When law enforcement takedown campaigns never succeed in rooting out threat groups, the result is always increased and more brazen cybercrime.
After having 2,500 of their malicious domains taken down, the infostealer threat group Lumma has been showing signs of resurgence.
According to reports, the takedown operation had started on 15 May, when Lumma customers had flooded Dark Web forums complaining they were unable to access the malware’s command and control servers and management dashboards.
On 23 May the group had publicly confirmed that their main server was not seized due to its geographic location. However, it had been successfully infiltrated when enforcement agencies exploited an unknown vulnerability that had resulted in the server and its backups being wiped. The agencies had also created a phishing login page to the harvest credentials and digital footprints of Lumma customers. They had also planted a JavaScript snippet that tried to access the customers’ web cameras.
Down but not out
Since then, Lumma have already claimed to be operational once more. Several cybercriminals have announced claims that no one related to Lumma has been arrested, and that “everything has been restored, and we are working normally.”
In addition, several clues show:
- The command-and-control servers registered in Russia had not been disabled, according to threat researchers from Check Point.
- Information stolen from compromised computers continues to appear on the online market. For example, two days after the operation, stolen credentials obtained by Lumma had been put on sale. As of May 29, there had been a steady increase of credentials added for sale.
- Data from Lumma-infected computers were still being sold by a centralized shop for the Russian market, after the takedown operation date.
As seen in Operation Cronos, which took down LockBit, law enforcement battling cybercrime often utilize psychological pressure against threat actors to sow distrust among them. The authorities had compromised LockBit’s leak site and planted a countdown timer teasing the disclosure of the identity of LockBit’s leader.
