Cyber firm Recorded Future buys ‘dark web’ infiltrator for $52 million

The band is getting back together: Recorded Future, a cybersecurity firm that sells threat intelligence, or information useful for computer security teams, is plunking down $52 million to buy a startup founded by a former employee.

Owned by Insight Partners, a private equity firm, and based in Somerville, Mass., Recorded Future, is acquiring Gemini Advisory, a fraud-tracking firm. The companies plan to announce the deal, which their leaders previewed in advance with Fortune, on Tuesday morning.

Christopher Ahlberg, Recorded Future’s CEO and cofounder, describes Andrei Barysevich, a former head analyst at the company, as a “master of the underground.” He “got us into the quote-unquote dark web” during his three-year tenure, Ahlberg says of Barysevich, who left to start Gemini in 2017.

Despite splitting up, Ahlberg and Barysevich never truly severed ties. Through its owner Insight Partners, Recorded Future invested a few million dollars in Gemini as part of a financing round in July 2020. Now, after the most recent deal, the two are reuniting.

Eyeing the Joker’s stash

Barysevich is a former consultant to the Federal Bureau of Investigation’s cybercrime division and longtime infiltrator of the digital underground. He is fluent in Russian, a lingua franca of online fraudsters, plus Belarusian and Ukrainian, also useful tongues for his line of work.

“Talking to the bad guys is not our primary objective anymore,” Barysevich says. “What we do very well is full automatic data collection and processing, and then mitigation for our clients.”

One example of a site Barysevich staked out is Joker’s Stash, a recently shuttered “carding” marketplace. He estimates that this superstore for stolen credit card information netted $1 billion in profit over its six years in business—mainly due to appreciation in the price of Bitcoin, its operators’ preferred medium of exchange.

“The primary suppliers of compromised data are still Russian speaking actors,” Barysevich says. But the buyers, who include everyone from Eastern Europeans to Chinese agents to street gangs in the U.S., are based all over the world, he says.

The ‘Bloomberg of cyber’

Ahlberg says his ambition is to grow Recorded Future into a different, more legitimate kind of superstore: “a Bloomberg of cyber,” as he calls it.

Ahlberg wants his company to be, in the other words, the go-to provider for data, analytics, and news centered on digital threats. The goal is to do for cybersecurity what Bloomberg does for all manner of financial intelligence as it concerns Wall Street.

Recorded Future has “close to $150 million in sales,” Ahlberg says, with about 550 employees and customers that include U.S. Cyber Command, Gap, Verizon, and Accenture. He says the addition of Gemini will help Recorded Future expand its fraud-tracking business, an offering of interest to banks, payment processors, and retailers.

Ahlberg says that Gemini and its team of nearly 30 employees will remain as an independent business unit. The company has been staffing up in other areas too, including recently hiring Catalin Cimpanu, a security reporter at ZDNet, to beef up its blogging.

Recorded Future isn’t the only business taking on the threat intel market, even if it did have the market segment’s biggest exit when Insight Partners led a $780 million leveraged buyout in 2019. Rivals include Flashpoint, a New York City-based firm where Barysevich also worked for a couple of years prior to joining Recorded Future, and Intel 471, a similarly cybercrime-focused firm based in Frisco, Tex.