Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A coordinated action led by Microsoft's Digital Crimes Unit, with participation from Bitsight and other partners, has successfully dismantled the operational capabilities of Lumma Stealer (LummaC2), a prominent information stealer operating since late 2022. The operation involved seizing over 1,000 domains and shutting down more than 90 Telegram channels and Steam profiles associated with the malware's infrastructure. LummaC2, which gained popularity after the takedown of Redline and Meta stealers, targeted Windows systems to extract sensitive data from various applications. The malware employed a complex, multi-tiered command and control infrastructure, using multiple domains, Steam profiles, and Telegram channels for resilience. This disruptive action is expected to significantly impact the threat landscape and hinder criminal activities in the malware scene.

Lumma Stealer (LummaC2) was a sophisticated information-stealing malware that emerged in late 2022, gaining prominence after the takedown of other stealers such as Redline and Meta. It primarily targeted Windows systems, aiming to extract sensitive data from a variety of applications. The malware utilized a complex, multi-tiered command and control (C2) infrastructure that leveraged over 1,000 domains, Steam profiles, and Telegram channels to maintain resilience and operational continuity. This infrastructure allowed attackers to manage and update the malware remotely, exfiltrate stolen data, and evade takedown attempts. The malware's capabilities included credential theft, data exfiltration, and potentially lateral movement within compromised networks, employing techniques aligned with MITRE ATT&CK tactics such as T1071 (Application Layer Protocol), T1005 (Data from Local System), T1140 (Deobfuscate/Decode Files or Information), T1555 (Credentials from Password Stores), T1555.003 (Credentials from Web Browsers), T1059 (Command and Scripting Interpreter), T1102 (Web Service), T1573 (Encrypted Channel), T1056 (Input Capture), and T1132 (Data Encoding). The recent coordinated takedown led by Microsoft's Digital Crimes Unit, with support from Bitsight and other partners, successfully dismantled Lumma Stealer's infrastructure by seizing domains and shutting down associated Telegram channels and Steam profiles. This action disrupts the malware's operational capabilities and is expected to significantly reduce its threat presence in the wild.

Detailed information about Lumma Stealer is Out... of business!. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'infrastructure takedown'

Filter Threats

Threats Tagged 'infrastructure takedown'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility