RedLine Infostealer Exposed Syrian Military Police Detainee Files and Telegram Session

Summary

A RedLine infection on a Syrian National Army military police computer stole credentials, a live Telegram session and unencrypted detainee records, exposing identities, photos, family details and interrogation statements that have circulated since 2023.

Key points

• A RedLine infostealer infected a computer used by the Military Police Investigation Section in Suluk, northern Syria; the log is dated May 10, 2023.
• The malware stole saved passwords and cookies, a live Telegram desktop session, and files from the computer’s desktop.
• The recovered files included seven interrogation records containing detainees’ identities, photographs, family details, and statements, as well as other unit records.
• The unencrypted records included unverified accusations identifying civilians and their contacts, creating risks for people named in the files.
• Researchers found two versions of one detainee’s statement with differing details, including a removed prior conviction and an added denial of drug use.
• The report says the stolen files have circulated since 2023; it assesses the infection as likely involving pirated software or a drive-by download, without evidence of spear-phishing or a state actor.

MITRE ATT&CK

Malware

Vendors

Products

Tools

Countries

Industries

Related Articles

• Python NodeStealer Adds Spyware Features and Expands Facebook Data TheftTelegram · T1005 · T1539
• New MacSync macOS Stealer Uses Binary Loaders to Target Crypto Users and DevelopersTelegram · T1539
• Bissa Scanner Used AI-Assisted Workflows to Exploit 900+ Targets and Harvest CredentialsTelegram · T1005
• Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet DataT1005 · T1539
• Compromised Jscrambler npm Releases Deliver Cross-Platform InfostealerT1005 · T1539