Introduction
Most threat intelligence work begins with a feed. Platforms like VMRay UniqueSignal deliver a continuous stream of fresh and unique indicators, each timestamped and labeled with contextual information such as the malware family, runtime behavior and MITRE ATT&CK labels. In a typical workflow, an analyst takes one of these indicators, confirms it’s still relevant and pushes it into a blocklist or SIEM rule.
Pivoting takes the same indicator further. Instead of stopping at the blocklist, you look at everything around it and the kind of context available depends on the indicator type. Since the starting point in this case is an IP address, the relevant pivots are things like the files that communicated with it, the certificates it served, the other domains hosted on it, its passive DNS history. Platforms like VirusTotal, FOFA, and Censys exist to map exactly these relationships. The goal is to turn one indicator into a cluster that is far more useful than a lone IP, both for detection coverage and for understanding what the attacker is actually doing.
This post documents one such pivot chain and it’s a good illustration of why the approach pays off. It started with a single RedLine Stealer C2 server IP pulled from UniqueSignal. The RedLine infrastructure itself didn’t lead far but the files communicating with that C2 did. They pointed to a targeted spear-phishing campaign against a South Korean Maritime company. From there, the investigation moved away from RedLine entirely and toward the email distribution infrastructure behind the phishing emails, eventually surfacing a cluster of attacker-owned domains and servers.
We’ll walk through each pivot in order, including the exact queries used along the way, so the process is reproducible.
Background: RedLine Stealer
RedLine is a commodity infostealer first observed in early 20200 and sold under a Malware-as-a-Service model on underground forums and Telegram channels. It gave affiliates a point-and-click control panel that both generates payloads and acts as the C2 server. The malware harvests credentials, browser cookies, autofill data, and cryptocurrency wallets, which then get bundled into logs and sold on credential marketplaces.
For several years RedLine was one of the dominant players in the space. RedLine and its clone META were together responsible for compromising over 64% of all infostealer-infected devices in 2024, accounting for more than 451 million stolen credentials. That run came to an end in October 2024, when Operation Magnus1 led by the Dutch National Police took down the RedLine and META backend infrastructure.2
(image source: TheHackerNews)
However, RedLine still surfaces in new incidents through older builds and repackaged variants, which is exactly the kind of long-tail activity that fresh threat feeds continue to pick up. The indicator at the center of this investigation is one of those late sightings and as it turned out, the RedLine label was only the entry point into a much broader threat ecosystem.
One Indicator, One Fingerprint
Every investigation needs a starting point. In this case it was a single RedLine indicator pulled from the VMRay UniqueSignal feed in our OpenCTI instance:
UniqueSignal is VMRay’s threat intelligence feed that delivers fresh and unique IOCs in STIX format. Feeds like this are especially valuable for catching fresh C2 infrastructure early in a campaign lifecycle.
The first thing worth noting is that the port number 55615 is non-standard and specific, which makes it a more selective pivot candidate. While UniqueSignal has a solid classification mechanism, I wanted to confirm the indicator was both genuinely RedLine and still relevant. A VirusTotal graph on the IP showed it tied to RedLine collections and a cluster of communicating files.
Checking the timestamps on those files, the earliest submission was from April, 2026 which is recent enough to treat this as live infrastructure. UniqueSignal’s timeliness is especially valuable in this case. Active infrastructure has a short window before operators rotate domains or abandon endpoints entirely. Getting ahead of those pivot points means acting on IOCs while the infrastructure is still alive.
Then I turned to the VMRay Platform’s sandbox to pull a full analysis report on one of the communicating samples. My goal was to capture the C2’s HTTP response and build a fingerprint from it. The VMRay sandbox executed the sample in an isolated environment and captured its full runtime behavior, including the HTTP traffic.
Two details stand out. The SOAPAction header pointing at tempuri.org is consistent with RedLine’s SOAP-based communication which confirms the family. More useful for pivoting, though, is the combination of the port 55615 and the Microsoft-HTTPAPI/2.0 server string. Neither is unusual on its own, but the pairing of that server string with this specific high port is selective enough to be worth searching on.
That combination is our first fingerprint.
A Second RedLine C2 Surfaces
With a fingerprint in hand, the next step was to see how many other servers shared it. FOFA indexes internet-wide scan data, so it’s well suited for this kind of lookup and querying it means we never touch the target infrastructure directly, which keeps the investigation quiet.
I translated the port and server-string combination into a FOFA query:
port=”55615″ && server=”Microsoft-HTTPAPI/2.0″
The query returned two additional hosts beyond the original:
This is a good reminder that a fingerprint is a starting filter, not a verdict. Microsoft-HTTPAPI/2.0 is a generic Windows HTTP server banner and plenty of legitimate services happen to run on high ports, so a generic banner like this will likely surface unrelated hosts. Checking each host individually, 85[.]17.40.98 lined up with RedLine activity, while 23[.]164.48.21 showed nothing to tie it to the family and was set aside as a false positive.
That left one new confirmed RedLine C2: 85[.]17.40.98. Not a huge expansion on its own. But the value of this host turned out to have nothing to do with RedLine.
A Maritime Phishing Campaign Behind the C2
The natural next step with a confirmed C2 is to look at what else VirusTotal knows about it. Pulling the relations for 85[.]17.40.98 returned a string of email files (.eml and .msg) submitted since January.
All of the email samples had been exclusively submitted from South Korea. These appear to be business exchanges written as part of ongoing conversations about shipment procedures, addressed to Kangrim Heavy Industries, a South Korean manufacturer of marine and industrial boilers that holds over 60% of the world market.3 The emails carried attached ZIP files which delivered Formbook, a long-running form-grabber and infostealer also sold as MaaS.
