RedLine and META infostealer malware disrupted in Operation Magnus

Under the course of Operation Magnus, law enforcement agencies of 6 countries – US, Australia, Germany, UK, Belgium and Portugal, managed to take down Web infrastructure of infostealer viruses and arrest two individuals involved in malware operations. The information, along with a lot of details, comes from the official website of the operation, established swiftly after its finish.

The website features an interesting video, with the recordings of what they’ve managed to capture during the operation. Among other things are source codes of the malware, all access credentials for C2 panels, Telegram bot, and all the server infrastructure required to handle the malware users.

According to this exact video, law enforcement agencies apparently get their hands into the infrastructure much before disrupting the operations, and slipped in a forged update. This update, in turn, leaked all the important information of malware users (i.e. ones who bought the subscription and used it to spy on people). Such data will be quite handy for cyber police to find and detain the attackers.

And that is exactly what the promise to do, at least according to the video. It ends with the lines “Thank you for installing this update. We are looking forward to seeing you soon!”, with an icon of cuffed hands in the middle.

This operation in its core principles aligns with the tactic that law enforcement all around the planet opted for in their effort against cybercrime. Instead of chasing headmasters of malware operations, they disrupt infrastructure, collect all the available data and detain all the malware operators who come by. This tactic allowed disrupting operations, though temporarily, of even the toughest malware groups like QakBot and LockBit.

Two Hackers Arrested, 1200 Servers Taken Down

The overall network infrastructure of two malware families consisted of over 1200 servers, located in multiple countries around the world. Getting access to all of them was actually the reason for involving such a significant number of law enforcement agencies from different countries.

Key initiator of the campaign is Eurojust, who coordinated the effort in different parts of the world. Aside from disabling that huge amount of virtual servers, Netherland’s National Police managed to get 2 physical servers – a much more valuable asset in terms of pushing the investigation further.

In Belgium, Federal Police arrested two people accused of managing the network infrastructure. Their personalities as well as actual roles in malware operations are to be disclosed, but I guess they are far from being top management of the malware gang. It is well known that RedLine originated from Russia, and it is highly likely for META infostealer to be a similar story.

What are these infostealers?

RedLine and META viruses are both infostealers that target at collecting as much user information as possible. Online account credentials, session tokens, cookies, crypto wallet information – they pick everything they can reach to on the attacked machine, and then stay in to eavesdrop on possible other info.

Both malware samples are pretty widespread, with RedLine reaching over 50 infections daily. Though, this is far from its prime-time: back in the days, new infections appeared in hundreds per day. META lastly had higher volumes of infection recently, though due to its shorter activity span, there is not too much to say about its past.

Activity graph of META stealer

Activity graph of RedLine stealer

As Operation Magnus turned out, the viruses are pretty much the same in terms of codebase, exactly, META repeated the older RedLine infostealer. Such rebranding is a common practice among different malware families, especially when one of the developers leaves the project and decides to start over under a different name. Though, no such things were happening around RedLine recently, so there’s no clear understanding why this happened.

The post Operation Magnus Disrupts Infrasturcture of RedLine, META Stealers appeared first on Gridinsoft Blog.

CPU-Z Malware in the WindowsReport Page Clone

Recently, a wave of malicious ads on Google Search results page offered users a Trojan-infected version of the popular CPU-Z program. For better disguise, the malware was hosted on a clone site of the real news site WindowsReport. As the presence of the official site for the product is not that obvious for users, such a trick was quite effective.

By clicking on such an advertisement, the victim goes through a series of redirects that fooled Google’s security scanners and filtered out crawlers, VPNs, bots, etc., redirecting them to a special decoy site that did not contain anything malicious.

Users ended up on a fake news site hosted on one of the following domains:

• argenferia[.]com;
• realvnc[.]pro;
• corporatecomf[.]online;
• cilrix-corp[.]pro;
• thecoopmodel[.]com;
• winscp-apps[.]online;
• wireshark-app[.]online;
• cilrix-corporate[.]online;
• workspace-app[.]online.

The result of these manipulations is the chain attack, initiated with FakeBat malware. Further, this loader injects well-known RedLine infostealer – an old-timer of the scene.

What is RedLine Infostealer?

