Lummac2

LummaC2 is a dynamic malware strain, first identified in Russian-speaking forums in 2022. It's written in C and distributed as Malware-as-a-Service (MaaS). The malware has been actively exploiting PowerShell commands to infiltrate systems and exfiltrate sensitive data. In 2023, LummaC2's use expanded alongside several other malware families such as Nokoyawa and BlackBasta ransomware, Minodo, Diceloader, Canyon, Aresloader, Vidar, among others. This expansion was facilitated by obtaining or purchasing malware from FIN7 developers and other sources. Researchers have observed that LummaC2 4.0 remains under active development, with constant updates being made to its features. These include enhancements to its obfuscation techniques and control panel. It uses sophisticated tactics like Process Injection and Persistence via Registry Modification, aligning with various MITRE ATT&CK frameworks. Furthermore, it leverages Microsoft's legitimate Living-off-the-Land binaries (LOLbins) such as Mshta.exe and Dllhost.exe for malicious purposes. If the malware does not detect human-like behavior during its operations, it restarts its process from the beginning, making it highly persistent and hard to detect. In addition to its original deployment, LummaC2 has been found in new malware strains used for initial access or information stealing, including SVCReady, CargoBay, Matanbuchus, Pikabot, Aresloader, Vidar, and Minodo. Two notable instances of this were found in files named "phoneoutsourcing.exe" related to the RisePro stealer and "647887023.png", which led to an infection with the LummaC2 stealer. Threat actors are distributing two different infostealers, Vidar and LummaC2, indicating a growing trend in its usage and evolution.