MALWARE/TOOLSPROFILE

By Insikt Group®
October 14, 2021

RedLine Stealer Is
Key Source of Identity Data
for Criminal Shops

MALWARE/TOOL PROFILEKey Judgments• RedLine Stealer malware steals information that canbe easily monetized, including usernames, passwords,
cookies, payment card information, and cryptocurrency
wallet information.
• The infostealer is marketed by the threat actor REDGladeon Telegram and several criminal forums; a cracked
version has also become available.
• RedLine Stealer has been widely adopted by criminals
over the past year.

Insikt Group used the Recorded Future® Platform, dark web analysis,
and proprietary and open sources to assess the RedLine infostealer
malware and its use as a source of stolen information for Russian Market
and Amigos Market. This report will interest threat intelligence analysts,
security operations centers (SOC), and incident response teams who
defend against data theft attacks.
Note: This report was updated on October 19, 2021 with additional
insight on the relationship between Russian Market and Amigos Market
provided by contacts at the KELA Group. We thank the KELA team fortheir contributions to this research.

• RedLine Stealer is a primary source of the stolen
information sold on multiple criminal shops, including
Amigos Market and Russian Market.
• The volume of advertisements for stolen log information
harvested by RedLine Stealer has increased over the
past year, aligning with the increased attention RedLine
Stealer has gotten across entry-level and top-tiercriminal sources.

Background

Executive Summary

RedLine Stealer is sold by the actor REDGlade on various
forumsand on Telegram beginning in February 2020. The
RedLine Stealer is an infostealer malware marketed
infostealer
is offered as malware-as-a-service with a subscription
and sold on several online criminal forums by the
Russian-speaking cybercriminal “REDGlade”, also known of varying lengths available.
as “Glade”. RedLine Stealer is used to steal credentials
Online discussions, reporting, and activities involving RedLine
and other information such as cryptocurrency wallet Stealer increased in March 2021 and have since been relatively
files that are easily monetized by direct use or sale to constant. This increase is also a reflection of reporting andother criminals. The sale of this stolen data is often sharing of information about RedLine Stealer as it has become
conducted through underground markets that provide more broadly recognized as a threat by the security community.
one-stop shopping for criminals involved in identity theft
RedLine Stealer collects usernames, passwords, cookies,
or who simply wish to cash out what they can based on
saved credentials, and credit card information from browsers. It
the stolen credentials available.
also collects data from FTP clients and IM clients. The malware
The infostealer has seen broad distribution since its also provides file collection functionality, and the user caninitial release in early 2020. Insikt Group identified and specify collection from certain file folders to gather files fromanalyzed multiple samples of RedLine Stealer, along with cryptocurrency cold wallets and other file locations.
a cracked builder for the malware, and concluded that
RedLine Stealer is also capable of performing basic download
the advertised capabilities of the malware are accurate.
and execute functions. The malware can download files fromRedLine Stealer has been actively in use since specified links, run executable programs, and open links via a
the first quarter of 2020 but has become more widely browser. It is therefore capable of loading additional malware
adopted in 2021. The infostealer is competently written onto the victim system. The RedLine Stealer malware can be used
and maintained, and due to the variety of threat actors purely for credential and data theft or as a loader and installer
operating it, RedLine Stealer can be associated with a for other malware. Although in most RedLine Stealer incidents
wide array of tactics, techniques, and procedures (TTPs). that have been observed the malware was used primarily as
However, despite this diversity of TTPs, Recorded Future an infostealer, incident responders discovering a system with
was able to create network and endpoint signatures for RedLine Stealer installed should presume that other malware
defenders to detect the use of RedLine Stealer.
may also be installed on the system.

