Cyble – Online File Converter Phishing Page Spreads RedLine Stealer

MITRE Techniques

• [T1566] Phishing – The attacker creates a fake file converter phishing site impersonating Convertio. Quote: “…phishing site, hxxps://convertigoto.net/, that impersonated a genuine ‘Convertio’ website.”
• [T1204] User Execution – Infections begin when users click the “download” button on the phishing site. Quote: “the actual infection starts when the user clicks on the ‘download’ button present in the phishing site.”
• [T1064] Scripting – The downloader uses command-line tools to fetch payloads (via curl) from attacker URLs. Quote: “using ‘curl executable’ and executed after renaming it to ‘1.exe’.”
• [T1059] Command and Scripting Interpreter – 3.bat runs PowerShell commands to modify security settings (Add-MpPreference) to evade detection. Quote: “PowerShell commands to add the file extensions (‘exe’ & ‘bat’) and drive path (‘C:’) to the exclusion list of Windows Defender.”
• [T1105] Ingress Tool Transfer – The BAT/EXE payloads are downloaded from attacker URLs using curl. Quote: “downloads an executable payload … from the below URL using ‘curl’ executable…”
• [T1071] Application Layer Protocol – The RedLine Stealer communicates with its C2 using a SOAP API. Quote: “uses a SOAP API to communicate with its C&C server.”
• [T1003] OS Credential Dumping / Credential Access – RedLine Stealer is capable of stealing information from browsers, wallets, and applications. Quote: “stealer is capable of stealing information from web browsers, cryptocurrency wallets, and applications such as FileZilla, Discord, Steam, Telegram, and VPN clients.”
• [T1057] Process Discovery – The campaign references a process tree showing how the shortcut-based downloads execute. Quote: “process tree of shortcut file downloads.”
• [T1082] System Information Discovery – RedLine collects OS, hardware, processes, antivirus, and installed programs. Quote: “collects information about the infected machine, such as OS, system hardware, running processes, antivirus products, installed programs, and system language.”