RedLine Infostealer Malware-as-a-Service Operation and Operation Magnus Takedown

Executive Summary

The transition of the global cyber threat landscape from traditional network intrusions to decentralized, identity-centric attacks is exemplified by the RedLine infostealer. First identified in March 2020, RedLine rapidly monopolized the underground economy, operating as a Malware-as-a-Service (MaaS) that accounted for over half of all global infostealer infections between 2020 and 2023. The malware extracts sensitive credentials, cryptocurrency wallets, and active web session cookies from compromised Windows endpoints, serving as a primary harvesting engine for initial access brokers (IABs).

Stolen RedLine telemetry was heavily weaponized by elite extortion syndicates, most notably the LAPSUS$ group (DEV-0537). By purchasing active web session cookies harvested by RedLine from underground markets, LAPSUS$ executed "Pass-The-Cookie" attacks to seamlessly bypass multi-factor authentication (MFA) mechanisms. This methodology enabled devastating compromises against Fortune 500 technology firms, exposing a structural vulnerability in modern enterprise identity management where session tokens act as pre-authenticated bearer tokens.

In October 2024, an international law enforcement coalition executed "Operation Magnus," a coordinated kinetic cyber operation that dismantled RedLine's global infrastructure. The operation seized master backend servers in the Netherlands, neutralized over 1,200 affiliate servers worldwide, and resulted in federal charges against the malware's primary developer, Maxim Rudometov. The takedown successfully disrupted one of the most prolific credential-harvesting networks in history, integrating psychological operations to destabilize trust within the cybercriminal underground.

Verification of Claims

1. Claim: RedLine and the META infostealer were authored and maintained by the same individual or group. → Verified → Source code analysis and backend module telemetry acquired during Operation Magnus definitively verify that META is a direct clone of RedLine, sharing identical authentication frameworks and cryptographic routines.

2. Claim: Maxim Rudometov faces a maximum penal exposure of 35 years in federal prison. → Verified → The unsealed United States Department of Justice (DOJ) complaint invokes statutes for access device fraud (10 years), conspiracy to commit computer intrusion (5 years), and money laundering (20 years), cumulatively totaling 35 years.

3. Claim: The RedLine backend communication infrastructure transitioned to a REST API communicating over HTTPS in early 2024. → Verified → Post-takedown analysis by ESET verified that malware operators abandoned the legacy Windows Communication Foundation (WCF) framework to evade network intrusion detection systems.

4. Claim: The LAPSUS$ extortion group heavily relied on RedLine logs to execute major network intrusions. → Verified → Microsoft Threat Intelligence and MITRE ATT&CK telemetry irrefutably confirm that DEV-0537 heavily purchased and utilized RedLine session cookies to bypass enterprise MFA.

5. Claim: Over 1,000 unique IP addresses hosted RedLine control panels globally. → Verified → Confirmed by ESET Research analysis, noting massive concentrations of hosted panels across Russia, Germany, and the Netherlands.

Timeline

Attack Anatomy

Initial Access: RedLine is strictly distributed as a payload by affiliates utilizing multiple delivery channels, including phishing emails, compromised video games, fraudulent software installers, and malicious Microsoft OneNote files containing embedded batch scripts.

Execution: The malware leverages execution techniques like process hollowing, suspending legitimate processes like Regsvcs.exe and overwriting memory with the malicious.NET payload. In OneNote campaigns, obfuscated batch scripts trigger PowerShell to decrypt the payload via AES and reflectively load it into memory to bypass the Antimalware Scan Interface (AMSI).

Persistence: The malware maintains access by creating Windows scheduled tasks (e.g., "Telemetry Logging" using fodhelper.exe) and disguises itself as legitimate services. It also modifies the hosts file to block antimalware domains and adds Windows Defender exclusions.

Privilege Escalation: RedLine dynamically resolves Windows APIs at runtime using LoadLibraryA and GetProcAddress via Platform Invocation Services (P/Invoke) to bypass behavioral heuristic detections.

