Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations

Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations ↗ source

May 21, 2025 CISA Advisory

Co-sealed by: CISA, FBI

Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b

Summary

LummaC2 malware is able to infiltrate victim computer networks and exfiltrate sensitive information, threatening vulnerable individuals’ and organizations’ computer networks across multiple U.S. critical infrastructure sectors. According to FBI information and trusted third-party reporting, this activity has been observed as recently as May 2025. The IOCs included in this advisory were associated with LummaC2 malware infections from November 2023 through May 2025. this advisory to reduce the likelihood and impact of LummaC2 malware.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

No CVEs are referenced in this publication.

Vendors Named in This Publication

Mozilla 13 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.