Skip to main content

News report

Lumma infostealer's infrastructure seized during US, EU, Microsoft operation

The Record (Recorded Future News), May 21, 2025. Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized..

Source type
News report
Published
May 21, 2025
Research grade
S1
Used in entries
2

Bibliographic record

Publisher
The Record (Recorded Future News)
Published
May 21, 2025
Source type
News report
Research grade
Source grade S1
Language
English
Official record
Not an official publication
Address
https://therecord.media/lumma-infostealer-malware-takedown-microsoft-fbi
What it supports
Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized.
Dataset id
src_doj_lumma_rebound_2025

Research notes

  • No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented.

How this source is used

Cited 2 times across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

Cited by

Later activity

2 citations

Cited for activity recorded after the takedown.

All sources