RedLine Stealer
Qu'est-ce que RedLine Stealer ?
RedLine StealerA subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
RedLine Stealer is a .NET-based Windows information stealer sold on Russian-speaking forums from around 2020 and the most prolific commodity stealer of 2021–2023. Standard capabilities include extraction of saved browser passwords, cookies, autofill, and crypto-extension data from Chromium and Gecko browsers; cryptocurrency wallet files; FTP/VPN/Steam/Discord/Telegram credentials; system fingerprinting; and an exfiltration channel to operator-controlled control servers, often with logs sold further on 'cloud of logs' marketplaces (RussianMarket, 2easy, Genesis successors). RedLine was distributed via cracked software, malvertising, YouTube/SEO baits, malicious Office docs, GitHub releases, and bundled with loaders such as Smoke or PrivateLoader. Stolen RedLine logs underpinned a sizeable share of credential-stuffing and initial-access broker activity through 2023. In October 2024 the U.S. DOJ, Dutch police, Eurojust, Microsoft, ESET, and others ran Operation Magnus, seizing infrastructure for RedLine and its sibling Meta Stealer, charging the alleged developer Maxim Rudometov, and publishing samples that enabled global cleanup. Activity dropped sharply but did not disappear.
● Exemples
- 01
An initial-access broker buys a 'log of logs' on RussianMarket, identifies a corporate VPN credential among the RedLine output, and resells access to a ransomware affiliate.
- 02
Operation Magnus seizes RedLine's control panel domains in October 2024, briefly halting the operation before sellers attempt to re-brand.
● Questions fréquentes
Qu'est-ce que RedLine Stealer ?
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024. Cette notion relève de la catégorie Logiciels malveillants en cybersécurité.
Que signifie RedLine Stealer ?
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
Comment fonctionne RedLine Stealer ?
RedLine Stealer is a .NET-based Windows information stealer sold on Russian-speaking forums from around 2020 and the most prolific commodity stealer of 2021–2023. Standard capabilities include extraction of saved browser passwords, cookies, autofill, and crypto-extension data from Chromium and Gecko browsers; cryptocurrency wallet files; FTP/VPN/Steam/Discord/Telegram credentials; system fingerprinting; and an exfiltration channel to operator-controlled control servers, often with logs sold further on 'cloud of logs' marketplaces (RussianMarket, 2easy, Genesis successors). RedLine was distributed via cracked software, malvertising, YouTube/SEO baits, malicious Office docs, GitHub releases, and bundled with loaders such as Smoke or PrivateLoader. Stolen RedLine logs underpinned a sizeable share of credential-stuffing and initial-access broker activity through 2023. In October 2024 the U.S. DOJ, Dutch police, Eurojust, Microsoft, ESET, and others ran Operation Magnus, seizing infrastructure for RedLine and its sibling Meta Stealer, charging the alleged developer Maxim Rudometov, and publishing samples that enabled global cleanup. Activity dropped sharply but did not disappear.
Comment se défendre contre RedLine Stealer ?
Les défenses contre RedLine Stealer combinent habituellement des contrôles techniques et des pratiques opérationnelles, comme détaillé dans la définition ci-dessus.
Quels sont les autres noms de RedLine Stealer ?
Noms alternatifs courants : RedLine, Meta Stealer (sibling).
● Termes liés
- malware№ 591
Info stealer
Logiciel malveillant qui collecte identifiants, cookies, jetons, portefeuilles crypto et autres données sensibles d'un appareil infecté pour les exfiltrer.
- malware№ 254
Voleur de credentials
Logiciel malveillant axé sur l'extraction de mots de passe, de hash et de jetons d'authentification depuis un système infecté ou sa mémoire.
- malware№ 708
Lumma Stealer
A subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites.
- malware№ 1329
Vidar Stealer
A long-running C++ Windows info-stealer derived from the older Arkei family, active since 2018 and still distributed in 2024–2025 via cracks, malvertising, and ClickFix lures.
- defense-ops№ 597
Initial Access Broker (IAB)
Specialiste cybercriminel qui obtient des acces non autorises a des reseaux d'entreprises et les revend a d'autres criminels, principalement aux affilies de ransomware.
- attacks№ 720
Malvertising
Utilisation de régies publicitaires en ligne pour diffuser des malwares, exploits ou arnaques via des annonces d'apparence légitime sur des sites de confiance.
● Voir aussi
- № 998Raccoon Stealer