{ "family": "redline", "sample_count": 120, "category": "infostealer", "description": "RedLine Stealer (cataloged across threat research as RedLine, RedLineStealer, and Trojan:Win32/RedLine) is the most ubiquitous and commercially successful information stealer of the modern era, first appearing on Russian-language dark web forums in March 2020. Developed in .NET (C#), RedLine is operated under an aggressive Malware-as-a-Service (MaaS) subscription model, offering prospective affiliates standalone builds and access to a centralized management web panel for nominal fees. RedLine is designed to conduct sweeping, automated reconnaissance and theft of sensitive user telemetry across compromised Windows endpoints. Its targeting scope includes stored passwords, autofill form entries, credit card details, and session cookies from all major Chromium-based (Chrome, Edge, Brave, Opera, Vivaldi) and Gecko-based (Firefox) web browsers. Additionally, RedLine harvests session tokens from Discord, Telegram, Steam, and FileZilla, alongside aggressively sweeping for over 40 distinct desktop and browser-extension cryptocurrency wallets (including MetaMask, Phantom, Exodus, Binance, and Atomic Wallet). The malware is distributed through a vast variety of infection vectors, including malvertising campaigns on search engines, fake game cheats and cracked software on YouTube and GitHub, weaponized phishing documents exploiting CVE-2021-40444 and CVE-2023-38831, and initial-access loaders such as SmokeLoader. Network communication utilizes raw TCP sockets or SOAP/HTTP requests with encrypted XML and JSON payloads, frequently disguised as benign web traffic to bypass egress monitoring. RedLine's harvested credential dumps ('logs') form the foundational primary supply for illicit initial-access markets like Genesis Market and Russian Market, routinely enabling subsequent enterprise ransomware intrusions.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "RedLine Stealer", "RedLineStealer", "Trojan:Win32/RedLine", "Win32/RedLine.A", "MSIL/RedLine", "RedLine.C" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is RedLine Stealer and what does it target?", "acceptedAnswer": { "@type": "Answer", "text": "RedLine Stealer is a .NET information stealer that targets stored browser credentials, autofill data, credit cards, session cookies, cryptocurrency wallets, VPN credentials, and instant messaging tokens from infected Windows endpoints." } }, { "@type": "Question", "name": "How is RedLine Stealer distributed to victims?", "acceptedAnswer": { "@type": "Answer", "text": "RedLine is distributed via search engine malvertising, fraudulent software cracks and game cheats on YouTube/GitHub, phishing emails with malicious document attachments (CVE-2021-40444, CVE-2023-38831), and pay-per-install (PPI) loader networks." } }, { "@type": "Question", "name": "How do threat actors monetize stolen RedLine logs?", "acceptedAnswer": { "@type": "Answer", "text": "Compromised credentials and cookies are packaged into 'logs' and sold on dark web marketplaces such as Genesis Market and Russian Market, or auctioned to initial access brokers who utilize them to infiltrate enterprise corporate networks." } }, { "@type": "Question", "name": "What cryptocurrency wallets does RedLine target?", "acceptedAnswer": { "@type": "Answer", "text": "RedLine sweeps for desktop wallet applications (Exodus, Electrum, Atomic Wallet, Binance) and browser extension wallets (MetaMask, Phantom, Ronin, Coinbase Wallet, TronLink) to steal private keys and seed phrases." } }, { "@type": "Question", "name": "What network protocols does RedLine utilize for C2?", "acceptedAnswer": { "@type": "Answer", "text": "RedLine communicates with its C2 server via raw TCP sockets or HTTP POST requests using Windows Communication Foundation (WCF) SOAP message structures, encrypting stolen data blobs with custom XOR or NetSerializer formats." } }, { "@type": "Question", "name": "How can organizations protect against RedLine Stealer?", "acceptedAnswer": { "@type": "Answer", "text": "Enforce hardware-bound MFA (FIDO2 tokens), disable browser credential storage via Group Policy in favor of enterprise password managers, deploy endpoint behavioral detection for .NET process memory anomalies, and monitor for unauthorized outbound TCP connections on non-standard ports." } }, { "@type": "Question", "name": "What specific Chromium and Gecko browser SQLite databases does RedLine target for cookie and credential theft?", "acceptedAnswer": { "@type": "Answer", "text": "RedLine Stealer aggressively parses user profile folders for Chromium engines (Google Chrome, Microsoft Edge, Brave, Opera) and Gecko engines (Mozilla Firefox). It targets the 'Login Data' database for plaintext passwords, the 'Cookies' or 'Network/Cookies' database for active session tokens, and the 'Web Data' database for autofill forms and saved credit card details, using Windows DPAPI to decrypt sensitive database columns." } }, { "@type": "Question", "name": "How does RedLine leverage SOAP XML and WCF web services for command and control exfiltration?", "acceptedAnswer": { "@type": "Answer", "text": "Unlike simple HTTP-based stealers, RedLine utilizes Windows Communication Foundation (WCF) with NetTcpBinding or SOAP XML web services over raw TCP connections. After collecting endpoint telemetry, it serializes stolen credentials, system hardware profiles, installed antivirus listings, and desktop screenshots into structured XML or binary messages and uploads them directly to the operator's management panel." } } ], "faq_count": 8, "mitre_attack": [ "T1555.003", "T1539", "T1005", "T1082", "T1083", "T1071.001", "T1041", "T1027" ], "cisa_advisory": "AA22-074A", "exploited_cves": [ "CVE-2021-40444", "CVE-2023-38831" ], "last_updated": "2026-10-16", "sources": [ { "name": "CISA Alert AA22-074A: Russian Cyber Actors Exploit RedLine Stealer", "url": "https://www.cisa.gov/news-events/alerts/2022/03/15/russian-state-sponsored-cyber-actors-gain-network-access-and-steal" }, { "name": "Mandiant: RedLine Stealer Technical Analysis and Credential Market Impact", "url": "https://www.mandiant.com/resources/blog/redline-stealer-logs-market" }, { "name": "Proofpoint: Threat Insight on RedLine MaaS Evolution", "url": "https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign" }, { "name": "SentinelOne: RedLine Stealer Architecture and Defense Guide", "url": "https://www.sentinelone.com/blog/redline-stealer-how-it-works-and-how-to-protect-against-it/" } ], "iocs": { "file_hashes": [ "4a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c1", "1025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a57", "e70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737b" ], "delivery": [ "Search engine malvertising distributing malicious installers disguised as popular software (AnyDesk, Notepad++, ChatGPT)", "YouTube video tutorials offering download links for cracked software, cryptocurrency bots, and game cheats", "Weaponized RAR/ZIP archives exploiting WinRAR remote code execution CVE-2023-38831 and Office CVE-2021-40444" ], "persistence": [ "Temporary execution from %LOCALAPPDATA%\\Temp without permanent persistence (runs once, exfiltrates, and halts)", "Scheduled task creation in persistent variant deployments (task name: 'SystemUpdate')", "Startup folder shortcut placement under %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ] }, "lineage": { "derived_from": [], "variants": [ "redline_v1", "redline_wcf", "meta_stealer" ] }, "ecosystem": [ "windows", "windows_pe" ], "attack_stage": [ "initial_access", "execution", "credential_access", "discovery", "collection", "command_and_control", "exfiltration" ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }