Threat reportMalwareTL-2026-1483
Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)
Latrodectus Phishing Campaign Delivering LummaStealer via (TL-2026-1483), also tracked as Latrodectus/LummaStealer 302-Redirect Cluster, is a high-severity malware campaign, first published 2026-07-18. It is attributed to TA578 - G1038 with medium confidence, affects Microsoft Windows (all supported desktop versions), maps to 41 MITRE ATT&CK techniques (T1005, T1016, T1021), and is covered by 9 detection rules and 45 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 41MITRE ATT&CK
- Actors
- 1TA578 - G1038
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 45Indicators of compromise
Key facts for TL-2026-1483
- Threat ID
- TL-2026-1483
- Also known as
- Latrodectus/LummaStealer 302-Redirect Cluster, lufyfeo.org Infrastructure Cluster
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- TA578 - G1038
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- all sectors opportunistic phishing, legal, professional services, finance, technology
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 45
Malware and tooling in Latrodectus Phishing Campaign Delivering LummaStealer via
Malware and tooling: IcedID, Latrodectus - S1160, Lumma Stealer - S1213, Latrodectus C2 (RC4/Base64), Validin
How Latrodectus Phishing Campaign Delivering LummaStealer via works
Passive DNS analysis (Validin) of the phishing domain lufyfeo[.]org, resolving to 193.106.174.218, uncovered a 36-domain cluster sharing hosting infrastructure and an identical HTTP 302-redirect pattern to legitimate PDF-hosting sites (documentcloud.org, harvardlawreview.org). The cluster is tied to the Latrodectus loader infection chain, which TA577/TA578 have used since late 2023 to ultimately deliver LummaStealer.
Embee Research analyzed passive DNS records via Validin for the phishing domain lufyfeo[.]org, which resolves to 193.106.174.218. By pivoting on shared IP infrastructure and a distinctive HTTP 302-redirect fingerprint that sends victims onward to legitimate document-hosting domains (documentcloud.org and, historically, harvardlawreview.org), analysts identified a cluster of 36 related malicious domains reusing the same hosting and redirect pattern. This redirect-to-legitimate-domain technique is a defense-evasion tactic: automated URL scanners and email security gateways see the final-hop destination as a trusted, high-reputation site, masking the malicious first hop.
The infrastructure is assessed to support the Latrodectus malware loader ecosystem. Latrodectus (MITRE ATT&CK Software S1160) is a Windows downloader first observed in September-November 2023 and assessed by Proofpoint and Unit 42 researchers as a likely successor to IcedID, built by the same developer group. It has been distributed primarily by TA577 (a historically prolific Qbot/IcedID distributor) and TA578 (assessed as an initial access broker using fraudulent contact-form submissions and copyright-infringement lures). Per Unit 42 reporting from March 7-8, 2024, the observed infection chain is: thread-hijacked email > malicious link > redirect to a fake Microsoft Azure page > Firebase-hosted URL > oversized JavaScript file download > victim double-click > wscript.exe executes the JS > JS generates WebDAV traffic to fetch an MSI package > msiexec.exe installs the Latrodectus DLL (exported function "fin") > Latrodectus establishes C2 over HTTP(S) > operators push a Lumma Stealer executable over the Latrodectus C2 channel for final-stage credential/data theft.
Latrodectus performs environment/anti-sandbox checks (minimum running-process count, 64-bit architecture verification, valid MAC address validation) before executing, uses a mutex ("runnung") to prevent re-infection, and persists via AutoRun registry keys and Windows Scheduled Tasks, self-copying to an AppData path derived from its bot ID. Its C2 protocol issues HTTP POST requests with RC4-encrypted (hardcoded key "12345"), Base64-encoded payloads, and uses FNV-1a hashing for campaign-ID values. Documented command handlers include arbitrary code execution (cmd_exec_exe/dll/cmd), system/process/desktop enumeration (cmd_get_sysinfo/proclist/desktop), self-update (cmd_update), and a legacy IcedID-component downloader (cmd_run_icedid, handler #18) retained from Latrodectus's shared IcedID lineage. Latrodectus has also been used to deliver QakBot, DarkGate, and PikaBot in other campaigns, in addition to Lumma Stealer.
Lumma Stealer (LummaC2) is a widely distributed, subscription-based information stealer written in C++/ASM, hardened with LLVM-based control-flow flattening/obfuscation, dead-code injection, and low-level syscall usage ("Heaven's Gate") to evade EDR hooking, and known to inject into legitimate processes (msbuild.exe, regasm.exe, regsvcs.exe, explorer.exe). It harvests browser-stored credentials, session cookies and autofill data from Chromium- and Gecko-based browsers, cryptocurrency wallet files/extensions (MetaMask, Electrum, Exodus), VPN configuration files, FTP and email client credentials, Telegram data, and documents (PDF/DOCX/RTF) from user profiles, then exfiltrates them over a tiered C2 architecture — hardcoded Tier-1 C2 domains fronted by Cloudflare, with Steam-profile and Telegram-channel fallback pointers and, in newer builds, blockchain-based (EtherHiding-style) C2 retrieval. Traffic to hardcoded C2s uses ChaCha20 encryption; fallback URL retrieval uses a custom stack-based cipher and ROT+11 obfuscation. Microsoft's Digital Crimes Unit conducted a large-scale takedown of roughly 2,300 Lumma-associated domains in May 2025, though the malware-as-a-service operation has continued to rebuild infrastructure since.
