Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Infostealer

Lumma Stealer

Infostealer 59 detections found

Also known as: LummaC2, LummaC2 Stealer, Lumma, LummaStealer

Lumma Stealer is a Windows information-stealing malware active since late 2022, sold as malware-as-a-service on Telegram and Russian-language forums (subscriptions roughly $250-$1,000) by a developer using the alias "Shamel." It targets browser-stored credentials, session cookies, and cryptocurrency wallets, and was described by Microsoft as the most widely used infostealer among cybercriminals, tied to at least 1.7 million theft instances. On May 21, 2025, Microsoft's Digital Crimes Unit, the DOJ, Europol, and Japan's Cybercrime Control Center jointly disrupted Lumma's infrastructure, seizing roughly 2,300 domains and sinkholing over 1,300 more; subsequent reporting notes the operators have made resurgence attempts since the takedown.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Detection rules

Source Rule Status Updated
splunk Windows BitLockerToGo with Network Activity production 2026-05-13
splunk Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt production 2026-05-13
splunk Cisco Secure Firewall - Lumma Stealer Download Attempt production 2026-05-13
splunk Cisco Secure Firewall - Lumma Stealer Activity production 2026-05-13
splunk Cisco Secure Firewall - Intrusion Events by Threat Activity production 2026-05-13
splunk Windows BitLockerToGo Process Execution production 2026-05-13
snort ET TROJAN Lumma Stealer Victim Fingerprinting Activity rev 1 2026-01-06
suricata ET MALWARE Lumma Stealer Victim Fingerprinting Activity rev 1 2026-01-06
suricata ET MALWARE Lumma Stealer Victim Profile Exfil rev 1 2025-09-10
snort ET TROJAN Lumma Stealer Victim Profile Exfil rev 1 2025-09-10
snort ET ATTACK_RESPONSE Lumma Stealer Payload Inbound rev 1 2025-09-02
suricata ET ATTACK_RESPONSE Lumma Stealer Payload Inbound rev 1 2025-09-02
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M4 rev 2 2024-09-04
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M3 rev 1 2024-08-30
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M3 rev 1 2024-08-30
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M2 rev 1 2024-08-30
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M1 rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M4 rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M2 rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M1 rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha Page Inbound M2 rev 1 2024-08-29
suricata ET MALWARE Lumma Stealer Related Fake Captcha Page Inbound M1 rev 1 2024-08-29
snort ET TROJAN Lumma Stealer Related Fake Captcha Page Inbound M1 rev 1 2024-08-29
suricata ET MALWARE Lumma Stealer Related Fake Captcha Page Inbound M2 rev 1 2024-08-29
snort ET TROJAN Lumma Stealer CnC Host Checkin rev 1 2024-07-23
suricata ET MALWARE Lumma Stealer CnC Host Checkin rev 1 2024-07-23
sigma BitLockerTogo.EXE Execution test 2024-07-11
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
snort ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
suricata ET MALWARE [ANY.RUN] Win32/Lumma Stealer Configuration Request Attempt rev 2 2024-03-27
suricata ET MALWARE Lumma Stealer Related Activity rev 2 2024-03-27
suricata ET MALWARE Lumma Stealer Related Activity M2 rev 2 2024-03-27
suricata ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 rev 3 2024-03-26
snort ET TROJAN Lumma Stealer Related Activity rev 2 2024-02-07
snort ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] Win32/Lumma Stealer Configuration Request Attempt rev 1 2023-12-28
suricata ET MALWARE [ANY.RUN] Win32/Lumma Stealer Check-In rev 1 2023-12-28
suricata ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration rev 1 2023-12-28
snort ET TROJAN Lumma Stealer Related Activity M2 rev 1 2023-12-21
snort ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 rev 2 2023-02-03