CYBERTHREATANALYSIS

By Insikt Group®
January 17, 2023

Annual Payment Fraud
Intelligence Report: 2022

CYBER THREAT ANALYSISThis report provides trends and metrics for the payment card fraud landscapein 2022 and identifies the merchants most frequently compromised or abusedas tester merchants. The target audience of this report is fraud and cyber threat
intelligence (CTI) teams at financial institutions and merchant services companies.

Executive Summary
2022 was a year of system shocks, and the payment cardfraud market did not survive unscathed. Russia’s cybercrime
crackdown — followed promptly by its full-scale invasion of
Ukraine in February 2022 — spawned lower carding volumes
for the remainder of the year. In total, 2022 saw 45.6 million
card-not-present (CNP) and 13.8 million card-present (CP)payment card records posted for sale to carding shops on thedark web. These figures were considerably lower than the 60
million CNP and 36 million CP records posted for sale in 2021.
Taken together, this decreased supply, demand, and turnoverdefined the payment card fraud market and threat landscapethroughout 2022.
In spite of this, the card fraud market and the threat actors
who populate it demonstrated remarkable resilience. Magecart
actors launched campaigns that employed fake payment card
forms, exploited legitimate merchant web infrastructure to
deploy e-skimmers, and used HTTP referer headers to impede
remediation by security analysts. One of these campaigns led
to the compromise of 2 online ordering platforms, a trending
tactic that exposes merchants who use the platforms to the riskof being compromised. Meanwhile, high-profile merchants wereincreasingly exploited by individual threat actors and checker
services on the dark web in order to verify the validity of stolencards. And finally, as war in Ukraine hampered cybercriminals’
ability to engage in card fraud, one top-tier carding shop exploitedthe lull in supply by flooding the market with recycled payment
card records. Although frustrated by these records’ low quality,
resourceful threat actors may nevertheless use them as cheap
sources of personally identifiable information (PII) that they canweaponize to carry out targeted account takeover (ATO) attacks
against their victims.
By employing proactive anti-fraud strategies that integrate
intelligence from throughout the payment fraud life cycle,
financial institutions and card issuers can reduce card fraud
losses in 2023. The overall level of card fraud activity in 2023 will
be highly dependent on whether or not Russia’s war in Ukraine
continues; if it does, threat actors’ ability to engage in card fraud
will likely remain degraded. But should the war end, a renewal or
increase in payment card fraud may follow.

1

Key Findings• 45.6 million CNP payment card records were posted
across dark web carding shops in 2022, down 24% from2021. It is highly likely that this year’s relatively low CNP
volumes are the result of Russia’s early-2022 cybercrime
crackdown and its subsequent full-scale invasion of
Ukraine. In 2022, the highest-impact CNP breaches
affected online ordering platforms.
• 13.8 million CP payment card records were posted acrossdark web carding shops in 2022, down 62% from 2021.
While it is possible the year’s events contributed to thisdrop-off, year-by-year CP volumes have also steadily
declined due to the rising global adoption of more secure
in-person payment methods. In 2022, CP breaches
overwhelmingly affected small restaurants and bars.
• The Recorded Future® Magecart Overwatch program
discovered 1,520 unique malicious domains involved in
the infections of 9,290 unique e-commerce domains at
any point in 2022.
• Full primary account numbers (PANs) for at least 20.5
million compromised payment cards were posted asplaintext or images to various resources including dark
web forums, pastebins, and social media.
• 21 card checker services monitored by Recorded Future
abused 2,953 unique merchants associated with 660
unique merchant identification numbers (MIDs) for illicit
card checks.
• Threat actors focused on avoiding or bypassing
protections offered by the 3-D Secure (3DS) protocol andincreasingly discussed the abuse of customer service
call centers as a means of facilitating their attacks.
Furthermore, a surge in cheap, reposted payment card
records posted throughout 2022 increased the attack
surface for ATO attacks.
• The payment fraud life cycle closely resembles a realworld market underpinned by supply chains, coordinatedexchange between buyers and sellers, and the provisionof services such as checkers. Although this high degreeof organization increases the opportunities and impact
of card fraud, it also produces a data-rich environment.
Therefore, card issuers, acquirers, and merchant service
providers should incorporate and integrate intelligencefrom across the payment fraud life cycle to proactively
combat fraud.

