Skuggaheimar/Threat Intelligence/RedLine Stealer
REDLINE
META STEALER
OPERATION MAGNUS
LUMMA
Threat IntelligenceMalwareMarch 7, 2026•15 min read

RedLine Stealer: The Infostealer That Fueled a Cybercrime Empire

Dissecting the most prolific information stealer of the modern era — from its $150/month MaaS model to the international Operation Magnus takedown that disrupted its infrastructure.

Scroll

RedLine Stealer dominated the infostealer landscape from 2020 to 2024, responsible for an estimated 51% of all infostealer infections worldwide. Operating as a Malware-as-a-Service (MaaS) platform at just $150/month, it enabled thousands of cybercriminals to harvest credentials, cryptocurrency wallets, and session tokens at industrial scale — until international law enforcement dismantled its infrastructure in October 2024.

Overview & MaaS Model

RedLine Stealer is a .NET-based (C#) information-stealing malware that first appeared in March 2020, initially distributed via COVID-19-themed phishing emails. It quickly grew into the most prolific infostealer family in modern cybercrime. The malware is believed to originate from Russia, with built-in safeguards preventing execution on systems with Russian keyboard layouts or geolocated in CIS countries.

Scale of Impact

According to Kaspersky, RedLine accounted for 51% of all infostealer infections from 2020 to 2023 and 34% in 2024. It is tracked by MITRE ATT&CK as S1240.

Pricing & Provisioning

ESET's analysis revealed that META Stealer shared the same codebase and backend infrastructure, effectively making it a fork or rebrand of RedLine.

Distribution Methods

Technical Capabilities

Browser Data Theft

Cryptocurrency Wallet Theft

Application Credential Theft

System Reconnaissance

C2 Infrastructure

MITRE ATT&CK Mapping

TacticTechniqueUsage
PersistenceT1547.001 Registry Run KeysAutostart persistence
Defense EvasionT1036 MasqueradingDisguises as legitimate software
Defense EvasionT1218.011 Rundll32Proxy execution
Defense EvasionT1497 Sandbox EvasionVM/sandbox detection
Defense EvasionT1562 Impair DefensesDisables security tools
Credential AccessT1555.003 Browser CredentialsChrome password decryption
CollectionT1113 Screen CaptureDesktop screenshots
CollectionT1005 Data from Local SystemFile grabbing, wallet theft
DiscoveryT1082 System Info DiscoveryFull system profiling
ExfiltrationT1041 Exfil Over C2All data via C2 channel

Notable Campaigns

DateCampaignDetails
Mar 2020COVID-19 phishingInitial discovery; spoofed Folding@home targeting US healthcare/manufacturing
Sep 2022Uber breach (Lapsus$)Employee credentials stolen via RedLine were purchased on dark web, enabling MFA fatigue attack
2023Fake ChatGPTMalvertising campaign posing as ChatGPT desktop application
2023Barbie Movie phishingFake movie video links delivering RedLine
Mar 2023Adobe Acrobat Sign abuseSpam exploiting legitimate Adobe services
Supply Chain Impact

RedLine-stolen credentials have been widely sold to Initial Access Brokers (IABs) on dark web marketplaces, fueling subsequent ransomware attacks, corporate network intrusions, and account takeovers at scale. The Uber breach is a prime example of this pipeline.

Operation Magnus (October 2024)

International Takedown

On October 28, 2024, the Dutch National Police (Politie), coordinated by Eurojust and supported by the FBI, UK NCIS, Belgian Federal Police, and Australian Federal Police, dismantled RedLine and META Stealer infrastructure in Operation Magnus.

Maxim Rudometov Charged

Maxim Rudometov, a Russian national from Krasnodar, was identified as a primary developer and administrator of RedLine. He used aliases "dendimirror," "alinchok," and "bloodzz.fenix." He was charged in the Western District of Texas with access device fraud, conspiracy to commit computer intrusion, and money laundering — facing a maximum of 35 years in prison. The US government is offering a $10 million reward for information leading to his capture. He remains at large.

Post-Takedown Landscape

Following Operation Magnus, RedLine no longer functions and cannot steal new data. However, the threat has not disappeared:

Detection & Defense

Protect Against Infostealer Threats

Mjolnir Security provides comprehensive capabilities to detect, respond to, and recover from infostealer compromises.

Credential Exposure MonitoringThreat HuntingIncident ResponseMDR ServicesDark Web IntelligenceEndpoint Protection
  • Credential Exposure Monitoring Continuously monitor dark web markets, Telegram channels, and infostealer log repositories for your organization's compromised credentials.
  • Threat Hunting as a Service Proactive hunting for infostealer artifacts, including RedLine successors (Lumma, Vidar, StealC), within your environment.
  • 24/7 Incident Response Rapid containment and forensic analysis when infostealer activity is detected. Call +1 833 403 5875.
Written by: Mjolnir Security  |  Published: March 7, 2026
Related Reports
Malware

Cobalt Strike: When Red Team Tools Become the Adversary's Arsenal

Read Report →
Malware

SystemBC: The Ransomware Enabler Hiding in Plain Sight

Read Report →