{
  "name": "Lumma Stealer is Out... of business!",
  "slug": "lumma-stealer-is-out-of-business",
  "description": "A coordinated action led by Microsoft's Digital Crimes Unit, with participation from Bitsight and other partners, has successfully dismantled the operational capabilities of Lumma Stealer (LummaC2), a prominent information stealer operating since late 2022. The operation involved seizing over 1,000 domains and shutting down more than 90 Telegram channels and Steam profiles associated with the malware's infrastructure. LummaC2, which gained popularity after the takedown of Redline and Meta stealers, targeted Windows systems to extract sensitive data from various applications. The malware employed a complex, multi-tiered command and control infrastructure, using multiple domains, Steam profiles, and Telegram channels for resilience. This disruptive action is expected to significantly impact the threat landscape and hinder criminal activities in the malware scene.",
  "published": "2025-05-21T21:03:21+00:00",
  "created_at": "2025-05-21T21:03:21+00:00",
  "modified_at": "2025-05-22T07:43:03+00:00",
  "created_at_opencti": "2025-05-21T21:03:21+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-05-21",
    "data theft",
    "information stealer",
    "infrastructure takedown",
    "lummac",
    "lummac2",
    "malware-as-a-service",
    "multi-tiered c2",
    "redline"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "ppi2.circledexj.cyou"
      },
      {
        "id": "",
        "name": "aex.circledexj.cyou"
      },
      {
        "id": "",
        "name": "c3.digital-odyssey.shop"
      },
      {
        "id": "",
        "name": "zsilvermoonbeam.hair"
      },
      {
        "id": "",
        "name": "zoolclaud.pw"
      },
      {
        "id": "",
        "name": "zincaa.shop"
      },
      {
        "id": "",
        "name": "zinc-sneark.biz"
      },
      {
        "id": "",
        "name": "zestmodp.top"
      },
      {
        "id": "",
        "name": "zfurrycomp.top"
      },
      {
        "id": "",
        "name": "zefnecho.cyou"
      },
      {
        "id": "",
        "name": "zengardxen.cyou"
      },
      {
        "id": "",
        "name": "zboldmeadow.cyou"
      },
      {
        "id": "",
        "name": "zadventurousfood.cyou"
      },
      {
        "id": "",
        "name": "younngpresseo.shop"
      },
      {
        "id": "",
        "name": "xrfxcaseq.live"
      },
      {
        "id": "",
        "name": "yndo-pepper.bond"
      },
      {
        "id": "",
        "name": "xcelmodo.run"
      },
      {
        "id": "",
        "name": "wxayfarer.live"
      },
      {
        "id": "",
        "name": "wucijyi.shop"
      },
      {
        "id": "",
        "name": "writekdmsnu.site"
      },
      {
        "id": "",
        "name": "wrigglesight.sbs"
      },
      {
        "id": "",
        "name": "wrench-creter.sbs"
      },
      {
        "id": "",
        "name": "wrathful-jammy.cyou"
      },
      {
        "id": "",
        "name": "wqanderludreams.tech"
      },
      {
        "id": "",
        "name": "worshipstrar.biz"
      },
      {
        "id": "",
        "name": "worryfillvolcawoi.shop"
      },
      {
        "id": "",
        "name": "worldpofadventure.today"
      },
      {
        "id": "",
        "name": "wordyfindy.lat"
      },
      {
        "id": "",
        "name": "worddosofrm.shop"
      },
      {
        "id": "",
        "name": "wonderfulbelif.click"
      },
      {
        "id": "",
        "name": "wolverineas.top"
      },
      {
        "id": "",
        "name": "wishagy.live"
      },
      {
        "id": "",
        "name": "wolfestandt.run"
      },
      {
        "id": "",
        "name": "wisemassiveharmonious.shop"
