A single RedLine C2 pivots into a maritime spear-phishing cluster and attacker-owned infrastructure.

An investigation beginning with a single RedLine Stealer C2 server from VMRay UniqueSignal evolved into uncovering a targeted Business Email Compromise campaign against South Korean maritime infrastructure. The analysis started with IP 194.156.79.122 on port 55615, leveraging fingerprinting techniques through FOFA and VirusTotal to identify additional C2 infrastructure. Pivoting through communicating files revealed spear-phishing emails targeting Kangrim Heavy Industries, a major South Korean marine boiler manufacturer. The campaign delivered Formbook malware through impersonated maritime supply chain companies. Further infrastructure analysis identified seven fraudulent domains hosted on TheHost LLC infrastructure, utilizing similar naming patterns and TLS certificates. The attack demonstrates sophisticated BEC tactics combining malware delivery with social engineering, mimicking legitimate business correspondence within the maritime shipping sector.

• Casbaneiro: A Banking Trojan with Distributed Data-Receiving ServersMalware2026-09-10
• Unpacking "Cruciferra": An Analysis of a Sophisticated Crypter ServiceMalware2026-07-20
• Analysis of Ongoing Ousaban Attacks Targeting the Iberian PeninsulaMalware2026-07-01
• Crafty Microsoft Teams Booking Flow Disguises Device Code PhishingCampaign2026-11-12
• Email threat landscape: Q3 2026 trends and insightsAnalysis2026-11-05