Defending Against RedLine Stealer Malware

New variants using Lua bytecode to enhance stealth and evasion capabilities have also been observed in the wild. The purpose of this advisory is to provide readers with information pertaining to this threat and the measures that can be taken to protect both individuals and organisations from falling victim.

How It Spreads

The RedLine Stealer malware is commonly spread through the following means:

• Phishing emails with urgent requests containing malicious attachments, or links that spoof a reputable company.

• Embedding the malware into an application that is disguised as a legitimate-looking application such as an antivirus software or an operating system update. The threat actor distributes this application and entices the victim to run it as a legitimate application/update required for their systems.

• Exploiting popular online repositories such as Github. The malware has been observed to masquerade as game cheating tools on Github. While installing the game cheat, victims are encouraged to further distribute it to unlock the full capabilities of the game cheat.

How To Protect Yourself

Individuals and organisations are advised to take the following measures to strengthen your cybersecurity posture and boost your online defences to protect yourself and your organisation against the RedLine Stealer malware.

For Individuals

• Store passwords securely, such as in an encrypted password manager rather than in web browsers

• Refrain from downloading pirated software applications and only download official software applications from trusted sources such as Microsoft and Adobe.

• Update systems, applications and software to the latest version and download the latest security patches.

• Install anti-virus/anti-malware software and keep the software (and its definition files) updated. Perform a scan of the systems and networks regularly and scan all received files.

• Report to your organisation's IT/security team or the relevant authorities once you notice suspicious behaviours such as unauthorised login attempts or unsolicited transactions.

For Organisations

• Organisations with cybersecurity capabilities may want to monitor dark web forums and Telegram channels for any mentions of your organisational data, systems or credentials for sale as this might indicate a possible compromise within your organisation.

• Disable all ports and protocols such as Telnet, Microsoft RPC, FTP, etc if they are not essential for business purposes.

• Isolate devices that use legacy operating systems if your organisation is unable to update these devices with security patches.

• Limit privileged access to authorised personnel to reduce the risk of privileged account abuse or compromise.

• Regularly monitor all user accounts and disable inactive accounts.

• Enforce password updates for account owners who receive reports that their credentials may have been leaked.

• Implement regular training programmes to educate employees about the latest types of phishing attacks, common phishing techniques and how to identify and respond to unsolicited, suspicious emails, URL links, and attachments. For more information on how you and your organisation can defend against cyber threats, please refer to our advisory here. [link: https://www.csa.gov.sg/alerts-advisories/Advisories/2023/ad-2023-013]

• Enable logging of system events to facilitate investigation of suspicious events or issues.

• Use an Effective Endpoint Detection and Response (EDR) Solution at end-users’ devices for continuous monitoring, detecting and responding of cyber threats.

• Closely monitor inbound and outbound network traffic for suspicious communications or data transmissions. This includes possible Indicators of Compromise (IOCs) related to the Redline Stealer.

References:

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/

https://www.acronis.com/en-sg/cyber-protection-center/posts/redline-stealer-a-malware-as-a-service-info-stealer/

https://flare.io/learn/resources/blog/redline-stealer-malware/

https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html