Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer
The Lumma Rebrand We’ve Been Waiting For?
Meet Remus, a new 64-bit variant of the infamous Lumma Stealer – emerging in the wake of Lumma's takedown and the doxxing of its alleged core members.
- Thread starter Khushal
- Start date
Gen Digital’s report makes a strong attribution case, but it still should be treated as an attribution assessment rather than absolute proof.Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer
The Lumma Rebrand We’ve Been Waiting For?www.gendigital.com
Why the link to Lumma looks credible
- The report points to multiple technical overlaps, not just one reused trick.
- Items like the same ABE bypass approach, matching AntiVM logic, similar syscall/sysenter design, and the same style of string obfuscation are more meaningful when seen together.
- The mention of transitional “Tenzor” builds is also important, because intermediate samples often provide the strongest linkage between old and new malware families.
A single shared technique would not be enough to conclude “Remus = Lumma.” Malware authors copy from each other frequently. But several low-level similarities combined with transitional samples is a much stronger basis for saying Remus is likely a rebrand, fork, or direct continuation of Lumma development.
What seems new
The move from Steam/Telegram dead drops to Ethereum smart contracts is a notable operational change.
- It can make takedown and infrastructure disruption harder.
- It also shows adaptation rather than a simple copy-paste relaunch.
- That said, changing C2 delivery does not weaken the attribution by itself. Threat actors often keep the same core tradecraft while updating delivery and resilience methods.
What to be careful about
It is still best not to state this as a confirmed fact unless more vendors or independent researchers corroborate it.
Attribution in cyber threat research is rarely 100% certain from public reporting alone. The safest wording is closer to:
- “Remus appears highly likely to be a Lumma rebrand or successor.”
- “Current public reporting suggests strong technical links between Remus and Lumma.”
Bottom line
Based on the indicators you quoted, the rebrand theory looks well-supported and technically plausible, but it should still be framed as high-confidence attribution, not unquestionable confirmation.
Sources