Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Mapping latest Lumma infrastructure
Malware Families
Excerpt
Another week, another Lumma hunt. Despite the efforts by law enforcement agencies, Lumma stands strong, new malware distribution and C2 domains are constantly created. This hunt started from the domain nonsazv[.]qpon reported as Lumma C2. The domain is hosted at an IP registered to Aeza ASN 210644, a known bulletproof hosting provider so it immediately shows potential for a pivot. Often, threat actors generate multiple domains using similar naming conventions for their…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | bac-bank.qpon | High | Score 58/100 | First seen |
| SHA256 | a727c650d72ec8ea286b1847b5a14f321598c63ae4bd1b0c9b0b85ac50e590d9 | Medium | Score 53/100 | First seen |
| Domain | nonsazv.qpon | High | Score 58/100 | First seen |
| Domain | pictuqyr.qpon | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…