Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The US Department of Justice and Microsoft disrupted LummaC2 infostealing-malware through domain seizures, taking down over 2,300 associated domains. The FBI and CISA released an advisory detailing LummaC2's tactics and indicators of compromise, including 114 domains. Analysis of these domains revealed common registration patterns, such as using Eastern European names and specific mail server hostnames. Notably, several domains featured an 'About Cats' landing page, with 58 additional domains sharing this characteristic and having high risk scores. These domains are suspected of distributing LummaC2 and other malware strains. Despite the takedown efforts, 41 of these domains remain active, highlighting the need for continued vigilance against LummaC2 infrastructure.

LummaC2 is an infostealing malware family whose infrastructure was recently targeted by coordinated law enforcement and private sector actions, notably by the US Department of Justice and Microsoft. These efforts resulted in the seizure of over 2,300 domains associated with LummaC2 operations. The FBI and CISA released advisories detailing the malware's tactics, techniques, and procedures (TTPs), including a list of 114 domains linked to the threat. Analysis of these domains uncovered distinct registration patterns, such as the use of Eastern European personal names and specific mail server hostnames, which serve as indicators for tracking and attribution. A unique characteristic identified was the presence of 'About Cats' landing pages on several domains, with 58 additional domains sharing this trait and exhibiting high risk scores. These cat-themed domains are suspected to be involved in distributing LummaC2 and potentially other malware strains. Despite the takedown efforts, 41 domains remain active, underscoring the resilience and adaptability of the threat actors behind LummaC2. The malware employs multiple techniques consistent with MITRE ATT&CK tactics such as domain fronting (T1102.001), use of web services (T1071.001), and infrastructure manipulation (T1583.001, T1589), indicating a sophisticated command and control (C2) infrastructure. The ongoing presence of active domains and the use of deceptive domain registration and hosting strategies highlight the need for continuous monitoring and threat intelligence sharing to mitigate LummaC2's impact.

Detailed information about Tracking LummaC2 Infrastructure with Cats. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'risk scoring'

Filter Threats

Threats Tagged 'risk scoring'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility