Redsip

Overview

Executive Summary

Infection Vector and Technical Capabilities

• SIP Credential Harvesting: The malware searches the infected endpoint for configuration files and registry entries associated with popular softphone applications (like X-Lite, MicroSIP, or Zoiper). It extracts the SIP server addresses, usernames, and plain-text (or weakly hashed) passwords used to authenticate to the corporate PBX.
• Network Sniffing (SIP Interception): Advanced variants of RedSip utilize network packet capture techniques (e.g., installing WinPcap or similar drivers) to sniff the local network interface for unencrypted SIP traffic (UDP port 5060). This allows the attacker to passively monitor call metadata (who is calling whom) and intercept authentication hashes.
• Toll Fraud Facilitation: By exfiltrating the SIP credentials to the C2 server, the threat actors can provision their own unauthorized softphones. They utilize the victim's PBX to make massive volumes of expensive, international premium-rate calls, leaving the victim organization with a devastating telecommunications bill.

Threat Assessment

Incident Response and Remediation

• Immediate Credential Revocation: The highest priority is to immediately revoke and reset the SIP passwords for all extensions associated with the compromised endpoint at the PBX/VoIP server level to halt any ongoing toll fraud.
• Endpoint Isolation and Telemetry Analysis: Isolate the endpoint. Utilize EDR to analyze the execution path and identify if any packet-sniffing drivers (like WinPcap) were covertly installed.
• VoIP Network Hardening: IT administration must ensure that all internal VoIP communications are encrypted (using SIPS and SRTP) to prevent local network sniffing, and implement strict Geo-IP blocking and rate-limiting on the PBX to prevent international toll fraud.

Known aliases

Threat reports may refer to this family under multiple names:

• Trojan.RedSip
• Spyware.SIP
• Backdoor.RedSip
• TollFraud.Win32

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_REDSIP_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redsip"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "redsip" ascii wide nocase
        $s2 = "trojan.redsip" ascii wide nocase
        $s3 = "spyware.sip" ascii wide nocase
        $s4 = "backdoor.redsip" ascii wide nocase
        $s5 = "tollfraud.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Redsip (Trojan) Execution & Triage
id: a57f002a-6f5a-591e-8674-7cfbfa6206de
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Redsip malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/redsip
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1555_003
- attack.t1040
- attack.t1056_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_REDSIP_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redsip tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "redsip" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Sever network connectivity for the flagged endpoint to terminate persistent command-and-control (C2) communication channels and stop Redsip from retrieving secondary stage payloads.
2. Capture process memory triage to detect and terminate malicious threads injected by Redsip into legitimate system processes such as explorer.exe or svchost.exe.
3. Audit Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and Task Scheduler entries to locate and purge Redsip persistence hooks.
4. Deploy updated enterprise EDR detection signatures and conduct an out-of-band endpoint scan to isolate dropped binaries and staged payloads.
5. Rotate all credentials, domain user passwords, and session cookies active on the system during the Redsip execution timeframe.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the incident is resolved simply because an antivirus tool removed the initial Redsip dropper; always verify that secondary payloads and persistence hooks have been eradicated.
2. Avoid logging in with Domain Admin or privileged credentials on a machine suspected of running Redsip until memory triage is complete.
3. Do not delay host isolation; automated lateral movement and credential dumping can occur within minutes of initial execution.

References & External Analysis

• Search "redsip" on VirusTotal (External Analysis)
• Search "redsip" on Any.Run (Sandbox Sandbox)
• Search "redsip" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Inexsmar
• Uploader
• Sofacy
• Qqshou
• Siscos
• Baidusearch
• Browsecx
• Bmkfxasqf6Ki

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/redsip.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.