      },
      {
        "id": "",
        "name": "wisecr213acktr.cyou"
      },
      {
        "id": "",
        "name": "winterchill.shop"
      },
      {
        "id": "",
        "name": "wildpadventures.tech"
      },
      {
        "id": "",
        "name": "wilddthings.top"
      },
      {
        "id": "",
        "name": "wiesespark.cyou"
      },
      {
        "id": "",
        "name": "wide-eyeder.cyou"
      },
      {
        "id": "",
        "name": "wickedneatr.sbs"
      },
      {
        "id": "",
        "name": "wholersorie.shop"
      },
      {
        "id": "",
        "name": "wellofflyric.click"
      },
      {
        "id": "",
        "name": "weighcobbweo.top"
      },
      {
        "id": "",
        "name": "weighappetis.click"
      },
      {
        "id": "",
        "name": "weiggheticulop.shop"
      },
      {
        "id": "",
        "name": "webinspisrve.icu"
      },
      {
        "id": "",
        "name": "web-security3.com"
      },
      {
        "id": "",
        "name": "weaponwo.life"
      },
      {
        "id": "",
        "name": "weaponswh.run"
      },
      {
        "id": "",
        "name": "wealthestored.icu"
      },
      {
        "id": "",
        "name": "weakkysemwmns.shop"
      },
      {
        "id": "",
        "name": "wavessdemotion.today"
      },
      {
        "id": "",
        "name": "washytortt.click"
      },
      {
        "id": "",
        "name": "washyceehsu.lat"
      },
      {
        "id": "",
        "name": "warnger.xyz"
      },
      {
        "id": "",
        "name": "warmwhearts.cloud"
      },
      {
        "id": "",
        "name": "warmconfuse.biz"
      },
      {
        "id": "",
        "name": "warlikedbeliev.org"
      },
      {
        "id": "",
        "name": "wandberup.shop"
      },
      {
        "id": "",
        "name": "waiteralcohowl.shop"
      },
      {
        "id": "",
        "name": "vwibrantwonders.rest"
      },
      {
        "id": "",
        "name": "vqaliantheart.live"
      },
      {
        "id": "",
        "name": "voyageprivato.bond"
      },
      {
        "id": "",
        "name": "vividimaginatigon.top"
      },
      {
        "id": "",
        "name": "vividhheartbeat.hair"
      },
      {
        "id": "",
        "name": "visiwonarypath.top"
      },
      {
        "id": "",
        "name": "viridisw.top"
      },
      {
        "id": "",
        "name": "virationli.site"
      },
      {
        "id": "",
        "name": "victoreqs.run"
      },
      {
        "id": "",
        "name": "vibrantadtventures.top"
      },
      {
        "id": "",
        "name": "vibranktdream.top"
      },
      {
        "id": "",
        "name": "vibrajntvibes.tech"
      },
      {
        "id": "",
        "name": "versersleep.shop"
      },
      {
        "id": "",
        "name": "versedkinfe.sbs"
      },
      {
        "id": "",
        "name": "vennurviot.sbs"
      },
      {
        "id": "",
        "name": "urbkureforum.top"
      },
      {
        "id": "",
        "name": "urbjanjungle.tech"
      },
      {
        "id": "",
        "name": "urbanouasis.cyou"
      },
      {
        "id": "",
        "name": "urbanodys.top"
      },
      {
        "id": "",
        "name": "urbanfzgproject.bet"
      },
      {
        "id": "",
        "name": "urbanaodes.click"
      },
      {
        "id": "",
        "name": "uqtilityutop.shop"
      },
      {
        "id": "",
        "name": "uprootquincju.shop"
      },
      {
        "id": "",
        "name": "uppermixturyz.site"
      },
      {
        "id": "",
        "name": "unrestyherf.cfd"
      },
      {
        "id": "",
        "name": "unknowneform.top"
      },
      {
        "id": "",
        "name": "unityshootsz.site"