Collection: The payload targets Chromium and Gecko-based browsers, querying SQLite databases via sqlite3.dll and extracting encrypted master keys using bcrypt.dll to steal passwords, autofill data, and active session cookies. It aggressively parses local directories for over 40 cryptocurrency wallets, Telegram sessions, VPN configs, and conducts WMI system profiling (capturing HWID, OS data, and desktop screenshots).

Exfiltration: Pre-2024 variants established command-and-control (C2) via dead-drop resolvers hosted on GitHub or Pastebin. Collected data is packaged and exfiltrated to HTTP POST endpoints (e.g., /Entity/Id<1-24>) utilizing a layered Base64 and custom XOR encryption routine.

Impact: Exfiltrated logs are monetized on dark web brokerages. The stolen session cookies are weaponized by elite extortion groups to bypass multi-factor authentication and execute catastrophic network intrusions against major corporate entities.

Threat Actor Profile

• Name / Alias: RedLine Stealer / META Stealer / Maxim Rudometov

• Attribution Confidence: High — The primary developer, Maxim Rudometov, was formally identified and charged by U.S. authorities based on forensic links between licensing servers, Apple iCloud telemetry, and Yandex email accounts.

• Motivation: Financial — The malware operated purely as a commercial Malware-as-a-Service (MaaS) enterprise, selling monthly subscriptions ($150) and lifetime licenses ($900) payable in cryptocurrency.

• Sophistication Level: Advanced — Displayed sophisticated layered obfuscation (Base64 + XOR), dynamic API resolution, process hollowing, reflective memory loading, and advanced backend architectures traversing WCF and REST API protocols.

• Known Previous Operations: The malware was utilized aggressively by initial access brokers and extortion syndicates, most notably the LAPSUS$ group, which breached Microsoft, Okta, Nvidia, and Samsung in 2022.

• Nation-State Nexus: No — Identified strictly as a financially motivated, decentralized cybercriminal operation.

• MITRE ATT&CK Techniques:

  • - T1566.001 — Phishing: Spearphishing Attachment
  • - T1055 — Process Injection
  • - T1059.001 — Command and Scripting Interpreter: PowerShell
  • - T1059.003 — Command and Scripting Interpreter: Windows Command Shell
  • - T1539 — Steal Web Session Cookie
  • - T1555.003 — Credentials from Password Stores: Credentials from Web Browsers
  • - T1003.003 — OS Credential Dumping: NTDS
  • - T1082 — System Information Discovery
  • - T1621 — Multi-Factor Authentication Request Generation
  • - T1199 — Trusted Relationship
  • - T1053.005 — Scheduled Task/Job: Scheduled Task
  • - T1565 — Data Manipulation

• Operational Security (OpSec): Moderate — The malware includes geofencing routines to abort execution on machines located in Commonwealth of Independent States (CIS) nations, shielding operators from domestic law enforcement. However, the developers exhibited fatal OpSec failures by storing cleartext passwords in the backend Database Controller, repeatedly logging into licensing servers from personal iCloud-linked IP addresses, and exposing over 1,200 affiliate control panels.

Technical Indicators

domains:
  - "fivto[.]online"
  - "spasshik[.]xyz"
  - "secure[.]controlpanel[.]asia"
  - "tempuri[.]org"
  - "santaanarealtor[.]icu"
ip_addresses:
  - "172.245.45[.]213"
  - "95.179.163[.]157"
  - "193.106.191[.]226"
  - "49.12.69[.]202"
  - "185.250.148[.]76"
  - "51.195.166[.]184"
file_hashes:
  - type: "sha256"
    value: "6cc44d98ce2fb628b25519eb2aa476b81c1dca23b4c11fb3f26951bba8e68d64"
    description: "RedLine Infostealer sample"
  - type: "sha256"
    value: "5be845902145831466d3b710541d2c5a53cfc50108126c8802b48226e89e1887"
    description: "RedLine Infostealer sample"
  - type: "sha256"
    value: "1365e7708c818aa8a3cbed2a295ce2d585c654d80b78b1e5b3af9f30c654a4fa"
    description: "RedLine Infostealer sample"
  - type: "sha256"
    value: "7701ee20f7c99aadf95e31bf775bf1614f66aea3e9f03dfadf5ee247ab8eb29c"
    description: "RedLine Infostealer sample"
  - type: "sha256"
    value: "1d18b3c7e5845a5c5cf519471a7b6ee354f848764b7c64b6f3ec59d0e3492e9b"
    description: "RedLine Infostealer sample"
urls:
  - "hxxp://tempuri[.]org/Entity/Id<1-24>"
  - "hxxps://fivto[.]online/secure-api/"
c2_infrastructure:
  - "Over 1,000 unique IP addresses hosting RedLine control panels globally"
  - "Backend server communication utilizes WCF (pre-2024) and REST API over HTTPS"
  - "Dead-drop resolvers hosted via abused GitHub repositories and Pastebin links"

