Justice Department Seizes Five Domains Behind the LummaC2 Information-Stealing Malware Service: FBI Has Identified at Least 1.7 Million Thefts
The Justice Department announced on May 21, 2025, the unsealing of two warrants authorizing the seizure of five internet domains used by malicious cyber actors to operate the LummaC2 information-stealing malware service; the investigation is led by the FBI's Dallas Field Office in Dallas County, Texas.
"The Department will continue to use its unique tools, authorities, and partnerships to disrupt malicious cyber operations and criminal networks," said Sue J. Bai, head of the Justice Department's National Security Division, calling the disruption another instance of prosecutors, agents and private-sector partners coming together against persistent cybersecurity threats. Matthew R. Galeotti, head of the Criminal Division, said malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims to facilitate crimes including fraudulent bank transfers and cryptocurrency theft, and that the Department is resolved to use court-ordered disruptions to protect the public's personal information and assets. Assistant Director Bryan Vorndran of the FBI's Cyber Division said LummaC2 was the most popular infostealer service available in online criminal markets, responsible for millions of attacks, and that the FBI and its partners disrupted its infrastructure and seized its user panels.
As alleged in the affidavits filed in support of the seizure warrants, the administrators of LummaC2 used the seized websites to distribute the malware to their affiliates and other cyber criminals. According to court documents, common targets include browser data, autofill information, login credentials for email and banking services, and cryptocurrency seed phrases, which permit access to virtual currency wallets. The FBI has identified at least 1.7 million instances where LummaC2 was used to steal this type of information, the affidavits allege.
The seized domains, also referred to as user panels, served as login pages for LummaC2, allowing credentialed users and administrators to access and deploy it. On May 19, 2025, the government seized two domains. On May 20, as detailed in court documents, the LummaC2 administrators told their users of three new domains they had set up to host the user panel; the next day, the government seized those three domains as well. The seizure will prevent the owners and cyber criminals from using the websites to access LummaC2 to compromise computers and steal victim information, the Department said; visitors to the sites will now see a message that the site has been seized by the Justice Department, including the FBI.
Concurrent with the Department's actions, Microsoft announced an independent civil action to take down 2,300 internet domains also claimed to be used by the LummaC2 actors or their proxies. The U.S. Attorney's Office for the Northern District of Texas, the National Security Division's National Security Cyber Section, and the Criminal Division's Computer Crime and Intellectual Property Section are handling the case. The Department also noted that the State Department's Rewards for Justice program offers up to $10 million for information on foreign government-linked individuals engaged in certain malicious cyber activities against U.S. critical infrastructure, and that anyone who believes a computer or device has been compromised can report it to the FBI's Internet Crime Complaint Center. (Source: U.S. Department of Justice)
Source: U.S. Department of Justice
Published by GSM · USA (original Chinese edition)
Photo: 图：位于华盛顿的联邦调查局总部 J. Edgar Hoover 大楼黄昏外景（资料图）。本案由联邦调查局 Dallas 外勤办公室调查、其网络司参与宣布查封。Sdkb 摄，CC BY-SA 4.0，经 Wikimedia Commons。 / Photo: The J. Edgar Hoover Building, FBI headquarters in Washington, D.C., at dusk (file photo). The case was investigated by the FBI's Dallas Field Office, and the FBI Cyber Division joined the announcement. Sdkb, CC BY-SA 4.0, via Wikimedia Commons.
