Recaptured Darknet Data from Breaches, Malware & Underground Sources
Learn how our Cyber Analytics Engine drives action to protect your business.
Cyber Analytics Engine
SpyCloud has been known for the massive repository of recaptured data that powers our ATO, ransomware, and online fraud prevention solutions. But our innovative Cyber Analytics Engine goes much further than strictly data collection. After each digital asset is acquired, it is put through a rigorous quality-control process to determine its value. We cleanse and parse it, crack the passwords and further enrich the data, and then correlate it to individual users across their multiple online personas to determine their true risk to your enterprise. The result is actionable insights relevant to your business that you can act on quickly – via integrations into your existing security stack – to shut down cyberattacks.
Collect
Creating the world’s largest collection of recaptured data
We rapidly collect stolen and leaked assets from the darknet containing user credentials, cookies (or tokens), and high-value PII such as first and last names, addresses, phone numbers, dates of birth, SSNs, credit card numbers, crypto wallets, and much more – data that is used by criminals to easily impersonate users and harm individuals and businesses.
Our collection methods use a combination of security research and automated technology. Our team of researchers have been performing this type of tradecraft for years and are the most capable in this area. Critical information is recaptured by our researchers very early in the attack timeline, often within days of the breach or malware infection occurring. In many cases, we are the first to inform the affected victim organizations through our responsible disclosure process. These efforts create the world’s largest and most relevant repository of recaptured data gathered from breaches, exfiltrated from malware-infected devices, and obtained from other underground sources.
- Data Breaches
- Malware-Exfiltrated Data
- Underground Sources
Curate
Removing the noise to reveal what's most actionable
Our unique cleansing and curation process reveals exposed data that is directly relevant and actionable for your business. The SpyCloud engine parses and normalizes petabytes of unstructured data, discarding records that do not contain passwords or high-value PII. It compares each record to the billions of assets already in our database. We end up discarding about 60% of the files we collect as duplicates from past breaches that have been repackaged as combolists. This ensures that our customers are not inundated with extraneous alerts.
Through this process, SpyCloud manages more than 200 distinct attributes collected directly from darknet records that are machine-readable and immediately actionable.
Enrich
Adding context and cracking passwords
SpyCloud goes further than any other vendor to enrich the recaptured data with supporting contextual information including the source, breach description, and the actual breached password. We have invested heavily in “de-hashing” collected passwords, allowing customers to determine whether exposed credentials exactly match the in-use credentials for their employees and customers. Through our proprietary processes, SpyCloud is able to provide more than 90% of collected passwords in plaintext, making our data the most actionable in the industry.
In the case of malware-exfiltrated data, SpyCloud provides all relevant context including the machine ID, IP address, infected date and time, and infection path, as well as target URLs, credentials, and cookies for critical workforce applications that have been siphoned and are in criminals’ hands. Acting quickly to invalidate this information with Post-Infection Remediation is crucial for stopping malware infections from becoming full-blown ransomware incidents.
Analyze
Correlating risk across users' multiple online personas
In this phase, our Cyber Analytics Engine draws correlations across billions of records that have been stolen and distributed by criminals. This allows SpyCloud to provide unique insights about the true identity and online behaviors of your employees and customers to determine the risk of ATO, synthetic identity, fraud tied to malware, and insider threats. These analytics are provided through APIs and integrations to popular SIEMs, SOARs, and TIPs to protect your enterprise from criminals using stolen information.
Fast Recapture Enables Swift Action
SpyCloud’s security researchers recapture data from the deepest layers of the darknet within days of a breach or malware infection occurring and share it with customers before it is used to cause harm, typically months or even years before anyone else. In many cases, we are the first to inform the affected victim organizations through our responsible disclosure process.
We’re confident you’ll get more matches with SpyCloud. Let’s do a match rate test.
