RedLine Stealer
Software · ATTACK:enterprise:S1240
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1240",
"title": "RedLine Stealer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1240",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--8c8e8b01-b4b1-479b-a7a9-78c40a12b916",
"external_id": "S1240",
"domain": "enterprise",
"created": "2025-09-17T14:42:04.015Z",
"modified": "2025-10-24T03:03:55.275Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ESET RedLine Stealer November 2024",
"url": "https://www.welivesecurity.com/en/eset-research/life-crooked-redline-analyzing-infamous-infostealers-backend/"
},
{
"source_name": "Kroll RedLine Stealer August 2024",
"url": "https://www.kroll.com/en/publications/cyber/redlinestealer-malware"
},
{
"source_name": "Proofpoint RedLine Stealer March 2020",
"url": "https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"
},
{
"source_name": "Splunk RedLine Stealer June 2023",
"url": "https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"
},
{
"source_name": "Veriti RedLine Stealer MAAS April 2023",
"url": "https://veriti.ai/blog/veriti-research/from-chatgpt-to-redline-stealer-the-dark-side-of-openai-and-google-bard/"
}
]
}Explicit source assertions (35)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02595a79-3ef9-41a6-be6f-14aebf3a96f1
ESET RedLine Stealer November 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1eb7d0a2-784b-44e8-a1dd-2c444b67bf29
Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--242af6ac-a8f9-44fd-ae3f-edd975b37b4c
Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023 · Veriti RedLine Stealer MAAS April 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30b3b0e1-88a4-4126-8a2e-78ccaedbb36d
Kroll RedLine Stealer August 2024 · Veriti RedLine Stealer MAAS April 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39b63ba5-41dc-4b47-9858-97abdda827cd
McAfee RedLine Stealer April 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--536cdc1b-65c7-4236-8e2a-b0093495c9d9
McAfee RedLine Stealer April 2024 · Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a817bea-020f-47f5-8bf3-80e0c8bdef79
ESET RedLine Stealer November 2024 · Kroll RedLine Stealer August 2024 · McAfee RedLine Stealer April 2024 · Veriti RedLine Stealer MAAS April 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b05bcf1-4943-4f19-8bc3-a44eec42d047
ESET RedLine Stealer November 2024 · Kroll RedLine Stealer August 2024 · Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023 · Veriti RedLine Stealer MAAS April 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b2c1413-9760-4867-8fe4-3b7c55f1e780
Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cd22798-0d6e-4bed-b139-c46a4cfa87a5
Kroll RedLine Stealer August 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d256f6f-9501-4fec-9255-941b8c2fe35a
ESET RedLine Stealer November 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79275d9c-25cb-4792-8ac9-57009b44bd35
ESET RedLine Stealer November 2024 · Kroll RedLine Stealer August 2024 · McAfee RedLine Stealer April 2024 · Proofpoint RedLine Stealer March 2020ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c6646c0-25d9-4de6-9c13-b7d588f295f9
Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e3b8db0-f8bf-4f61-bfc8-b87b5e42a998
Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--870704bf-fa76-413b-a529-b95bbca48771
Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88f285fd-670b-4600-878f-7d78b86ab929
Kroll RedLine Stealer August 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--891d4be2-c0d1-48f2-920c-0bd9378ac44e
McAfee RedLine Stealer April 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91872d37-d1f6-4a12-a011-85f929a3f8aa
ESET RedLine Stealer November 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94813c25-e3ba-4f51-ba49-f0fc5e486e8a
Kroll RedLine Stealer August 2024 · Veriti RedLine Stealer MAAS April 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94eef51a-f00b-49db-9a8a-9730b4c80b9a
McAfee RedLine Stealer April 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98847982-f5fe-4c8e-bd90-b24ba3ff58bd
ESET RedLine Stealer November 2024 · Kroll RedLine Stealer August 2024 · Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9cf53303-770b-4de2-bbf2-3d79d5432f93
Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9fba03e7-126f-42ca-81a4-5c314756a36a
Kroll RedLine Stealer August 2024 · Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0704053-1dec-4f7d-bcb2-ff2372640b02
ESET RedLine Stealer November 2024 · Kroll RedLine Stealer August 2024 · Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1e3d08f-cec9-48df-b377-6f0d0d223e3b
Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6d72bce-1f65-40e8-9c7b-c9c384276d6e
Proofpoint RedLine Stealer March 2020ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae711f8d-3b42-405f-8e31-fdb561f08a79
McAfee RedLine Stealer April 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afe95822-7845-4f16-b50c-62f428c59697
Kroll RedLine Stealer August 2024 · Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023 · Veriti RedLine Stealer MAAS April 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0e89ad2-f1ff-4646-8af6-8f60bcf96281
ESET RedLine Stealer November 2024 · McAfee RedLine Stealer April 2024 · Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6455e96-9b28-4749-8b76-220f27ac4ee8
ESET RedLine Stealer November 2024 · Proofpoint RedLine Stealer March 2020ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c31efd65-8907-41f7-8cc2-17c7f8313a67
McAfee RedLine Stealer April 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c398b815-5ec1-45a9-bbe8-14153ae5d703
Splunk RedLine Stealer June 2023ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9ae6db9-d29e-4576-8567-520920c7ef79
McAfee RedLine Stealer April 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ddc7c412-20f1-4820-9816-ec2c8063cc1c
McAfee RedLine Stealer April 2024ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea245e90-c14f-457c-998f-04c431dcc458
Splunk RedLine Stealer June 2023