1

MTP-2021-1014

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

Figure 1: Timeline of RedLine Stealer events 2020 to 2021 (Source: Recorded Future)

Methods of Distribution

Threat Analysis

RedLine Stealer is commonly distributed by phishing email,
RedLine Stealer is one of the most notorious infostealer
as well as messaging on social media. The phishing email lures brands being sold on the dark web for the last year and a half.
are often topical, concerning current events such as COVID-19 The stealer is associated with several threat actors primarily
information. RedLine Stealer has also been found disguised as operating on low-tier Russian-speaking forums and Telegram
legitimate applications, including as an installer for Telegram, channels.
and has been installed via SmokeLoader masquerading as
RedLine Stealer was first advertised on February 18, 2020,
privacy software. Legitimate websites may be used as part of theon the low-tier Best Hack Forum (BHF) by the threat actor
infection chain for RedLine Stealer distribution. As a commodity
REDGlade. Similar advertisements were observed several days
malware that has been available since early 2020, and for which
later on other Russian-language low-tier forums WWH Club by
a cracked version has been released, the malware is used by
the threat actor Glade. All advertisements listed the Telegram
disparate operators; thus, initial RedLine Stealer installation
channel @REDLINESUPPORT as a primary point of contact forvectors may include many different methods and techniques.
the interested parties, a contact which is still active at the timeof this publication. REDGlade also originally registered on Best
Hack Forum on February 13, 2020, and has a positive reputation
among other cybercriminals on the forum. Analysis of the content
published by REDGlade indicates that they are primarily involvedin the sales and support of RedLine Stealer. REDGlade was also
active on other Russian-speaking dark web forums posting
about RedLine Stealer. The threat actor Glade registered on
WWH Club forum on February 13, 2020, the same date REDGladeregistered on BHF. Considering identical product listings, datesof registration, and the Telegram handle @REDLINESUPPORT,
Insikt Group believes that the usernames REDGlade and Glade
are very likely operated by the same individual or threat actor
group.
www.recordedfuture.com | Recorded Future ®

MTP-2021-1014

2

MALWARE/TOOL PROFILE

Figure 2: List of sources with RedLine Stealer advertisements (Source: Recorded Future)

Examination of dark web discussions indicates that the
RedLine Stealer is advertised as having the following
primary sources supporting the sale of RedLine Stealer are BHF technical functionality:and WWH Club forums. The seller encourages threat actors to use• A customizable file-grabberpersonal messages and forum escrow for conducting purchases• Filters for country and operating system (capable ofand provides a 20% discount for all types of goods and services
setting up a blocklist of countries where the build will notthat meet the requirements. Open-source references toward
work)
the Telegram handle @REDLINESUPPORT indicate that it was• Create and edit tasks
allegedly registered in Denmark.
According to the threat actor, RedLine Stealer is an infostealer
with an admin panel developed in C# and steals login data frommultiple sources, including:• All Chromium and Mozilla Gecko-based web browsers• Cookies• Panel configuration that enables actors to remove
duplicate logs
• Collect information about the victim’s system basedon the following indicators. Information can be viewed
directly from the panel without opening the log:
• IP address• Account credentials• Country• Payment card data

• City• Autofill forms• Current username• FTP and Instant messenger client data

• HWID• Keyboard layouts• Screenshot• Screen resolution• Operating system3

MTP-2021-1014

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

Figure 3: RedLine Stealer sales thread on the dark web (Source: BHF Forum)• UAC settings• Types of privileges• User-Agent• Information about the components of the infected
machine (video cards and processors)• Installed antiviruses
Initial advertisements for RedLine Stealer detailed several
secondary tasks or functions it supports, such as:• RunPE — injection of a 32-bit file downloaded from a
direct link into another user-specified file
• DownloadAndEx — download a file via a direct link to thespecified path from subsequent launch• On August 26, 2021, the threat actor “alfy1331”
publicly shared on XSS Forum a cracked version of
RedLine Stealer v. 20.2. According to the threat actor,
the infostealer was cracked by another threat actor
with the Telegram account @kurome_sup. A search
for this Telegram handle on dark web sources foundthe threat actor “Kurome”, a member of the low-tierRussian-speaking forum, who uses it as a primary pointof contact. This upload likely had a cascading effectas other forums, including Best Hack Forum, where
REDGlade initially operated, had members sharing
cracked versions of RedLine Stealer with the sameversion as the sample uploaded to XSS Forum: Version
20.2.

• OpenLink — open the link in the default browser• Downloading files via a direct link to a specified path

“Cracked” Versions of RedLine Stealer
Threat actors continue to distribute “cracked” versions of
RedLine Stealer in 2021. The distribution of cracked versions of
RedLine Stealer is not a new phenomenon and has been reported
as far back as 2020. While the validity of these cracked versionsof the stealer from over a year ago is less certain, actors in
2021 attempting to gain access to the malware are more likely torely on recent iterations of RedLine Stealer that were reportedly
leaked across multiple sources within the past two months.

www.recordedfuture.com | Recorded Future ®

MTP-2021-1014

4

MALWARE/TOOL PROFILE

According to REDGLade, there are 2 types of subscription
licenses for the latest malware variants:• “PRO”, a lifetime license available for $800 with 3 monthsof free crypt service and antivirus scan check• “Lite”, a 1-month license with 1 month of free cryptservice available for $150
REDGLade previously provided discounts to buyers, andthe subscription costs have varied since the product’s launchin February 2020. RedLine Stealer is advertised as accepting
payments in the following cryptocurrencies: Bitcoin, Litecoin,
Ethereum, Monero, and Tether. Additionally, RedLine Stealer’s
Telegram support channel has continued to provide updates
regarding new features available to Lite and PRO users
throughout 2021. In February 2021, the channel stated that
future builds would be signed by default with Code Signing
digital certificates.

Figure 4: alfy1331 shared cracked version of RedLine Stealer v.20.2 builder (Source: XSS Forum)

As of this writing, the latest version of RedLine Stealer,version 21.2, was released on September 3, 2021. alfy1331
stated that the admin panel of the malware was updated andold RedLine Stealer builds would not work in the updated admin
panel.

Since its initial appearance, RedLine Stealer has continued
to be adopted by top-tier cybercriminals. A thread launched
on June 27, 2021, on the top-tier Russian-speaking forum
Exploit called “Raccoon VS Redline VS Smoke” detailed how
cybercriminals discussed the positives and negatives of various
infostealers that currently operate on the dark web market.
Participants stated that RedLine Stealer has good technicalfunctionality and provides compromised credentials and otherrelevant data as stated in the specs. Also, they stated that oneof the primary advantages of RedLine Stealer is its crypt service,“Spectrum Crypt Service” @spectrcrypt_bot. For example, thethreat actor “_pra9ma” added that its functionality is similar tothat of AZORult stealer.

Figure 5: Yorkshire looking for RedLine Stealer source code (Source: Exploit Forum)

5

MTP-2021-1014

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

Given its positive feedback among cybercriminals, thesource code of RedLine Stealer is sought after by many threat
actors, who are ready to pay a price significantly higher than its
lifetime license cost. On September 17, 2021, the threat actor“Yorkshire” on Exploit Forum was going to buy RedLine Stealer’s
source code for $2,000.

Role of RedL ine Stealer in Underground Shops
Analysis of the dark web shops involved in the sales ofthe stolen account credentials indicates that RedLine Stealer
continues to supply several prominent underground shops,
including Russian Market and Amigos Market, with the largest
number of compromised accounts as of this writing in comparison
to 4 to 5 other stealers often leveraged by its administrators.
Typically, the prices for RedLine Stealer-compromised accounts
are higher than other infostealers. Recently compromised
accounts by RedLine Stealer cost $10.

Figure 6: RedLine Stealer listings for sale on the dark web (Source: Russian Market)

www.recordedfuture.com | Recorded Future ®

MTP-2021-1014

6

MALWARE/TOOL PROFILE

Stealer

Russian Market
Listings

Amigos Market
Listings

RedLine761,985

765,217

Vidar

645,078

645,078

Taurus95,417

95,417

Racoon85,95187,720AZORult

48,663

48,663

RedLine Stealer Admin Panel Analysis
On August 26th, 2021, alfy1331 shared a cracked versionof the admin panel used to build RedLine Stealer and explore
data stolen from infected machines on XSS Forum, giving otherthreat actors free access to RedLine Stealer. The cracked version
shared on XSS is version 20.2; as of this writing the official
RedLine Stealer is up to version 21.2. Insikt Group acquired thiscracked version for in-depth analysis.

