Lumma logs on forums
Lumma Stealer profileAccording to CISA and FBI, there were more than 21,000 listings selling Lumma logs on cybercrime forums between April and June 2024. CISA and FBI (AA25-141B)
Forums, sites and messaging channels where logs collected by infostealers and account access are sold.
Stolen data is not income for the attacker on its own; it becomes income when sold. Logs change hands through forum listings, searchable catalogues on dedicated sites or bulk files in Telegram channels. CISA and FBI (AA25-141B)
According to Eurojust, Genesis Market sold packages of usernames and passwords for email, bank and social media accounts and, from 2018 until it was taken down, was one of the largest facilitators of cybercrime. Eurojust
The seller uploads logs from infected devices to the market or channel. CISA and FBI (AA25-141B)
The buyer searches by country, domain or service name.
The buyer purchases the log or account access and uses or resells it. Eurojust
According to CISA and FBI, there were more than 21,000 listings selling Lumma logs on cybercrime forums between April and June 2024. CISA and FBI (AA25-141B)
In Operation Cookie Monster, supported by Eurojust, Genesis Market’s infrastructure was dismantled; in 13 countries more than 100 arrests and more than 200 searches targeted customers who had bought stolen access from the market. Eurojust
Troy Hunt examined a 1.5 TB corpus of logs published as individual files in a Telegram channel called ALIEN TXTBASE and noted that the channel is not the only one, but a major distribution channel. Troy Hunt
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy