ESET takes half in international operation to disrupt Lumma Stealer

ESET has collaborated with Microsoft, BitSight, Lumen, Cloudflare, CleanDNS, and GMO Registry in a world disruption operation in opposition to Lumma Stealer, an notorious malware-as-a-service (MaaS) infostealer. The operation focused Lumma Stealer infrastructure with all recognized C&C servers prior to now 12 months, rendering the exfiltration community, or a big a part of it, nonoperational.

Key factors of this blogpost:

• ESET took half in a coordinated international operation to disrupt Lumma Stealer.
• ESET offered technical evaluation and statistical info, and extracted important knowledge from tens of hundreds of malware samples.
• We offer an outline of the Lumma Stealer MaaS ecosystem.
• We additionally present technical evaluation and an outline of the evolution of Lumma Stealer’s key static and dynamic properties, which have been crucial to the disruption effort.

Disruption contribution

ESET automated methods processed tens of hundreds of Lumma Stealer samples, dissecting them to extract key components, similar to C&C servers and affiliate identifiers. This allowed us to constantly monitor Lumma Stealer’s exercise, monitor growth updates, cluster associates, and extra.

Infostealer malware households, like Lumma Stealer, are sometimes only a foreshadowing of a future, way more devastating assault. Harvested credentials are a valued commodity within the cybercrime underground, bought by preliminary entry brokers to numerous different cybercriminals, together with ransomware associates. Lumma Stealer has been some of the prevalent infostealers over the previous two years, and ESET telemetry (see Determine 1) confirms that it has left no a part of the world untouched.

Lumma Stealer builders had been actively creating and sustaining their malware. We’ve got recurrently observed code updates starting from minor bug fixes to finish alternative of string encryption algorithms and adjustments to the community protocol. The operators additionally actively maintained the shared exfiltration community infrastructure. Between June 17^th, 2024 and Might 1^st, 2025, we noticed a complete of three,353 distinctive C&C domains, averaging roughly 74 new domains rising every week together with occasional updates to Telegram-based dead-drop resolvers (see Determine 2). We focus on the small print of the community infrastructure later within the blogpost.

This ongoing evolution underscores the numerous risk posed by Lumma Stealer and highlights the significance and complexity of the disruption effort.

Background

Over the previous two years, Lumma Stealer (also called LummaC or LummaC2) has emerged as some of the energetic infostealers within the cybercrime ecosystem, changing into a well-liked device amongst cybercriminals as a consequence of its energetic growth of malware options and its infrastructure being bought as a service.

Malware as a service

Lumma Stealer adopts the idea of malware as a service (MaaS), the place associates pay a month-to-month price, based mostly on their tier, to obtain the newest malware builds and the community infrastructure vital for knowledge exfiltration. Associates have entry to a administration panel with a user-friendly interface the place they’ll obtain exfiltrated knowledge and harvested credentials.

The tiered subscription mannequin ranges from USD 250 to USD 1,000 monthly, every with more and more subtle options. Decrease tiers embrace fundamental filtering and log obtain choices, whereas increased tiers supply customized knowledge assortment, evasion instruments, and early entry to new options. The most costly plan emphasizes stealth and flexibility, providing distinctive construct era and decreased detection.

The operators of Lumma Stealer have additionally created a Telegram market with a ranking system for associates to promote stolen knowledge with out intermediaries. {The marketplace} has been properly documented in Cybereason analysis. Furthermore, they preserve public documentation of the administration panel for associates and periodically share updates and fixes on hacking boards, as proven in Determine 3.

Open documentation not solely helps associates with much less expertise to make use of the malware service, but in addition offers invaluable insights for safety researchers. Builders give attention to malware builds, knowledge pipelining, and infrastructure upkeep, whereas associates are liable for distributing the malware. This info, mixed with the service’s recognition, ends in all kinds of compromise vectors.

Widespread distribution strategies embrace phishing, cracked software program, and different malware downloaders together with SmokeLoader, DarkGate, Amadey, Vidar, and others. Widespread phishing schemes contain ClickFix or faux CAPTCHA net pages, fraudulent boards with cracked software program, faux GitHub repositories, fraudulent hyperlinks on Reddit boards, and lots of extra.

Technical evaluation

Quite a few public analyses have already been written about Lumma Stealer and its compromise vectors. Our focus right here, nevertheless, is on the elements related to the disruption. On this part, we’ll briefly introduce the important thing static and dynamic properties that we’ve got been actively extracting from Lumma Stealer.

Static properties of Lumma Stealer

Varied info comes embedded in Lumma Stealer malware samples. This naturally presents a super goal for automated extraction. Apart from the apparent knowledge of curiosity – C&C server domains – the samples additionally include identifier strings that tie the pattern to a particular affiliate and a marketing campaign, and an optionally available identifier resulting in a customized dynamic configuration. These identifiers are utilized in community communication with the C&C server throughout knowledge exfiltration and requests for dynamic configuration. Within the sections beneath, we take a look at these properties in depth.

C&C domains

Every Lumma Stealer pattern accommodates a listing of 9 encrypted C&C domains. Whereas the encryption strategies have advanced over time, the attribute array construction has remained constant as much as the time of writing.

Primarily based on Lumma Stealer’s inside pattern versioning, which is closely protected by stack string obfuscation, we all know that up till January 2025, the C&C domains within the samples have been protected by an XOR operate and base64 encoding (see Determine 4). When the base64-encoded string was decoded, it revealed a construction the place the primary 32 bytes served as an XOR key, and the remaining bytes contained the encrypted C&C area.

In January 2025, Lumma Stealer transitioned the safety of the C&C record to ChaCha20 encryption with a single hardcoded key and nonce (see Determine 5). This safety of the C&C record within the Lumma Stealer binaries has remained the identical up till the time of publication.

Lifeless-drop resolvers

Since June 2024, every Lumma Stealer construct got here with a brand new characteristic for acquiring a backup C&C. If no C&C server from the static config responds to Lumma Stealer, then the backup C&C is extracted from a dummy Steam profile net web page appearing as a dead-drop resolver. The Steam profile URL is closely protected within the binary, the identical method because the model string. The encrypted backup C&C URL is ready within the Steam profile identify, as proven in Determine 6, and the safety is an easy Caesar cipher (ROT11).

In February 2025, Lumma Stealer acquired an replace that included a characteristic for acquiring a brand new, major C&C URL from a Telegram channel dead-drop resolver. The C&C URL is extracted from the Telegram channel’s title subject, and it’s protected by the identical algorithm as within the case of the Steam profile dead-drop resolver. The principle distinction within the utilization of the Telegram and Steam profile dead-drop resolvers is that the Telegram possibility is examined first, whereas the Steam profile is used as a final resort if profitable communication has not been established with beforehand obtained C&C servers (Determine 16).

Furthermore, we imagine that the Telegram dead-drop resolver is on the market for increased tier subscriptions. It’s because many samples shouldn’t have the Telegram URL set, and due to this fact the malware skips this methodology.

Lumma Stealer identifier

Every Lumma Stealer pattern accommodates a singular hardcoded affiliate identifier referred to as LID. It’s embedded in plaintext type and utilized for communication with C&C servers. Up till March 2025, the LID parameter string adopted a structured format, delimited by two dashes (Determine 7). A detailed evaluation of the LID affiliate string is offered in an upcoming part.

Though probably the most prevalent LID noticed throughout our monitoring begins with the string uz4s1o; the second most typical LID, which begins with LPnhqo, offers a greater instance for visualizing typical LID variability. Within the phrase cloud in Determine 8, we current the highest 200 LIDs collected throughout our monitoring, beginning with LPnhqo.

Nevertheless, in early March 2025, Lumma Stealer transitioned to utilizing hexadecimal identifiers, referred to internally as UID (see Determine 9).

Optionally available configuration identifier

Along with the LID parameter, Lumma Stealer samples may additionally include an optionally available parameter referred to internally as J. When current, this parameter is in cleartext and formatted as a 32-byte ASCII hex string (see Determine 10). The J parameter is utilized within the C&C request for dynamic configuration with extra definitions for exfiltration. We speak about dynamic configuration in additional element in a following part.

If the J parameter is lacking within the Lumma Stealer pattern, an empty string is used within the C&C request and a default configuration is retrieved. Not like LID, the J parameter isn’t current in Lumma Stealer samples. Nevertheless, it performs an important function when current, because it permits retrieving a dynamic configuration that considerably will increase the stealer’s capabilities, making it a extra versatile exfiltration device for risk actors.

In March 2025, when the LID parameter was renamed to UID and its format modified, the J parameter was renamed to CID however with no change to its format or operate.

Evaluation of static properties

From our long-term monitoring and statistical evaluation of LID parameters, we imagine that the primary section of the LID identifies the affiliate, whereas the second section differentiates between campaigns. Primarily based on this assumption you possibly can see the highest 200 affiliate identifiers in Determine 11.