There are only 4 steps involved to configure the cracked
version. These steps can be completed in under 10 minutes by anexperienced threat actor. This includes running 2 executables as
Does not supply
1,561
Fickeran administrative user, logging in to the panel using the supplied
credentials
username (“ims0rry”) and password (“racoon”), and filling out
a few fields in a panel that generates a functioning build of
Table 1: Compromised account listings by infostealer brand on Amigos Market and Russian Market(Source: Recorded Future Data)
RedLine Stealer. The cracked distribution also contains an FAQ,
a 12-page PDF included when RedLine Stealer is purchased
Despite the volume of RedLine Stealer infections appearing
from the original developer. The FAQ has detailed installation,across Russian Market and Amigos Market listings, both Amigosbuilding, crypting, and general configuration and customization
Market and Russian Market were identified by Insikt Group (Juneinstructions, making RedLine Stealer more accessible and easy2021) posting identical listings regularly that contained the same
to use for any threat actor on the dark web.
timestamps, infostealer variants used, geographical locations of
Before generating a build for RedLine Stealer, threat actors
affected machines, and ISPs. This also means that the figures inTable 1, above, tabulating the true number of listings across the can customize the build settings using the panel seen in Figure
2 shops is inflated by nearly double, as there are a large number 7 below. Threat actors can choose to collect data from browsers,
VPN clients, Steam, Telegram, and more. They can also specify
of listings on both shops which are identical.
which files they want to retrieve, including the use of wildcard
KELA Group shared research with Insikt Group to further
filtering, and also which domains to filter for, including sensitive
corroborate the relationship between the 2 shops. Their research
passwords and cookies.
highlights unique identifiers, viewable by inspecting the HTMLThe cracked version of RedLine Stealer also includes apage content, that are identical between Russian Market andstandalone
builder configured with the default parameters seen
Amigos Market. Bot data being advertised on Amigos Market thathas been scraped from Russian Market uses the identifier that above. Threat actors can use the cracked standalone builder
was assigned to this data set on Russian Market and prepends (Kurome.Builder) to specify their server IP address, port, build
it with the letter “v”. In some instances, the same stolen data is ID, and error message, as seen in Figure 8 below. Insikt Groupre-listed on Amigos Market for a 50% markup over its price on developed a script to extract the configuration information from
Russian Market. KELA’s analysis shows that of the 1.5 million bots an executable that was built using the cracked builder. The script
being advertised on Amigos Market, the number of identifiers and extracted configuration details are available to Recordedthat do not have the prepended “v” designation is a small fraction Future clients.
of what is being advertised overall, suggesting a large portionof Amigos Market is almost entirely a mirror of Russian Market.

Insikt Group used the cracked builder to create a malware
sample that exfiltrated the collected data to an admin panel
running in our lab. This gave us access to the data exfiltrated
from the infostealer and allowed us to interact with the data
Technical Analysis
using the admin panel. The panel view labeled “Logs” contains a
Insikt Group analyzed the 3 main RedLine Stealer components: list of machines infected with RedLine Stealer that have finishedthe legitimate admin panel, which contains an integrated builder exfiltrating stolen data. This can be seen below in Figure 9,that requires purchasing the software to use, the cracked version, along with the options available to the threat actor to explore
which allows free access to the admin panel but does not allow the stolen data.
builds to be created from within the panel, and a cracked builderthat generates RedLine Stealer builds outside of the admin panel
without needing to pay for the software.

7

MTP-2021-1014

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

Figure 7: RedLine Stealer build settings panel (Source: Recorded Future)

Figure 8: RedLine Stealer builder options (top) and cracked builder (bottom) (Source: Recorded Future)

www.recordedfuture.com | Recorded Future ®

MTP-2021-1014

8

MALWARE/TOOL PROFILE

Figure 9: RedLine Stealer panel showing exfiltrated logs from infected machine (Source: Recorded Future)

One of the menu options, “System Info”, gives the threat
actor a detailed view into the infected machine, such as theinstalled operating system, hardware details, a screenshot,
installed antivirus, the country code, IP address, and other useful
information, which can be seen in Figure 10 below.
Threat actors can access specific logs to gain information
to support further operations. An example, seen below in Figure
11, shows the detailed view giving the threat actor access tothe cookies stolen from the infected machine. Theft of cookies
can lead to session hijacking and session spoofing, which canallow an attacker to impersonate the infected user and accesswebsites they frequent.
Information exfiltrated from an infected machine can besaved locally to be accessed outside of the dedicated admin
panel. Additional information outside of what is displayed in thepanel can be found in the saved logs, including a list of installedsoftware, a process list, and more detailed user information.
Threat actors that manage multiple deployments of RedLine
Stealer can use the “Statistics” tab in the panel to get an overview
of the data they’ve successfully stolen. The statistics include
the number of wallets, passwords, credit cards, and cookies, aswell as statistics about the top 10 operating systems, antivirus
systems, and countries where they’ve deployed RedLine Stealer.

