RedLine Stealer
O que é RedLine Stealer?
RedLine StealerA subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
RedLine Stealer is a .NET-based Windows information stealer sold on Russian-speaking forums from around 2020 and the most prolific commodity stealer of 2021–2023. Standard capabilities include extraction of saved browser passwords, cookies, autofill, and crypto-extension data from Chromium and Gecko browsers; cryptocurrency wallet files; FTP/VPN/Steam/Discord/Telegram credentials; system fingerprinting; and an exfiltration channel to operator-controlled control servers, often with logs sold further on 'cloud of logs' marketplaces (RussianMarket, 2easy, Genesis successors). RedLine was distributed via cracked software, malvertising, YouTube/SEO baits, malicious Office docs, GitHub releases, and bundled with loaders such as Smoke or PrivateLoader. Stolen RedLine logs underpinned a sizeable share of credential-stuffing and initial-access broker activity through 2023. In October 2024 the U.S. DOJ, Dutch police, Eurojust, Microsoft, ESET, and others ran Operation Magnus, seizing infrastructure for RedLine and its sibling Meta Stealer, charging the alleged developer Maxim Rudometov, and publishing samples that enabled global cleanup. Activity dropped sharply but did not disappear.
● Exemplos
- 01
An initial-access broker buys a 'log of logs' on RussianMarket, identifies a corporate VPN credential among the RedLine output, and resells access to a ransomware affiliate.
- 02
Operation Magnus seizes RedLine's control panel domains in October 2024, briefly halting the operation before sellers attempt to re-brand.
● Perguntas frequentes
O que é RedLine Stealer?
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024. Pertence à categoria Malware da cibersegurança.
O que significa RedLine Stealer?
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
Como funciona RedLine Stealer?
RedLine Stealer is a .NET-based Windows information stealer sold on Russian-speaking forums from around 2020 and the most prolific commodity stealer of 2021–2023. Standard capabilities include extraction of saved browser passwords, cookies, autofill, and crypto-extension data from Chromium and Gecko browsers; cryptocurrency wallet files; FTP/VPN/Steam/Discord/Telegram credentials; system fingerprinting; and an exfiltration channel to operator-controlled control servers, often with logs sold further on 'cloud of logs' marketplaces (RussianMarket, 2easy, Genesis successors). RedLine was distributed via cracked software, malvertising, YouTube/SEO baits, malicious Office docs, GitHub releases, and bundled with loaders such as Smoke or PrivateLoader. Stolen RedLine logs underpinned a sizeable share of credential-stuffing and initial-access broker activity through 2023. In October 2024 the U.S. DOJ, Dutch police, Eurojust, Microsoft, ESET, and others ran Operation Magnus, seizing infrastructure for RedLine and its sibling Meta Stealer, charging the alleged developer Maxim Rudometov, and publishing samples that enabled global cleanup. Activity dropped sharply but did not disappear.
Como se defender contra RedLine Stealer?
As defesas contra RedLine Stealer costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para RedLine Stealer?
Nomes alternativos comuns: RedLine, Meta Stealer (sibling).
● Termos relacionados
- malware№ 591
Info stealer
Malware que recolhe credenciais, cookies, tokens, carteiras de cripto e outros dados sensíveis do dispositivo infetado e os exfiltra para o atacante.
- malware№ 254
Ladrão de credenciais
Malware focado em extrair palavras-passe, hashes e tokens de autenticação de um sistema infetado ou da sua memória.
- malware№ 708
Lumma Stealer
A subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites.
- malware№ 1329
Vidar Stealer
A long-running C++ Windows info-stealer derived from the older Arkei family, active since 2018 and still distributed in 2024–2025 via cracks, malvertising, and ClickFix lures.
- defense-ops№ 597
Initial Access Broker (IAB)
Especialista cibercriminoso que obtem acesso nao autorizado a redes empresariais e o vende a outros criminosos, sobretudo afiliados de ransomware.
- attacks№ 720
Malvertising
Uso de redes de publicidade online para distribuir malware, exploits ou esquemas através de anúncios aparentemente legítimos em sites de confiança.
● Veja também
- № 998Raccoon Stealer