RedLine Infostealer Thread Reveals Hidden Maritime Phishing and BEC Infrastructure

A routine threat-feed alert for a RedLine Stealer command-and-control (C2) IP morphed into a full-scale pivot investigation that exposed a tailored maritime spear‑phishing and business email compromise (BEC) ecosystem.

The starting signal a UniqueSignal entry from VMRay identified 194[.]156.79.122:55615 as a RedLine-associated host.

That solitary indicator, combined with targeted forensic pivots across VirusTotal, FOFA, Censys and sandbox telemetry, produced a durable cluster of attacker-owned domains, mail infrastructure and delivery servers that underpin a narrow, high-impact campaign against South Korean maritime supply-chain targets.

The analyst workflow demonstrates modern threat intelligence in miniature: ingest a timestamped IOC from a high-fidelity feed, validate its family and freshness via sandbox runtime artifacts, then pivot outward on selective fingerprints rather than stopping at a blocklist.

One additional confirmed C2 (85[.]17.40.98:55615) surfaced; its value came not from additional RedLine infections but from related artifacts observed on VirusTotal: e‑mail samples (.eml/.msg) tied to narrow spear‑phishing against Kangrim Heavy Industries, a dominant supplier of marine and industrial boilers.

According to VMRay, UniqueSignal deliver a continuous stream of fresh and unique indicators, each timestamped and labeled with contextual information.

RedLine and its clone META were together responsible for compromising over 64% of all infostealer-infected devices in 2024, accounting for more than 451 million stolen credentials.

The emails are illustrative of targeted BEC tradecraft. Messages impersonated legitimate maritime suppliers, used shipment-specific pretexts, and delivered disposable payloads (FormBook and other infostealers) in attached ZIP archives.

Maritime Phishing and BEC Infrastructure

Multiple submissions originated from South Korea, and sender addresses combined both legitimate corporate domains (likely spoofed or compromised) and domains registered expressly to impersonate suppliers notably krysegroupllc[.]online.

In this case the pivot fingerprint combined a nonstandard high port (55615) with the Microsoft-HTTPAPI/2.0 server banner and a SOAPAction pointing at tempuri.org a pairing sufficiently selective to reveal other RedLine C2s via FOFA.

These impersonator domains are the more valuable pivot: payload binaries rotate rapidly, but mail-sending infrastructure and impersonation domains persist long enough to be mitigated at scale if identified.

Pivoting on krysegroupllc[.]online revealed a consistent hosting and certificate pattern. While Cloudflare fronted some records, deeper FOFA/Censys queries tied the domain to TheHost LLC and an Apache/OpenSSL HTTP server banner that, when combined, became a secondary fingerprint.

Searching for that provider-plus-banner combination exposed seven additional fraudulent domains hosted across a small set of IPs (for example 185[.]252.24.78 -> acasiallc[.]shop and 185[.]252.24.52 -> ansysllc[.]shop).

The domain naming conventions short names, “llc” suffixes and impersonation of known suppliers match the initial phishing lures and confirm an operator playbook focused on supply‑chain impersonation and narrowly scoped BEC.

This investigation underscores three operational points for defenders. First, high‑quality live feeds such as VMRay UniqueSignal matter: timeliness lets analysts act before operators rotate infrastructure.

Second, pivoting on contextual artifacts (server banners, TLS certificates, passive DNS, file submissions) turns single IOCs into clusters that deliver detection and mitigation targets far more useful than an isolated IP.

Third, prioritizing distribution infrastructure impersonator domains, mail servers, and hosting providers yields durable controls because these elements persist beyond ephemeral payloads.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.