9

MTP-2021-1014

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

Figure 10: System information and screenshot exfiltrated from an infected machine to RedLine Stealer admin panel (Source: Recorded Future)

Figure 11: Cookies exfiltrated from an infected machine to RedLine Stealer panel (Source: Recorded Future)

www.recordedfuture.com | Recorded Future ®

MTP-2021-1014

10

MALWARE/TOOL PROFILE

Figure 12: Saving a “log” from an infected machine results in these files being saved to the specified folder (Source: Recorded Future)

Figure 13: RedLine Stealer panel showing statistics about infected machines that communicate with this command and control server(Source: Recorded Future)

RedLine Stealer Analysis

developed RedLine Stealer included recommendations in the FAQ
on crypting services available via Telegram that can be used
The RediIne Stealer is written in C#, and based on Insikt
with RedLine Stealer, one of which is the @spectrcrypt_bot. The
Group’s analysis, the code appears to be written by an experienced
recommended services are:C# developer. The malware has a modular design with classes• Using the /defensenet command in @spectrcrypt_bot,
dedicated to each task or module, seen below in Figure 14. This
which is operated by the threat actor
allows new components to be written and integrated with minimal
overhead. The icon file associated with the executable can varyfrom build to build as it can be specified by the threat actor
using the RedLine Stealer admin panel. Builds created using thecracked builder have an original filename “Implosions.exe”, theassembly name “Happy.exe”, and are 96 KB; however, this canchange depending on the layers of obfuscation applied by eachthreat actor after building RedLine Stealer. The threat actor who

11• Using the /defense command in @spectrcrypt_bot, andthe executable will be crypted on crypter[.]biz• @Floiar• @ninjacrypterbot

MTP-2021-1014

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

Figure 14: Modules included in RedLine Stealer version 20.2 (Source: Recorded Future)

Figure 15: Example of the ProtonVPNRule class highlighting developer tendencies (Source: Recorded Future)

www.recordedfuture.com | Recorded Future ®

MTP-2021-1014

12

MALWARE/TOOL PROFILE

Figure 15 highlights the following trends used by thedeveloper throughout the RedLine Stealer code:
1. The code obfuscates path strings and uses string
replacement functions to determine the real file path,
helping the malware evade static string detection.
2. It uses arrays for strings instead of string variables andstores strings in reverse order to avoid string detection.
3. Continuous misspellings of words can be found within
the code.
The bulk of the collection can be seen in the module labeled“ResultFactory”, specifically in the function called directlyfrom the application’s Program.Execute main function named“sl9HSDF234”. Interestingly, the names of the functions in
ResultFactory are obfuscated, while all other function names inthe binary are unobfuscated.
RedLine Stealer will terminate its own process and delete
itself from disk in an attempt to remain undetected aftercollecting and exfiltrating the stolen data.

RedLine Stealer samples execute various commands thatcan be keyed on for detection. Although the PID and the pathof the executable will change depending on the environment
this instance of RedLine Stealer is running in, these commands
and subsequent actions can be used for detection. We havecreated a Sigma rule to detect the use of commands and thisrule has been shared on the Recorded Future Platform.
Insikt Group has also created a YARA rule for RedLine
Stealer. The YARA rule is based upon uncommon strings
found in the code as well as the misspellings described in the
RedLine Stealer Analysis section. The YARA rule is available to
Recorded Future clients.

Network-Based Detection
Network detection logic can be developed by making useof several key elements in the communications between the
RedLine Stealer implant and the command and control (C2)server:Since the release of the cracked builder, the original developer
has continued to add functionality to RedLine Stealer. Some
researchers report the addition of more types of crypto wallets
being collected from newer samples including TerraStation,
HarmonyWallet, Coin98Wallet, TonCrystal, and KardiaChain.

• RedLine Stealer communicates using the Microsoft
Simple Object Access Protocol (SOAP), which allows
applications to transfer data over HTTP. Tempuri[.]org
is the default domain used by Microsoft development
products including SOAP, and this and other SOAP
artifacts are observed in the RedLine Stealer C2 traffic.
• Specific communications from the server are visible in
the traffic, including commands from the C2 to gather
information. There are some uncommon strings used.