Downloading the CPU-Z installer from the attackers’ resource resulted in the download of an MSI file containing a malicious PowerShell script, which the researchers identified as the FakeBat malware loader (aka EugenLoader). This downloader extracted the Redline payload from a remote URL and launched it on the victim’s computer.

Redline is a powerful data theft tool that can steal passwords, session tokens, cookies, and vast amounts of other stuff. We have a dedicated article with the complete tech analysis of this malware – consider checking it out.

Earlier, we wrote about how cybercriminals distribute RedLine infostealer. It uses sites for downloading the fake MSI Afterburner utility. To distribute it, various domains were also used as part of the hacker campaign, which could be mistaken by users for the official MSI website. The imitation of brand resources was done quite well.

According to Google representatives, all malicious ads associated with the hacker campaign to distribute the infected CPU-Z tool have now been removed, and appropriate action has been taken against the accounts associated with them.

This is not the first time that hackers have used Google Ads

This exact malvertising campaign was discovered by analysts, who believe it is part of a previously observed campaign of a similar purpose. Previously, the attackers used fake Notepad++ advertisements to deliver the malware.

In the ads, the attackers promoted URLs that were clearly not associated with Notepad++, and used misleading titles in their ads. Since headers are much larger and visible than URLs, many people likely didn’t notice the catch.

Let me remind you that we talked about how malware operators and other hackers are increasingly using Google Ads to distribute malware to users who are looking for popular software. So, you can encounter malicious ads when searching for Slack, Grammarly, Dashlane, Audacity, and dozens of other programs.

The post Malicious CPU-Z Copy Is Spread In Google Search Ads appeared first on Gridinsoft Blog.

What are Redline and Vidar Stealers?

RedLine is an infostealer malware that appeared back in 2020, offered under Malware-as-a-service model. It is appreciated by cybercriminals for its wide functionality, that includes not only automated data gathering, but also manual commands for scanning the directories. And, typically for any stealers, it relies on stealthiness, that is additionally enhanced by a crypter software that comes as a side to the malware.

Vidar is similar but different. Aiming at a similar list of desktop apps, browsers and crypto wallets, it is closer to the definitive stealer. Once it finishes collecting information, all the gathered info is packed into the archive and sent to the command server. When this transfer is over, Vidar performs “melting” – or deletes itself, simply.

RedLine and Vidar Ransomware Delivery

In late summer 2023, the developers of RedLine and Vidar stealers started spreading ransomware under their own rule. The methods of gaining initial access remained the same – crooks send to victims an email with awaited or unpleasant information and an attachment. This attachment – you guessed it right, is a payload. The use of double extensions (pdf.htm, in one of the cases noticed by analysts) is quite typical for such attacks. As Microsoft disabled macros from running when they have come from the Web, the new, and quite old ways of spreading were put into use.

Once the victim runs the file, the chain of executions starts. First, the JScript applet connects to the intermediary server, downloads and executes the .exe file. This file, in turn, initiates the downloading of a PNG picture, which appears to be a bitmap image. Further, the image decodes into a shellcode, which transforms into yet another shellcode, saved to the Temp folder.

The second shellcode is getting launched in a Command Prompt instance spawned by the aforementioned .exe file. This way, the final payload comes into view – an infected console instance of 7-Zip utility. Upon execution, it launches the ransomware attack.

RedLine Uses EV Certificates to Conceal Itself

Another interesting, though not novel tactic used by hackers, is embedding EV certificates into malware. RedLine started using this practice in June 2023, starting with its stealers. Extended Validation (EV) code signing certs appeared as a shortcut for large companies for signing their software. Instead of thorough checks that prime the issue of a regular code certificate, this one needs only the request from a company. To get the right of EV requesting, the co should undergo a 16-stage checkup that verifies all edges of its identity. But, as it commonly happens, cybercriminals found a way to use it for their benefit.

It is not uncommon for certificates to leak, but the trust level is critical this time. Common certs require less authentication to issue, and consequently have less trust. Meanwhile, EV certificates rarely fall under suspicion, and frequent recalls may turn into a problem for the company. There is also no clear info on how EV certificates leaked. In the case of RedLine, such application turns exceptionally threatening due to the number of its samples that appear every day.

How to protect against ransomware?

