MITRE ATT&CKsoftware (malware)

S1240 RedLine Stealer

Published 2025-09-17 Modified 2025-10-24 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2025-09-17

Description

RedLine Stealer is an information-stealer malware variant first identified in 2020. RedLine Stealer is a Malware as a Service (MaaS) and was reportedly sold as either a one-time purchase or a monthly subscription service. Information obtained from RedLine Stealer has been known to be sold on the deep and dark web to Initial Access Brokers (IABs), who use or resell the stolen credentials for further intrusions.

Related

Uses · MITRE ATT&CK (35)

  • T1685 Disable or Modify Tools technique
  • T1059.011 Lua sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1657 Financial Theft technique
  • T1027.010 Command Obfuscation sub-technique
  • T1614.001 System Language Discovery sub-technique
  • T1614 System Location Discovery technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1087.001 Local Account sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1555 Credentials from Password Stores technique
  • T1027.002 Software Packing sub-technique
  • T1553.002 Code Signing sub-technique
  • T1218.007 Msiexec sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1518 Software Discovery technique
  • T1497 Virtualization/Sandbox Evasion technique
  • T1480 Execution Guardrails technique
  • T1217 Browser Information Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1012 Query Registry technique
  • T1016 System Network Configuration Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1036 Masquerading technique
Show all 35 ›

References