CTA-2023-0117

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 1: Payment card fraud conforms to a general life cycle (Source: Recorded Future)monetize it, usually through fraudulent transactions. If actors canacquire enough of a victim’s personally identifiable information
Background(PII), they can even attempt account takeover (ATO) attacks to
Payment card fraud exists as part of a sophisticatedcash out their victim’s bank account.
underground economy. Production networks, supply chains, andThroughout 2022, Recorded Future monitored this shadow
dark web carding shops provide threat actors with the means tomarket criminal services and wares to their peers or to purvey economy to empower clients to disrupt fraud at every stage ofstolen data to end users who engage in card fraud. Within this the payment card fraud life cycle. In the course of our monitoring,shadow economy, payment card fraud conforms to a certain “life we observed both continuing trends from 2021 and novel trends
that grew organically from the events of 2022.
cycle”, as seen in Figure 1.
At the beginning of the life cycle, physical compromises
facilitate the theft of payment card data from merchants’ card- Magecart E-Skimmer Infections
present (CP) transactions. Meanwhile, cybercriminals enact digital
Magecart e-skimmer attacks are used to steal customer
compromises — often with Magecart e-skimmer infections — topayment card data from e-commerce websites and exfiltrate it
steal card data from online card-not-present (CNP) transactions.
to the attackers’ infrastructure. From there, stolen records canThese stolen card records are posted for sale to the dark web,
be sold on the dark web.
where partial payment card data is put on display so criminal
buyers can go “window shopping”. Occasionally, carding shops
In 2022, Magecart attacks continued to enjoy popularity
release full stolen payment card data for promotional purposes, among dark web cybercriminal communities. Recorded Future
which provides one of the many opportunities for criminals to observed 1,520 unique malicious domains that were used tosnatch up full primary account numbers (PANs). Before making a host e-skimmer payloads or receive stolen payment card datasale, carding shops use aptly named checkers to appraise stolen from infected e-commerce domains. 9,290 unique e-commercecard sets; individual criminals use the same checkers to verify domains suffered from an infection at any point in 2022. Of
their records’ validity before or after purchase. Once “end user” these, 2,468 e-commerce domains remained actively infectedfraudulent actors acquire their desired payment card data, they at the close of 2022.

www.recordedfuture.com | Recorded Future ®

CTA-2023-0117

2

CYBER THREAT ANALYSIS

Figure 2: Quantity of high-risk Magecart infections that affected each country in 2022 (Source:
Recorded Future)

Figure 2 shows the quantity of high-risk Magecart infections
Recorded Future also discovered a novel Magecart campaign
in each country. An infection is only considered high-risk for in which a malware server used the HTTP referer header incountries that appear in the infected website’s “Top 5” sources requests to limit downloads of malicious scripts. Threat actorsof web traffic (according to Similar Web). If an infected website’s injected links to malicious JavaScript files into e-commerce
web traffic data was unavailable, analysts substituted it with the shops, but the server hosting these files only sent the malicious
location where the website was hosted to determine whether or scripts when: 1) HTTP referer headers were present; and 2)
not the infection was high-risk.
their value reflected the infected e-commerce websites. This
technique was likely meant to impede security analysts in
Fake payment card forms and attack-carrier domains
remediating infections. As with Magecart Group 7’s campaign,(legitimate e-commerce domains that threat actors havethis campaign’s malware installed fake payment card forms oncompromised and incorporated into their attack infrastructure)checkout pages.
enjoyed frequent use throughout 2022. In January 2022,
Magecart Group 7 launched a Magecart campaign that saw
In December 2021 and September 2022, we reported on how
fake payment card entry forms injected onto e-commerce Magecart actors exploit Google Tag Manager (GTM) containers
websites to replace legitimate payment gateway subforms and to infect e-commerce sites, and this trend continued throughout
inline frames (iframes). As previous attack-carrier domains 2022. GTM is a legitimate web service used for internet marketing,became inaccessible, Magecart Group 7 repeatedly migrated website usage metrics, and customer tracking. 2 GTM-based
its operations to new attack-carrier domains. In total, 12 attack- e-skimmer variants have been involved in Magecart infections
carrier domains were abused during this campaign to infect 1,141 since as early as March and June 2021; a third was found in
websites.
Magecart infections that began no later than July 2022. In total,
we have detected 891 e-commerce domains that were infectedby any of these variants.

