With the advancement of technology, cyber crimes have become increasingly common. It is stated that a 19-year-old young hacker hacked telecom networks and caused damage of 4 million dollars.

19-year-old young hacker named Remington Ogletree, hacker He is accused of being affiliated with the Scattered Spider group, exploiting security vulnerabilities, carrying out extensive phishing activities and gaining unauthorized access. According to court records shared by Bloomberg, Ogletree breached the security of two telecom companies, sent phishing links to millions of users and tried to steal large amounts of cryptocurrency from users.

The mentioned hacking incidents took place in October 2023. However, authorities have just announced the developments to raise awareness about potential fraud and cybercrime activities. It is stated that Remington Ogletree sent a total of 8.5 million text messages to users.

The mentioned crimes were not limited to telecom companies. Ogletree’s actions extend to US financial institutions. Because the young hacker managed to deceive 12 employees, obtain sensitive information and access accounts. This is not the first time such cyber crimes have made headlines. Other incidents caused by hackers have also been brought up before.

While Ogletree’s case continues, the events revealed the security vulnerabilities of the telecom industry and what could happen if the necessary precautions are not taken. The names of the hacked telecom companies were not disclosed.

Following the seizure of RedLine Stealer by international authorities, security researchers published their research into the stealer’s undocumented backend modules, which aided law enforcement in the takeover effort.

Security researchers, in collaboration with law enforcement, collected numerous modules used to run the infrastructure behind RedLine Stealer in 2023. The Dutch National police, together with the FBI, Eurojust and several other law enforcement agencies, dismantled the infamous RedLine Stealer operation and its clone called META Stealer on October 24, 2024.

This global effort, called Operation Magnus, resulted in the removal of three servers in the Netherlands, the seizure of two domain names, the detention of two people in Belgium, and the unsealing of charges against one of the alleged perpetrators in the United States.

Security researchers participated in a partial takedown of the RedLine malware in April 2023, enabling the removal of several GitHub repositories used as dead-drop analyzers for the malware’s control panel. At that time, previously undocumented backend modules of this malware family were investigated in collaboration with other researchers at Flare. These modules do not directly interact with the malware, but instead handle authentication and provide functionality for the control panel.

More than 1,000 unique IP addresses used to host RedLine control panels were identified. While there is some overlap, this puts the number of subscribers to RedLine MaaS at around 1,000. The 2023 versions of RedLine Stealer, reviewed in detail, use the Windows Communications Framework for communication between components, while the latest version in 2024 uses a REST API.

“Based on our analysis of source code and backend samples, we determined that RedLine Stealer and META Stealer share the same creator.” he said.

These unique IP addresses were used to host RedLine panels. Of these hosted panels, Russia, Germany, and the Netherlands each represent about 20 percent of the total, while Finland and the United States each represent about 10 percent. It was also able to detect multiple different backend servers. In terms of their geographical distribution, the servers are mostly located in Russia (about a third), while the UK, the Netherlands, and the Czech Republic each represent about 15 percent of the servers we detected.

First discovery in 2020

RedLine Stealer is an information-stealing malware first discovered in 2020, and rather than being operated centrally, it operates on a MaaS model where anyone can purchase a turnkey information-stealing solution from various online forums and Telegram channels.

Customers, whom we call affiliates, can receive monthly subscriptions or lifetime licenses; For their money, they get a control panel that generates malware samples and acts as a C&C server for them.

The examples created are local cryptocurrency wallets; cookies, saved ID information and saved credit card information from browsers; It can collect a wide variety of information, including saved data from Steam, Discord, Telegram, and various desktop VPN applications. Using an off-the-shelf solution makes it easier for affiliates to integrate RedLine Stealer into larger campaigns. Some notable examples include ChatGPT free download in 2023 and what appear to be video game cheats in the first half of 2024.

Magnus Before Operation RedLine was among the most common data-stealing malware, with a large number of affiliates using its control panel. But the malware-as-a-service initiative appears to be led by a small number of individuals, some of whom have now been identified by law enforcement.