All About High-in-Demand Information Theft Tool: RedLine Stealer

Introduction

Attack Methods

2020

• During its first notable campaign in March 2020, a phishing email was trying to take advantage of the Coronavirus pandemic to spread the stealer primarily targeting healthcare and manufacturing industries in the U.S. Threat actors abused MSBuild to deploy RATs and information-stealing malware, including RedLine. 
• In July, a malware campaign was detected using a malicious document used to deliver AutoIt scripts, which eventually infected users with CyberGate RAT and RedLine Stealer. 
• In October, threat actors were observed abusing the paste.nrecom[.]net service to deliver several malware, including AgentTesla, LimeRAT, Ransomware, and RedLine Stealer.

2021

• In June 2021, malicious pay-per-click ads were observed in Google’s search results, leading the victims to RedLine Infostealers. 
• In July, a fake website was seen delivering Smoke Loader that subsequently downloaded the RedLine Stealer while masquerading as a ‘Privacy Tool.’ 
• In November, a cryptocurrency-related campaign was found abusing a legitimate Russian RAT tool called TeamViewer with SpyAgent that also downloaded the RedLine Stealer.
• Another campaign in the month was offering fake installers of popular software to bait users, infecting them with RedLine Stealer.
• End of December witnessed the stealer with stolen 441K accounts used against different online services, according to a data breach notification service Have I Been Pwned.

2022

• In February 2022, cybercriminals were delivering RedLine Stealer disguised as the Windows 11 Upgrade installer to lure victims. 
• In March 2022, Microsoft confirmed that a threat group known as LAPSUS$ was able to gain access to the source code of some of its internal projects, including Bing, Cortana, and Bing Maps, by deploying the RedLine Stealer. 
• In the same month, Okta also declared that Lapsus$ group was able to compromise over 366 corporate customers by leveraging RedLine malware.
• In April, ZingoStealer malware was discovered with powerful data-stealing features, with the ability to load additional payloads including the RedLine Stealer. 
• One more campaign founded in April used the RIG Exploit Kit (EK) to spread RedLine Stealer targeting by exploiting an Internet Explorer vulnerability.
• A new attack chain spotted in May abused Discord’s CDN to spread SYK Crypter, which eventually dropped the RedLine Stealer. 
• A week later, a cybercriminal group was reported dropping the potent RedLine Stealer via fake Binance NFT mystery box bots.

Availability and Attack Profile

Notable attacks

• In October 2021 attackers used social engineering and phishing emails to compromise YouTube creators with information-stealing malware including the RedLine Stealer. 
• In January 2022, a new variant of the RedLine was distributed using emails with a fake COVID-19 Omicron stat counter app as bait, targeting victims across 12 countries, without focusing on any specific individual or organization. 
• Zscaler reported a crypto scam in February that was using social engineering to deliver Dark Crystal RAT that led to RedLine Stealer infection. 
• In March, a malware campaign was using the Valorant cheat as lures on YouTube to fool the players into downloading the RedLine Stealer. 

Prevention and Mitigation

Conclusion

Indicators of Compromise