International Operation Dismantles Lumma Infostealer Infrastructure

Members of an international police and technology coalition announced on May 21, 2025, that they had jointly dismantled the infrastructure of the Lumma infostealer. The operation involved the FBI, the U.S. Department of Justice, Europol, Japan’s Cybercrime Control Center, Microsoft, and several cybersecurity companies.

In the United States, the judiciary enabled Microsoft to take down, suspend, and block around 2,300 malicious domains that formed the backbone of Lumma’s infrastructure. The tech giant also worked with authorities in Japan and the EU to cut access to the infostealer in those regions.

The FBI has been investigating Lumma since September 2023 and identified approximately 10 million infections, making it one of the most widespread infostealers worldwide. It was developed by “Shamel,” a cybercriminal based in Russia, who has been marketing it since at least 2022. According to Brett Leatherman, a senior FBI official, Lumma’s ease of use has allowed “people with very little technical knowledge to very easily become cybercriminal actors.”