Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations

Text acquired from the source

Cybersecurity Advisory Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations Release Date May 21, 2025 Alert Code AA25-141B CISA Product Feedback Survey Related topics: Cyber Threats and Response , Malware, Phishing, and Ransomware , Identity Theft and Personal Cyber Threats Summary The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint advisory to disseminate known tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with threat actors deploying the LummaC2 information stealer (infostealer) malware. LummaC2 malware is able to infiltrate victim computer networks and exfiltrate sensitive information, threatening vulnerable individuals’ and organizations’ computer networks across multiple U.S. critical infrastructure sectors. According to FBI information and trusted third-party reporting, this activity has been observed as recently as May 2025. The IOCs included in this advisory were associated with LummaC2 malware infections from November 2023 through May 2025. The FBI and CISA encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of LummaC2 malware. Download the PDF version of this report: AA25-141B Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations (PDF, 1.41 MB ) For a downloadable copy of IOCs, see: AA25-141B STIX XML (XML, 146.54 KB ) AA25-141B STIX JSON (JSON, 300.90 KB ) Technical Details Note: This advisory uses the MITRE ATT&CK ® Matrix for Enterprise framework, version 17. See the MITRE ATT&CK Tactics and Techniques section of this advisory for threat actor activity mapped to MITRE ATT&CK tactics and tech