New from VMRay Labs: Climbing the Pyramid of Lumma Pain

[Khushal]

Content source

https://www.vmray.com/climbing-the-pyramid-of-lumma-pain/

Infostealers like Lumma aren’t just widespread — they’re evolving fast. In this new Labs blog, Julian Wolf breaks down how Lumma operates across delivery, evasion, and monetization, and what defenders can do to move from reactive cleanup to meaningful disruption.

How threat actors abuse SVGs for phishing

How malware analysis reveals Lumma Stealer C2 infrastructure patterns and helps defenders climb the Pyramid of Pain.

www.vmray.com

 

[Bot]

Worth a read. This VMRay Labs post (dated Feb 5, 2026) is less about “a single magic IoC” and more about why defenders get better leverage when they deliberately move up the Pyramid of Pain (from hashes → domains/infrastructure → higher-level patterns). ([vmray.com](https://www.vmray.com/climbing-the-pyramid-of-lumma-pain/))

Key takeaways from the post (what stood out)

• VMRay’s dataset: configs extracted from 7,000+ Lumma samples (July–Oct 2025), yielding 1,207 unique C2 domains. The practical point: pivoting from “thousands of hashes” to “hundreds/thousands of infra indicators” can improve coverage and raises attacker cost. ([vmray.com](https://www.vmray.com/climbing-the-pyramid-of-lumma-pain/))
• Domain “speed” matters: median time between a C2 domain’s first appearance (registration/cert) and first use was ~67 days, but median “active use” (first used to last used) was ~2.33 days (with a 75th percentile still <30 days). So ingesting domain IoCs weeks later often won’t help for real-time blocking (though it can still help for retro-hunts). ([vmray.com](https://www.vmray.com/climbing-the-pyramid-of-lumma-pain/))
• They also show how TLS certificate issuer patterns and JARM TLS fingerprints can help cluster/hunt infra; in their dataset, a small number of JARM fingerprints dominated. They explicitly note these aren’t high-fidelity by themselves. ([vmray.com](https://www.vmray.com/climbing-the-pyramid-of-lumma-pain/))

What defenders can do with this (practical, “disruption” oriented)

• Don’t over-invest in hash-blocking alone: hashes are easy for attackers to change, and at scale you end up chasing noise. The post’s numbers are a good illustration of why infra pivots can give you more “bang per indicator.” ([vmray.com](https://www.vmray.com/climbing-the-pyramid-of-lumma-pain/))
• Treat infostealer IoCs as perishable: if your pipeline can’t collect, validate, and deploy detections quickly (hours/days), domain-based blocking will often lag reality. Optimize for timeliness and automated ingestion/expiration. ([vmray.com](https://www.vmray.com/climbing-the-pyramid-of-lumma-pain/))
• Use “pattern indicators” carefully: TLS issuer/JARM-style clustering can be useful for hunting and preemptive identification, but should be combined with other signals (DNS behavior, hosting traits, endpoint telemetry) to reduce false positives. ([vmray.com](https://www.vmray.com/climbing-the-pyramid-of-lumma-pain/))

Context: Lumma has also been hit by major disruption efforts
In May 2025, Microsoft + partners and law enforcement reported disrupting Lumma’s ecosystem (incl. thousands of domains) and Microsoft reported identifying 394,000+ infected Windows computers over a two‑month window in 2025; DOJ also announced domain seizures tied to Lumma infrastructure. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/?utm_source=openai))

Sources

• How threat actors abuse SVGs for phishing
• Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool
• Justice Department Seizes Domains Behind Major Information-Stealing Malware Operation
• The Pyramid of Pain

 

[ForgottenSeer 123960]

Technical Analysis & Remediation

Campaign Profile
Industrialized MaaS Lumma Stealer (MaaS) continues to dominate the infostealer market, utilizing diverse delivery vectors like "ClickFix" (Fake CAPTCHA) and malvertising to deploy payloads that harvest browser data, crypto wallets, and 2FA extensions.

MITRE ATT&CK Mapping

T1583.003 (Acquire Infrastructure)
Rapid rotation of C2 domains.

T1566 (Phishing)
Delivery via Fake CAPTCHA/ClickFix pages.

T1059.001 (PowerShell)
Execution of clipboard content (ClickFix TTP).

T1588.004 (Digital Certificates)
Specific patterns in TLS certificate generation.

Live Evidence Extraction (The "Anchor" Protocol)

Sample Volume
The dataset included ">7000 unique samples" which utilized "1207 unique C2 domains".

Infrastructure Reuse
Analysis revealed that just five JARM fingerprints dominate the entire C2 infrastructure for these samples.

Detection Strategy
The report explicitly warns that "neither certificate issuer nor JARM hash alone are high fidelity indicators" but become powerful when combined for hunting.

Remediation - THE ENTERPRISE TRACK (SANS PICERL)

Phase 1: Identification & Containment

Infrastructure Hunting
Implement detection logic that correlates New Domains + Suspect JARM Fingerprints + Specific TLS Issuers. Do not rely on JARM alone to avoid false positives.

Traffic Analysis
Monitor for POST requests to /api endpoints with user-agent strings mimicking legitimate browsers but originating from non-browser processes (e.g., PowerShell, mshta.exe).

Blast Radius
If a host connects to a known Lumma C2, assume immediate compromise of all active session tokens and browser-stored credentials.

Phase 2: Eradication

Behavioral Blocking
Block the "ClickFix" chain: prevent the execution of PowerShell or mshta.exe spawned directly from Run dialogs or clipboard paste actions where possible (Attack Surface Reduction rules).

Forensic Indicators
Look for persistent tasks or registry keys created by the second-stage loader (often disguised as legitimate update tasks).

Phase 3: Recovery

Identity Reset
Force global password resets and revoke all active OIDC/SAML tokens for affected users. Hardware MFA (FIDO2) is strongly recommended to immunize against future stealer attacks.

Phase 4: Lessons Learned

Shift Left
Move detection logic from "blocking bad domains" (reactive) to "blocking bad infrastructure patterns" (proactive), as advocated by the VMRay report.

Remediation - THE HOME USER TRACK

Priority 1: Safety (Immediate Action)

Disconnect
Immediately disconnect the infected device from the network (Wi-Fi/Ethernet) to stop data exfiltration.

Run Scans
Use a reputable non-resident scanner (e.g., Microsoft Defender Offline or Malwarebytes) to identify and remove the binary.

Priority 2: Identity (The Critical Step)

Reset from Clean Device
Do NOT change passwords on the infected machine. Use a separate, clean phone or computer to reset passwords for Email, Banking, and Social Media.

Revoke Sessions
Log out of all active sessions (e.g., "Sign out of all devices" in Google/Facebook security settings).

Priority 3: Persistence

Check Startups
Inspect Task Manager > Startup apps and Windows Task Scheduler for unrecognized entries.

Reinstall OS
For 100% confidence, a full "Nuke and Pave" (format and reinstall Windows) is the only way to ensure deep persistence mechanisms (like rootkits) are gone.

Hardening & References

Baseline
CIS Benchmark for Google Chrome/Microsoft Edge (disable saving passwords in browsers).

Tactical
SANS output on "ClickFix" social engineering – verify CAPTCHA requests that ask for clipboard actions.

Reference

VMRay Labs Report

ThreatLocker: MIDDLEWARE Group

SANS Internet Storm Center

Microsoft Security Blog