Key Takeaways
- A batch of RedLine infostealer samples failed to run in every conventional sandbox we tested, which is exactly what made them worth a second look
- The malware doesn't hardcode where it calls home. Something else decides that, and it isn't a server anyone can simply take offline
- Our FileScan.io Threat Labs team traced that infrastructure back further than a single blocked IP would ever reveal
- That infrastructure has been quietly active for well over a year, based on the trail uncovered in the investigation
- The pattern extends well beyond these samples, raising questions about how much infrastructure is actually connected
- Following the full trail surfaces a recurring hosting pattern
What Makes This Technique Different From a Typical Infostealer Delivery?
Most infostealer takedowns depend on finding and blocking a server. These samples use a different approach. They rely on EtherHiding, a technique that stores a campaign's real command-and-control destination inside a blockchain smart contract rather than the malware itself, letting attackers redirect a campaign without ever touching the binary.
On top of that, the samples failed to execute as normal programs in standard sandboxes. That's a deliberate evasion layer built to defeat automated detonation before the payload gets a chance to run at all.
Why Should SOC Teams and Engineers Care?
SOC professionals and threat hunters
A blocked IP address tells you almost nothing about how long a campaign has been running or how far its infrastructure actually extends. Getting that picture means reading a public blockchain, not just a threat feed, and connecting evidence that most SOC tooling was never built to correlate.
Software and infrastructure engineers
Blockchain RPC calls, the same communication method wallets and dApps use to talk to a network, are increasingly showing up as C2 signals inside malware. Teams building or securing blockchain infrastructure now need to account for RPC traffic being abused for malware command and control.
Which Organizations Face the Greatest Exposure?
RedLine steals credentials, session tokens, and stored browser data, so it targets whatever organization has valuable access to lose. A few categories carry higher risk:
- Financial services and fintech, where stolen credentials convert directly into fraud
- Government agencies and critical infrastructure operators, where compromised access can disrupt operations and expose data
- Managed service providers, where one stolen credential can open a path into multiple downstream clients
- Technology and SaaS companies, where session tokens and API keys are high-value targets
What Damage Can a Campaign Like This Cause?
Once RedLine harvests credentials, the impact depends on what those credentials can access, from direct financial fraud to a foothold used for a later ransomware deployment. Recovery typically means rotating every credential the malware could have touched, revoking active sessions, and reconstructing which systems the stolen access reached before detection. Hidden command infrastructure can extend the period in which stolen access remains usable.
How MetaDefender Aether Fits Into This Picture
MetaDefender Aether™ is designed to detect malware that deliberately fails in conventional sandboxes, including the samples behind this research. Its Advanced Emulation defeats anti-VM, anti-debug, and time-based evasion without manual tuning, so samples designed to break conventional sandboxes still get analyzed instead of waved through.
Its Threat Indicator Repository then correlates the resulting IPs, domains, and hashes against more than 50 billion known indicators, giving SOC teams broader infrastructure context around each indicator.
What Does the FileScan.io Investigation Answer?
Our FileScan.io Threat Labs team also traced the infrastructure behind the samples.
The full investigation explains:
- How researchers reverse-engineered samples built to fail in conventional sandboxes
- How they recovered an encrypted command address
- How far back the campaign infrastructure extends
- How many other campaigns may share the same underlying setup
Frequently Asked Questions
What is EtherHiding?
EtherHiding is a technique that stores or retrieves attacker-controlled configuration, such as a command server address, inside a public blockchain smart contract. This keeps a campaign's true destination intact even after its visible infrastructure is taken down.
Is RedLine a new malware family?
No. RedLine is a well-established infostealer. This cluster is notable for its pairing with EtherHiding and the evasion behavior FileScan.io Threat Labs observed during analysis.
Why doesn't blocking the known command server stop the campaign?
The smart contract behind the campaign can still resolve to a replacement address, so the infrastructure survives the takedown of any single indicator.
How did researchers get past the sample's anti-sandbox defenses?
That's one of the core findings of the investigation. The full technique is broken down in the FileScan.io Threat Labs article.
How can MetaDefender Aether help detect malware like this?
MetaDefender Aether pairs Advanced Emulation, built to defeat anti-VM and anti-debug evasion, with a Threat Indicator Repository that correlates command-and-control infrastructure across billions of known indicators, catching samples designed to slip past conventional sandboxes.
