#BREAKING #ESETresearch can confirm the news of
#Lumma Stealer's revival. ESET telemetry and botnet tracking show that operators are rebuilding their infrastructure, with their renewed activity reaching similar levels to those before the
#disruption in May 2025.
Lumma Stealer operators are registering dozens of new domains weekly, resolving them primarily at nameservers located in RU. As seen with other threats in the past, this can complicate future attempts to disrupt its malicious operations.
In partnership with
#Microsoft and other allies, ESET is tracking Lumma Stealer activity and continues to partially disrupt its operations, specifically by targeting its
#Steam dead drop resolvers.
While ESET telemetry shows new Lumma Stealer builds weekly, their codebase hasn’t changed much since the takedown attempt. This suggests that the attackers had to focus on operational recovery instead of innovation.
C&C data show reduced activity around the disruption (marked in turquoise) but the number of new samples detected per day has seen only minimal changes, highlighting the continual risk.
For more info on Lumma Stealer and the disruption, read our blogpost from a few weeks back
https://www.welivesecurity.com/en/eset-research/eset-takes-part-global-operation-disrupt-lumma-stealer/
![Breaking News Consumer's Handbook (onthemedia.org):
1. In the immediate aftermath, news outlets will get it wrong.
2. Don't trust anonymous sources.
3. Don't trust stories that cite another news outlet as the source of the information.
4. There's almost never a second shooter.
5. Pay attention to the language the media uses.
- "We are getting reports"…could mean anything.
- "We are seeking confirmation"…means they don't have it.
- "[News outlet] has learned"…means it has a scoop or is going out on a limb.
6. Look for news outlets close to the incident.
7. Compare multiple sources.
8. Big news brings out the fakers. And photoshoppers.
9. Beware reflexive retweeting. Some of this is on you.](https://status.nevillepark.ca/fileserver/01E7KXQY753BHZVT5NGAP0Z1YW/attachment/original/01JYAR5N79E94QMFWXE6J9X26Q.png)
