Skuggaheimar/Threat Intelligence/Lumma C2 Stealer
LUMMA C2 STEALER
LUMMA
INFORMATION STEALER
ECRIME
Threat IntelligenceMalwareNovember 10, 2025•15 min read

Lumma C2 Stealer: Threat Intelligence Profile

Rising MaaS stealer replacing RedLine

Scroll

Lumma C2 Stealer (also known as Lumma, LummaC2, LummaC Stealer) is a information stealer active since 2022. Rising MaaS stealer replacing RedLine. Key characteristics include: browser credentials, crypto wallets, 2FA tokens, Telegram C2, $250-1000/month, post-RedLine leader.

Overview & Background

Rising MaaS stealer replacing RedLine. First identified in 2022, this threat is attributed to eCrime (MaaS).

Threat Assessment

Lumma C2 Stealer remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this information stealer.

Technical Analysis

Lumma C2 Stealer employs the following capabilities and techniques:

MITRE ATT&CK Mapping

TacticTechniqueUsage
Initial AccessT1566.001 Phishing AttachmentCommon delivery vector
ExecutionT1204.002 Malicious FileUser-triggered execution
PersistenceT1547.001 Registry Run KeysAutostart persistence
Defense EvasionT1027 Obfuscated FilesPayload obfuscation
C2T1071.001 Web ProtocolsHTTP/HTTPS C2

Detection & Defense

Defend Against Lumma C2 Stealer

Mjolnir Security provides detection and response capabilities against Lumma C2 Stealer and similar threats.

Threat DetectionIncident ResponseThreat HuntingMDR ServicesThreat Intelligence
  • Proactive Threat Hunting Hunt for Lumma C2 Stealer indicators and TTPs within your environment.
  • Threat Intelligence Monitor Lumma C2 Stealer campaigns and infrastructure changes.
  • 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Written by: Mjolnir Security  |  Published: November 10, 2025
Related Reports
Malware

RedLine Stealer: The Infostealer That Fueled a Cybercrime Empire

Read Report →
Malware

Cobalt Strike: Adversary's Arsenal

Read Report →