Surely, modern ransomware amazes with the diversity of evasion techniques and damage done to the system. However, the spreading methods remain more or less the same for most families and samples. Email spam, questionable software downloaded from third-party sources – they have no reason to change a well-working scheme. And your best counteraction to this is your attention with spreading methods.

Do not interact with questionable emails. Hackers commonly use buzzwords that induce urgency of required actions. That is what drastically differs genuine messages from spam ones – companies never do that. Even though some of the messages are styled so they look legit and repeat what you’re waiting for, avoid haste and check the details of the message. Aside from the text style, the email address in spam messages is typically wrong from a normal one. Fortunately, there is no way to hide the sender’s address.

Be diligent to the files from the Internet you are going to run. The trick with double extensions (like .pdf.exe) exists over two decades, and hackers never shy away from using it. Since Windows does not show you the extensions of your files, it is extremely easy to get fooled in such a way. In your File Explorer settings, you can make it showing the extensions. Go to the View button on the upper panel, then click Show → File Name Extensions option in the drop-down list. This will make it much easier to detect such tricky files.

Use a reliable anti-malware software with advanced heuristic features. As you could have guessed, it is quite hard to detect the ransomware from RedLine developers statically. It disguises as deeply encoded files that are hard to identify in any way. Even the final payload masquerades as a legit console utility. In such a sophisticated case, only a heuristic detection method can help. GridinSoft Anti-Malware has multi-stage heuristic analysis with a neural scanning engine on hand. This can effectively detect such threats – try it out!

The post Redline and Vidar Stealers Switch to Ransomware Delivery appeared first on Gridinsoft Blog.

Information is one of our most valuable assets in today’s digital world, making it a prime target for cybercriminals. These threat actors use specialized infostealer malware to extract sensitive data stored on your devices, putting your personal and financial information at serious risk. Cybersecurity experts have reported an alarming 103% increase in infostealer attacks during 2023-2024, with this upward trend showing no signs of slowing down. This comprehensive guide explains what infostealers are, how they work, and most importantly, how to protect yourself from these dangerous threats.

What is an Infostealer?

An infostealer is malicious software specifically designed to collect sensitive information from an infected device and transmit it to attackers. These sophisticated programs target high-value data including:

• Saved browser credentials (usernames and passwords)
• Banking information and credit card details
• Cryptocurrency wallet data and private keys
• Browser cookies and session data
• Email account credentials
• Personal documents and identity information
• Cached form data containing personal information
• System information and installed software details

The attack cycle typically follows a standard pattern: after infection, the infostealer silently collects data and stores it in a designated directory. Once collection is complete, it packages this information and sends it to command-and-control (C2) servers operated by threat actors. The most valuable targets for attackers are financial credentials, cryptocurrency wallet information, and authentication data that can be either monetized directly or sold on dark web markets.

Since 2020, infostealers have experienced unprecedented growth in both sophistication and popularity among cybercriminals. This surge has established three clear market leaders: Raccoon, Vidar, and RedLine Stealer. These threats are continually evolving, with security researchers recently documenting their use in compromising over 100,000 ChatGPT accounts and targeting other high-value platforms.

Major Infostealer Families: Technical Analysis

RedLine Stealer

RedLine emerged on Russian cybercrime forums in March 2020 and quickly became the most profitable credential-stealing malware in the logs marketplace. This sophisticated infostealer is specifically engineered to extract sensitive information from web browsers, including:

• Saved login credentials across all major browsers
• Autocomplete form data containing personal information
• Stored credit card information and payment details
• Cryptocurrency wallet credentials and access information

Upon infection, RedLine conducts a comprehensive system inventory, collecting usernames, geographic location data, hardware configurations, and installed security software. This information helps attackers profile victims and evade detection. Distribution occurs through multiple vectors, including malicious advertisements, cracked software, phishing campaigns, and compromised application downloads.

Raccoon Stealer

First appearing in 2019, Raccoon Stealer pioneered the malware-as-a-service (MaaS) model for infostealers, initially marketed on underground forums before transitioning to Telegram distribution channels. The malware received a significant update in 2022 that enhanced its detection evasion capabilities and expanded its functionality.