      },
      {
        "id": "",
        "name": "uniquedpieco.site"
      },
      {
        "id": "",
        "name": "uniqueadowpqm.shop"
      },
      {
        "id": "",
        "name": "underlinemdsj.site"
      },
      {
        "id": "",
        "name": "undesirabkel.click"
      },
      {
        "id": "",
        "name": "uncertainyelemz.bet"
      },
      {
        "id": "",
        "name": "unawaredfostwp.shop"
      },
      {
        "id": "",
        "name": "twilitghtarc.live"
      },
      {
        "id": "",
        "name": "twhoughtfulgifts.cyou"
      },
      {
        "id": "",
        "name": "turngallerudgo.icu"
      },
      {
        "id": "",
        "name": "turkeyunlikelyofw.shop"
      },
      {
        "id": "",
        "name": "tryyudjasudqo.shop"
      },
      {
        "id": "",
        "name": "trustterwowqm.shop"
      },
      {
        "id": "",
        "name": "truegbloom.cyou"
      },
      {
        "id": "",
        "name": "truefbloom.cyou"
      },
      {
        "id": "",
        "name": "truculengisau.biz"
      },
      {
        "id": "",
        "name": "trotwhvn.live"
      },
      {
        "id": "",
        "name": "trolleyrreiwn.shop"
      },
      {
        "id": "",
        "name": "triplooqp.world"
      },
      {
        "id": "",
        "name": "tripfflux.world"
      },
      {
        "id": "",
        "name": "trenndylicensei.shop"
      },
      {
        "id": "",
        "name": "trendsetterstop.top"
      },
      {
        "id": "",
        "name": "treatynreit.site"
      },
      {
        "id": "",
        "name": "travielup.top"
      },
      {
        "id": "",
        "name": "traveljournal-techinsights.shop"
      },
      {
        "id": "",
        "name": "travewlio.shop"
      },
      {
        "id": "",
        "name": "travelilx.top"
      },
      {
        "id": "",
        "name": "tranuqlekper.bond"
      },
      {
        "id": "",
        "name": "transfosdrm.live"
      },
      {
        "id": "",
        "name": "transatcitov.cfd"
      },
      {
        "id": "",
        "name": "tranqyuilspace.hair"
      },
      {
        "id": "",
        "name": "tranqnuilserenity.pics"
      },
      {
        "id": "",
        "name": "tradersneez.click"
      },
      {
        "id": "",
        "name": "tracnquilforest.life"
      },
      {
        "id": "",
        "name": "touvrlane.bet"
      },
      {
        "id": "",
        "name": "torubleeodsmzo.shop"
      },
      {
        "id": "",
        "name": "tortoisgfe.top"
      },
      {
        "id": "",
        "name": "toptalentw.top"
      },
      {
        "id": "",
        "name": "toppyneedus.biz"
      },
      {
        "id": "",
        "name": "togoltrove.shop"
      },
      {
        "id": "",
        "name": "tirepublicerj.shop"
      },
      {
        "id": "",
        "name": "tinpanckakgou.shop"
      },
      {
        "id": "",
        "name": "timnelessdesign.cyou"
      },
      {
        "id": "",
        "name": "thumbystriw.store"
      },
      {
        "id": "",
        "name": "thritvingnature.click"
      },
      {
        "id": "",
        "name": "thingymediay.cyou"
      },
      {
        "id": "",
        "name": "thingssalver.click"
      },
      {
        "id": "",
        "name": "thingspouter.top"
      },
      {
        "id": "",
        "name": "thicktoys.sbs"
      },
      {
        "id": "",
        "name": "theorxhysics.shop"
      },
      {
        "id": "",
        "name": "theinterg.world"
      },
      {
        "id": "",
        "name": "thehealthylifesstop.top"
      },
      {
        "id": "",
        "name": "thegoodstylestop.top"
      },
      {
        "id": "",
        "name": "thefashioniststop.top"
      },