Host-Based Detection• Specific communications from the infected system arevisible in the traffic, such as system enumeration andresponses to commands. Some uncommon strings are
used.

Figure 16: ResultFactory class showing the list of collected data (left), and a detailed view of the scanned wallets (right) (Source: Recorded Future)

13

MTP-2021-1014

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

Figure 17: RedLine Stealer-infected communication displaying SOAP interaction and C2 server instructions (Source: Recorded Future)

RedLine Stealer C2 servers use TCP, but do not use any
specific port. As mentioned in the technical analysis section
above, the port can be set within the RedLine Stealer builder.
RedLine Stealer C2 servers most often are observed using
random, high port numbers such as 11915 or 31858. Benign SOAP
traffic is often on port 80, however, RedLine Stealer C2 servers
have been observed operating on port 80 as well.
Not all of these elements are specific to RedLine Stealer,and in fact those such as the use of SOAP or port 80/TCP arequite common in network traffic. But by combining some ofthese features, effective detections may be developed. Basedon this data, Snort IDS rules were created using aspects of thepreceding elements these are available on the Recorded Future
Platform.

Active C2 Server Detection
Insikt Group detects active RedLine Stealer C2 servers basedon configuration data extracted from RedLine Stealer samples,
which are then validated by checking for the appropriate
response from the server. C2 servers so identified can be foundin the Recorded Future Platform.
There are also open-source resources available fororganizations to keep informed of RedLine Stealer C2 servers
observed in the wild, such as the ThreatFox compilation of
RedLine Stealer C2 servers provided by Abuse.ch.

www.recordedfuture.com | Recorded Future ®

MTP-2021-1014

14

MALWARE/TOOL PROFILE

Outlook
RedLine Stealer has become increasingly popular since
its launch in 2020 based on a general increase in reference
count observed among underground sources monitored by
Insikt Group. This increase has been furthered by the influx ofcracked versions of RedLine Stealer distributed across Englishlanguage cybercriminal forums, such as Raid Forums, that areeasily accessible even to actors with less experience with similar
tooling. RedLine Stealer’s role as a secondary payload that
supplements threat activity tied to other popular undergroundtooling, such as SmokeLoader, raises the probability that thisstealer will continue to be a reliable method of data harvesting forthe near future. The demand for stolen login information derived
from RedLine Stealer infections for sale within the criminal
underground similarly ensures that shops and marketplaces willcontinue to rely on it as a primary source of stolen information tosell. This continues to be reflected on multiple popular infostealer
shops, such as Russian Market, where RedLine Stealer infections
are associated with the highest volume of infected machines
when compared to other popular infostealers including Vidar and
AZORult.
Several links to cracked versions of RedLine Stealer
distributed within underground sources are no longer active, with
REDGlade likely to have taken steps to prevent old builds of theinfostealer from working with the new admin panel. However,threat actors who have already downloaded the older, cracked
RedLine Stealer package, which includes a builder and control
panel, can continue using and sharing the malware without any
cost.
Despite the release of a cracked version of the RedLine
Stealer, REDGlade has continued to develop the malware andnow sells a new, updated version. It is expected that both the“legitimate” and cracked versions of the malware will remain
popular due to the free or minimal cost of this effective infostealer.
We expect that the criminal marketplaces currently selling datacollected by RedLine Stealer will continue doing so as long as themalware remains an effective means of accomplishing this task.
Since REDGlade continues to update RedLine Stealer withnew functionality and continues to add new features to theadmin panel, detections will need to be verified and updated
accordingly in the future.

15

MTP-2021-1014

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

About Recorded Future
Recorded Future is the world’s largest provider of intelligence for enterprisesecurity. By combining persistent and pervasive automated data collection and analytics
with human analysis, Recorded Future delivers intelligence that is timely, accurate,
and actionable. In a world of ever-increasing chaos and uncertainty, Recorded Futureempowers organizations with the visibility they need to identify and detect threats
faster; take proactive action to disrupt adversaries; and protect their people, systems,
and assets, so business can be conducted with confidence. Recorded Future is trusted
by more than 1,000 businesses and government organizations around the world.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

www.recordedfuture.com | Recorded Future ®

MTP-2021-1014

16