3

CTA-2023-0117

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 3: Blue pins represent the physical location of merchants affected by CP breaches, whereas orange pins represent the headquarters for companies affected by CNP
breaches (Source: Recorded Future)

Top Payment Card Breaches in 2022
As we scour the web for Magecart infections, our analysts
hunt down common points of purchase (CPPs) linked tostolen payment cards offered for sale on the dark web.
Through collaboration with partner financial institutions, wereported breaches that exposed customer payment card
data at over 1,000 unique merchants in 2022. For 77% of themerchants, we have identified compromised payment cards fromthe breaches on the dark web. As shown in Figure 3, merchants
in all 50 states and the District of Columbia were affected, withthe heaviest concentrations in major metropolitan areas.
While CP breaches overwhelmingly affected small restaurants
and bars, CNP breaches predominantly affected e-commerce
websites across various industries and were largely conducted
through Magecart e-skimmer infections. The highest-impact
CNP breaches occurred as a result of “platform breaches”,
which are attacks that compromise an e-commerce service thatfacilitates online sales or website management. By targeting an
e-commerce service, threat actors create a disproportionately
expanded attack surface, causing a significant number of client
merchants that use the platform to be compromised.
Among this year’s platform breaches, the highest-impact
compromises targeted outsourced online ordering solutions
for restaurants and ticketing solutions for entertainment andtransportation companies:

www.recordedfuture.com | Recorded Future ®

• MenuDrive and Harbortouch, both of which are online
ordering platforms for restaurants, were targeted by asingle Magecart campaign that resulted in e-skimmer
infections for 80 restaurants using MenuDrive and 74
using Harbortouch. This campaign began no later thanJanuary 18, 2022, and persisted into Q2 of 2022.
• Another online ordering platform, InTouchPOS, wastargeted in a separate, unrelated Magecart campaign
resulting in e-skimmer infections for 157 restaurants
using the platform. This campaign began no later thanNovember 12, 2021, and persisted into Q2 of 2022.
Disturbingly, similarities in attack methodology suggestthat the actors responsible for compromising InTouchPOS
were also responsible for the HTTP referer header
campaign (referenced in the Magecart section above).
• Core Cashless, an online ticketing platform foramusement parks, was breached, resulting in the
exposure of payment card data from transactions at 45
amusement parks. First reported by Recorded Future in
mid-July 2022, Core Cashless publicly acknowledged thebreach in September 2022, claiming the breach lasted
from January 2022 to July 2022.

CTA-2023-0117

4

CYBER THREAT ANALYSIS

Compromised Payment Cards on the Dark Web

Carding Shops and Trading Volumes

In 2022, 45.6 million CNP and 13.8 million CP payment card
Once threat actors have compromised payment cards,
records were posted for sale across dozens of carding shops. Of
they can either attempt to fraudulently monetize the records
these 59.4 million compromised payment card records, 70% werethemselves, or sell the compromised records to other actors,
issued by financial institutions in the United States. The abuse
often via carding shops.
of stolen CP records was once the dominant form of card fraud,
That said, the threat actors who compromise payment cards but over the past few years the volume of CNP records posted
are rarely the same ones who use them to commit fraud. Payment for sale has overtaken CP records. 2 trends drive this shift:card fraud is an unpredictable, time-consuming process.
Fraudulent actors must operate logistical networks, resell goods• A decrease in CP volumes due to the rising adoption
and services, devise and execute cash-out schemes, and launderof secure in-person transaction technologies (such as
their criminal profits. Alternatively, threat actors can simply
EMV chips and contactless payment) and the massive
sell their stolen payment cards on carding shops to generate
reduction of in-person transactions during the COVID-19
predictable, painless profits.
pandemic
Magecart e-skimming is an illustrative example. In 2022,• An increase in CNP volumes due to Increased online
the average infected website saw 5,215 monthly visitors, andshopping, the advancement of Magecart e-skimming
according to e-commerce platform BigCommerce, averagetechniques, and the proliferation of Magecart-as-acustomer conversion rates range from 2.5 to 3%. If threat actors
servicecollect between 130 to 160 cards per month from each of theirinfected websites and then sell them at an average price of $15
This year, the card fraud market was heavily disrupted by
USD per compromised card, they could easily earn between$1,950 and $2,400 USD per month, per infected website. geopolitically driven events. In January and February 2022,
Magecart threat groups often operate dozens of e-skimmer Russian law enforcement launched an unprecedented crackdown
infections at any given moment. This enables them to amass on domestic cybercrime, shutting down several top-tier carding
substantial criminal profits without sinking time and effort into shops. Given that the crackdown occurred during Russia’s troop
buildup on the Ukrainian border, the prevailing theory is thatfraudulent monetization.
Russia sought to signal its intent to cooperate with the West
Usually, threat actors who purchase compromised records
against cybercrime should the West acquiesce to Russian
are either: 1) “lower-tier” threat actors who lack the technicaldemands regarding Ukraine.
expertise to engage in widespread card collection; or 2) “mature”
threat actors with established monetization and moneylaundering networks. Carding shops serve as the connective
tissue of the card fraud ecosystem, bringing together buyers
and sellers.