What makes Raccoon particularly dangerous is its ability to steal data from:

• More than 60 different web browsers
• Cryptocurrency browser extensions
• Cryptocurrency desktop wallets
• Authentication cookies enabling session hijacking
• Discord tokens and Telegram session data

Interestingly, Raccoon has a controversial reputation within hacker communities, with many users claiming its operators intercept the most valuable stolen logs before providing them to customers. Despite these allegations, Raccoon remains one of the most widely used infostealers, with its data appearing in numerous credential harvesting operations and follow-up attacks.

Vidar Stealer

Vidar represents the “hit-and-run” category of infostealers, designed for maximum data extraction with minimal footprint. First detected in 2019 during a malvertising campaign, Vidar was distributed alongside GandCrab ransomware using the Fallout exploit kit.

Built using C++ and derived from the earlier Arkei stealer, Vidar is commercially available on underground forums and Telegram channels. Its distinguishing feature is a comprehensive admin panel that allows customers to configure targeting parameters and monitor their botnet of infected systems.

Vidar’s data harvesting capabilities include:

• Browser artifacts (history, cookies, saved passwords)
• Cryptocurrency wallet files and credentials
• PayPal and banking service information
• Two-factor authentication backup codes
• Session tokens for various online services
• Screenshots of the victim’s desktop and active windows

After completing data collection, Vidar executes a “meltdown” procedure, effectively removing itself from the infected system to avoid detection and forensic analysis. This self-deletion capability makes Vidar particularly challenging to detect and analyze after an attack has occurred.

How Infostealers Spread: Common Infection Vectors

Cybercriminals employ various sophisticated distribution methods to deploy infostealers on target systems. Understanding these attack vectors is crucial for effective prevention:

• Pirated Software and Cracked Applications

  Threat actors frequently bundle infostealers with pirated software downloads. These modified applications appear to function normally while silently installing malware in the background. The increased sophistication of modern infostealers makes them particularly difficult to detect in compromised software packages.

• Malvertising Campaigns

  Exploit kits deployed through malicious online advertisements remain one of the most prevalent distribution methods. When users click on these ads, they may unknowingly trigger an infostealer download, or be redirected to phishing sites that deploy the malware. In advanced attacks, even simply viewing the advertisement can initiate a drive-by download through browser exploits.

• System Compromises and Supply Chain Attacks

  Once attackers gain initial access to a system through other means, they often deploy infostealers as secondary payloads. This approach is particularly common in supply chain attacks where legitimate software update mechanisms are compromised to distribute malware to thousands of systems simultaneously.

• Phishing and Social Engineering

  Sophisticated phishing campaigns remain highly effective at delivering infostealers. Attackers impersonate legitimate organizations in emails containing malicious attachments or links to compromised websites. These communications may be sent to large groups (mass phishing) or carefully tailored for specific individuals or organizations (spear phishing).

Technical Methods Used by Infostealers to Extract Data

Modern infostealers employ several sophisticated techniques to extract sensitive information from infected systems:

• Browser Database Extraction

  Infostealers specifically target browser data storage files such as Login Data, Web Data, and Cookies in Chrome-based browsers, or logins.json and cookies.sqlite in Firefox. These files contain encrypted credentials that the malware decrypts using built-in browser functions or by extracting encryption keys from the system.

• Memory Scraping

  Advanced infostealers scan process memory for patterns matching passwords, credit card numbers, and other sensitive data. This technique captures information that might only exist temporarily in memory during browser sessions, bypassing disk encryption and other security measures.

• Form Grabbing and Web Injection

  By hooking into browser processes, infostealers can intercept data as it’s being entered into web forms before encryption or transmission. This approach captures credentials even when they aren’t stored locally, making it effective against security-conscious users who disable password saving features.

• API Hooking and DLL Hijacking

  Infostealers often modify system functions through API hooking or DLL hijacking to intercept cryptographic operations, redirect network traffic, or capture authentication data as it’s processed by the operating system.

How to Protect Your System from Infostealers

Implementing these essential security practices will significantly reduce your risk of infostealer infections:

• Keep Software Updated

  Infostealers frequently exploit known browser vulnerabilities and security flaws in operating systems. Install updates for your OS, browsers, and applications immediately when available to patch these vulnerabilities before they can be exploited.

