Lumma

Lumma is a malicious software, or malware, known for its hard-to-detect nature. It primarily targets cryptocurrency wallets, two-factor authentication browser extensions, and other sensitive information on a victim's device. Lumma operates by exploiting vulnerabilities in systems, such as the Microsoft Defender SmartScreen bug CVE-2024-21412, to deliver harmful payloads like Lumma Infostealer. Once executed, this component exfiltrates sensitive data, including cryptocurrency wallet files, browser data, and password manager databases. Lumma Stealer communicates with its Command & Control (C&C) server via HTTP and uses process hollowing, a technique that allows it to hide its activities within legitimate processes. The Lumma malware was delivered through a sophisticated chain of infection observed by Unit 42. This involved the transmission of a Lumma executable file (EXE) over Latrodectus C2, a known command and control server. The malware was part of a new wave of threats that included not only information stealers like Lumma C2 and Vidar but also backdoors/downloaders such as Aresloader and Canyon. Some of these were acquired from FIN7 developers, including Minodo and Diceloader. As per a report published by Red Canary last month, Lumma was ranked as the sixth most prevalent malware in the wild, tied with the popular SocGholish and the ubiquitous Cobalt Strike. Despite its prevalence, Lumma's stealthy operations and advanced anti-sandbox methods make it a particularly insidious strain of malware. To download its payload, Lumma Stealer employs FTP, further complicating detection efforts. Ultimately, Lumma Stealer exfiltrates the victim’s data to its C&C server, demonstrating the high level of threat it poses to users' sensitive information.