Microsoft raises posse to target dangerous Lumma malware

A broad coalition of technology partners and law enforcement agencies, spearheaded by Microsoft’s Digital Crimes Unit (DCU), has disrupted the dangerous Lumma Stealer malware-as-a-service (MaaS) operation, which played a key role in the arsenals of multiple cyber criminal gangs, including ransomware crews.

Using a court order granted in the US District Court of the Northern District of Georgia earlier in May, the DCU and its posse seized and took down approximately 2,300 malicious domains that formed the core of the Lumma operation.

“Lumma steals passwords, credit cards, bank accounts and cryptocurrency wallets, and has enabled criminals to hold schools to ransom, empty bank accounts and disrupt critical services,” said DCU assistant general counsel, Steven Masada.

At the same time, the US Department of Justice (DoJ) seized the MaaS central command structure and targeted the underground marketplaces where access was sold, while elsewhere, Europol’s European Crime Centre (EC3) and Japan’s Cybercrime Control Centre (JC3) went after locally hosted infrastructure.

Europol EC3 head Edvardas Šileris, said: “This operation is a clear example of how public-private partnerships are transforming the fight against cyber crime. By combining Europol’s coordination capabilities with Microsoft’s technical insights, a vast criminal infrastructure has been disrupted. Cyber criminals thrive on fragmentation – but together, we are stronger.”

In a blog post detailing the takedown, Masada said that over a two-month period, Microsoft had identified more than 394,000 Windows computers that had been infected by Lumma. These machines have now been “freed”, with communications between Lumma and its victims severed.

This joint action is designed to slow the speed at which [threat] actors can launch their attacks, minimise the effectiveness of their campaigns, and hinder their illicit profits by cutting a major revenue stream

At the same time, about 1,300 domains seized by or transferred to Microsoft – including 300 actioned by Europol – are now redirecting to Microsoft-operated sinkholes.

“This will allow Microsoft’s DCU to provide actionable intelligence to continue to harden the security of the company’s services and help protect online users,” said Masada. “These insights will also assist public- and private-sector partners as they continue to track, investigate and remediate this threat.

“This joint action is designed to slow the speed at which these actors can launch their attacks, minimise the effectiveness of their campaigns, and hinder their illicit profits by cutting a major revenue stream.”