• Practice Safe Browsing Habits

  Exercise caution when opening email attachments or clicking links, especially from unknown sources. Infostealers commonly spread through malicious email attachments and compromised websites. Be particularly suspicious of emails that don’t address you by name or contain generic urgency messages. Always verify URLs before clicking and ensure you’re visiting legitimate websites.

• Implement Multi-Factor Authentication

  Multi-factor authentication (MFA) provides critical protection against credential theft. Even if an infostealer successfully captures your passwords, MFA requires an additional verification method, significantly reducing the risk of account compromise. Whenever possible, use hardware security keys or authenticator apps rather than SMS-based verification.

• Avoid Pirated Software

  Pirated software frequently contains malware, providing a revenue stream for the cracking groups distributing them. Use only legitimate applications from official sources. Today’s software ecosystem offers numerous free, freemium, and open-source alternatives for most applications, eliminating the need to risk using pirated software.

• Use Dedicated Security Software

  Deploy comprehensive anti-malware protection that includes real-time monitoring and behavioral detection capabilities. GridinSoft Anti-Malware provides specialized detection for infostealers and other advanced threats, offering protection against even the newest variants through its heuristic analysis engine.

How to Detect and Remove Infostealers

If you suspect your system may be infected with an infostealer, look for these warning signs:

• Unexpected browser performance issues or crashes
• Modified browser settings or homepage changes
• Unusual network activity, particularly during idle periods
• Unexpected authentication prompts from websites you’ve previously logged into
• Unauthorized account activity or transaction notifications
• New, unfamiliar processes in Task Manager

Automatic Removal with GridinSoft Anti-Malware

For effective detection and removal of infostealers, we recommend using specialized anti-malware software. GridinSoft Anti-Malware is specifically designed to identify and eliminate sophisticated threats that traditional antivirus programs might miss.

Download and install Anti-Malware by clicking the button below. After the installation, run a Full scan: this will check all the volumes present in the system, including hidden folders and system files. Scanning will take around 15 minutes.

After the scan, you will see the list of detected malicious and unwanted elements. It is possible to adjust the actions that the antimalware program does to each element: click "Advanced mode" and see the options in the drop-down menus. You can also see extended information about each detection - malware type, effects and potential source of infection.

Click "Clean Now" to start the removal process. Important: removal process may take several minutes when there are a lot of detections. Do not interrupt this process, and you will get your system as clean as new.

Post-Infection Security Measures

After removing an infostealer, take these additional steps to secure your digital identity:

1. Change all passwords from a different, clean device
2. Enable multi-factor authentication on all important accounts
3. Monitor financial statements for unauthorized transactions
4. Check login activity logs for your important online accounts
5. Consider credit monitoring services if financial information may have been compromised

Frequently Asked Questions About Infostealers

Conclusion

Infostealers represent one of the most significant threats to personal and financial security in today’s digital landscape. Their sophisticated data extraction capabilities and continuous evolution make them challenging adversaries. By understanding how these threats operate and implementing the recommended security practices, you can significantly reduce your risk of infection and data compromise.

Remember that security is an ongoing process, not a one-time implementation. Regular software updates, cautious online behavior, and periodic security scans are essential components of an effective defense strategy against infostealers and other digital threats.

The post Infostealers: How to Detect, Remove and Prevent Information-Stealing Malware in 2025 appeared first on Gridinsoft Blog.

ChatGPT in a Nutshell

Perhaps every active Internet user has at least heard of a chatbot from OpenAI. Is it worth mentioning that many use it for study or work? This bot can do a lot, for example, give advice, and the recipe for your favorite dishes, find an extra semicolon and comma in the code, or even rewrite the code. Even this text was written by ChatGPT (joke). While some users use ChatGPT as a key generator for Windows, others embed it in their enterprise processes. The latter is most interesting to attackers since ChatGPT saves the entire history of conversations by default.

ChatGPT Accounts Are Compromised by Stealer Malware

According to a new report, 101,134 accounts were compromised by info stealer malware. Researchers found stolen information logs about these credentials illegally sold on darknet marketplaces over the past year. In addition, attackers stole most accounts between June 2022 and May 2023. The epicenter was Asia-Pacific (40.5%), with India (12,632 accounts), Pakistan (9,217 accounts), and Brazil (6,531 accounts). The Middle East and Africa came in second place with 2,925 accounts, followed by Europe in third place with 16,951 accounts. Next comes Latin America with 12,314 accounts, North America with 4,737, and the CIS with 754 accounts. The affiliation of 454 compromised accounts is not specified.

