Malware

Lumma Stealer

Also known as: LummaC2 Stealer

Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.

Indicators of Compromise 14

Domain ip-api[.]com Domain pool[.]supportxmr[.]com Filename FEbJCNWOCKMJ.bat Filename MicrosoftEdgeUpdate.exe Filename MicrosoftUpdate.exe Filename NisSrv.exe Filename WinRing0x64.sys Filename libuv-1.dll Filename mgwthmc2.dat SHA-256 7ed4a256e1d281cb4f194d13ff554fd4fb280dafde0a67a18115ea038ea6c87d IP 116[.]203[.]243[.]208 IP 136[.]243[.]203[.]109 IP 136[.]243[.]203[.]111 IP 138[.]199[.]246[.]13

MITRE ATT&CK TTPs 2

T1059.001
PowerShell
Execution
 T1574.002
DLL Side-Loading
Persistence

Source Articles

EU sanctions Russian GRU military hackers over cyberattacks
The European Union and the United Kingdom have jointly imposed sanctions on Russian individuals and entities linked to state-sponsored cyberattacks. The targeted groups include GRU officers, FSB-affiliated hackers such as the Turla group, and cybercriminals involved in operations like the Lumma Stealer malware. These actors are accused of conducting cyberespionage, targeting critical infrastructure across Europe, and supporting disinformation campaigns. The sanctions follow a series of attacks on energy grids and government institutions, including failed attempts to disrupt Poland's power infrastructure.
bleeping-computer ·2w ago
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
In April 2026, a financially motivated campaign distributed the Vidar stealer and XMRig cryptocurrency miner via malvertising, targeting users searching for cracked software. The attackers used password-protected archives with fake code signing certificates to evade detection and deliver payloads. The malware employed file inflation, DLL sideloading, and AMSI bypass techniques to avoid sandbox analysis and security controls. Victims were primarily located in the U.S. and EU, with data exfiltrated to C2 servers and Monero mining initiated through a configured pool.
unit42 ·2w ago