RAT / stealerATT&CK S1240
RedLine Stealer
Also known as: RedLine
RedLine Stealer is an information stealer sold as malware-as-a-service. It collects saved passwords, browser cookies, autofill data and cryptocurrency wallets from infected computers, and the stolen logins are resold and used for further intrusions. It was a target of Operation Magnus, an international law enforcement action in October 2024.
- Public attribution and associated actors
- Sold as malware-as-a-service. In October 2024 the US Department of Justice unsealed charges against an alleged developer and administrator of RedLine.
- First seen
- Around 2020
- Platforms
- Windows
- MITRE ATT&CK software entries
- S1240 RedLine Stealer
Status: Infrastructure disrupted by Operation Magnus in October 2024, with US charges unsealed against an alleged developer (reported).
How it spreads or gets in
- Fake software downloads, cracked software, malicious advertising and phishing attachments run by the victim.
Key behaviours
- Stole browser passwords, cookies and autofill data.
- Collected system details and took screenshots.
- Sent the stolen data to its command server.
ATT&CK techniques
- T1204.002User Execution: Malicious File
- T1555.003Credentials from Password Stores: Credentials from Web Browsers
- T1539Steal Web Session Cookie
- T1217Browser Information Discovery
- T1113Screen Capture
- T1082System Information Discovery
- T1041Exfiltration Over C2 Channel
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Detect non-browser processes reading browser credential and cookie files.
- Alert on sign-ins that reuse a session cookie from a new device or location.
- Monitor for software installed from unofficial download sites.
Defences that work
- Use phishing-resistant MFA and short session lifetimes for critical apps.
- Stop users installing unapproved software, and block cracked-software sites.
- Separate personal and work browsing; do not sync work passwords to personal devices.