2025-07-15 (Tuesday): #LummaStealer infection with #SecTopRAT.

A #pcap of the #Lumma traffic and #SecTop #RAT activity, the #malware/artifacts from an infection, and the associated IOCs are available at https://www.malware-traffic-analysis.net/2025/07/15/index.html

Leaked Shellter Elite Tool Now Fueling Infostealer Attacks Worldwide https://hackread.com/leaked-shellter-elite-tool-infostealer-attacks-worldwide/ #Cybersecurity #ShellterElite #CyberAttacks #ArechClient2 #Rhadamanthys #CyberAttack #Infostealer #CyberCrime #Security #security #Lumma

Leaked Shellter Elite Tool Now Fueling Infostealer Attacks Worldwide – Source:hackread.com https://ciso2ciso.com/leaked-shellter-elite-tool-now-fueling-infostealer-attacks-worldwide-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #ShellterElite #ArechClient2 #CyberAttacks #Rhadamanthys #CyberAttack #Infostealer #CyberCrime #Hackread #security #Lumma

2025-07-02 (Wednesday): Another #LummaStealer infection with follow-up #Rsockstun #malware.

The #Lumma Stealer infection uses a password-protected 7-zip archive, a NullSoft installer, and #AutoItv3.

Malware samples, a #pcap and some IOCs are available at https://www.malware-traffic-analysis.net/2025/07/02/index.html

Today I learned that by shifting .lat you can end up with .fun and that when you end up with a Lumma dead drop resolver, you don't know which is the right TLD...

2025-06-26 (Thursday): #LummaStealer infection leads to follow-up loader that retrieves a pen test tool hosted on Github and configures it as #malware.

A #pcap of the infection traffic, the associated malware, and IOCs are available at: https://www.malware-traffic-analysis.net/2025/06/26/index.html

After the #Lumma Stealer takedown a few weeks ago, threat actors moved away from Cloudflare to AS47105 Vault Dweller OU with Finnish upstream Creanova

195.82.146.193:443
195.82.146.221:443
195.82.146.223:443

Not only Lumma botnet C2s are hosted there as ThreatFox tells
https://threatfox.abuse.ch/asn/47105/

Lumma infostealer takedown may have inflicted only a flesh wound as crew keeps pinching and selling data – Source: go.theregister.com https://ciso2ciso.com/lumma-infostealer-takedown-may-have-inflicted-only-a-flesh-wound-as-crew-keeps-pinching-and-selling-data-source-go-theregister-com/ #rssfeedpostgeneratorecho #TheRegisterSecurity #CyberSecurityNews #TheRegister #Lumma

Researchers from #CheckPoint confirmed that despite last week’s FBI announcement that it helped to take down the crew behind the #Lumma infostealer, the malware continues to operate. The group's command and control servers remain operational.

https://www.theregister.com/2025/06/02/security_news_roundup/

A week in security (May 19 – May 25) https://www.malwarebytes.com/blog/news/2025/05/a-week-in-security-may-19-may-25 #23andMe #update #lumma #News

#PorSiTeLoPerdiste Microsoft descubre un malware que infectó 394.000 equipos en todo el planeta, Colombia entre los países afectados https://www.enter.co/empresas/seguridad/microsoft-descubre-un-malware-que-infecto-394-000-equipos-en-todo-el-planeta-colombia-entre-los-paises-afectados/?utm_source=dlvr.it&utm_medium=mastodon #Seguridad #Lumma #LummaStealer

Authorities Carry Out Elaborate Global #Takedown of #Infostealer Heavily Used by #Cybercriminals

US, European, and Japanese authorities, along with tech companies including #Microsoft and #Cloudflare , say they’ve disrupted #Lumma , an #infostealer popular with criminal gangs.
#privacy #security

https://www.wired.com/story/lumma-stealer-takedown-disrupted/

#Microsoft Says 394,000 #Windows Computers Infected By #Lumma #Malware Globally - Slashdot
#security #malware

https://it.slashdot.org/story/25/05/21/1954240/microsoft-says-394000-windows-computers-infected-by-lumma-malware-globally?utm_source=rss1.0mainlinkanon&utm_medium=feed