Lumma Infostealer Developers Persist in Their Malicious Activities
Europol, the FBI, Microsoft, and other partners have executed a coordinated operation targeting the Lumma infostealer, a malware distributed through a malware-as-a-service (MaaS) model.
Europol, the FBI, Microsoft, and other partners have executed a coordinated operation targeting the Lumma infostealer, a malware distributed through a malware-as-a-service (MaaS) model.
Lumma, known for stealing credentials and utilized by cybercriminal groups such as Scattered Spider, Angry Likho, and CoralRaider, faced substantial disruption. Starting on Mon, May 15, 2023, law enforcement agencies seized approximately 2,500 domains linked to Lumma, affecting its command and control (C2) servers and management dashboards.
The operation led to customer complaints on dark web forums about inaccessible services. However, the operation did not completely dismantle Lumma's infrastructure, particularly those hosted in Russia. An undisclosed vulnerability in the Integrated Dell Remote Access Controller (iDRAC) allowed law enforcement to infiltrate the main server. Actions included wiping the server and backups, deploying a phishing login page, and inserting a JavaScript snippet for webcam access.
Despite these efforts, Lumma's developers showed resilience and began restoring operations. By Tue, May 23, 2023, they acknowledged the seizure but reported no arrests and claimed services were back to normal. Technical analysis by Check Point confirmed that many Russia-registered C2 servers remained operational.
The operation led to customer complaints on dark web forums about inaccessible services.
Stolen data from Lumma-infected systems continues to appear on illicit markets. A Telegram bot offered 95 logs from 41 countries two days post-operation, increasing to 406 logs by May 29. Centralized Russian marketplaces also show new Lumma logs, indicating ongoing activity.
Reputational damage to Lumma may pose a significant long-term challenge. Law enforcement's psychological tactics, including messages on Lumma's Telegram channel, aim to create distrust among its user base. The mixed opinions on dark web forums reflect uncertainty about Lumma's future.
Check Point Research notes that while Lumma's infrastructure is being aggressively reinstated, the trust among affiliates may not recover as easily. The operation's focus on psychological disruption, combined with the availability of stolen data, suggests Lumma remains a threat under scrutiny.
Based on reporting by GBHackers.