An international coalition led by the Dutch National Police, the FBI, and Eurojust dismantled the infrastructure of the RedLine and Meta (MetaStealer) malware operations in Operation Magnus. Authorities seized primary command-and-control servers in the Netherlands, confiscated domains including fivto[.]online and spasshik[.]xyz, and gained control over licensing panels, REST-API endpoints, and operator databases. Concurrently, the U.S. Department of Justice unsealed an indictment charging developer Maxim Rudometov with computer intrusion conspiracy and money laundering.

Operating under a Malware-as-a-Service (MaaS) architecture, RedLine and Meta infected millions of systems via malvertising and dropper chains to extract browser credentials, cryptocurrency wallets, and authentication cookies from Chromium SQLite databases. By transmitting harvested session tokens over SOAP/WCF and HTTP endpoints to bypass multi-factor authentication (MFA), the platforms acted as a premier initial access pipeline for ransomware groups. The seizure compromised operator client logs, IP addresses, and source code, halting active subscription distribution.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Harvesting raw session cookies and local credential vaults circumvents perimeter MFA controls, allowing initial access brokers to execute authenticated session replay and lateral traversal across enterprise single sign-on (SSO) environments without generating anomaly triggers.
• Bullet 2 — Strategic & Defender Imperative: Organizations must mandate phishing-resistant FIDO2 hardware keys, enforce device-bound session credentials (DBSC) to invalidate exfiltrated browser tokens, continuously audit endpoint execution from unverified installers, and immediately revoke exposed session identities.