Global Law Enforcement Disrupts Lumma Infostealer in Coordinated Takedown

Global Effort to Disrupt Lumma Infostealer

In a significant cybersecurity operation, a consortium of global law enforcement agencies and tech companies have successfully disrupted the Lumma infostealer malware. This coordinated takedown targeted one of the most popular infostealer tools used by cybercriminals worldwide 1

1

Scope and Impact of Lumma

Source: Decrypt

Lumma, also known as LummaC2, has been a go-to tool for hundreds of cyber threat actors. It was used to steal sensitive information including passwords, credit card details, banking information, and cryptocurrency wallet data. Microsoft reported that between March 16 and May 16, 2025, more than 394,000 Windows computers were infected with Lumma malware 2

2

The malware's popularity among cybercriminals was evident from its mention in over 21,000 listings on cybercrime forums in the spring of 2024. Lumma's widespread adoption can be attributed to its ease of distribution, difficulty in detection, and ability to bypass certain security defenses 1

1

Coordinated Takedown Operation

Source: Wired

The operation involved multiple agencies and companies:

1. Microsoft's Digital Crimes Unit (DCU) obtained a U.S. district court order to seize and take down about 2,300 domains supporting Lumma's infrastructure 2

   2

   .
2. The U.S. Department of Justice seized Lumma's command and control infrastructure and disrupted cybercriminal marketplaces selling the malware 1

   1

   .
3. Europol's European Cybercrime Center and Japan's Cybercrime Control Center disrupted regional Lumma infrastructure 2

   2

   .
4. Cloudflare assisted by blocking command and control server domains, Lumma's Marketplace domains, and banning accounts used to configure the domains 1

   1

   .

Lumma's Origins and Development

Lumma first emerged on Russian-language cybercrime forums in 2022. The main developer, known by the online handle "Shamel," is believed to be based in Russia. Shamel marketed different tiers of service for Lumma via Telegram and other Russian-language chat forums, allowing cybercriminals to create custom versions of the malware, add distribution tools, and track stolen information through an online portal 3

3

Related Stories

Microsoft and European police dismantle RedVDS cybercrime service behind $40 million in fraud

Microsoft Disrupts EvilTokens AI-Assisted Platform That Compromised 12,000 Accounts

Cybercriminals Exploit AI Hype to Spread Ransomware and Malware

Europol Dismantles $540 Million Cryptocurrency Fraud Ring: AI's Role in Sophisticated Scams

Evolving Threat Landscape

Source: Ars Technica

While the use of infostealing malware has surged since 2020, there's been a recent shift towards malware-free attacks. According to CrowdStrike's 2025 Global Threat Report, 79% of attacks detected last year were malware-free, compared to 40% in 2019. However, Malware-as-a-Service tools like Lumma continue to attract buyers, allowing less sophisticated threat actors to access advanced capabilities 3

3

Ongoing Vigilance

Despite the successful takedown, authorities warn that Lumma remains a potent threat. Microsoft continues to monitor emerging variants of the malware, emphasizing the need for ongoing vigilance in the face of evolving cybersecurity challenges 3

3