RedLine Stealer
Что такое RedLine Stealer?
RedLine StealerA subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
RedLine Stealer is a .NET-based Windows information stealer sold on Russian-speaking forums from around 2020 and the most prolific commodity stealer of 2021–2023. Standard capabilities include extraction of saved browser passwords, cookies, autofill, and crypto-extension data from Chromium and Gecko browsers; cryptocurrency wallet files; FTP/VPN/Steam/Discord/Telegram credentials; system fingerprinting; and an exfiltration channel to operator-controlled control servers, often with logs sold further on 'cloud of logs' marketplaces (RussianMarket, 2easy, Genesis successors). RedLine was distributed via cracked software, malvertising, YouTube/SEO baits, malicious Office docs, GitHub releases, and bundled with loaders such as Smoke or PrivateLoader. Stolen RedLine logs underpinned a sizeable share of credential-stuffing and initial-access broker activity through 2023. In October 2024 the U.S. DOJ, Dutch police, Eurojust, Microsoft, ESET, and others ran Operation Magnus, seizing infrastructure for RedLine and its sibling Meta Stealer, charging the alleged developer Maxim Rudometov, and publishing samples that enabled global cleanup. Activity dropped sharply but did not disappear.
● Примеры
- 01
An initial-access broker buys a 'log of logs' on RussianMarket, identifies a corporate VPN credential among the RedLine output, and resells access to a ransomware affiliate.
- 02
Operation Magnus seizes RedLine's control panel domains in October 2024, briefly halting the operation before sellers attempt to re-brand.
● Частые вопросы
Что такое RedLine Stealer?
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024. Относится к категории Вредоносное ПО в кибербезопасности.
Что означает RedLine Stealer?
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
Как работает RedLine Stealer?
RedLine Stealer is a .NET-based Windows information stealer sold on Russian-speaking forums from around 2020 and the most prolific commodity stealer of 2021–2023. Standard capabilities include extraction of saved browser passwords, cookies, autofill, and crypto-extension data from Chromium and Gecko browsers; cryptocurrency wallet files; FTP/VPN/Steam/Discord/Telegram credentials; system fingerprinting; and an exfiltration channel to operator-controlled control servers, often with logs sold further on 'cloud of logs' marketplaces (RussianMarket, 2easy, Genesis successors). RedLine was distributed via cracked software, malvertising, YouTube/SEO baits, malicious Office docs, GitHub releases, and bundled with loaders such as Smoke or PrivateLoader. Stolen RedLine logs underpinned a sizeable share of credential-stuffing and initial-access broker activity through 2023. In October 2024 the U.S. DOJ, Dutch police, Eurojust, Microsoft, ESET, and others ran Operation Magnus, seizing infrastructure for RedLine and its sibling Meta Stealer, charging the alleged developer Maxim Rudometov, and publishing samples that enabled global cleanup. Activity dropped sharply but did not disappear.
Как защититься от RedLine Stealer?
Защита от RedLine Stealer обычно сочетает технические меры и операционные практики, как описано в определении выше.
Какие есть другие названия RedLine Stealer?
Распространённые альтернативные названия: RedLine, Meta Stealer (sibling).
● Связанные термины
- malware№ 591
Инфостилер
Вредоносное ПО, собирающее учётные данные, cookie, токены, криптокошельки и другие ценные данные с заражённого устройства и отправляющее их злоумышленнику.
- malware№ 254
Похититель учётных данных
Вредоносное ПО, специально извлекающее пароли, хеши и токены аутентификации из заражённой системы или её памяти.
- malware№ 708
Lumma Stealer
A subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites.
- malware№ 1329
Vidar Stealer
A long-running C++ Windows info-stealer derived from the older Arkei family, active since 2018 and still distributed in 2024–2025 via cracks, malvertising, and ClickFix lures.
- defense-ops№ 597
Initial Access Broker (IAB)
Киберпреступный специалист, который добывает несанкционированный доступ к корпоративным сетям и продаёт его другим преступникам, особенно партнёрам ransomware-группировок.
- attacks№ 720
Malvertising
Использование онлайн-рекламных сетей для распространения вредоносного ПО, эксплойтов или мошенничества через внешне легитимные объявления на доверенных сайтах.
● См. также
- № 998Raccoon Stealer