Government release

# Justice Department Seizes Domains Behind Major Information-Stealing Malware Operation

United States Department of Justice, May 21, 2025. Seizure of the central command structure and the marketplaces selling the malware.

**Source type:** Government release

**Published:** May 21, 2025

**Research grade:** P1

**Used in entries:** 5

## Bibliographic record

**Publisher:** United States Department of Justice

**Published:** May 21, 2025

**Source type:** Government release

**Research grade:** Source grade P1

**Language:** English

**Official record:** Official publication

**Address:** [https://www.justice.gov/opa/pr/justice-department-seizes-domains-behind-major-information-stealing-malware-operation](https://www.justice.gov/opa/pr/justice-department-seizes-domains-behind-major-information-stealing-malware-operation)

**What it supports:** Seizure of the central command structure and the marketplaces selling the malware

**Dataset id:** src\_doj\_lumma\_2025

How this source is used

Cited 5 times across 4 record types.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Takedown records

1 citation

Cited on the takedown record itself.

-
[Lumma Stealer disruption](https://takedownindex.org/takedowns/lumma-stealer-disruption)

Malware and botnets, May 2025

Supporting source

### Organization roles

2 citations

Cited for an organization's recorded role in a takedown.

-
[United States Department of Justice](https://takedownindex.org/takedowns/lumma-stealer-disruption)

Co-lead, Lumma Stealer disruption

Supporting source
-
[Federal Bureau of Investigation](https://takedownindex.org/takedowns/lumma-stealer-disruption)

Investigating, Lumma Stealer disruption

Supporting source

### Infrastructure

1 citation

Cited for infrastructure recorded as acted on.

-
[5 command and control servers](https://takedownindex.org/takedowns/lumma-stealer-disruption)

Command and control servers seized, Lumma Stealer disruption

Supporting source

### Later activity

1 citation

Cited for activity recorded after the takedown.

-
[Lumma replacement domains (3 domains, seized same wave)](https://takedownindex.org/takedowns/lumma-stealer-disruption)

Same operators, Lumma Stealer disruption

Supporting source

[All sources](https://takedownindex.org/sources)