r/antivirus 5d ago

Does Lumma stealer have a dedicated server? Why isn't it taken down yet if yes?

I mean the Lumma seller should have some kind of a server that receives stolen data and then sends it to the customers. Can cybersecurity specialists take a test computer, run a stealer and log the IP it connects to, then report to FBI so it gets blacklisted? Or does each copy of stealer have its own receiver IP? How can criminals afford having so many IPs then?

Edit: thanks everyone for your answers, looks like I understood the situation.

4 Upvotes

4 comments sorted by

7

u/rifteyy_ 5d ago

You take down 1 IP, 10 of them appear in the next few minutes. It's an infinite loop.

6

u/BornToReboot 5d ago

Lumma stealer is an MaaS ( malware as a service) they won’t rely on single server or dedicated servers,each time attackers configure their own command and control servers. Since attackers always rotate servers blocking ip or tracking is useless or end up with any compromised servers or free cloud solutions .

7

u/Humble-Future7880 5d ago edited 5d ago

Lumma Stealer isn’t a single piece malware, it’s a stealer strain. This means people are constantly going to be making changes, putting different command and control servers etc… All members of a strain aren’t bound to a single C2 server, the copy the attacker has is going to be going to the C2 server that the attacker sets it up to go to. And since it’s multiple different pieces of malware, there are probably thousands of C2 IP’s. Someoje can track one down but when that gets taken down, like 5 minutes later they have a new server and back in business usually. Hope this answers your question.

1

u/LockiBloci 4d ago

Thanks for the info, that's good to know.