Legal and Regulatory Response

Law Enforcement Actions

On October 28, 2024, a joint coalition including the Dutch National Police, FBI, and Eurojust executed "Operation Magnus". The operation seized three master backend servers in the Netherlands, neutralized over 1,200 global affiliate servers, and confiscated dead-drop domains. Two individuals were arrested in Belgium. Authorities heavily integrated psychological operations (PSYOPS) via www.operation-magnus.com, directly infiltrating dark web forums to taunt affiliates and destabilize trust in the MaaS platform.

Government Directives

In May 2023, the Indian government's Cyber Swachhta Kendra (CSK) issued formal alerts regarding RedLine's proliferation via phishing and OneNote payloads, distributing IoCs and defensive countermeasures.

Platform Response

In April 2023, ESET collaborated directly with GitHub to remove repositories functioning as dead-drop resolvers for RedLine’s C2 infrastructure. Following Operation Magnus in November 2024, ESET launched a specialized online scanner tool to assist users in detecting latent infections.

Criminal Proceedings

The U.S. Department of Justice unsealed a criminal complaint — not an indictment — against Russian national Maxim Rudometov in the U.S. District Court for the Western District of Texas. The distinction matters procedurally: a complaint is sworn by a federal agent before a magistrate and supports an arrest warrant, whereas an indictment requires a grand jury. The complaint had been signed under seal well before the takedown and was unsealed on 29 October 2024, the day after the operational phase. He is charged with access device fraud, conspiracy to commit computer intrusion, and money laundering, facing a cumulative statutory maximum of 35 years in federal prison.

Impact Assessment

• Victim Count: Estimated: Millions of endpoints and users worldwide targeted by the RedLine and META stealers between 2020 and 2024.

• Control Panel Hosts: Confirmed: Over 1,000 unique IP addresses identified hosting RedLine control panels.

• Geographic Distribution: Reported: 20% of hosted panels located in Russia, 20% in Germany, and 20% in the Netherlands.

• Data Types Stolen: Confirmed: Browser credentials, active session cookies, credit card details, over 40 types of cryptocurrency wallets, Discord tokens, Steam files, Telegram data, VPN credentials, and FTP logins.

• High-Profile Breaches: Confirmed: Extortion groups like LAPSUS$ leveraged RedLine-harvested session cookies to breach global entities including Microsoft, Okta, Nvidia, and Samsung throughout 2022.

• Operational Disruption: Confirmed: Operation Magnus seized three master servers, two domains, and neutralized 1,200 affiliate servers, effectively shutting down the primary MaaS infrastructure as of October 2024.

Lessons and Defensive Recommendations

For Security Teams / SOC Analysts: Monitor endpoint telemetry for suspicious encoded PowerShell commands initiated by vbc.exe and block processes creating executables in %APPDATA% or %TEMP% directories. Detect and alert on scheduled task creation using fodhelper.exe or names like "Telemetry Logging". Alert on any unauthorized modifications to the Windows hosts file blocking antimalware domains or commands adding Windows Defender exclusions. Deep packet inspection should flag Base64/XOR payloads traversing HTTP POST requests toward endpoints formatted as /Entity/Id<1-24>.

