Loading story…
Dutch police, the FBI, and international partners disrupted the RedLine and META infostealer operations in a coordinated action dubbed Operation Magnus, seizing or taking control of infrastructure used to run the malware-as-a-service platforms. Authorities said they hacked or dismantled servers tied to both strains, replacing criminal infrastructure with law-enforcement notices and aiming to cut off panels and backend systems used by cybercriminal customers to steal credentials, browser data, cookies, and cryptocurrency wallet information from victims worldwide.
The U.S. Department of Justice said the United States joined the international action and separately unsealed charges against a Russian national accused of helping develop and administer RedLine. Reporting on the operation said investigators targeted what officials described as the core infrastructure behind two of the most widely used infostealers in the cybercrime ecosystem, combining technical disruption with criminal charges to weaken both the malware services and the people allegedly operating them.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
U.S. authorities unsealed charges against Russian national Maxim Rudometov, alleging he developed and administered the RedLine infostealer. The case linked the criminal charges to the broader international disruption effort against RedLine and META.
Dutch police, working with the FBI and other partners, hacked, seized, or otherwise disrupted servers tied to RedLine and META, with officials describing the action as affecting all known servers for the malware operations. The takedown was intended to interrupt the infostealers' command-and-control and criminal business activity.
Authorities from the Netherlands, the United States, and international partners carried out Operation Magnus to disrupt the RedLine and META infostealer ecosystem. The operation targeted the malware families' infrastructure and supporting criminal services.
Before the law enforcement action, RedLine and META were operating as prominent infostealer malware services used to steal credentials, financial data, and other sensitive information from victims worldwide. Their infrastructure and customer base made them significant cybercrime enablers.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcejustice.gov
Open sourcecyberscoop.com
Open sourcehelpnetsecurity.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft, Europol, law enforcement agencies, and multiple private-sector partners carried out a coordinated disruption of the **StealC** infostealer and **Amadey** loader ecosystems, using court orders and related legal actions to target both malware operations at once. The operation struck a broad criminal infrastructure spanning more than 200 command-and-control domains and IP addresses, with partner reporting citing **66 domains** and **296 servers** tied to the two services. Microsoft said the malware families were linked to more than **140,000 infected computers** in a single week in May, while partner investigators reported the seizure of **25.6 million unique credentials** stolen from more than **385,000 compromised systems**. Investigators said **StealC**, active since 2023 as a malware-as-a-service infostealer, was used to steal browser data, credentials, email and messaging data, VPN and cloud access, and cryptocurrency wallet information, while **Amadey**, active since 2018, functioned as a modular loader and backdoor that frequently delivered StealC and other payloads. Researchers also identified a vulnerability in the StealC command-and-control panel that helped support search-and-seizure actions, and they used configuration extraction and a custom emulator to map affiliate activity and delivery chains. The two malware families were described as part of a broader cybercrime ecosystem tied to credential theft, access brokering, and downstream attacks including ransomware, with observed links to payloads such as **AsyncRAT**, **RedLine**, **Vidar**, **XMRig**, and in one case **LockBit Black**.
Aug 11, 2026
U.S. authorities extradited Armenian national **Hambardzum Minasyan** to face charges for allegedly helping develop and operate the **RedLine** infostealer malware, a tool widely used to steal login credentials and other sensitive data from victims’ computers. Prosecutors accused Minasyan of maintaining key RedLine infrastructure, including virtual private servers, internet domains, malware distribution repositories, and a cryptocurrency account used to collect payments from affiliates who deployed the malware. The indictment charges Minasyan with conspiracy to commit access device fraud, conspiracy to violate the **Computer Fraud and Abuse Act**, and conspiracy to commit money laundering. The case follows the multinational **Operation Magnus** disruption of the RedLine and Meta infostealers in 2024, carried out with authorities in the United States, Belgium, the Netherlands, and **Eurojust**. U.S. officials had previously charged alleged co-conspirator **Maxim Rudometov**, identified as a RedLine developer and administrator, and also launched a public website for victims seeking information and assistance.
Jun 29, 2026
International law enforcement agencies have intensified efforts to disrupt the infrastructure of prominent malware and ransomware operations. Europol, as part of Operation Endgame, targeted the servers supporting the Rhadamanthys information stealer, resulting in a sudden loss of access for its operators and a halt in observed activity since late October 2025. Rhadamanthys, a C++-based stealer-as-a-service, had been widely distributed through phishing campaigns and malicious ads, with its latest version released in October 2025. The operation's impact on the long-term viability of Rhadamanthys remains to be seen, but the immediate effect has been a significant reduction in its activity. In parallel, law enforcement agencies across the US and Europe have made notable arrests and infrastructure takedowns targeting ransomware groups. The UK’s National Crime Agency apprehended a suspect linked to a ransomware attack that disrupted multiple European airports, while US authorities filed charges against the administrator of several notorious ransomware gangs and seized assets from a Zeppelin ransomware distributor. Additionally, a coordinated international operation dismantled the infrastructure of the BlackSuit ransomware group, further demonstrating the global commitment to combating cybercrime. These actions collectively signal a robust and ongoing crackdown on cybercriminal operations by international authorities.
Jul 12, 2026