Netskope Threat Labs

Lumma Stealer

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

Lumma Stealer is an information stealer family in use since at least 2022 and operated as malware as a service. Its operators sell captured data in criminal markets to initial access brokers, who use or resell the credentials for further intrusions.

Stats

First seen
June 2023
Last seen
October 2026

Also known as

LummaLummaCLummaC2LummaCStealerLummaStealerLummacLummacStealerLummastealer

MITRE ATT&CK techniques

35 techniques across 10 tactics.

TA0001 Initial Access

TA0002 Execution

TA0003 Persistence

TA0005 Stealth

TA0006 Credential Access

  • T1539Steal Web Session Cookie
  • T1555Credentials from Password Stores

TA0007 Discovery

  • T1082System Information Discovery
  • T1217Browser Information Discovery
  • T1518Software Discovery

TA0009 Collection

TA0011 Command and Control

TA0010 Exfiltration

  • T1041Exfiltration Over C2 Channel

TA0112 Defense Impairment

Alert name variants

Alert Name
ByteCode-MSIL.Downloader.LummaStealer
ByteCode-MSIL.Spyware.Lummastealer
ByteCode-MSIL.Trojan.LummaC
ByteCode-MSIL.Trojan.Lummastealer
ByteCode-MSIL.Trojan.LummaStealer
Document-HTML.Downloader.LummaStealer
Document-HTML.Trojan.Lummastealer
Email-MIME.Trojan.LummaStealer
Gen:Variant.LummaStealer.1
Gen:Variant.LummaStealer.141

Related IPS Signatures

Signature Name
MALWARE-CNC Win.Malware.Lumma variant outbound connection
MALWARE-OTHER Win.Malware.Lumma variant download attempt
MALWARE-OTHER Win.Malware.Lumma variant malicious webpage popup attempt
MALWARE-OTHER Win.Malware.Lumma variant powershell script download attempt

Related blogs

Related families

QakBotDarkGateMetamorfoTrickBotGrandoreiro

References