Figure 4: In recent years, CNP records have overtaken CP records in both supply and demand (Source: Recorded Future)

5

CTA-2023-0117

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 5: Russian law enforcement’s closure of carding shops in early 2022 severely decreased volumes in March and April 2022, before volumes began to rebound in May 2022
(Source: Recorded Future)

Nevertheless, Russia invaded Ukraine in February 2022,
quickly dispelling the climate of fear that had permeated theRussian dark web in the wake of the crackdown. The fear ofprosecution by Russian law enforcement evaporated by midMarch 2022, and volumes rebounded as new carding shops
assumed the lost market share. Yet by the second half of2022, threat actors on card fraud-focused forums increasingly
complained that compromised records were extremely “lowquality” (no longer active and valid). At the same time, ourinternal analysis revealed that several large carding shops were
flooding the market with low-priced, reposted, or fake records.

• Carding shops post compromised cards on fraud-focusedforums and Telegram channels for marketing purposes• Aspiring threat actors/groups post records on forums andTelegram channels to build their reputations• Reckless or inexperienced threat actors post payment
card records and images of compromised cards to social
media• Threat actors involved in negotiations post full records to“pastebins” as a quick and easy way to share data withother threat actors.

Ultimately, lower payment card volumes were posted inTogether with the full PANs, threat actors also frequently
2022 than 2021. From the second half of February through April,post other associated card data (such as expiration date or CVV)
this was almost certainly a result of the Russian cybercrimeand PII.
crackdown. After April, lower carding demand and depressedvolumes of “fresh” records were likely a result of Russia’s war.
It is highly likely that the war has significantly affected Russian
and Ukrainian threat actors’ ability to engage in card fraud asa result of troop mobilization, refugee and voluntary migration,energy instability, inconsistent internet connectivity, anddeteriorated server infrastructure. (Russian-occupied areasof the Donbas region of Ukraine were long suspected to havehosted cybercriminal server infrastructure.)

Full Compromised Payment Card Data Posted toForums, Social Media, and Other Resources
In addition to the 59.4 million partial payment card records
posted to carding shops, the full primary account numbers (PANs)of over 20.5 million compromised payment cards were posted asplaintext or images across various resources including dark web
forums, pastebins, and social media. Although posting the full,
unredacted data of compromised card records deprives actors ofpotential profits from unrealized sales, a range of reasons exists
for doing so. These include the following:www.recordedfuture.com | Recorded Future ®

CTA-2023-0117

6

CYBER THREAT ANALYSIS

Figure 6: In 2022, the full card numbers of 20.5 million compromised cards were either accidentally or intentionally posted to the web (Source: Recorded Future)

In 2022, 21 checker services monitored by Recorded Future
abused 2,953 unique merchants associated with 660 uniquemerchant identification numbers (MIDs) for illicit card checks.
Often, purchasing stolen payment cards is the first step in Among the unique MIDs that surfaced during our checkera threat actor’s efforts to make illicit purchases. Occasionally, services monitoring, the 5 most common merchant category
the fraudster may purchase a card that has already been codes (MCC) abused by checkers are listed below.

“Checkers”: Criminal Services for Verifying
Compromised Card Validity

flagged as stolen by the issuing financial institution, barring thefraudster from monetizing that card. As a result, carding shops
and individual fraudsters use “checkers”: dark web services thatallow them to determine if a card is valid or if it has been flagged
as stolen.