      {
        "id": "",
        "name": "territoryleaduo.click"
      },
      {
        "id": "",
        "name": "tentabatte.lat"
      },
      {
        "id": "",
        "name": "techworld2025.top"
      },
      {
        "id": "",
        "name": "techsxzts.click"
      },
      {
        "id": "",
        "name": "techspherxe.top"
      },
      {
        "id": "",
        "name": "techmindzs.live"
      },
      {
        "id": "",
        "name": "techixnnovation.tech"
      },
      {
        "id": "",
        "name": "tecchsavvy.cyou"
      },
      {
        "id": "",
        "name": "teachherwjw.shop"
      },
      {
        "id": "",
        "name": "tawdrydadysz.icu"
      },
      {
        "id": "",
        "name": "targett.top"
      },
      {
        "id": "",
        "name": "targetsand.shop"
      },
      {
        "id": "",
        "name": "taramigo.life"
      },
      {
        "id": "",
        "name": "tampermonkey08.top"
      },
      {
        "id": "",
        "name": "tampermonkey03.top"
      },
      {
        "id": "",
        "name": "tampermonkey02.top"
      },
      {
        "id": "",
        "name": "talkynicer.lat"
      },
      {
        "id": "",
        "name": "tacticaltr.shop"
      },
      {
        "id": "",
        "name": "tacticalte.shop"
      },
      {
        "id": "",
        "name": "tacitglibbr.biz"
      },
      {
        "id": "",
        "name": "sysmeshm.run"
      },
      {
        "id": "",
        "name": "sustainskelet.lat"
      },
      {
        "id": "",
        "name": "surroundeocw.shop"
      },
      {
        "id": "",
        "name": "supporse-comment.cyou"
      },
      {
        "id": "",
        "name": "supjportsho.icu"
      },
      {
        "id": "",
        "name": "sunpnyvibes.tech"
      },
      {
        "id": "",
        "name": "suggestyuoz.biz"
      },
      {
        "id": "",
        "name": "sudnnyparadox.hair"
      },
      {
        "id": "",
        "name": "subduedkinlkly.shop"
      },
      {
        "id": "",
        "name": "subawhipnator.life"
      },
      {
        "id": "",
        "name": "stylishdesigzns.top"
      },
      {
        "id": "",
        "name": "styleclinic-beautyicon.shop"
      },
      {
        "id": "",
        "name": "stxarnavig.live"
      },
      {
        "id": "",
        "name": "stuffgull.top"
      },
      {
        "id": "",
        "name": "studennotediw.store"
      },
      {
        "id": "",
        "name": "strivehelpeu.bond"
      },
      {
        "id": "",
        "name": "stripedre-lot.bond"
      },
      {
        "id": "",
        "name": "strikebripm.sbs"
      },
      {
        "id": "",
        "name": "strawpeasaen.fun"
      },
      {
        "id": "",
        "name": "story-tense-faz.sbs"
      },
      {
        "id": "",
        "name": "stormlegue.com"
      },
      {
        "id": "",
        "name": "stitchmiscpaew.shop"
      },
      {
        "id": "",
        "name": "stingyerasjhru.click"
      },
      {
        "id": "",
        "name": "steycools.pw"
      },
      {
        "id": "",
        "name": "stepupnwr.live"
      },
      {
        "id": "",
        "name": "steppriflej.xyz"
      },
      {
        "id": "",
        "name": "steepycentnqopm.shop"
      },
      {
        "id": "",
        "name": "steelixr.live"
      },
      {
        "id": "",
        "name": "startydashek.click"
      },
      {
        "id": "",
        "name": "starrynsightsky.icu"
      },
      {
        "id": "",
        "name": "stare-roar.cyou"
      },
      {
        "id": "",
        "name": "stardbawn.cyou"
      },
      {
        "id": "",
        "name": "starcloc.bet"
      },
      {
        "id": "",
        "name": "standartedby.shop"
      },
      {
