A sprawling operation undertaken by world regulation enforcement businesses and a consortium of personal sector companies has disrupted the web infrastructure related to a commodity info stealer often called Lumma (aka LummaC or LummaC2), seizing 2,300 domains that acted because the command-and-control (C2) spine to commandeer contaminated Home windows programs.
“Malware like LummaC2 is deployed to steal delicate info reminiscent of person login credentials from hundreds of thousands of victims in an effort to facilitate a number of crimes, together with fraudulent financial institution transfers and cryptocurrency theft,” the U.S. Division of Justice (DoJ) mentioned in a press release.
The confiscated infrastructure has been used to focus on hundreds of thousands the world over by associates and different cyber criminals. Lumma Stealer, energetic since late 2022, is estimated to have been utilized in at the least 1.7 million cases to steal info, reminiscent of browser information, autofill info, login credentials, and cryptocurrency seed phrases. The U.S. Federal Bureau of Investigation (FBI) has attributed round 10 million infections to Lumma.
The seizure impacts 5 domains that function login panels for Lumma Stealer’s directors and paying prospects to deploy the malware, thereby stopping them from compromising the computer systems and stealing sufferer info.
“Between March 16 and Could 16, 2025, Microsoft recognized over 394,000 Home windows computer systems globally contaminated by the Lumma malware,” Europol mentioned, including the operation cuts off communications between the malicious device and victims. The company described Lumma because the “world’s most important infostealer risk.”
Microsoft’s Digital Crimes Unit (DCU), in partnership with different cybersecurity firms ESET, BitSight, Lumen, Cloudflare, CleanDNS, and GMO Registry, mentioned it took down roughly 2,300 malicious domains that shaped the spine of Lumma’s infrastructure.
 |
| Unfold of Lumma Stealer malware infections throughout Home windows units |
“The first developer of Lumma relies in Russia and goes by the web alias ‘Shamel,'” Steven Masada, assistant normal counsel at DCU, mentioned. “Shamel markets totally different tiers of service for Lumma through Telegram and different Russian-language chat boards. Relying on what service a cybercriminal purchases, they’ll create their very own variations of the malware, add instruments to hide and distribute it, and observe stolen info by a web-based portal.”
The stealer, marketed underneath a malware-as-a-service (MaaS) mannequin, is accessible on a subscription foundation for wherever between $250 to $1,000. The developer additionally gives a $20,000 plan that grants prospects entry to supply code and the fitting to promote it to different prison actors.
 |
| Weekly counts of recent C2 domains |
“Decrease tiers embody fundamental filtering and log obtain choices, whereas larger tiers provide customized information assortment, evasion instruments, and early entry to new options,” ESET mentioned. “The costliest plan emphasizes stealth and adaptableness, providing distinctive construct era and diminished detection.”
Through the years, Lumma has turn out to be one thing of a infamous risk, being delivered through varied distribution vectors, together with the more and more common ClickFix methodology. The Home windows maker, which is monitoring the risk actor behind the stealer underneath the title Storm-2477, mentioned its distribution infrastructure is each “dynamic and resilient,” leveraging a mixture of phishing, malvertising, drive-by obtain schemes, abuse of trusted platforms, and visitors distribution programs like Prometheus.
 |
| Lumma C2 choice mechanism |
Cato Networks, in a report revealed Wednesday, revealed that suspected Russian risk actors are leveraging Tigris Object Storage, Oracle Cloud Infrastructure (OCI) Object Storage, and Scaleway Object Storage to host pretend reCAPTCHA pages that make use of ClickFix-style lures to trick customers into downloading Lumma Stealer.
“The current marketing campaign leveraging Tigris Object Storage, OCI Object Storage, and Scaleway Object Storage builds upon earlier strategies, introducing new supply mechanisms aimed toward evading detection and concentrating on technically proficient customers,” researchers Guile Domingo, Man Waizel, and Tomer Agayev mentioned.
 |
| Assault circulation for ClickFix resulting in Lumma Stealer utilizing Prometheus TDS |
A number of the notable features of the malware are under –
- It employs a multi-tiered C2 infrastructure consisting of a set of 9 often altering tier-1 domains hard-coded into the malware’s configuration and fallback C2s hosted on Steam profiles and Telegram channels that time to tier-1 C2s
- The payloads are usually unfold utilizing pay-per-install (PPI) networks or visitors sellers that ship installs-as-a-service.
- The stealer is often bundled with spoofed software program or cracked variations of common industrial software program, concentrating on customers trying to keep away from paying for authentic licenses
- The operators have created a Telegram market with a score system for associates to promote stolen information with out intermediaries
- The core binary is obfuscated with superior safety reminiscent of low-level digital machine (LLVM core), Management Circulation Flattening (CFF), Management Circulation Obfuscation, personalized stack decryption, large stack variables, and useless codes, amongst others to make static evaluation tough
- There have been greater than 21,000 market listings promoting Lumma Stealer logs on a number of cybercriminal boards from April by June of 2024, a 71.7% improve from April by June of 2023
“The Lumma Stealer distribution infrastructure is versatile and adaptable,” Microsoft mentioned. “Operators frequently refine their methods, rotating malicious domains, exploiting advert networks, and leveraging authentic cloud companies to evade detection and preserve operational continuity. To additional disguise the actual C2 servers, all of the C2 servers are hidden behind the Cloudflare proxy.”
“This dynamic construction permits operators to maximise the success of campaigns whereas complicating efforts to hint or dismantle their actions. The expansion and resilience of Lumma Stealer highlights the broader evolution of cybercrime and underscores the necessity for layered defenses and business collaboration to counter threats.”
Internet infrastructure firm Cloudflare mentioned it positioned a brand new, Turnstile-enabled interstitial warning web page in entrance of the malicious actors’ C2 server and market domains, in addition to taking motion in opposition to the accounts that have been used to configure the domains.
“This disruption labored to completely setback their operations by days, taking down a big variety of domains, and in the end blocking their capacity to generate income by committing cybercrime,” Blake Darché, head of Cloudforce One, mentioned. “Whereas this effort threw a large wrench into the most important world infostealers infrastructure, like every risk actor, these behind Lumma will shift ways and reemerge to deliver their marketing campaign again on-line.”
In an interview with safety researcher g0njxa in January 2025, the developer behind Lumma mentioned they meant to stop operations by subsequent fall. “We have now finished a number of work over two years to realize what now we have now,” they mentioned. “We’re pleased with this. It has turn out to be part of our day by day life for us, and never simply work.”
