bleepingcomputer.com - The Lumma infostealer malware operation is gradually resuming activities following a massive law enforcement operation in May, which resulted in the seizure of 2,300 domains and parts of its infrastructure.
Although the Lumma malware-as-a-service (MaaS) platform suffered significant disruption from the law enforcement action, as confirmed by early June reports on infostealer activity, it didn't shut down.
The operators immediately acknowledged the situation on XSS forums, but claimed that their central server had not been seized (although it had been remotely wiped), and restoration efforts were already underway.
Gradually, the MaaS built up again and regained trust within the cybercrime community, and is now facilitating infostealing operations on multiple platforms again.
According to Trend Micro analysts, Lumma has almost returned to pre-takedown activity levels, with the cybersecurity firm's telemetry indicating a rapid rebuilding of infrastructure.
"Following the law enforcement action against Lumma Stealer and its associated infrastructure, our team has observed clear signs of a resurgence in Lumma's operations," reads the Trend Micro report.
"Network telemetry indicates that Lumma's infrastructure began ramping up again within weeks of the takedown."
Researchers have discovered another data-seizing macOS malware, with "Cthulhu Stealer" sold to online criminals for just $500 a month.
Cado Security has identified a malware-as-a-service (MaaS) targeting macOS users named “Cthulhu Stealer”.
In the hidden corners of the internet, a parallel economy thrives—one that operates beyond the reach of conventional search engines and law enforcement agencies. Dark Web Forums have become the breeding grounds for cybercriminals.
In the world of cybersecurity, Exploit in is a well-known private Russian hacker forum. Since it began in 2012, the forum has developed into a well-known exchange and sales platform for various cybercrime tools and stolen data. A wide range of cybercrime-related topics are covered by Exploit, such as credit card information, email spamming tools, social engineering, security & vulnerabilities, social network hacking, cryptography, cracked tools, buying and selling of hacked databases, info-stealer & Malware as a service (Maas). The creators of Exploit, a well-known cybercrime forum where ransomware gangs recruit affiliates and promote their Ransomware-as-a-Service (RaaS) offerings, have declared that ransomware advertisements are no longer permitted and will be taken down.
RedLine is an information stealer which operates on a MaaS (malware-as-a-service) model. This stealer is available on underground forums, and priced according to users' needs.
