Lummac2

LummaC2 is a malicious software (malware) that was initially identified in Russian-speaking forums in 2022. The malware, written in C and distributed as Malware-as-a-Service (MaaS), has been actively developed over time, with researchers noting that LummaC2 4.0 operates as a dynamic malware strain. It's designed to steal information from infected systems and is known for its obfuscated PowerShell tactics. Techniques such as shellcode encryption, code obfuscation, and embedding LummaC2 and Rhadamanthys information stealers into legitimate binaries are used to evade antivirus detection and sandbox analysis. In 2023, the use of LummaC2 expanded alongside several other malware families including Nokoyawa and BlackBasta ransomware, Minodo, Diceloader, Aresloader, and Canyon. These malwares were obtained or purchased from FIN7 developers. LummaC2 has also appeared in new malware strains used for initial access or information stealing, such as SVCReady, CargoBay, Matanbuchus, Pikabot, Aresloader, Vidar, and Minodo. This shows a significant broadening of its application across different cyber threat landscapes. The initial attack vector of LummaC2 involves obfuscated PowerShell commands that download and execute payloads, often leveraging Microsoft’s legitimate Living-off-the-Land binaries (LOLbins) like Mshta.exe and Dllhost.exe for malicious purposes. LummaC2's techniques align with various MITRE ATT&CK frameworks, such as Process Injection (T1055) and Persistence via Registry Modification (T1547.001). The continuous development and adaptation of LummaC2 highlight the evolving nature of cyber threats and underscore the need for robust, up-to-date cybersecurity measures.