The reuse of a fixed 302-redirect fingerprint across 36 domains sharing a single hosting IP represents a durable pivot point: any newly registered domain resolving to 193.106.174.218 (or reusing the identical redirect-to-documentcloud.org/harvardlawreview.org pattern) should be treated as part of this cluster and blocked pending validation.
MITRE ATT&CK techniques used in TL-2026-1483
Collection
T1005 Data from Local System; T1115 Clipboard Data
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.002 Domain Account; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1518.001 Security Software Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055.012 Process Hollowing; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.007 Msiexec; T1218.011 Rundll32; T1497 Virtualization/Sandbox Evasion; T1564.004 NTFS File Attributes; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1204.001 Malicious Link; T1569.002 Service Execution
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography
Impact
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in Latrodectus Phishing Campaign Delivering LummaStealer via
- Microsoft — Windows (all supported desktop versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server (workstation-class endpoints)
Remediation for Latrodectus Phishing Campaign Delivering LummaStealer via
Immediate actions
- Block/sinkhole the resolved IP 193.106.174.218 and all 36 clustered phishing domains at DNS/firewall/proxy
- Alert on outbound HTTP 302 redirects sourced from newly-registered or low-reputation domains that terminate on documentcloud.org or harvardlawreview.org
- Block execution of JavaScript (.js) files launched directly via double-click / wscript.exe from user Downloads or email attachment paths
- Restrict or alert on msiexec.exe installing packages from WebDAV UNC paths (\\<ip>\<share>\*.msi or webdav://)
- Hunt for the mutex string "runnung" and AutoRun/Scheduled Task entries pointing to AppData-resident, randomly-bot-ID-named executables
- Search email gateway logs for TA578-style fraudulent contact-form submissions and copyright-infringement-themed lures, and TA577-style thread-hijacked emails with zipped JS/ISO attachments
Workarounds
- Disable the WebClient (WebDAV Client) service on workstations that do not require WebDAV connectivity
- Enforce Windows Script Host (WSH) restrictions or AppLocker policy to block .js execution outside of approved directories
Longer-term hardening
- Deploy network detection for RC4-encrypted, Base64-encoded HTTP POST beacons matching the documented Latrodectus C2 pattern
- Deploy EDR rules for process injection/hollowing into msbuild.exe, regasm.exe, regsvcs.exe, and explorer.exe (Lumma Stealer TTP)
- Establish continuous passive-DNS/Validin-style pivoting on any confirmed C2/redirect IP to proactively discover cluster expansion
- User awareness training on fake CAPTCHA ("ClickFix") pages and copyright-infringement/contact-form phishing lures
- Restrict WebDAV client access (WebClient service) on endpoints where not business-required
Timeline of Latrodectus Phishing Campaign Delivering LummaStealer via
- Latrodectus malware loader first observed in the wild, assessed as an emerging successor to the IcedID loader.
- TA577 begins distributing Latrodectus via thread-hijacked emails with zipped JavaScript/ISO attachments, before later reverting to Pikabot.
- TA578 becomes the primary Latrodectus operator, using fraudulent contact-form submissions impersonating companies with copyright-infringement claims.
- Unit 42 documents the full infection chain: thread-hijacked email > link > fake Azure page > Firebase URL > JS download > WebDAV MSI install > Latrodectus DLL > Lumma Stealer delivered over Latrodectus C2.
- Proofpoint, Trustwave, and Pulsedive publish in-depth Latrodectus technical analyses characterizing it as 'IcedID 2.0' with shared developer lineage.
- Broader industry reporting (The Hacker News, Infosecurity Magazine, Rewterz) confirms Latrodectus as an IcedID successor actively used in ongoing phishing campaigns.
- Microsoft's Digital Crimes Unit executes a large-scale takedown of approximately 2,300 domains supporting the Lumma Stealer malware-as-a-service operation.
- Embee Research publishes passive-DNS (Validin) analysis of lufyfeo[.]org (resolving to 193.106.174.218), identifying a 36-domain cluster sharing hosting and an identical HTTP 302-redirect pattern to documentcloud.org/harvardlawreview.org tied to the Latrodectus-to-LummaStealer delivery chain.
Sources cited for Latrodectus Phishing Campaign Delivering LummaStealer via
- Phishing Domain Analysis With Passive DNS (Latrodectus)
- Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns
- Latrodectus Malware Analysis: IcedID 2.0
- Analyzing Latrodectus: The New Face of Malware Loaders
- Pulsedive Threat Research - Latrodectus Loader
- New Malware "Latrodectus" Linked to IcedID
- Latrodectus, Software S1160 | MITRE ATT&CK
- Latrodectus Malware Loader Found in Phishing Campaigns, Replacing IcedID – Active IOCs
- Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer
- Lumma Stealer Malware Profile & 7d C2 Tracker
- LummaC2 stealer: Everything you need to know
- Lumma Stealer - Certego
- Lumma Stealer Malware Analysis, Overview by ANY.RUN
- New Updates to LummaC2 Stealer Malware
- Lumma Stealer Analysis
Detection coverage for TL-2026-1483
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1483 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.