Tools for accounts compromise

As mentioned above, cybercriminals stole information using specific malware, exactly – stealers. This malware is specifically tuned to steal specific information. In this case, the attackers used Raccoon Stealer, who stole 78,348 accounts; Vidar, which stole 1,984 accounts; and Redline Stealer, that stole 6,773 accounts. Although it is widely believed that the Raccoon group has degenerated, this did not prevent it from stealing the most accounts. This is probably because this malware is so widespread that it continues to function even after it has been blocked by more security-conscious organizations by more security-conscious organizations.

Causes

At first glance, it may seem more reasonable to steal bank data. However, there are several reasons for the high demand for ChatGPT accounts. First, the attackers are often in countries where chatbot does not work. Residents of countries such as Russia, Iran, and Afghanistan are trying to access the technology at least that way. Accounts with paid subscriptions are prevalent.

Second, as mentioned initially, many organizations use ChatGPT in their workflows. In addition to the fact that employees often use it and may unknowingly enter sensitive information (this has happened, too), some businesses integrate ChatGPT into their workflow. For example, employees may maintain secret correspondence or use the bot to optimize proprietary code. Because ChatGPT stores the history of user queries and AI responses, this information can be seen by anyone with access to the account. Such accounts are precious on the darknet, and many are willing to pay good money to get them.

Security Recommendations

However, users can reduce the risks associated with compromised ChatGPT accounts. I recommend enabling two-factor authentication and updating your passwords regularly. 2FA will be a pain in the ass and deny attackers from logging into your account even if they know your username and password. Regular password changes are an effective tool against password leaks. Besides, you can disable the “Chat history & training” checkbox or manually clear conversations after each conversation.

The post Over 100k ChatGPT Accounts Are For Sale on the Darknet appeared first on Gridinsoft Blog.

What is RedLine malware?

First, let me remind you what RedLine is. It is a classic infostealer that targets cryptocurrency wallet credentials, browser AutoFill forms, cookies, and credentials from other applications. The most common way of spreading this malware is spear phishing, which contains infected files and phishing links. Another option used by malware masters recently is malvertising through Google Search ads. The latter supposes the creation of a website that replicates the downloading page of a legit free software – like 7zip, OBS Studio or LibreOffice.

Emerged in early 2020, RedLine had moderate activity throughout its lifespan. The first noticeable activity happened only half a year after the first sample detection – meaning its developers were raising their malware from scratch. But now it made an enormous spike, that peaked on May 7 – over 39,000 samples emerged that day.

What does that mean?

Actually, almost a hundred thousand samples do not correspond to 100,000 victims. RedLine malware toolkit offers sample recompilation and its developers recommend compiling a fresh sample for each attack. That makes every malware unit unique, which makes it way harder to detect by classic anti-virus programs. Encrypting utility, which is also recommended by the malware developers to use, makes it even tougher.

Sure, some of these samples are definitely used in ongoing attacks. RedLine bears on continuous operations and botnet expansions, which requires retaining high infection rates. “Background” activity of this malware is about 1,500 samples a day – meaning most of them are used in actual attacks. Meanwhile, no huge infection spikes were detected recently, at least not of the scale of the sample generation.

The most concerning hypothesis is that RedLine is getting ready for a massive attack. How will this attack be conducted – this is about to be guessed or seen, yet cybercriminals rarely betray their “classic” spreading ways. Email spam, especially precision-made ones, remains very effective and exceptionally cheap – so why would they reinvent the bicycle?

Another possible occasion is way less dramatic, yet does not mean that the threat is over. Such a massive sample generation may be an outcome of some tests – for example, ones done to test the compiler, crypto, or other mechanism. Neither me nor any other analyst can know for sure what exactly they test, but these changes may have qualitative differences. The best way to understand what that means is to spectate, fortunately, these maneuvers do not disrupt threat intelligence in any way.

IoC RedLine Stealer

• Spy.Win32.Redline.lu!heur: 793c25cdeada24a25a352641089c7e9aa8827159030f8c6f7d254951e1daf159
• Spy.Win32.Redline.lu!heur: b6d7f3c98be1395d0d44c6d500af407cccf3e2da79e1e9c78f5b88b9fca9211f
• Spy.Win32.Redline.lu!heur: dc71c35a2d49a15bb1e30432211ed655003dc39531e47201feecc50c9f196e74
• Spy.Win32.Redline.lu!heur: 64c47faead7a72f14feb3f36b9e8f6446a1fdcfcebbb8d32b2944348e40be3e0
• Spy.Win32.Redline.lu!heur: 78df5dd27086d25674a6b62028226b22b87a9a35c719324f6ed25618babb8409
• Spy.Win32.Redline.lu!heur: d05eb8842e28d5ccb2616ced436708e980662022494e4aa479b0763f162f71b7
• Malware.U.RedLine.tr: 8e686687b92281fc447b5e025bbcc0139f1fce560a69fa721ec5c61f58c163dd
• Trojan.Win32.RedLine.mz!n: cd07f55fee9c352d07424a5a45e657f139d908bdfa73896f6dc92402dd42a6ca
• Spy.Win32.Redline.lu!heur: 0855a642a88abca0d504328addc0c43c70316540f768b669e4dfaf8de8d87f4e
• Trojan.Win32.RedLine.mz!n: acbb3d54b4392443037ed3ecb35d079cb2a9b11f914b3ee74f9ad2de1aee6ee3

How to stay protected?

I’ve already mentioned preferred spreading ways that RedLine has used since its emergence in 2020. Protective measures should be built around counteracting these methods. And, of course, as the last line of defense, there should be anti-malware software.

Perform a diligent check for each email you receive. It may look like a too paranoid measure for messages, but be aware – it is not about “just emails”. The number of cyberattacks on companies of all sizes done through email spam is terrifying, thus such a threat should not be ignored. Any questionable attachment, link, or strange email address of a sender is a red flag.

Use network monitoring tools. Both active and passive will fit, as RedLine does not apply complicated anti-detection methods. Still, it tries to spoof the traffic path during the C2 communication – and here is where protective solutions shine. Firewalls are much cheaper and easier to set up, but lack reactive response capabilities. Meanwhile, NDR solutions trade their complexity and expense for the ability to intercept even the most novice threats.

Anti-malware software – the last argument of kings. The ideal network security situation is preventing malware from making its way to the live workstation. Though idealism is sometimes synonymous with naivety. For that reason, a thing to back up your security is essential, both if you’re a home user or are connected to the corporate LAN. GridinSoft Anti-Malware is a great choice for home protection, though it will be better to seek a specialized option to protect an entire network.

The post RedLine Stealer Issues 100,000 Samples – What is Happening? appeared first on Gridinsoft Blog.

Let me remind you that we also talked that Djvu Ransomware Spreads via Discord, Carrying RedLine Stealer, and also that IS Specialists Discovered a New Version of Malware from Russian Hackers LOLI Stealer.

MSI Afterburner is the most popular GPU overclocking, monitoring and fine-tuning tool that can be used by owners of almost any video card, and thanks to this, it is quite naturally used by millions of gamers around the world.

Alas, the popularity of the utility has made it a good target for cybercriminals who abuse the fame of MSI Afterburner to attack Windows users with powerful graphics cards that can be used for cryptocurrency mining.

The researchers say that the campaign they found used various domains that could be mistaken by users for the official MSI website (besides, such resources were easier to promote using “black hat SEO”). Some of these domains are listed below:

1. msi-afterburner–download.site
2. msi-afterburner-download.site
3. msi-afterburner-download.tech
4. msi-afterburner-download.онлайн
5. msi-afterburner-download.store
6. msi-afterburner-download.ru
7. msi-afterburner.download
8. msafterburners.com
9. msi-afterburnerr.com

Fake site

In other cases, the domains did not attempt to imitate the MSI brand and were likely promoted directly through private messages, forums, and social media:

1. git[.]git[.]skblxin[.]matrizauto[.]net
2. git[.]git[.]git[.]skblxin[.]matrizauto[.]net
3. git[.]git[.]git[.]git[.]skblxin[.]matrizauto[.]net
4. git[.]git[.]git[.]git[.]git[.]skblxin[.]matrizauto[.]net

Running the fake MSI Afterburner setup file (MSIAfterburnerSetup.msi) from these sites installed the real Afterburner. But at the same time, the installer silently downloaded and launched the RedLine malware, which specializes in data theft, and the XMR miner on the victim’s device.

Once installed, the miner connects to its pool using a hard-coded username and password, and then collects and transmits basic system data to attackers. In this case, the value of CPU max threads is set to 20, exceeding the number of threads even for the most modern processors. That is, the malware is configured to capture all the available power of the infected machine.

At the same time, the malware starts mining cryptocurrency only 60 minutes after the processor goes into standby mode, that is, it makes sure that the infected computer does not perform any resource-intensive tasks and, most likely, was left unattended.

In addition, the miner uses “-cinit-stealth-targets”, which allows it to pause activity and clean up GPU memory when running certain programs listed in the stealth targets section. These can be process monitors, antivirus software, device hardware resource viewers, and other tools that can help the victim detect a malicious process. Experts write that the miner hides in Taskmgr.exe, ProcessHacker.exe, perfmon.exe, procexp.exe and procexp64.exe.

While the miner quietly uses the resources of the victim’s system to mine Monero, the RedLine stealer works in the background, stealing passwords, cookies, browser information and data from any cryptocurrency wallets.

The Cyble report notes that so far, the components of this fake MSI Afterburner are poorly detected by antiviruses. For example, according to VirusTotal, the malicious installation file MSIAfterburnerSetup.msi is detected by only three security products out of 56, and the browser_assistant.exe file by only two products out of 67.

The post Fake MSI Afterburner Infects Users’ Machines with Miners and Stealers appeared first on Gridinsoft Blog.

The malicious campaigns have been going on for nearly three years

The malicious campaigns have been going on for nearly three years. The malware activity started in 2018 with numerous C2 addresses that threat actors used in every month of activity. However one of the domains stataready[.]icu threat actors used as the MagnatExtension C2 only in January 2019. They still use it in the settings obtained from the C2 servers as the updated C2. In August this year a security researcher mentioned the malvertising campaign on their Twitter page. They posted screenshots of the ads and shared one of the downloaded samples.

#RedLineStealer being delivered through fake WeChat installers, coming from @GoogleAds .

.zip -> .iso -> .exehttps://t.co/J5npamHM1P

Creates a new user account, forwards RDP port, drops RDPWrap… Damn.

cc @JAMESWT_MHT @James_inthe_box @malwrhunterteam pic.twitter.com/0Jvaz4tChc

— Aura (@SecurityAura) August 9, 2021

Threat actors mostly targeted Canada (50% of the total infections), U.S and Australia. Also they focused their efforts on Norway, Spain and Italy. Cyber security specialists add that authors of the malware regularly improve their works, activity that shows clearly there will be other floods of malicious waves. The malware alone specialists discern one being the password stealer and the other a Chrome extension that works as a banking trojan. The use of the third element of the distributed malware RDP backdoor remains unclear to specialists. The first two may be used to obtain user credentials and further sell them or use for its own future purposes. While the third, RDP, threat actors most likely will use it for further exploitation on systems or sell as RDP access.

In an attack a user would look for a desired software when they come across an ad with a link

In an attack a user would look for a desired software when they come across an ad with a link. It redirects them to a web page where they could download searched software. Attackers named the downloads with different names. It could be nox_setup_55606.exe, battlefieldsetup_76522.exe, wechat-35355.exe, build_9.716-6032.exe, setup_164335.exe and viber-25164.exe. On the execution it won`t install the actual software but instead the malicious loader on the system. The installer in its turn deobfuscates and begins the execution of three malicious payloads: Password Stealer ( Redline or Azorult), Chrome Extension Installer and RDP Backdoor.

Specialists discern the installer/loader as a nullsoft installer that decodes and drops a legitimate AutoIt interpreter or an SFX-7-Zip archive. Here come also three obfuscated AutoIt scripts that decode the final payloads in memory and inject them into the memory to another process. Three specific pieces of malware make up the final payloads :

The post Magnat campaigns delivering fake installers appeared first on Gridinsoft Blog.