade, to get rid of the vulnerabilities.

All manufacturers have vulnerabilities in their firmware. It’s inevitable. It happens. We just have to stay up to date. And so we can see here, this is an IP camera. I’ve got it loaded up on the screen here. We got a great, you know, view of the IP phone in the in the lab. This is on a rack right now in real time. But I can see if I look at this. You know. Firmware tab. Here.

You can actually quickly see all of the different versions of firmware that are available for this camera. You can see the historical stuff. How many CVEs these things have on them? Right? This is a great way to just kind of quickly. See, if you’re a company trying to solve this problem, you can actually understand the scope of your issue very quickly, you know.

But, more importantly, we can actually come in here and do things like, Hey, let’s upgrade that firmware. Let’s actually go in and install a new version of this firmware so that we can take that hygiene and really apply it to the IoT infrastructure because we do a great job on the IT side, we’re staying upstate with our patching. We’re making people change their credentials every 6 months or every 90 days. You know much to our users’ chagrin, but we’re doing all of these things that are kind of routine and regular maintenance that I think are really important.

We just aren’t doing it here to the IoT.

And so, with Phosphorus, we can actually go and see that available firmware version upgrade it. But what if you have 500 or 10,000 of these cameras? Right? What if the problem starts to scale out exponentially? And I think that’s where really the power of one of our superpowers is really, really kind of shines, because we have the ability to not only find all of these cameras to begin with and help you understand where you’re susceptible to that risk. But we have the ability to then take that context and pivot into direct remediation actions. And we can do it at scale.

And I think that’s really where, if I go in here and click, add a job. I’m gonna go ahead and say, install firmware. And what I can do is just a few clicks. Let’s go access upgrades.

Let’s just do that hit next.

What I can do is literally come in here and just say, Hey, give me all of my access cameras and say just type access. And now I can select all of the access cameras in my environment, and that could again be 5. It could be 5,000.

I can come down and actually create a firmware upgrade program that can run on its own. Here through Phosphorus, go through upgrade all of the firmware to the latest version and report back all of the issues because sometimes cameras are going to be offline, or maybe they’re on too old of a version. You know, things like that. But we’re able to give one person, one administrator, the ability to be a force multiplier for that entire IoT infrastructure. And now we can pick and choose the version of firmware we want. Let’s get off that vulnerable firmware. Let’s say next. But more importantly, let’s do this as a constant like, hey? Every 90 days. Let’s upgrade the firmware every you know. 6 months. Let’s upgrade the firmware so that we’re never too far out of date.

All things that you could do in the platform. All very simple, and not something that you have to spend, you know, hundreds and hundreds of hours working on. It’s very, very simple and very easy to do so.

I know that’s a bit of a shame. We don’t generally like to do these kinds of, you know advertisements on Phosphorus Live. We try to make them more informational about the space. But I do think this one’s so important because it’s such a big attack where the entire core, the root of the problem was a neglected IoT device.

And we have that solution. It’s here. Talk to us. We’re happy to help and you know we’re happy to help you even build your IoT lifecycle management program as well. Not just the, you know, discovery itself.

So with that, said, I’m gonna go ahead and stop sharing, see if we have any questions in the chat. I know we don’t get, Chris, we don’t get your time on these things very often. You’re a busy man as our as our staff engineer. You know the world of IoT with millions and millions and billions of devices. And so you’ve got your hands full there. But I wanna make sure that we give people the opportunity to ask questions here.

And I know we get a lot of these questions come in after the fact. People watch this on replay. They watch it on the you know, any one of the different streaming platforms that we have again, we’re on, you know Linkedin Live. We’re on Youtube and Twitch. And we’re here on our Zoom conference call so we get a lot of replays where people will then come back later and ask questions, so we can always wrap up with that.

And I do see one question here. They were asking about, you had mentioned early in the Webinar that there was kind of a connection or an assumed connection between the Akira Ransomware Group and the Conti Ransomware Group who, I think anyone in the cybersecurity space is pretty familiar with the Conti group. Can you expand a little bit on what that connection is between those two groups.

 

Chris Prest: Sure, sure.

So, it’s suspected, because the Crypto Wallet payments that were made between known Akira members and some past Conti members took place. So those transactions took place, so most likely there was a link between the two. So that’s why it’s very suspected that some of those members may be working with or working for this gang, specifically.

 

James McCarthy: Yeah, that is interesting because it means that you know some of the Old Guard as old as much as you can call the Conti group an old guard. They’re learning, and they’re adapting. They’re changing their tactics maybe under a new flag. But it’s a very established group of people who have figured out a new vector, and so I can’t imagine this is going to go away anytime soon.

 

Chris Prest: Very true, very true.

 

James McCarthy: Awesome. Well, hey, I think that’s we’re going to go ahead and wrap up here just a couple of minutes past our timing. But, Chris, I really appreciate you taking the time, man. I wanna get you back into the lab and working on those devices as quick as possible. But I appreciate your time, man.

 

Chris Prest: Thank you so much. It was a blast. I appreciate it.