Furthermore, we’ve got been in a position to create a visualization of the associates’ actions over the previous 12 months (see Determine 12). This visualization highlights every week in January 2025. These kind of visualizations have offered us with invaluable insights into the patterns and behaviors of various risk actors. Moreover, the visualizations reveal a shared, domain-based C&C infrastructure amongst most Lumma Stealer associates. On the similar time, we have been in a position to establish much less regularly used C&C domains, which we suspect have been reserved for increased tier associates or extra necessary campaigns.

Dynamic properties of Lumma Stealer

Lumma Stealer retrieves a dynamic configuration from the C&C server, which accommodates definitions specifying what to scan for exfiltration (see Desk 1). The first focus is on stealing net browser extension knowledge and databases containing passwords, session cookies, net shopping historical past, and autofill knowledge. Apart from net browsers, it additionally focuses on stealing knowledge from password managers, VPNs, FTP purchasers, cloud providers, distant desktop functions, electronic mail purchasers, cryptocurrency wallets, and note-taking functions.

Desk 1. Dynamic config’s JSON fields

Regardless that we haven’t seen important adjustments within the default configurations, this characteristic enhances the malware’s capacity to carry out focused exfiltration (see Determine 13). A complete overview of the configuration fields has already been properly documented on this analysis by SpyCloud.

The configuration is in JSON format, and it’s downloaded from the C&C server utilizing an HTTPS POST request that features the LID identifier, optionally available J parameter, and a particular hardcoded Consumer-Agent string.

The safety of the dynamic configuration has modified a couple of occasions not too long ago. Previously, it was protected in the identical method because the static C&C record, by a 32-byte XOR operate and base64 encoding. In March 2025 the safety modified to ChaCha20, the place the important thing and nonce have been prepended to the encrypted configuration.

The Consumer-Agent string is necessary to comply with, as offering it appropriately is crucial for receiving the dynamic configuration. In April 2025, Lumma Stealer launched a further layer of obfuscation by encrypting JSON values utilizing an 8-byte XOR operate (see Determine 14).

This encrypted variant of the dynamic configuration is delivered when a barely up to date Consumer-Agent string is specified (see Desk 2).

Desk 2. Consumer-Agent variants

Apart from this dynamic configuration strategy, Lumma Stealer samples nonetheless include hardcoded directions for exfiltrating information. These embrace knowledge from functions similar to Outlook or Thunderbird, Steam account info, and Discord account tokens (see this SpyCloud blogpost). This mixture of dynamic and hardcoded configurations ensures that Lumma Stealer can successfully accumulate a variety of invaluable knowledge.

To summarize all of the static and dynamic adjustments talked about to date, we’ve got created a timeline (Determine 15) highlighting probably the most important developments noticed within the Lumma Stealer malware over the previous 12 months.

C&C communication

All through our Lumma Stealer monitoring interval, all extracted C&C domains constantly led to Cloudflare providers, that are utilized to hide Lumma Stealer’s actual C&C infrastructure. Cloudflare providers are additionally employed for C&C servers positioned through dead-drop resolvers.

First, Lumma Stealer must get hold of an energetic C&C server. The mechanism of this alternative is illustrated within the circulation chart proven in Determine 16.

Handshake

Though the precise handshake request to the C&C server shouldn’t be current within the newest Lumma Stealer builds, it’s price mentioning as a result of it was a characteristic of our monitoring for a very long time. The handshake request was an HTTPS POST request containing act=reside and a hardcoded Consumer-Agent. Energetic servers responded with a cleartext okay message.

Configuration request

When Lumma Stealer identifies an energetic C&C server, it requests the configuration through an HTTPS POST request (Determine 17), which incorporates the LID and J parameters as knowledge. If the J parameter shouldn’t be current within the pattern, Lumma Stealer retrieves the default configuration from the C&C server. This configuration specifies what to scan for exfiltration, permitting the malware to adapt to totally different targets and environments.

Further payload execution

After Lumma Stealer efficiently exfiltrates delicate knowledge and harvested credentials, it points one remaining HTTPS POST request to the C&C server – this time, with a further sufferer {hardware} ID known as hwid. This remaining request retrieves a configuration of a further payload to be executed on the sufferer’s machine. The payload or a URL to obtain from is a part of that configuration. Observe that such a payload shouldn’t be all the time offered.

Anti-analysis obfuscation methods

Lumma Stealer employs a couple of, however efficient, anti-emulation methods to make evaluation as difficult as attainable. These methods are designed to evade detection and hinder the efforts of safety analysts.

