Joint Operation Disrupts Major Cybercrime Infrastructure
US federal authorities have successfully seized multiple domains linked to LummaC2 malware, a notorious information-stealing tool used by cybercriminals to harvest crypto wallet credentials, banking logins, and personal data.
“LummaC2 was a key piece of malware infrastructure facilitating large-scale financial theft,” said a spokesperson from the U.S. Department of Justice (DOJ).
The takedown was part of a coordinated operation involving the FBI, Department of Homeland Security, and international law enforcement agencies.
How LummaC2 Worked
LummaC2, also known as Lumma Stealer, is a widely distributed malware-as-a-service (MaaS) tool that has been sold on dark web forums since early 2023. It is designed to extract sensitive data from infected devices, including:
- Crypto wallet credentials (MetaMask, Exodus, Trust Wallet)
- Online banking usernames and passwords
- Browser-stored passwords and cookies
- Two-factor authentication tokens
“The malware’s ability to target crypto assets made it especially dangerous in the DeFi and Web3 landscape,” noted a cybersecurity analyst from ThreatLocker.
Domain Seizure Targets Command-and-Control Servers
The recent domain seizures focused on disrupting LummaC2’s command-and-control (C2) infrastructure, which allowed attackers to receive stolen data and issue malware updates remotely.
By taking control of the core domains used to operate LummaC2, US authorities have dealt a significant blow to the malware’s distribution network, making it harder for cybercriminals to coordinate attacks.
“This action helps dismantle one of the key pipelines for credential theft in the crypto space,” said an official from the Cybersecurity and Infrastructure Security Agency (CISA).
Crypto and Financial Sectors on High Alert
Several victims in the U.S. and Europe have lost millions in crypto assets due to LummaC2 infections, particularly those using non-custodial wallets or browser extensions. Financial institutions and exchanges have been advised to review access logs and monitor for compromised credentials.
“LummaC2 exemplifies the evolving threat to digital finance. Institutions must stay proactive,” said a blockchain security expert at CertiK.
Ongoing Investigation and Future Warnings
While the domain seizure is a major win, investigators warn that variants of LummaC2 may still be active on underground forums. Authorities urge users and businesses to update antivirus software, enable multi-factor authentication, and avoid suspicious links or downloads.
“Cybercrime doesn’t stop with one takedown. Ongoing vigilance is essential,” said the DOJ in a public advisory.
Conclusion
The dismantling of LummaC2’s domain infrastructure marks a major cybersecurity milestone, especially in the fight against malware targeting crypto users and financial platforms. As digital assets become more mainstream, governments are ramping up efforts to track and neutralize emerging cyber threats.