ESET shines light on cyber criminal RedLine empire

Cyber security analysts at ESET have published a detailed analysis of the RedLine Stealer operation and its clone, Meta, following the dismantling of the cyber criminal empire in a Dutch-led operation.

Operation Magnus, carried out by the Dutch National Police force with support from the European Union, FBI, and UK’s National Crime Agency, successfully took down the infamous infostealers’ infrastructure.

ESET played a crucial role in the investigation, initially notifying Dutch authorities about the malwares’ infrastructure hosted in their jurisdiction. They also participated in a preliminary operation targeting the gang’s use of GitHub repositories as a control mechanism.

After analyzing the malwares’ source code and backend infrastructure, ESET confirmed that both RedLine and Meta were created by the same individual. They identified over 1,000 unique IP addresses used to control the operation.

According to ESET researcher Alexandre Côté Cyr, “We identified over 1,000 unique IP addresses hosting RedLine control panels, indicating a significant number of subscribers to the RedLine MaaS.”

ESET’s investigation revealed that the 2023 versions of RedLine Stealer used the Windows Communication Framework, while the latest version from 2024 utilizes a REST API for communication.