RedLine Stealer
Was ist RedLine Stealer?
RedLine StealerA subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
RedLine Stealer is a .NET-based Windows information stealer sold on Russian-speaking forums from around 2020 and the most prolific commodity stealer of 2021–2023. Standard capabilities include extraction of saved browser passwords, cookies, autofill, and crypto-extension data from Chromium and Gecko browsers; cryptocurrency wallet files; FTP/VPN/Steam/Discord/Telegram credentials; system fingerprinting; and an exfiltration channel to operator-controlled control servers, often with logs sold further on 'cloud of logs' marketplaces (RussianMarket, 2easy, Genesis successors). RedLine was distributed via cracked software, malvertising, YouTube/SEO baits, malicious Office docs, GitHub releases, and bundled with loaders such as Smoke or PrivateLoader. Stolen RedLine logs underpinned a sizeable share of credential-stuffing and initial-access broker activity through 2023. In October 2024 the U.S. DOJ, Dutch police, Eurojust, Microsoft, ESET, and others ran Operation Magnus, seizing infrastructure for RedLine and its sibling Meta Stealer, charging the alleged developer Maxim Rudometov, and publishing samples that enabled global cleanup. Activity dropped sharply but did not disappear.
● Beispiele
- 01
An initial-access broker buys a 'log of logs' on RussianMarket, identifies a corporate VPN credential among the RedLine output, and resells access to a ransomware affiliate.
- 02
Operation Magnus seizes RedLine's control panel domains in October 2024, briefly halting the operation before sellers attempt to re-brand.
● Häufige Fragen
Was ist RedLine Stealer?
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024. Es gehört zur Kategorie Schadsoftware der Cybersicherheit.
Was bedeutet RedLine Stealer?
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
Wie funktioniert RedLine Stealer?
RedLine Stealer is a .NET-based Windows information stealer sold on Russian-speaking forums from around 2020 and the most prolific commodity stealer of 2021–2023. Standard capabilities include extraction of saved browser passwords, cookies, autofill, and crypto-extension data from Chromium and Gecko browsers; cryptocurrency wallet files; FTP/VPN/Steam/Discord/Telegram credentials; system fingerprinting; and an exfiltration channel to operator-controlled control servers, often with logs sold further on 'cloud of logs' marketplaces (RussianMarket, 2easy, Genesis successors). RedLine was distributed via cracked software, malvertising, YouTube/SEO baits, malicious Office docs, GitHub releases, and bundled with loaders such as Smoke or PrivateLoader. Stolen RedLine logs underpinned a sizeable share of credential-stuffing and initial-access broker activity through 2023. In October 2024 the U.S. DOJ, Dutch police, Eurojust, Microsoft, ESET, and others ran Operation Magnus, seizing infrastructure for RedLine and its sibling Meta Stealer, charging the alleged developer Maxim Rudometov, and publishing samples that enabled global cleanup. Activity dropped sharply but did not disappear.
Wie schützt man sich gegen RedLine Stealer?
Schutzmaßnahmen gegen RedLine Stealer kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für RedLine Stealer?
Übliche alternative Bezeichnungen: RedLine, Meta Stealer (sibling).
● Verwandte Begriffe
- malware№ 591
Info-Stealer
Schadsoftware, die Zugangsdaten, Cookies, Tokens, Krypto-Wallets und andere sensible Daten von einem infizierten Gerät erbeutet und an den Angreifer überträgt.
- malware№ 254
Credential-Stealer
Schadsoftware, die gezielt Passwörter, Hashes und Authentifizierungstoken aus einem infizierten System oder dessen Speicher extrahiert.
- malware№ 708
Lumma Stealer
A subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites.
- malware№ 1329
Vidar Stealer
A long-running C++ Windows info-stealer derived from the older Arkei family, active since 2018 and still distributed in 2024–2025 via cracks, malvertising, and ClickFix lures.
- defense-ops№ 597
Initial Access Broker (IAB)
Cybercrime-Spezialist, der unautorisierten Zugriff auf Unternehmensnetzwerke beschafft und an andere Kriminelle, vor allem Ransomware-Affiliates, verkauft.
- attacks№ 720
Malvertising
Missbrauch von Online-Werbenetzwerken, um Schadsoftware, Exploits oder Betrug über scheinbar legitime Anzeigen auf vertrauenswürdigen Websites zu verbreiten.
● Siehe auch
- № 998Raccoon Stealer