RedLine-Stealer-C2-Defender-Bypass-Payload-Analysis

1. Connexion C2 – IP 198.46.86.63 L'analyse réseau révèle que RedLine Stealer établit une connexion vers l'adresse IP distante 198.46.86.63. Cette IP est probablement le serveur de commande et de contrôle C2 du maliciel, utilisé pour l'exfiltration de données et la livraison de commandes...

nightHawkResponse

nightHawk Response Application conçue sur mesure pour la présentation asynchrone de données forensiques sur un backend Elasticsearch. Cette application est conçue pour ingérer un fichier de « collections » Mandiant Redline et offrir une flexibilité dans la recherche, l'empilement et le marquage...

CVE-2026-6274

CVE-2026-6274 : Contournement d'authentification Redline WR3200 English | Turkish Ce dépôt contient les détails techniques et la preuve de concept PoC pour CVE-2026-6274. La vulnérabilité existe dans les routeurs Redline WR3200 versions antérieures au firmware v7.1.8 et permet à un attaquant de...

ThreatResearch

Extracteurs de configuration Quelques scripts utilisés par notre équipe pour extraire des configs de certains échantillons analysés. PlugX Remcos templateX RedLine Stealer...

CVE-2026-6274

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8...

CVE-2026-6274

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8...

CVE-2026-6274 Authentication Bypass in DTS Electronics' Redline WR3200

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8...

CVE-2026-6274 Authentication Bypass in DTS Electronics' Redline WR3200

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8...

EUVD-2026-34793

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8...

CVE-2026-6274

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8...

CVE-2026-6274

CVE-2026-6274 concerns an authentication weakness in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200, where improper/missing authentication for a critical function allows accessing functionality not properly constrained by ACLs. Affected firmware ranges are 7.1.3 through before 7.1.8. ...

Redline WR3200 安全漏洞

The Redline WR3200 is a Wi-Fi 4 router from the Turkish company Redline, capable of supporting 300Mbps wireless transmission. The Redline WR3200 versions from 7.1.3 to 7.1.8 have security vulnerabilities. These vulnerabilities stem from improper authentication, lack of authentication for critical...

PT-2026-46912

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8...

Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure

Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader , strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service MaaS model. The threat actor behind CastleLoader has been assigned the...

EUVD-2011-3820

Malware in sbrugna...

EUVD-2023-24005

Malicious code in bioql PyPI...

EUVD-2023-24035

Malicious code in bioql PyPI...

CVE-2011-3863

Cross-site scripting XSS vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter...

Redline, Vidar and Raccoon Malware Stole 1 Billion Passwords in 2024

Specops 2025 Breached Password Report reveals over 1 billion passwords stolen by malware in the past year, exposing…...

Dutch Police Disrupt Major Info Stealers RedLine and MetaStealer in Operation Magnus

The Dutch National Police, along with international partners, have announced the disruption of the infrastructure powering two information stealers tracked as RedLine and MetaStealer. The takedown, which took place on October 28, 2024, is the result of an international law enforcement task force...