MCC

Description

8011

Doctors–not elsewhere classified

5999

Miscellaneous and Specialty Retail Stores
Health Practitioners, Medical Services–Not Elsewhere Clas-

Fraudsters access card checkers through dedicated checker 8099
sifiedservices or dark web marketplaces that offer checker services
7299
Other Services–Not Elsewhere Classified
through application programming interface (API) integration. To
Organizations, Charitable and Social Service
use the card checkers, fraudsters simply input the compromised 8398
payment card data and the checker performs automated checks. Table 1: The 5 most common MCCs based on the number of unique MIDs associated with each MCC
Card checkers verify card validity by either: 1) conducting a (Source: Recorded Future)small CNP transaction, typically between $0.01 and $1.00; or 2)
At the beginning of 2022, we predicted that donation sites
initiating a zero-dollar authorization request for the card, typicallywouldenjoy popularity for card checks because of their viability
by linking the card to an account on an e-commerce or social
media website. Checkers complete checks within seconds and and discretion. This prediction appears to have held true: ininform the fraudster whether the card is valid (card accepted) 2022, MCC 8398 (“Organizations, Charitable and Social Service”)
ranked #5 among MCCs used for card-checking.
or invalid (card declined).
In 2022, one popular checker systematically incorporated
Card-checking data provides financial institutions withhigh-profile
merchants into its card-checking infrastructure,a final warning signal before a compromised payment card isastrategy
thatis likely to enjoy wider adoption across otherfraudulently monetized for a high-dollar transaction. By adding
known “tester merchants” to a risk model, financial institutions checker services and the threat actor community at large. Major
can monitor their portfolio and raise the risk score for cards merchants’ web payment services present an effective andthat conduct transactions or authorizations with known checker reliable means for checking stolen payment cards, and 4 of the top
merchants.

7

CTA-2023-0117

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 7: Responding to high demand in 2022, “userletmein” advertised their call support services (Source: XSS Forum)

For cases where cybercriminals had to bypass 3DS to
20 tester merchants this year were industry-leading companies
in the news media, audio streaming, and transportation verticals. monetize stolen payment cards, they increasingly turned toSimilarly, threat actors discussing card-checking on dark web technical solutions. Historically, fraudsters have resorted toforums demonstrated interest in exploiting other high-profile high-level social engineering techniques to bypass 3DS, butmerchants — including a market leader in activewear — for card phishing panels are a recent technical innovation that facilitatechecks. These companies have international client bases, and phishing operations at scale, especially for threat actors whoover the last 3 months they saw from 7.4 to 173.4 million monthly lack collection expertise. In 2022, a growing amount of phishingvisitors to their websites. It is highly likely that threat actors panels — including those capable of 3DS bypass — wereare increasingly abusing high-profile merchants because these developed for rent or sale as components in ready-to-go phishingpackages. This is almost certainly part of a greater shift towardmerchants:phishing-as-a-service (PhaaS) that has occurred in recent years.
• Process massive volumes of transactions and
Beginning in April 2022, a top-tier carding shop flooded theauthorizations, making it more difficult for financial
marketwith low-quality records that had previously been posted
institutions to distinguish legitimate behavior fromon a defunct top-tier carding shop. While these dated records
suspicious activity
were less actionable for monetization through payment card
• Operate internationally, allowing threat actors to more
fraud, the availability of additional PII with these cheap records
successfully check non-US cards
increased the attack surface for ATO attacks. 25% of email
addresses listed with these low-quality records were available
Fraudulent Monetization and Account Takeovers from other credential breaches across the web. By obtaining
Fraudsters focused great efforts on avoiding or bypassing email addresses from these cheap, abundant records, and then3-D Secure (3DS), which provides formidable security for online cross-referencing them with other credential breaches, astute
payment card transactions. To this end, 3 leading card-checker threat actors can likely locate additional victim PII. With thisservices added features in 2022 that allow fraudsters to check information in hand, they can refer to the bank identification
whether or not cards are 3DS-protected, likely in response to numbers (BINs) from the cheap payment card records to enact
targeted ATO attacks against their victims’ bank accounts.
rising demand for non-3DS stolen payment cards.

