In a major victory against cybercrime, Operation Magnus—a coordinated effort led by the FBI, DOJ, and international law enforcement—has taken down the notorious RedLine and Meta infostealers. These malware strains were responsible for stealing millions of credentials and sensitive data worldwide. Partnering with agencies like the Dutch National Police, UK National Crime Agency, and Australian Federal Police, U.S. officials dismantled over 1,200 servers across multiple countries.
Designed to harvest a wide range of personal information from usernames and passwords to banking details and cryptocurrency wallets, RedLine and Meta funneled stolen data into the dark web, where cybercriminals used it for ransomware, identity theft, and fraud. These malware programs infiltrated victims' devices through phishing emails, fake software updates, and even spoofed ads for popular tools like ChatGPT.
A key figure behind RedLine, Maxim Rudometov, has been charged with access device fraud, conspiracy to commit computer intrusion, and money laundering. If convicted, he faces up to 30 years in prison. The takedown operation, led by the FBI’s Austin Cyber Task Force, highlights the extensive resources dedicated to combating global cybercrime.
Law enforcement seized the infrastructure supporting RedLine and Meta, including servers, source codes, REST-API servers, and Telegram bots that distributed the malware globally. This wasn’t just malware; it was a fully operational malware-as-a-service (MaaS) business, where affiliates paid for access, customization, and even "customer support."
- A New Era of Malware-as-a-Service: RedLine and Meta infostealers weren’t just software—they were part of a professionalized crime network offering “customer support,” updates, and customization for affiliates. This sophisticated structure allowed even low-level cybercriminals to execute complex attacks.
- Global Cooperation is Critical: Operation Magnus exemplifies the power of international collaboration, with agencies from multiple countries dismantling over 1,200 servers. The operation underscores the necessity of cross-border alliances to combat the increasingly global nature of cybercrime.
These infostealers were widely distributed through social media ads, phishing emails, and fake AI chatbots, deceiving countless victims by appearing as legitimate applications. Authorities suspect that more stolen data remains hidden, revealing the vast scope of cybercrime’s reach in the digital age.