A sprawling operation undertaken by international regulation enforcement businesses and a consortium of personal sector corporations has disrupted the net infrastructure related to a commodity data stealer often called Lumma (aka LummaC or LummaC2), seizing 2,300 domains that acted because the command-and-control (C2) spine to commandeer contaminated Home windows techniques.
“Malware like LummaC2 is deployed to steal delicate data corresponding to consumer login credentials from hundreds of thousands of victims with the intention to facilitate a number of crimes, together with fraudulent financial institution transfers and cryptocurrency theft,” the U.S. Division of Justice (DoJ) mentioned in a press release.
The confiscated infrastructure has been used to focus on hundreds of thousands the world over by means of associates and different cyber criminals. Lumma Stealer, energetic since late 2022, is estimated to have been utilized in at the least 1.7 million situations to steal data, corresponding to browser information, autofill data, login credentials, and cryptocurrency seed phrases. The U.S. Federal Bureau of Investigation (FBI) has attributed round 10 million infections to Lumma.
The seizure impacts 5 domains that function login panels for Lumma Stealer’s directors and paying clients to deploy the malware, thereby stopping them from compromising the computer systems and stealing sufferer data.
“Between March 16 and Could 16, 2025, Microsoft recognized over 394,000 Home windows computer systems globally contaminated by the Lumma malware,” Europol mentioned, including the operation cuts off communications between the malicious software and victims. The company described Lumma because the “world’s most important infostealer menace.”
Microsoft’s Digital Crimes Unit (DCU), in partnership with different cybersecurity firms ESET, BitSight, Lumen, Cloudflare, CleanDNS, and GMO Registry, mentioned it took down roughly 2,300 malicious domains that fashioned the spine of Lumma’s infrastructure.
 |
| Unfold of Lumma Stealer malware infections throughout Home windows gadgets |
“The first developer of Lumma is predicated in Russia and goes by the web alias ‘Shamel,'” Steven Masada, assistant common counsel at DCU, mentioned. “Shamel markets totally different tiers of service for Lumma through Telegram and different Russian-language chat boards. Relying on what service a cybercriminal purchases, they will create their very own variations of the malware, add instruments to hide and distribute it, and monitor stolen data by means of a web-based portal.”
The stealer, marketed below a malware-as-a-service (MaaS) mannequin, is offered on a subscription foundation for anyplace between $250 to $1,000. The developer additionally provides a $20,000 plan that grants clients entry to supply code and the precise to promote it to different legal actors.
 |
| Weekly counts of recent C2 domains |
“Decrease tiers embrace primary filtering and log obtain choices, whereas larger tiers supply customized information assortment, evasion instruments, and early entry to new options,” ESET mentioned. “The most costly plan emphasizes stealth and flexibility, providing distinctive construct era and diminished detection.”
Through the years, Lumma has grow to be one thing of a infamous menace, being delivered through varied distribution vectors, together with the more and more standard ClickFix technique. The Home windows maker, which is monitoring the menace actor behind the stealer below the title Storm-2477, mentioned its distribution infrastructure is each “dynamic and resilient,” leveraging a mixture of phishing, malvertising, drive-by obtain schemes, abuse of trusted platforms, and site visitors distribution techniques like Prometheus.
 |
| Lumma C2 choice mechanism |
Cato Networks, in a report revealed Wednesday, revealed that suspected Russian menace actors are leveraging Tigris Object Storage, Oracle Cloud Infrastructure (OCI) Object Storage, and Scaleway Object Storage to host pretend reCAPTCHA pages that make use of ClickFix-style lures to trick customers into downloading Lumma Stealer.
“The latest marketing campaign leveraging Tigris Object Storage, OCI Object Storage, and Scaleway Object Storage builds upon earlier strategies, introducing new supply mechanisms aimed toward evading detection and concentrating on technically proficient customers,” researchers Guile Domingo, Man Waizel, and Tomer Agayev mentioned.
 |
| Assault movement for ClickFix resulting in Lumma Stealer utilizing Prometheus TDS |
A number of the notable elements of the malware are under –
- It employs a multi-tiered C2 infrastructure consisting of a set of 9 steadily altering tier-1 domains hard-coded into the malware’s configuration and fallback C2s hosted on Steam profiles and Telegram channels that time to tier-1 C2s
- The payloads are usually unfold utilizing pay-per-install (PPI) networks or site visitors sellers that ship installs-as-a-service.
- The stealer is usually bundled with spoofed software program or cracked variations of standard industrial software program, concentrating on customers seeking to keep away from paying for legit licenses
- The operators have created a Telegram market with a score system for associates to promote stolen information with out intermediaries
- The core binary is obfuscated with superior safety corresponding to low-level digital machine (LLVM core), Management Stream Flattening (CFF), Management Stream Obfuscation, custom-made stack decryption, large stack variables, and useless codes, amongst others to make static evaluation troublesome
- There have been greater than 21,000 market listings promoting Lumma Stealer logs on a number of cybercriminal boards from April by means of June of 2024, a 71.7% improve from April by means of June of 2023
“The Lumma Stealer distribution infrastructure is versatile and adaptable,” Microsoft mentioned. “Operators regularly refine their methods, rotating malicious domains, exploiting advert networks, and leveraging legit cloud companies to evade detection and keep operational continuity. To additional conceal the true C2 servers, all of the C2 servers are hidden behind the Cloudflare proxy.”
“This dynamic construction permits operators to maximise the success of campaigns whereas complicating efforts to hint or dismantle their actions. The expansion and resilience of Lumma Stealer highlights the broader evolution of cybercrime and underscores the necessity for layered defenses and trade collaboration to counter threats.”
Internet infrastructure firm Cloudflare mentioned it positioned a brand new, Turnstile-enabled interstitial warning web page in entrance of the malicious actors’ C2 server and market domains, in addition to taking motion towards the accounts that had been used to configure the domains.
“This disruption labored to completely setback their operations by days, taking down a major variety of domains, and in the end blocking their capacity to earn a living by committing cybercrime,” Blake Darché, head of Cloudforce One, mentioned. “Whereas this effort threw a large wrench into the biggest international infostealers infrastructure, like every menace actor, these behind Lumma will shift ways and reemerge to carry their marketing campaign again on-line.”
In an interview with safety researcher g0njxa in January 2025, the developer behind Lumma mentioned they meant to stop operations by subsequent fall. “We’ve finished numerous work over two years to realize what now we have now,” they mentioned. “We’re happy with this. It has grow to be part of our each day life for us, and never simply work.”
