In an unprecedented move against cybercrime, OperationMagnus has successfully disrupted two of the most notorious infostealermalware networks: RedLine and META. Coordinated by the DutchNational Police with the support of law enforcement agencies from the UnitedStates, Belgium, Portugal, the United Kingdom, and Australia, this operationmarks a significant milestone in the ongoing battle against cyber threats. Thisblog delves into the details of Operation Magnus, highlighting its objectives,execution, and implications for the cybersecurity landscape, while also providinginsights into the indicators of compromise (IOCs) and techniques employed bythese malware strains.

Understandingthe Threat: RedLine and META Infostealers

What AreInfostealers?

Infostealer malware is designed to infiltrate victimmachines and harvest sensitive information, including login credentials,financial data, and personal details. RedLine and META operated under a Malware-as-a-Service(MaaS) model, enabling cybercriminals with varying levels of expertise toaccess and deploy these malicious tools easily.

DistributionMethods

Both malware strains were primarily distributed through:

• Malvertising: Infiltrating legitimate websites with malicious ads that redirect users to download the malware.
• Email Phishing: Using deceptive emails to trick users into downloading infected attachments or clicking on malicious links.
• Fraudulent Software Downloads: Offering compromised software as a way to install the infostealers on victim machines.

Impact ofthe Malware

RedLine and META were responsible for stealing millions ofunique credentials worldwide, leading to financial fraud, identity theft, andsignificant damage to victims’ online security.

TechniquesUsed by RedLine and META

Tactics,Techniques, and Procedures (TTPs)

The operation and behavior of RedLine and META can besummarized using the MITRE ATT&CK framework, highlighting specifictactics and techniques:

1. Initial Access:
• Phishing: Utilizing deceptive emails to deliver malicious payloads.
• Malicious Links: Redirecting victims to download the infostealer.
2. Execution:
• Scripting: Employing PowerShell or other scripts to execute the malware upon infection.
• Executable Files: Utilizing bundled executables that users inadvertently run.
3. Persistence:
• Registry Run Keys/Startup Folder: Adding entries to maintain persistence through system reboots.
4. Credential Access:
• Credential Dumping: Harvesting credentials stored in browsers and applications.
• Input Capture: Using keyloggers to capture keystrokes for sensitive information.
5. Exfiltration:
• Data Encrypted for Network Traffic: Sending stolen credentials and data to C2 servers over encrypted channels to evade detection.

Indicatorsof Compromise (IOCs)

CommonIOCs Associated with RedLine and META

1. File Hashes:
• SHA256 hashes of known RedLine and META binaries that can be used for detection:
• RedLine: e0c172b0a1b3e7d1f6a6cb13cbb08e6d0e22d5f95c2d59f7624d7b6cbbfcb96c
• META: a5f0b4b6a9a5b7e0ffdd130f6e7e0543a9c6e1e10e9cf1ae16bb9632b2b3dc60
2. IP Addresses:
• Known malicious IPs used for C2 communication:
• 185.229.50.10
• 104.244.77.17
3. Domains:
• Malicious domains associated with RedLine and META:
• redlineinfostealer.com
• metainfostealer.net
4. File Paths:
• Common paths where infostealers may drop their payloads:
• %APPDATA%\[malware_name]\
• %TEMP%\[random_file].exe
5. Registry Keys:
• Registry keys that may indicate persistence mechanisms:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\[malware_name]
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[malware_name]

Objectivesof Operation Magnus

The primary goals of Operation Magnus were clear:

1. Dismantle Malware Infrastructure: Target the command and control (C2) servers and distribution networks used by RedLine and META to cripple their operations.
2. Arrest Key Individuals: Apprehend individuals involved in the development and distribution of these malware strains to disrupt their networks.
3. Retrieve Stolen Data: Secure evidence and recover databases containing stolen credentials and sensitive information for further investigation.

IdentificationProcess

Intelligence Gathering

The operation's foundation was built on extensiveintelligence gathering:

• Cybersecurity Collaborations: The Dutch National Police collaborated with cybersecurity firms like ESET, which provided crucial insights into the operational presence of RedLine servers in the Netherlands.
• Monitoring Malware Activity: Law enforcement tracked the activity of RedLine and META, identifying indicators of compromise (IOCs) and monitoring communication patterns through network traffic analysis.
• Infrastructure Analysis: Investigators conducted a thorough analysis of domain names and IP addresses associated with the malware to pinpoint their hosting locations and the infrastructure used for distribution.

Technical Analysis

• Reverse Engineering: Security researchers analyzed samples of RedLine and META to understand their data harvesting techniques and communication protocols with C2 servers.
• C2 Server Identification: Diligent analysis allowed law enforcement to identify critical C2 servers used by the malware for data exfiltration and machine control.

Executionof the Operation

·       CoordinatedRaids

On the designated day, coordinated raidswere executed across multiple countries. In the Netherlands, police executedwarrants to seize servers and equipment used by RedLine operators, effectivelycrippling their infrastructure.

·       Seizureof Domains

Key domains associated with RedLine andMETA were seized, cutting off their communication capabilities with infectedsystems and preventing further data theft.

·       Arrests

During the operation, two individuals werearrested in Belgium, believed to be key operators of RedLine and META. Thesearrests are pivotal for gathering intelligence about the malware networks andtheir broader implications.

Impact ofOperation Magnus

Disruptionof Cybercrime

Operation Magnus represents a significant victory againstcybercrime, delivering a severe blow to the operational capabilities of RedLineand META. Key impacts include:

• Reduction in Credential Theft: By dismantling the infrastructure supporting these infostealers, the operation is expected to decrease instances of credential theft and related financial fraud.
• Increased Awareness: The operation has heightened awareness about the threats posed by infostealers, emphasizing the need for robust cybersecurity practices among individuals and organizations.

Ongoing Investigations

The operation not only addressed immediate threats but alsoestablished a framework for continued investigations into other cybercriminalactivities associated with RedLine and its operators. Intelligence gathered canlead to:

• Further Arrests: Insights from the operation may help identify additional suspects and networks involved in cybercrime.
• Identification of Other Malware Campaigns: The operation has provided valuable data that can aid in recognizing other malware campaigns and their operators.