Overview

• Microsoft's Digital Crimes Unit, with global law enforcement and tech partners, seized 2,300 domains and disrupted Lumma's command-and-control servers.
• The operation severed links between Lumma malware and over 394,000 infected Windows machines globally, preventing further exploitation.
• Lumma, marketed as malware-as-a-service by a Russian developer known as 'Shamel,' has been used to steal credentials, financial data, and cryptocurrency wallets.
• The malware was distributed through phishing, malvertising, and fake AI tools, enabling cybercriminals to target sectors including healthcare, education, and critical infrastructure.
• Despite the takedown, experts warn of a potential resurgence due to Lumma's adaptable subscription model and safe-haven development environment in Russia.