RedLine C2 Pivot Reveals Seven Fraudulent Domains Used in Maritime Phishing Attacks

Cybersecuritynews •Tushar Subhra Dutta • July 6, 2026

A single leaked command and control server ended up unraveling an entire phishing operation aimed at the maritime shipping world. What started as a routine look at RedLine Stealer traffic turned into the discovery of seven fake domains built to trick companies in the maritime supply chain. RedLine Stealer has been one of the most […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Spear-Phishing Campaign Targets South Korean Maritime Sector Using RedLine C2 A spear-phishing campaign has been identified targeting the South Korean maritime industry, utilizing RedLine Stealer command-and-control (C2) infrastructure. The campaign was uncovered through a VMRay UniqueSignal feed that revealed an IP address associated with RedLine activity. Seven fraudulent domains were identified, specifically designed to deceive companies within the maritime supply chain. These domains were part of a broader phishing operation aimed at credential theft. The attack leverages spear-phishing emails to distribute malicious payloads. The maritime sector is particularly vulnerable due to its reliance on digital communications for operations. Current status indicates ongoing monitoring and analysis of the phishing infrastructure. No specific CVEs were reported in the articles, but the threat is significant due to the targeted nature of the attacks. 2 sources 54

Extracted Entities

RedLine C2 Pivot Reveals Seven Fraudulent Domains Used in Maritime Phishing Attacks

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)