www.recordedfuture.com | Recorded Future ®

CTA-2023-0117

8

CYBER THREAT ANALYSIS

A related theme in fraudsters’ TTPs this year was the Outlook
growing abuse of call centers. Staff at call centers are trained
The Nilson Report recently reported that in 2021, “cardto prioritize customer satisfaction, and threat actors have dialed
issuers, merchants, acquirers of card payments from merchants,
in on this as a “weak link” in financial institutions’ security
in addition to acquirers of card transactions from ATMs incurred
posture. By contacting customer support centers and assuming
gross fraud losses of $32.34 billion, up 13.8% from 2020”. In
the identities of their victims, fraudsters can leverage victim PII
2022, however, depressed trading volumes seen on carding
to verify available funds in their victims’ accounts, withdraw or
shops diminish the likelihood that payment card fraud losses
transfer funds, and confirm transactions. A multitude of dark web
last year underwent an equally large increase.
actors offer bespoke call services to facilitate these attacks, andalthough shrewd customer support representatives frequently
In any market economy, players live and die by the rule
detect and prevent fraud, threat actors can compensate for of “survival of the fittest” — and the card fraud market is no
failed attacks through volume. For fraudsters, one successful exception. But if the events of 2022 had a chilling effect onsocial engineering call can justify dozens of fruitless attempts. the payment card fraud market and threat landscape, theresulting volumes and turnover are far from a death knell. On
the contrary, the austere economic conditions that occurred
Mitigation
this year demonstrate that the card fraud underground is fully
Financial institutions that may be exposed to payment capable of evolving to survive systemic shocks.
card fraud losses from both their card-issuing and cardFor 2023, we assess that the future of the card fraud market
acquiring functions should incorporate and act on intelligence
will remain highly dependent on external events. Should Russia’s
from each stage of the fraud life cycle to mitigate the financial
war in Ukraine continue, the factors influencing regional threat
and reputational costs of payment fraud. The payment fraud
actors’ ability to engage in card fraud will likely persist, andecosystem closely resembles a real-world market. Although thisthreat actors’ ability to engage in card fraud will remain lower
sophistication increases the threats and costs that the payment
than before the war, even as they continue to adapt. If the war
fraud ecosystem imposes on the entities it affects, it also serves
should end, monitoring the region’s post-war economies will be
as a rich source for valuable intelligence.
crucial to determine whether the conditions and incentives exist
Financial institutions should also employ a proactive anti- for a renewal — or possibly even an increase — in card fraud
fraud approach that establishes e-skimmer intelligence as activity.
a foundational pillar of transaction monitoring, risk scoring,and reissuance rules. Historically, card issuers have primarily
relied on “reactive” common point of purchase analysis to trace
fraudulent transactions conducted with payment cards back tothe source of compromise.
Card issuers should also leverage carding shop intelligenceto identify compromised payment cards within their portfolio thatare being sold on the dark web. The majority of compromised
payment cards that eventually turn into fraudulent transactions
first appear on carding shops.
Finally, card issuers should systematically incorporatechecker intelligence into risk-scoring processes in order tosurface compromised payment cards that have otherwise
remained undetected. Threat actors turn to checkers to verify
the validity of compromised payment cards later in the payment
fraud life cycle. These card checks provide card issuers with avital final signal before high-dollar fraudulent transactions areattempted.

9CTA-2023-0117

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

About Insikt Group®
Insikt Group is Recorded Future’s threat research division, comprising analysts andsecurity researchers with deep government, law enforcement, military, and intelligenceagency experience. Their mission is to produce intelligence on a range of cyber andgeopolitical threats that reduces risk for clients, enables tangible outcomes, and prevents
business disruption. Coverage areas include research on state-sponsored threat groups;
financially-motivated threat actors on the darknet and criminal underground; newly
emerging malware and attacker infrastructure; strategic geopolitics; and influence
operations.

About Recorded Future®
Recorded Future is the world’s largest intelligence company. Recorded Future’s
cloud-based Intelligence Platform provides the most complete coverage acrossadversaries, infrastructure, and targets. By combining persistent and pervasive
automated data collection and analytics with human analysis, Recorded Future provides
real-time visibility into the vast digital landscape and empowers clients to take proactive
action to disrupt adversaries and keep their people, systems, and infrastructure safe.
Headquartered in Boston with offices and employees around the world, Recorded
Future works with more than 1,500 businesses and government organizations acrossmore than 60 countries.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

www.recordedfuture.com | Recorded Future ®

CTA-2023-0117

10