Threat Research

Response to CISA Advisory (AA25-141B): Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations

AttackIQ
Response to CISA Advisory (AA25-141B): Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations

The CISA and FBI released a joint advisory detailing the Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) of the LummaC2 information stealer malware, active since 2022 and targeting Windows systems. AttackIQ updated its assessment template to help organizations simulate these threats, enhancing detection and prevention capabilities against Lumma Stealer’s post-compromise behaviors. #LummaStealer #LummaC2 #AttackIQ

Keypoints

  • Lumma Stealer (LummaC2) is a lightweight, subscription-based information stealer malware operating since at least 2022, targeting Windows 7 through Windows 11.
  • The malware collects system profiling data, browser information (including cookies, passwords, and extensions), cryptocurrency wallets, and two-factor authentication details before exfiltration.
  • Lumma has been promoted primarily on Russian-speaking dark web forums and Telegram channels since May 2023.
  • AttackIQ has updated its Lumma Stealer assessment template with the latest TTPs from CISA’s May 2025 advisory to aid security teams in testing defenses against this threat.
  • The assessment covers multiple MITRE ATT&CK techniques, including process injection, system binary proxy execution, persistence via registry run keys, and exfiltration over C2 channels.
  • Recommended priorities for detection and mitigation include monitoring ingress tool transfers and using endpoint and network controls to detect malicious payload delivery.
  • AttackIQ’s platform supports continuous validation of defenses, helping organizations improve security posture by emulating adversary behavior aligned with the CTEM framework.

MITRE Techniques

  • [T1105] Ingress Tool Transfer – Downloads malicious payloads to memory or disk to test prevention capabilities (‘downloads to memory and saves to disk in two separate scenarios’).
  • [T1055] Process Injection – Injects code by allocating memory and writing shellcode within a running process (‘performs process injection by allocating memory in a running process with VirtualAlloc’).
  • [T1218.010] System Binary Proxy Execution: Mshta – Uses mshta to execute a remote HTA payload containing VBScript (’employs the Mshta Windows utility to download a remote Microsoft HTML Application payload’).
  • [T1059.001] Command and Scripting Interpreter: PowerShell – Runs base64-encoded PowerShell scripts (‘executes PowerShell script using the -encodedCommand parameter’).
  • [T1218.011] System Binary Proxy Execution: Rundll32 – Executes export functions from DLLs using rundll32 (‘executes an export function from an AttackIQ DLL using the RunDll32 utility’).
  • [T1574.002] Hijack Execution Flow: DLL Side-Loading – Loads a malicious DLL through a trusted executable to evade detection (‘leverages a legitimate and trusted executable to side-load a malicious DLL’).
  • [T1547.001] Logon Autostart Execution: Registry Run Keys – Adds persistence by setting registry keys to run malware on system startup (‘sets the HKLM registry run key’).
  • [T1497] Virtualization/Sandbox Evasion – Uses Windows API calls to detect debugging or sandbox environments (‘calls IsDebuggerPresent Windows API’).
  • [T1012] Query Registry – Enumerates user-specific registry keys for system information (‘queries HKCUSOFTWAREMicrosoftWindowsCurrentVersionInternet Settings registry key’).
  • [T1217] Browser Bookmark Discovery – Enumeration of browser bookmarks using PowerShell scripts (‘leverages a PowerShell script to enumerate browser bookmarks with Get-Content’).
  • [T1041] Exfiltration Over C2 Channel – Sends stolen data via HTTP POST requests to Command and Control servers (‘simulates exfiltration of sensitive information through HTTP POST requests’).

Indicators of Compromise

  • [File Hashes] Samples of Lumma Stealer payloads – core payloads across versions and obfuscation methods, including multiple identified hashes.
  • [Registry Keys] Persistence mechanisms – HKLMSoftwareMicrosoftWindowsCurrentVersionRun key used for autostart execution.
  • [Command Lines] PowerShell and cmd.exe commands – usage of encoded PowerShell scripts involving “Invoke-WebRequest” and “DownloadData” for payload download.
  • [Network Traffic] Exfiltration over HTTP POST – transmission of browser data, credit card numbers, and passwords to C2 servers.

Read more: https://www.attackiq.com/2025/05/22/response-to-cisa-advisory-aa25-141b/

SHARE THIS STORY

WhatsAppX (Twitter)TelegramBlueskyFacebookLinkedInThreadsEmailPrint