A sprawling operation undertaken by world regulation enforcement businesses and a consortium of personal sector companies has disrupted the web infrastructure related to a commodity info stealer generally known as Lumma (aka LummaC or LummaC2), seizing 2,300 domains that acted because the command-and-control (C2) spine to commandeer contaminated Home windows techniques.
“Malware like LummaC2 is deployed to steal delicate info comparable to person login credentials from hundreds of thousands of victims to be able to facilitate a bunch of crimes, together with fraudulent financial institution transfers and cryptocurrency theft,” the U.S. Division of Justice (DoJ) stated in an announcement.
The confiscated infrastructure has been used to focus on hundreds of thousands the world over by means of associates and different cyber criminals. Lumma Stealer, lively since late 2022, is estimated to have been utilized in at the least 1.7 million cases to steal info, comparable to browser knowledge, autofill info, login credentials, and cryptocurrency seed phrases. The U.S. Federal Bureau of Investigation (FBI) has attributed round 10 million infections to Lumma.
The seizure impacts 5 domains that function login panels for Lumma Stealer’s directors and paying clients to deploy the malware, thereby stopping them from compromising the computer systems and stealing sufferer info.
“Between March 16 and Might 16, 2025, Microsoft recognized over 394,000 Home windows computer systems globally contaminated by the Lumma malware,” Europol stated, including the operation cuts off communications between the malicious instrument and victims. The company described Lumma because the “world’s most vital infostealer menace.”
Microsoft’s Digital Crimes Unit (DCU), in partnership with different cybersecurity firms ESET, BitSight, Lumen, Cloudflare, CleanDNS, and GMO Registry, stated it took down roughly 2,300 malicious domains that fashioned the spine of Lumma’s infrastructure.
 |
| Unfold of Lumma Stealer malware infections throughout Home windows units |
“The first developer of Lumma relies in Russia and goes by the web alias ‘Shamel,'” Steven Masada, assistant common counsel at DCU, stated. “Shamel markets totally different tiers of service for Lumma through Telegram and different Russian-language chat boards. Relying on what service a cybercriminal purchases, they’ll create their very own variations of the malware, add instruments to hide and distribute it, and observe stolen info by means of an internet portal.”
The stealer, marketed beneath a malware-as-a-service (MaaS) mannequin, is obtainable on a subscription foundation for wherever between $250 to $1,000. The developer additionally gives a $20,000 plan that grants clients entry to supply code and the proper to promote it to different felony actors.
 |
| Weekly counts of latest C2 domains |
“Decrease tiers embody fundamental filtering and log obtain choices, whereas increased tiers provide customized knowledge assortment, evasion instruments, and early entry to new options,” ESET stated. “The costliest plan emphasizes stealth and flexibility, providing distinctive construct technology and lowered detection.”
Over time, Lumma has turn into one thing of a infamous menace, being delivered through varied distribution vectors, together with the more and more common ClickFix technique. The Home windows maker, which is monitoring the menace actor behind the stealer beneath the title Storm-2477, stated its distribution infrastructure is each “dynamic and resilient,” leveraging a mixture of phishing, malvertising, drive-by obtain schemes, abuse of trusted platforms, and site visitors distribution techniques like Prometheus.
 |
| Lumma C2 choice mechanism |
Cato Networks, in a report revealed Wednesday, revealed that suspected Russian menace actors are leveraging Tigris Object Storage, Oracle Cloud Infrastructure (OCI) Object Storage, and Scaleway Object Storage to host pretend reCAPTCHA pages that make use of ClickFix-style lures to trick customers into downloading Lumma Stealer.
“The latest marketing campaign leveraging Tigris Object Storage, OCI Object Storage, and Scaleway Object Storage builds upon earlier strategies, introducing new supply mechanisms aimed toward evading detection and concentrating on technically proficient customers,” researchers Guile Domingo, Man Waizel, and Tomer Agayev stated.
 |
| Attack circulate for ClickFix resulting in Lumma Stealer utilizing Prometheus TDS |
A few of the notable points of the malware are beneath –
- It employs a multi-tiered C2 infrastructure consisting of a set of 9 regularly altering tier-1 domains hard-coded into the malware’s configuration and fallback C2s hosted on Steam profiles and Telegram channels that time to tier-1 C2s
- The payloads are sometimes unfold utilizing pay-per-install (PPI) networks or site visitors sellers that ship installs-as-a-service.
- The stealer is often bundled with spoofed software program or cracked variations of common industrial software program, concentrating on customers seeking to keep away from paying for reliable licenses
- The operators have created a Telegram market with a ranking system for associates to promote stolen knowledge with out intermediaries
- The core binary is obfuscated with superior safety comparable to low-level digital machine (LLVM core), Management Circulation Flattening (CFF), Management Circulation Obfuscation, personalized stack decryption, large stack variables, and lifeless codes, amongst others to make static evaluation troublesome
- There have been greater than 21,000 market listings promoting Lumma Stealer logs on a number of cybercriminal boards from April by means of June of 2024, a 71.7% improve from April by means of June of 2023
“The Lumma Stealer distribution infrastructure is versatile and adaptable,” Microsoft stated. “Operators frequently refine their strategies, rotating malicious domains, exploiting advert networks, and leveraging reliable cloud companies to evade detection and preserve operational continuity. To additional disguise the true C2 servers, all of the C2 servers are hidden behind the Cloudflare proxy.”
“This dynamic construction permits operators to maximise the success of campaigns whereas complicating efforts to hint or dismantle their actions. The expansion and resilience of Lumma Stealer highlights the broader evolution of cybercrime and underscores the necessity for layered defenses and trade collaboration to counter threats.”
In an interview with security researcher g0njxa in January 2025, the developer behind Lumma stated they meant to stop operations by subsequent fall. “Now we have carried out plenty of work over two years to attain what we’ve got now,” they stated. “We’re happy with this. It has turn into part of our each day life for us, and never simply work.”
