Hackers Use RedLine C2 Infrastructure to Target South Korean Maritime Industry

Gbhackers •Mayura Kathir • July 6, 2026

A single RedLine Stealer command-and-control (C2) indicator has revealed a focused spear-phishing campaign targeting the South Korean maritime industry, exposing a cluster of attacker-owned domains and mail infrastructure used to distribute credential-stealing payloads. The initial signal originated from a VMRay UniqueSignal feed: an IP observed running RedLine activity on a non-standard high port (194[.]156.79.122:55615). That […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Spear-Phishing Campaign Targets South Korean Maritime Sector Using RedLine C2 A spear-phishing campaign has been identified targeting the South Korean maritime industry, utilizing RedLine Stealer command-and-control (C2) infrastructure. The campaign was uncovered through a VMRay UniqueSignal feed that revealed an IP address associated with RedLine activity. Seven fraudulent domains were identified, specifically designed to deceive companies within the maritime supply chain. These domains were part of a broader phishing operation aimed at credential theft. The attack leverages spear-phishing emails to distribute malicious payloads. The maritime sector is particularly vulnerable due to its reliance on digital communications for operations. Current status indicates ongoing monitoring and analysis of the phishing infrastructure. No specific CVEs were reported in the articles, but the threat is significant due to the targeted nature of the attacks. 2 sources 54

Extracted Entities

Hackers Use RedLine C2 Infrastructure to Target South Korean Maritime Industry

The full story

Extracted Entities

Attack Types (1)

IP Addresses (1)

Malware (1)

MITRE ATT&CK (2)