Oblique soar obfuscation

One of many major obfuscation methods utilized by Lumma Stealer is oblique management circulation flattening, proven in Determine 18. This methodology successfully disrupts the code blocks of the capabilities, making it practically not possible to maintain monitor of the operate logic. By flattening the management circulation, the malware obfuscates its operations, complicating the evaluation course of. For an in depth exploration of this method and thorough evaluation of those obfuscation patterns, together with a top level view of the answer, you possibly can discuss with this complete article by Mandiant.

Stack strings

One other method employed by Lumma Stealer is using encrypted stack strings, as illustrated in Determine 19. This methodology successfully hides binary knowledge and lots of necessary strings within the Lumma Stealer pattern, making static evaluation of the binary troublesome. Furthermore, every encrypted string has its personal distinctive mathematical operate for decryption, including one other layer of complexity to the evaluation course of.

Import API obfuscation

In Lumma Stealer, imports are resolved at runtime. Import names are hashed utilizing the FNV-1a algorithm with every construct utilizing a customized offset foundation. As proven in Determine 20, since August 25^th, 2024, Lumma Stealer additionally obfuscates the FNV hash algorithm parameters through the use of stack strings.

Conclusion

This international disruption operation was made attainable by our long-term monitoring of Lumma Stealer, which we’ve got offered an outline of on this blogpost. We’ve got described the modus operandi of the Lumma Stealer group and its service. Moreover, we’ve got documented the necessary static identifiers and C&C communication in addition to its evolution over the past 12 months. Lastly, we summarized the important thing obfuscation methods that make the evaluation of Lumma Stealer difficult.

The disruption operation, led by Microsoft, goals to grab all recognized Lumma Stealer C&C domains, rendering Lumma Stealer’s exfiltration infrastructure nonfunctional. ESET will proceed to trace different infostealers whereas carefully monitoring for Lumma Stealer exercise following this disruption operation.

For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com. 

ESET Analysis gives personal APT intelligence stories and knowledge feeds. For any inquiries about this service, go to the ESET Risk Intelligence web page.

IoCs

SHA-1	Filename	Detection	Description
6F94CFAABB19491F2B8E719D74AD032D4BEB3F29	AcroRd32.exe	Win32/Spy.Lumma Stealer.B	Lumma Stealer pattern – Construct 2024-06-27.
C5D3278284666863D7587F1B31B06F407C592AC4	Notion.exe	Win32/Spy.Lumma Stealer.B	Lumma Stealer pattern – Construct 2024-07-14.
5FA1EDC42ABB42D54D98FEE0D282DA453E200E99	explorer.exe	Win32/Spy.Lumma Stealer.B	Lumma Stealer pattern – Construct 2024-08-08.
0D744811CF41606DEB41596119EC7615FFEB0355	aspnet_regiis.exe	Win32/Spy.Lumma Stealer.B	Lumma Stealer pattern – Construct 2024-08-25.
2E3D4C2A7C68DE2DD31A8E0043D9CF7E7E20FDE1	nslookup.exe	Win32/Spy.Lumma Stealer.B	Lumma Stealer pattern – Construct 2024-09-20.
09734D99A278B3CF59FE82E96EE3019067AF2AC5	nslookup.exe	Win32/Spy.Lumma Stealer.B	Lumma Stealer pattern – Construct 2024-10-04.
1435D389C72A5855A5D6655D6299B4D7E78A0127	BitLockerToGo.exe	Win32/Spy.Lumma Stealer.B	Lumma Stealer pattern – Construct 2024-11-09.
2CCCEA9E1990D6BC7755CE5C3B9B0E4C9A8F0B59	exterior.exe	Win32/Spy.Lumma Stealer.B	Lumma Stealer pattern – Construct 2024-12-23.
658550E697D9499DB7821CBBBF59FFD39EB59053	Wemod-Premium-Unlocker-2025	MSIL/GenKryptik.HGWU	Lumma Stealer pattern – Construct 2025-01-18.
070A001AC12139CC1238017D795A2B43AC52770D	khykuQw.exe	Win32/Kryptik.HYUC	Lumma Stealer pattern – Construct 2025-02-27.
1FD806B1A0425340704F435CBF916B748801A387	Begin.exe	Win64/Injector.WR	Lumma Stealer pattern – Construct 2025-03-24.
F4840C887CAAFF0D5E073600AEC7C96099E32030	loader.exe	Win64/Kryptik.FAZ	Lumma Stealer pattern – Construct 2025-04-15.
8F58C4A16717176DFE3CD531C7E41BEF8CDF6CFE	Set-up.exe	Win32/Spy.Lumma Stealer.B	Lumma Stealer pattern – Construct 2025-04-23.

Community

MITRE ATT&CK methods

This desk was constructed utilizing model 17 of the MITRE ATT&CK framework.