Created by: lindbergh

Date created: 2022-12-16

Last edited: 2023-03-17

Description: Heatmap of instances of ATT&CK techniques for RedLine Stealer based on recent public CTI reporting (sources in notes for each technique).

Techniques (34)

  • Account Discovery

    ID: T1087

    Tactics: Discovery

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • Application Layer Protocol

    ID: T1071

    Tactics: Command and Control

    Description: https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Automated Exfiltration

    ID: T1020

    Tactics: Exfiltration

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns

  • Command and Scripting Interpreter

    ID: T1059

    Tactics: Execution

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns,

    https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Credentials from Web Browsers

    ID: T1555.003

    Tactics: Credential Access

    Description: https://www.trellix.com/en-us/about/newsroom/stories/research/trellix-global-defenders-invaders-of-the-information-snatchers.html, https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • Data Encoding

    ID: T1132

    Tactics: Command and Control

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns

  • Data from Local System

    ID: T1005

    Tactics: Collection

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns,

    https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Deobfuscate/Decode Files or Information

    ID: T1140

    Tactics: Defense Evasion

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns

  • Encrypted Channel

    ID: T1573

    Tactics: Command and Control

    Description: https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Exfiltration Over C2 Channel

    ID: T1041

    Tactics: Exfiltration

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • File and Directory Discovery

    ID: T1083

    Tactics: Discovery

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns

  • Impair Defenses

    ID: T1562

    Tactics: Defense Evasion

    Description: https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Ingress Tool Transfer

    ID: T1105

    Tactics: Command and Control

    Description: https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Input Capture

    ID: T1056

    Tactics: Credential Access, Collection

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns

  • Non-Application Layer Protocol

    ID: T1095

    Tactics: Command and Control

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • Non-Standard Port

    ID: T1571

    Tactics: Command and Control

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • OS Credential Dumping

    ID: T1003

    Tactics: Credential Access

    Description: https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Peripheral Device Discovery

    ID: T1120

    Tactics: Discovery

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • Phishing

    ID: T1566

    Tactics: Initial Access

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/,

    https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Process Discovery

    ID: T1057

    Tactics: Discovery

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns,

    https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/,

    https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Process Injection

    ID: T1055

    Tactics: Privilege Escalation, Defense Evasion

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns,

    https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Query Registry

    ID: T1012

    Tactics: Discovery

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns

  • Screen Capture

    ID: T1113

    Tactics: Collection

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns,

    https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • Software Discovery

    ID: T1518

    Tactics: Discovery

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/,

    https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Steal Application Access Token

    ID: T1528

    Tactics: Credential Access

    Description: https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-redline-stealer

  • Steal Web Session Cookie

    ID: T1539

    Tactics: Credential Access

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns,

    https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • System Information Discovery

    ID: T1082

    Tactics: Discovery

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns,

    https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • System Location Discovery

    ID: T1614

    Tactics: Discovery

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • System Service Discovery

    ID: T1007

    Tactics: Discovery

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • System Time Discovery

    ID: T1124

    Tactics: Discovery

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • Unsecured Credentials

    ID: T1552

    Tactics: Credential Access

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/

  • User Execution

    ID: T1204

    Tactics: Execution

    Description: https://blog.cyble.com/2022/11/30/redline-stealer-being-distributed-via-fake-express-vpn-sites/,

    https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Virtualization/Sandbox Evasion

    ID: T1497

    Tactics: Defense Evasion, Discovery

    Description: https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns,

    https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

  • Windows Management Instrumentation

    ID: T1047

    Tactics: Execution

    Description: https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

infostealers-logo
favicon__1_ removebg-png

BE THE FIRST TO KNOW

Stay informed with the latest insights in our Infostealers weekly report.

Receive immediate notification if your email is involved in an infostealer infection.

No Spam, We Promise

favicon__1_ removebg-png

BE THE FIRST TO KNOW

Stay informed with the latest insights in our Infostealers weekly report.

Receive immediate notification if your email is involved in an infostealer infection.

No Spam, We Promise