Armenian man extradited to the US over alleged role in RedLine infostealer operation

In March 2026 the US Justice Department announced that Armenian national Hambardzum Minasyan had been extradited to Texas to face charges over his alleged role in RedLine, one of the most widely used infostealers of the past few years. The arrest itself changes little for engineering teams. The malware behind it matters a lot more: infostealers are now a main source of the stolen passwords, session cookies and API tokens used to break into developer accounts and cloud environments.

What happened

According to the US Attorney's Office for the Western District of Texas, Minasyan was extradited on 23 March 2026 with help from the DOJ's Office of International Affairs and a DOJ attorney stationed at Eurojust. He made his initial appearance in federal court in Austin, and the department announced the case on 25 March.

A three-count indictment charges him with conspiracy to commit access device fraud (up to 10 years), conspiracy to violate the Computer Fraud and Abuse Act (up to 20 years) and conspiracy to commit money laundering (up to 20 years). Prosecutors allege that he:

• registered two virtual private servers and two internet domains used to host parts of RedLine's infrastructure;
• maintained command-and-control servers and administration panels that affiliates used to run campaigns;
• created repositories on a file-sharing site to distribute the malware to affiliates;
• registered a cryptocurrency account in November 2021 that received affiliate payments; and
• answered questions from current and prospective affiliates and helped launder proceeds through cryptocurrency exchanges.

An indictment is an allegation, and Minasyan is presumed innocent unless proven guilty.

The case follows Operation Magnus in October 2024, when Dutch police, the FBI, Eurojust and Belgian partners disrupted the RedLine and META infostealer platforms by taking down servers in the Netherlands and seizing domains and Telegram channels. On the same day, the DOJ unsealed charges against Russian national Maxim Rudometov, an alleged RedLine developer and administrator who faces a combined maximum of 35 years. In June 2025 the State Department's Rewards for Justice program offered up to $10 million for information on Rudometov and on foreign government-linked actors using RedLine.

Who is affected

• Anyone whose machine ran RedLine. The malware was sold to affiliates as a service, so victims range from home users to employees of large companies.
• Organisations whose staff credentials ended up in stealer logs. Logs from infected machines are traded and resold long after the infection, so taking down infrastructure doesn't take those credentials out of circulation.
• Developers in particular. A developer laptop usually holds browser sessions for GitHub, cloud consoles and CI systems, plus SSH keys, .env files and CLI credential caches. That's a valuable target for a stealer.

What it means for developers and engineering teams

Infostealers like RedLine typically arrive through cracked software, fake installers, malicious ads or phishing attachments. Once running, they sweep browser password stores, cookies and autofill data, crypto wallets and common application config files, then upload the bundle to the operator. Because they grab session cookies as well as passwords, an attacker can often import a stolen session and skip both the password prompt and MFA. Dutch investigators said exactly this technique, known as "pass-the-cookie", was likely used in a 2024 breach of the Dutch police.

For engineering teams the takeaway is to treat each developer workstation as part of your production attack surface. Long-lived sessions, personal access tokens with broad scopes and plaintext cloud credentials in home directories turn one infected laptop into access to repositories, package registries and cloud accounts. Arrests and takedowns raise the operators' costs, but the stealer market has repeatedly replaced disrupted brands quickly.

What to do now

1. Shorten session lifetimes for GitHub/GitLab organisations, cloud consoles and admin tools, and require re-authentication for sensitive actions.
2. Use phishing-resistant MFA (FIDO2 security keys or passkeys) for source control, cloud and identity-provider admins.
3. Replace long-lived secrets on laptops. Prefer SSO-issued short-lived cloud credentials (for example aws sso login) over static keys in ~/.aws/credentials, and fine-grained, expiring personal access tokens over classic ones.
4. Ban cracked software and unofficial installers on any machine that touches company code, and run endpoint protection on developer machines too.
5. Watch for stolen sessions. Alert on sign-ins from new devices or locations that reuse an existing session, and know how to revoke all sessions for a user in your IdP and in GitHub/GitLab.
6. Have a stealer playbook. If a machine is confirmed infected, rebuild it, then rotate every credential that was stored or cached on it, not only the user's password.

Related on TechLogHub

• Authentication: how sessions and MFA fit together
• OAuth: tokens that stealers also target

Sources

• US Attorney's Office, Western District of Texas: Armenian man extradited to US, faces charges for role in infostealing malware scheme
• CyberScoop: second defendant in RedLine infostealer case extradited
• BleepingComputer: Russian charged by US for creating RedLine infostealer malware
• The Register: $10M Rewards for Justice offer over RedLine
• BleepingComputer: pass-the-cookie attack in 2024 Dutch police breach