For Developers and Architects: Implement application whitelisting solutions (like Windows Defender Application Control or Software Restriction Policies) to block the execution of unsigned binaries from temporary user directories. Restrict PowerShell execution by enforcing constrained language modes and enabling comprehensive script block logging. Prevent Office applications (such as OneNote) from spawning child processes or creating executable files.

For Platform / Cloud Providers: Actively monitor and remove malicious repositories and text dumps (e.g., GitHub, Pastebin) hosting dead-drop configuration files. Implement rapid detection and takedown protocols for cryptocurrency-related phishing campaigns and fraudulent software installers hosted on platform infrastructure.

For Leadership / CISO: Organizations must urgently transition to hardware-bound authentication (FIDO2/WebAuthn) to mitigate the threat of MFA fatigue and cookie-replay attacks. Reduce the default time-to-live (TTL) for active web session cookies and OAuth tokens, mandating global session revocation across Identity Providers (IdPs) upon suspected endpoint compromise. Maintain continuous dark web monitoring on markets like Genesis and the Russian Market to identify exposed corporate credentials and proactively reset sessions before initial access brokers can monetize them.

Sources

1. Flare. "RedLine Stealer Malware".
2. Cyber Swachhta Kendra (CSK). "RedLine info-stealer malware".
3. Wazuh. "How to detect RedLine Infostealer with Wazuh".
4. ESET. "Days after takedown, ESET Research releases analysis of RedLine Stealer infostealer empire".
5. Microsoft. "DEV-0537 criminal actor targeting organizations for data exfiltration".
6. U.S. Department of Justice. "U.S. Joins International Action Against RedLine and META Infostealers".
7. The Hacker News. "Dutch Police Disrupt Major Info Stealers RedLine and MetaStealer".
8. ESET WeLiveSecurity. "Life on a crooked RedLine: Analyzing the infamous infostealer's backend".
9. SLCyber. "RedLine and META Infostealers Targeted in Operation Magnus".
10. Field Effect. "RedLine and META MaaS platforms disrupted, mastermind charged".
11. CloudSEK. "RedLine Stealer Malware: How It Works & How to Remove It".
12. GitGuardian. "Latest from Lapsus$, Reviewing the Microsoft Breach".
13. Fraunhofer FKIE. "Malpedia: win.redline_stealer".
14. MITRE ATT&CK. "RedLine Stealer, Software S1240".
15. Eurojust. "Malware targeting millions of people taken down by international coalition".
16. OCCRP. "Servers Seized, Suspect Charged in Global Infostealer Takedown".
17. Intel 471. "RedLine and Meta: The Story of Two Disrupted Infostealers".
18. TechSpot. "Eurojust, FBI, and other agencies join forces to take down two major data-stealing malware rings".
19. CyberInsider. "Operation Magnus: RedLine Malware Developer Arrested".
20. Analyst 1. "RedLine, A License to Steal: The Rudometov Story & Operation Magnus".
21. eSentire. "Increase in Redline Stealer Observations".
22. Acronis. "RedLine Stealer: A malware-as-a-service info-stealer".
23. Rapid7. "Rapid7 observes use of Microsoft OneNote to spread Redline Infostealer malware".
24. eSentire. "eSentire Threat Intelligence Malware Analysis: Redline Stealer".
25. Netskope. "RedLine Stealer Campaign Using Binance Mystery Box Videos to Spread GitHub-Hosted Payload".
26. HC3. "Lapsus$, Okta and the Health Sector".
27. Cybersecurity Dive. "Infostealer malware surges on dark web amid rise in MFA fatigue attacks".
28. SonicWall. "RedLine Info-Stealer Targets Crypto Wallets, VPN Credentials and Browser Cookies".
29. SecurityScorecard. "A Detailed Analysis of the RedLine Stealer".
30. Yazoul. "RedLine Stealer Malware - IOCs, Reports & Analysis".

Corrections log — 1 September 2026: The Legal and Regulatory Response section described the DOJ filing against Rudometov as an indictment. The filing was a criminal complaint, unsealed on 29 October 2024, one day after the operational takedown. Corrected, with the procedural distinction explained.