Underground Power Struggle Exposes Lumma Stealer’s Core Team

Major Doxxing Campaign Targets Lumma Stealer Leadership

In a dramatic turn of events within the cybercrime underworld, the developers and administrators behind the notorious Lumma Stealer malware have been exposed through an extensive doxxing campaign. Between August and October 2025, sensitive personal information of five key individuals allegedly responsible for operating one of the most dangerous information stealers was leaked publicly, revealing internal turmoil and potential betrayal within their ranks., according to industry experts

The Anatomy of the Exposure

According to security researchers at Trend Micro, the doxxing campaign appears to have been executed by competing cybercrime actors seeking to disrupt Lumma’s operations. The leaked information included passport numbers, bank account details, email addresses, and links to various online profiles of individuals holding both operational oversight roles and technical positions related to crypter development for malware obfuscation., as comprehensive coverage

The depth and consistency of the exposed information suggests either insider knowledge or access to compromised accounts and databases. Accompanying the data leaks were threats and accusations that the Lumma Stealer team had prioritized profit over the operational security of their clients, indicating possible internal conflicts within the cybercriminal ecosystem.

Operational Impact on Lumma Infrastructure

The timing of this exposure aligns with observed declines in Lumma Stealer’s operational activity. Security monitors noted a significant reduction in new command and control (C2) infrastructure deployment and fewer targeted endpoints since September 2025. The disruption was compounded when the group’s Telegram accounts were compromised on September 17, severely hampering their ability to communicate with customers and coordinate malicious activities., according to technology trends

This represents the second major blow to Lumma Stealer in recent years, following Microsoft’s coordinated takedown of over 2,000 domains associated with the malware in May 2024, which also led to the identification of 394,000 infected Windows computers., according to market insights

Shifting Landscape in the Infostealer Market

The instability of Lumma Stealer has triggered a migration trend among cybercriminals seeking reliable information stealers. Forum discussions and Telegram channel monitoring reveal that users are actively transitioning to alternative solutions, with Vidar and StealC emerging as primary replacement options.

The ripple effects extend to supporting services within the cybercrime ecosystem:

• Pay-per-install (PPI) services like Amadey have experienced reduced demand
• Users report concerns about Lumma’s instability and loss of support
• Competing malware developers are capitalizing on the power vacuum

Broader Implications for Cybersecurity

This incident highlights several important trends in the cybercrime landscape. First, it demonstrates that internal conflicts and competition within criminal communities can be as damaging to their operations as law enforcement actions. Second, it shows that even sophisticated malware operations are vulnerable to the same types of attacks they perpetrate against others.

The exposure of Lumma Stealer’s core team provides valuable intelligence for security researchers and law enforcement agencies. Understanding the tactics, techniques, and procedures used by such groups becomes easier when the individuals behind them are identified, potentially leading to more effective countermeasures.

Looking Forward

While the immediate future of Lumma Stealer appears uncertain, the information stealer market has proven resilient in the face of such disruptions. The void left by Lumma’s decline will likely be filled by existing competitors or new entrants, continuing the cat-and-mouse game between cybercriminals and security defenders.

Organizations should remain vigilant and continue implementing robust security measures, as the migration of cybercriminals to new platforms often involves testing new distribution methods and attack vectors that might initially evade detection.

References & Further Reading

This article draws from multiple authoritative sources. For more information, please consult:

• https://www.trendmicro.com/en_gb/research/25/j/the-impact-of-water-kurita-lumma-stealer-doxxing.html
• https://attack.mitre.org/software/S1025/

This article aggregates information from publicly available sources. All trademarks and copyrights belong to their respective owners.

Note: Featured image is for illustrative purposes only and does not represent any specific product, service, or entity mentioned in this article.