RedLine and META infostealers taken down in international law enforcement action – Source: www.csoonline.com

Law enforcement agencies from six countries, including the US, dealt a major blow to the command-and-control infrastructure used by RedLine and META, two of the most popular infostealers in the cybercriminal underground.

The operation, coordinated through Eurojust, resulted in the shutdown of servers, the extraction of a customer database, the indictment of a suspected developer, and the arrest of two individuals.

RedLine is both a standalone and subscription-based malware platform that dates back to early 2020 when it started being distributed in Coronavirus-themed campaigns. Since then, it has become one of the most popular infostealers, having targeted millions of users, according to the European Union’s Eurojust agency.

RedLine was marketed on Russian-language cybercriminal forums for $150 for the lite version, $200 for the pro version and $100/month as a subscription, making it accessible to a wide range of cybercriminals. Its features include stealing information stored in browsers such as email addresses, authentication cookies, passwords, credit cards and other autocomplete form data that could include personal information.

Operation involved US, UK, Netherlands, Belgium, Portugal, and Australia

The malware also steals cryptocurrency wallets and collects information about the infected machine such as location, hardware and installed software. The META infostealer is a version of RedLine that appeared in 2022.

“To take down the transnational malware, Eurojust coordinated cooperation between authorities from the Netherlands, the United States, Belgium, Portugal, the United Kingdom, and Australia,” Eurojust said in a press release. “Through Eurojust, authorities were able to quickly exchange information and coordinate actions to take down the infostealers.”

The investigation started after the Dutch subsidiary of antivirus company ESET contacted police about the existence of RedLine servers in the Netherlands. The authorities managed to take over the servers and find information about how the entire infrastructure, made up of over 1,200 servers around the world, worked.

A database of cybercriminal customers who bought RedLine and META was also recovered and will serve as the basis for further investigation.

Servers were shut down and two suspects charged

The global action, dubbed Operation Magnus, culminated on Oct. 28 when the servers were shut down and Belgian authorities arrested two suspects. The Telegram channels used by the infostealer administrators to offer support to their customers were also shut down.

The US Department of Justice (DoJ) announced charges against one of the suspected developers and administrators of the RedLine infostealer named Maxim Rudometov. According to investigators, Rudometov was observed regularly accessing the RedLine infrastructure, as well as various cryptocurrency accounts used to receive payments associated with the infostealer.

RedLine and META are used in campaigns against major corporations as well, not just consumers. Since they are used by different groups, they are distributed using a variety of methods including email phishing, malvertizing, fraudulent software downloads, and sideloading by other malware.

The stolen information can be used to bypass multi-factor authentication (MFA) protections and is sold on cybercrime forums as “logs.” Such information can be used for fraud and to perpetrate further intrusions.

“Through various investigative steps, law enforcement has collected victim log data stolen from computers infected with RedLine and META. While an exact number has not been finalized, agents have identified millions of unique credentials (usernames and passwords), email addresses, bank accounts, cryptocurrency addresses, credit card numbers, etc.,” the DoJ said.

ESET has developed a free online scan that can be used to determine if a computer has been infected with either of these two infostealers. The company also offers further guidance in case an infection is detected.