        "id": "",
        "name": "springobtainn.biz"
      },
      {
        "id": "",
        "name": "spookycappy.biz"
      },
      {
        "id": "",
        "name": "spirittunek.store"
      },
      {
        "id": "",
        "name": "spellshagey.biz"
      },
      {
        "id": "",
        "name": "spacedbv.world"
      }
    ],
    "malware": [
      {
        "id": "0051da15-675b-4665-a6d1-872f64cf47ea",
        "name": "Lumma Stealer",
        "slug": "lumma-stealer"
      }
    ],
    "intrusion_sets": [
      {
        "id": "b9a7069d-7d9a-4ff6-8e06-7dc7e0bc6d80",
        "name": "Lumma Stealer",
        "slug": "lumma-stealer"
      }
    ],
    "attack_patterns": [
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "zealjkh.digital"
      },
      {
        "id": "",
        "name": "weldorae.digital"
      },
      {
        "id": "",
        "name": "upmodini.digital"
      },
      {
        "id": "",
        "name": "triggerte.digital"
      },
      {
        "id": "",
        "name": "thnnkzt.digital"
      },
      {
        "id": "",
        "name": "sterpickced.digital"
      },
      {
        "id": "",
        "name": "steelmor.digital"
      },
      {
        "id": "",
        "name": "steeliow.digital"
      },
      {
        "id": "",
        "name": "sparkiob.digital"
      },
      {
        "id": "",
        "name": "shiftvc.digital"
      },
      {
        "id": "",
        "name": "reformzv.digital"
      },
      {
        "id": "",
        "name": "racxilb.digital"
      },
      {
        "id": "",
        "name": "porcupineq.digital"
      },
      {
        "id": "",
        "name": "physicalsnowwer.digital"
      },
      {
        "id": "",
        "name": "owlflright.digital"
      },
      {
        "id": "",
        "name": "overlapseq.digital"
      },
      {
        "id": "",
        "name": "nebdulaq.digital"
      },
      {
        "id": "",
        "name": "metalsyo.digital"
      },
      {
        "id": "",
        "name": "meerkaty.digital"
      },
      {
        "id": "",
        "name": "lsunarlandsc.digital"
      },
      {
        "id": "",
        "name": "longitudde.digital"
      },
      {
        "id": "",
        "name": "lancery.digital"
      },
      {
        "id": "",
        "name": "krxspint.digital"
      },
      {
        "id": "",
        "name": "italecony.digital"
      },
      {
        "id": "",
        "name": "heatmodd.digital"
      },
      {
        "id": "",
        "name": "grxeasyw.digital"
      },
      {
        "id": "",
        "name": "furryfinkders.digital"
      },
      {
        "id": "",
        "name": "firearmsv.digital"
      },
      {
        "id": "",
        "name": "faminuarfas.digital"
      },
      {
        "id": "",
        "name": "erilhvs.digital"
      },
      {
        "id": "",
        "name": "elvernwood.digital"
      },
      {
        "id": "",
        "name": "easyfwdr.digital"
      },
      {
        "id": "",
        "name": "dreamttexxerk.digital"
      },
      {
        "id": "",
        "name": "discrk.digital"
      },
      {
        "id": "",
        "name": "darjkafsg.digital"
      },
      {
        "id": "",
        "name": "comexisj.digital"
      },
      {
        "id": "",
        "name": "byteplusx.digital"
      },
      {
        "id": "",
        "name": "boltetuurked.digital"
      },
      {
        "id": "",
        "name": "blissfulspillow.digital"
      },
      {
        "id": "",
        "name": "aromatcagge.digital"
      },
      {
        "id": "",
        "name": "agroecologyguide.digital"
      }
    ]
  },
  "external_refs": [
    "https://www.bitsight.com/blog/lumma-stealer-is-out-of-business",
    "https://otx.alienvault.com/pulse/682e5bb94e2f4e75be640cb5"
  ]
}