Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSSnatchCloudRedlineStealer

Also known as:@SNATCH_CLOUD@watercloud_infoSNATCH CLOUDRedline space-stripped

What is the CSSnatchCloudRedlineStealer infostealer, and what data does it steal?

CSSnatchCloudRedlineStealer (also known as @SNATCH_CLOUD, @watercloud_info, SNATCH CLOUD and Redline space-stripped) is a variant of an information-stealing malware family. CSSnatchCloudRedlineStealer targets browser credentials, cryptocurrency wallets, FTP and VPN client credentials, System hardware, locale, timezone, and screen inventory and Antivirus product inventory. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with high attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSSnatchCloudRedlineStealer is a CyStack tracking name for a space-stripped Redline UserInformation.txt distributed by the @SNATCH_CLOUD Telegram reseller under the operator handle @watercloud_info. Observed inside <DD.MM> @SNATCH_CLOUD <count>K.part<N>.rar aggregator packs at <CC><32-char-token>_<ISO8601-with-spaces>/ UserInformation.txt victim folders. The body carries the canonical REDLINE ASCII figlet banner and the official https://t.me/redline_market_bot sales-channel URL - Redline's documented storefront - alongside the full Redline-canonical field vocabulary (BuildID, FileLocation, UserName, Country, HWID, CurrentLanguage, ScreenSize, TimeZone, OperationSystem Redline-typo, UAC, ProcessElevation, Logdate, AvailableKeyboardLayouts, Hardwares: + Name: entries, Anti-Viruses:). The reseller strips every whitespace separator from both keys (Build ID: → BuildID:, Operation System: → OperationSystem:, Current Language: → CurrentLanguage:) and values (16147.3MB or 16931676160 bytes collapses to 16147.3MBor 16931676160bytes); every other presentation detail matches canonical Redline exactly.

Family attribution is canonical Redline: the body's official t.me/redline_market_bot sales-channel URL confirms the panel builder as stock Redline, and the full BuildID / OperationSystem / FileLocation / Hardwares: + Name: Total of RAM, X MB or Y bytes dual-serialization combination is Redline-canonical per SecurityScorecard's Redline disassembly and Flare's Redline write-up. HEROIC Threat Intelligence documents @SNATCH_CLOUD as a dedicated Telegram release vehicle (an 18,561-record stealer-log breach from the channel is in the Darkhive catalogue). The panel's own BuildID: @<handle> body header names the operator (@watercloud_info in observed samples) which the per-victim IOC emits as the distribution-channel overlay.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
sn********	Telegram	High

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`c26dd9b...`	1	High

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence