Lumma Stealer Malware Resurgence Challenges Global Takedown

A persistent infostealer resurfaced just days after an international takedown, another example of how even large-scale crackdowns may fail to permanently disrupt sophisticated malware-as-a-service operations.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Lumma, also known as LummaC2, has circulated on the darkweb since 2022 and quickly became a popular tool for cybercriminals to steal credentials and financial data. The U.S. Department of Justice, FBI and Microsoft led a May takedown of 2,300 domains tied to Lumma’s command-and-control network, rerouting traffic to sinkholes and collecting intelligence as Europol confirmed the disruption (see: Police Operation and Microsoft Take Down Lumma Infostealer).

An organization Microsoft tracks as Storm-2477 offers access to the malware for between $250 and $1,000 a month. A Lumma infection often is a prelude to a ransomware attack from groups including Scattered Spider. It’s “a go-to tool for cybercriminals and online threat actors,” wrote Steven Masada, assistant general counsel at Microsoft’s Digital Crimes Unit in a blog post heralding the May 21 takedown. Lumma’s primary developer is based in Russia and goes by the internet alias “Shamel.”

Security firm Check Point spotted the Lumma operation days after the takedown confirming the takedown, but contesting the FBI’s assertion that police seized the main server. The server, “Lumma Developer” wrote, was beyond the geographic reach of U.S. law enforcement. The FBI “did penetrate the server through an unknown exploit and formatted all the disks,” Lumma Developer wrote. But, “we quickly restored functionality and added more logging.”

Malware-as-a-service platforms like Lumma often rebound after takedowns because their modular design and tooling allow operators to quickly reassemble key components, said Zulifkar Ramzan, head of the Lat61 threat intelligence team and chief technology officer of the security firm Point Wild.

“In the case of Lumma, which has compromised hundreds of thousands of systems and stolen tens of millions of records, the high financial incentives and modular architecture of the malware make a swift return more feasible,” Ramzan told Information Security Media Group.

Research from Ramzan’s threat intelligence team shows that hackers used Lumma to compromise more than 394,000 Windows devices and exfiltrated over 70 million records in just two months ending May 16. He added that while Lumma’s return was rapid, it reflects how easily cybercrime operations can adapt and recover by shifting infrastructure.

“Most takedowns hit the surface, not the roots,” he said. “The kingpins behind these operations are rarely unmasked, let alone arrested. Until that changes, the threat won’t disappear.”

Ensar Seker, chief information security officer at SOCRadar, said malware resurgences like Lumma’s used to be rare but they’re becoming common – especially in the stealer-as-a-service market, where threat actors can rapidly clone infrastructure and redeploy operations. Lumma’s swift rebound shows signs of a well-prepared, professionalized operations, according to Seker.

“In the past, a coordinated takedown might stall operations for months,” Seker said. “But today’s cybercriminals operate with backp channels, mirrors and modular ecosystems that allow them to pivot in days, not weeks.”

“In Lumma’s case, the speed of its comeback suggests a well-prepared operation, not just a lone actor scrambling to rebrand,” he added.