Spear-Phishing Campaign Targets South Korean Maritime Sector Using RedLine C2

A spear-phishing campaign has been identified targeting the South Korean maritime industry, utilizing RedLine Stealer command-and-control (C2) infrastructure. The campaign was uncovered through a VMRay UniqueSignal feed that revealed an IP address associated with RedLine activity. Seven fraudulent domains were identified, specifically designed to deceive companies within the maritime supply chain. These domains were part of a broader phishing operation aimed at credential theft. The attack leverages spear-phishing emails to distribute malicious payloads. The maritime sector is particularly vulnerable due to its reliance on digital communications for operations. Current status indicates ongoing monitoring and analysis of the phishing infrastructure. No specific CVEs were reported in the articles, but the threat is significant due to the targeted nature of the attacks.

Key Points: • A spear-phishing campaign targets the South Korean maritime industry using RedLine Stealer. • Seven fraudulent domains were identified, aimed at tricking maritime supply chain companies. • The attack exploits spear-phishing emails to distribute credential-stealing payloads.