Lumma Stealer (LummaC2) grew, over roughly three years, from one stealer among many into one of the most widely deployed information stealers sold as malware-as-a-service. Its story since has two parts worth separating: how its command-and-control traffic actually works, and what happened when law enforcement went after its infrastructure in May 2025.

[INFO]
This article summarises reporting from Microsoft Threat Intelligence (via Security Affairs) and a public technical write-up tracing Lumma's protocol. An earlier version of this article described an RSA-4096 key exchange and a hardware-bound session protocol that do not appear in any source found for this rewrite; that claim has been removed.

//How the C2 Protocol Actually Works

Per Microsoft's analysis, Lumma uses a layered C2 infrastructure: hardcoded tier-1 servers plus fallback channels through Telegram and Steam profile pages, with the real infrastructure fronted by Cloudflare. Communication to the hardcoded servers and the Telegram fallback is protected with ChaCha20, a stream cipher - not RSA, and not a 4096-bit asymmetric exchange. The Steam-profile fallback channel uses a separate, custom stack-based algorithm that Microsoft reports changes between versions. All of it travels over HTTPS.

A master's-thesis research project (covering October 2024 to May 2025, later written up by Certego) independently reverse-engineered an earlier version's protocol in more detail: version 4 used Base64 encoding with a 32-byte XOR key for C2 responses, over a POST /api endpoint. The researchers decrypted enough of the protocol to build an emulator that could impersonate an infected machine, which they then used to build an automated monitoring framework. Microsoft's own reporting notes that the C2 domains, URI paths and POST data formats have continued to change across versions.

No public RSA-4096 claim found

Nothing in the sources checked for this rewrite describes an RSA-4096 handshake or a session protocol cryptographically bound to a hardware fingerprint on first contact. If that detail exists in a report this rewrite did not find, it has not been incorporated; this article sticks to what Microsoft and the independent research describe: ChaCha20 and ad hoc obfuscation, not a documented 4096-bit RSA exchange.

//The May 2025 Takedown

A coordinated law enforcement action in May 2025 dismantled a significant portion of Lumma's infrastructure, reported by Security Affairs and others as the most disruptive event in the operation's history to that point. A later HPE write-up (published January 2026) reported that the affiliate ecosystem and rapid infrastructure rotation allowed the operation to rebound within weeks of the takedown - disruption, not elimination.

That same HPE report lists observed indicators from its own 2026 monitoring: C2 domains on the .su top-level domain, repeated POST requests to a path named /sawo, and a long, rotating list of .su domains, alongside the stealer's anti-VM and anti-debug checks and use of indirect syscalls. Domain-based indicators for a malware-as-a-service product rotate quickly; treat any specific domain list, including this one, as dated the moment it is published.

[WARNING]
No sample set, C2 domain list or infection count here is this site's own data. For current indicators, check Microsoft Threat Intelligence, Zscaler, or another named vendor's current reporting directly - a list copied into an article is stale as soon as the operators rotate.