Lumma infostealer infected about 10 million systems before global disruption

Cybercriminals used the prolific malware to target individuals and businesses, including Fortune 500 companies, according to the FBI.

LummaC2 infected around 10 million devices and systems, allowing for millions of follow-on attacks, before the information-stealing malware operation was dismantled through a coordinated global operation this week, Brett Leatherman, the FBI’s deputy assistant director for cyber operations, said during a media briefing Wednesday. 

“Since its inception in 2022, LummaC2’s malware-as-a-service platform rose to become the most prolific information stealer for sale in online criminal markets and used by cybercriminals to conduct attacks against millions of innocent victims,” Leatherman said. 

The FBI has identified at least 1.7 million instances where LummaC2 was used to steal usernames, passwords, browser extensions, remote connections, system information, cryptocurrency wallets and seed phrases, and data autofill information, including stored credit cards. 

The number of victims linked to LummaC2 increased exponentially and so quickly over the past couple years that officials are still digging through evidence to find and attribute more attacks to the infostealer outfit. The FBI estimates the malware platform facilitated $36.5 million in credit card theft alone in 2023.

LummaC2, also known as Lumma Stealer, targeted individuals and businesses, including Fortune 500 companies, according to Leatherman. Known victims include airlines, universities, banks, insurance providers, hospitals, state governments and internet service providers. 

Authorities and cybersecurity firms that aided in the investigation and takedown of LummaC2’s core infrastructure said the infostealer malware infected systems via social engineering, fake or spoofed software, phishing emails, fraudulent links and fake CAPTCHA deliveries.

The Cybersecurity and Infrastructure Security Agency released technical details about how LummaC2 malware infects systems and the operations it conducts to steal data. The malware enabled cybercriminals to bypass endpoint detection and response (EDR) tools and antivirus programs that are designed to track and alert users to phishing attempts or drive-by downloads, the agency said.

Researchers at Cloudflare, one of the security firms that assisted the Justice Department, said Lumma’s operators collected stolen credentials as logs, which were then indexed for sale on a marketplace where criminals could search for and buy potentially lucrative credentials.

Scores of companies — ESET, Microsoft, Bitsight, Lumen, CleanDNS and GMO Registry — that helped seize and dismantle Lumma’s domains, central command and control and marketplaces where the malware was sold to other cybercriminals lauded the far-reaching success of the disruption operation.

Yet, despite the U.S. government’s quick seizure Wednesday of three new domains LummaC2 administrators set up to host the user panel the day prior, concerns lingers about the cybercriminal group’s ability to regroup and continue operations.

“When we conduct these technical operations, they’re not always permanent,” Leatherman said. 

“We may not eradicate the threat. That’s yet to be seen in any technical operation, but any period of downtime to the actors brings relief to victims, and that’s what we’re looking to do here,” he added. 

There’s no guarantee Lumma’s operators won’t reconstitute, but coordinated disruption efforts will continue to target and hinder the group’s technical operation, including its access, capacity and capability to impact more victims, Leatherman said. 

“This is part of a greater law enforcement investigation into the group, and we hope that this will also fracture trust within the ecosystem itself,” he said. “There’s a financial cost to them being down, but there’s also a reputational cost as well, and we think that everybody operating in this environment should understand that.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• FBI raises alarm over deceptive phishing campaign targeting prominent people

• McKesson copes with fallout from data theft extortion attack

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure