lumma_stealer_operators

The Lumma Stealer operators are a cybercriminal group responsible for the development, distribution, and operation of the Lumma Stealer infostealer malware, which is the most prevalent infostealer in 2025, accounting for 51% of observed infections. Lumma Stealer is distributed as a malware-as-a-service (MaaS) tool and has infected hundreds of thousands of Windows computers globally. The operators leverage various infection vectors, including ClickFix social engineering campaigns and fake gaming mods (notably for Roblox and Minecraft), to deliver their malware. Their primary objective is credential harvesting, targeting identity portals and SaaS applications, and facilitating initial access for other cybercriminals, such as initial access brokers (IABs) who sell compromised credentials on dark web marketplaces. Lumma Stealer is also linked to ransomware operations, with a short median time between credential theft and subsequent ransomware activity. The malware is coded not to execute on Russian systems, suggesting a likely Russian-speaking origin or operational base. In May 2025, a globally coordinated law enforcement operation disrupted the Lumma Stealer infrastructure, but the resilience and adaptability of such groups remain a concern. No specific aliases or sub-groups are mentioned in the provided content.