#lumma — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #lumma, aggregated by home.social.
-
2026-01-01 (Thursday): #LummaStealer infection with follow-up malware.
A #pcap of the infection traffic, the #Lumma #Stealer files, and a list of IOCs are available at https://www.malware-traffic-analysis.net/2026/01/01/index.html
Lumma Stealer C2 domain: offenms[.]cyou
The follow-up malware is using memory-scanner[.]cc for its C2 traffic, just like I saw on 2025-12-30. But this follow-up malware also used another C2 domain: communicationfirewall-security[.]cc
-
2025-12-30 (Tuesday): #LummaStealer infection with follow-up malware.
A #pcap of the infection traffic, the associated #Lumma with follow-up #malware samples, and some IOCs are available at www.malware-traffic-analysis.net/2025/12/30/index.html
I don't know what the follow-up malware is, but unlike Lumma Stealer, the follow-up malware was made persistent.
Big thanks to VirusTotal on this, because I was able to grab VirusTotal's CAPE Sandbox analysis of the Lumma Stealer sample, and it shows the URLs from the HTTPS traffic that I can't get in my lab.
If anyone knows what the follow-up malware is, please share that info!
-
Y en un giro de los acontecimientos, un grupo rival (de infostealer presumiblemente) ataca y expone a la luz las identidades y detalles de los miembros de #Lumma, con información tan sensible como datos bancarios o número de pasaporte. Esto se une al compromiso de las cuentas de Telegram del grupo criminal. Esto, claro, ha provocado el éxodo de clientes a plataformas de malware as a service alternativas. Y yo viendo esto con palomitas.
Ahora me explico la caída en picado en la actividad de Lumma.
-
RE: https://infosec.exchange/@patrickcmiller/115414802165768074
For those interested in the doxxing published on website named ‘Lumma Rats, here's the site:
lummakrysy[.]rip
-
網路捷徑檔案安全機制繞過漏洞遭到利用超過一年,攻擊者用於散布數種竊資軟體 | iThome
Link
📌 Summary:
微軟在今年2月例行更新中修補了網路捷徑檔案安全繞過漏洞CVE-2024-21412,但駭客卻利用這項漏洞來散布多種竊資軟體,攻擊範圍涵蓋北美、西班牙和泰國。資安業者Fortinet在分析中發現,攻擊者製作指向特定遠端伺服器的惡意URL檔案,並在受害電腦下載LNK檔案,誘使受害者執行該檔案,從而推進攻擊。研究人員看到駭客使用兩種不同程式碼注入工具來繞過防禦,最終在受害電腦植入竊資軟體。
🎯 Key Points:
1. 微軟在今年2月修補了網路捷徑檔案安全繞過漏洞CVE-2024-21412,但駭客利用它散布竊資軟體。
2. 資安業者Fortinet發現,攻擊者製作指向特定遠端伺服器的惡意URL檔案,並誘使受害者執行以推進攻擊。
3. 研究人員看到駭客使用兩種程式碼注入工具,最終在受害電腦植入竊資軟體。
4. Fortinet發現,駭客利用Steam社群網站作為Dead Drop Resolver來埋藏C2來源。
🔖 Keywords:
#CVE-2024-21412
#Fortinet
#Water Hydra
#Lumma Stealer
#Meduza Stealer
#ACR Stealer
#PowerShell
#HTA指令碼
#Edge主程式圖示
#LNK檔案
#forfiles
#mshta
#Imghippo
#GdipBitmapGetPixel
#HijackLoader
#Steam社群網站
#Dead Drop Resolver
#Docker
#AuthZ
#OpenAI
#GPT-4o mini
#Meta Llama 3