Lumma Stealer: From Config to Infrastructure

Coming soon. This write-up is still being written. Check back shortly; it will be published at this same address.

The threat-intelligence layer on the Lumma campaign: passive enrichment of the recovered C2 domains, clustering, hunting queries and judgments.

What it will cover

• Passive enrichment of the C2 domains recovered by my extractor
• Clustering by registrar, name servers, TLS certificates, hosting and timing
• Hunting queries and how precise each one is
• A Diamond Model per delivery chain and confidence-rated judgments

Meanwhile

• The case file in my portfolio: https://artfuldodger10.github.io/portfolio/#/case/lumma-cti
• The code, detections and IOCs: lumma-stealer-campaign