# Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)

> Passive DNS analysis (Validin) of the phishing domain lufyfeo[.]org, resolving to 193.106.174.218, uncovered a 36-domain cluster sharing hosting infrastructure and an identical HTTP 302-redirect pattern to legitimate PDF-hosting sites (documentcloud.org, harvardlawreview.org). The cluster is tied to the Latrodectus loader infection chain, which TA577/TA578 have used since late 2023 to ultimately deliver LummaStealer.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1483
- **ID:** TL-2026-1483
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TA578 - G1038
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Embee Research analyzed passive DNS records via Validin for the phishing domain lufyfeo[.]org, which resolves to 193.106.174.218. By pivoting on shared IP infrastructure and a distinctive HTTP 302-redirect fingerprint that sends victims onward to legitimate document-hosting domains (documentcloud.org and, historically, harvardlawreview.org), analysts identified a cluster of 36 related malicious domains reusing the same hosting and redirect pattern. This redirect-to-legitimate-domain technique is a defense-evasion tactic: automated URL scanners and email security gateways see the final-hop destination as a trusted, high-reputation site, masking the malicious first hop.

The infrastructure is assessed to support the Latrodectus malware loader ecosystem. Latrodectus (MITRE ATT&CK Software S1160) is a Windows downloader first observed in September-November 2023 and assessed by Proofpoint and Unit 42 researchers as a likely successor to IcedID, built by the same developer group. It has been distributed primarily by TA577 (a historically prolific Qbot/IcedID distributor) and TA578 (assessed as an initial access broker using fraudulent contact-form submissions and copyright-infringement lures). Per Unit 42 reporting from March 7-8, 2024, the observed infection chain is: thread-hijacked email > malicious link > redirect to a fake Microsoft Azure page > Firebase-hosted URL > oversized JavaScript file download > victim double-click > wscript.exe executes the JS > JS generates WebDAV traffic to fetch an MSI package > msiexec.exe installs the Latrodectus DLL (exported function "fin") > Latrodectus establishes C2 over HTTP(S) > operators push a Lumma Stealer executable over the Latrodectus C2 channel for final-stage credential/data theft.

Latrodectus performs environment/anti-sandbox checks (minimum running-process count, 64-bit architecture verification, valid MAC address validation) before executing, uses a mutex ("runnung") to prevent re-infection, and persists via AutoRun registry keys and Windows Scheduled Tasks, self-copying to an AppData path derived from its bot ID. Its C2 protocol issues HTTP POST requests with RC4-encrypted (hardcoded key "12345"), Base64-encoded payloads, and uses FNV-1a hashing for campaign-ID values. Documented command handlers include arbitrary code execution (cmd_exec_exe/dll/cmd), system/process/desktop enumeration (cmd_get_sysinfo/proclist/desktop), self-update (cmd_update), and a legacy IcedID-component downloader (cmd_run_icedid, handler #18) retained from Latrodectus's shared IcedID lineage. Latrodectus has also been used to deliver QakBot, DarkGate, and PikaBot in other campaigns, in addition to Lumma Stealer.

Lumma Stealer (LummaC2) is a widely distributed, subscription-based information stealer written in C++/ASM, hardened with LLVM-based control-flow flattening/obfuscation, dead-code injection, and low-level syscall usage ("Heaven's Gate") to evade EDR hooking, and known to inject into legitimate processes (msbuild.exe, regasm.exe, regsvcs.exe, explorer.exe). It harvests browser-stored credentials, session cookies and autofill data from Chromium- and Gecko-based browsers, cryptocurrency wallet files/extensions (MetaMask, Electrum, Exodus), VPN configuration files, FTP and email client credentials, Telegram data, and documents (PDF/DOCX/RTF) from user profiles, then exfiltrates them over a tiered C2 architecture — hardcoded Tier-1 C2 domains fronted by Cloudflare, with Steam-profile and Telegram-channel fallback pointers and, in newer builds, blockchain-based (EtherHiding-style) C2 retrieval. Traffic to hardcoded C2s uses ChaCha20 encryption; fallback URL retrieval uses a custom stack-based cipher and ROT+11 obfuscation. Microsoft's Digital Crimes Unit conducted a large-scale takedown of roughly 2,300 Lumma-associated domains in May 2025, though the malware-as-a-service operation has continued to rebuild infrastructure since.

The reuse of a fixed 302-redirect fingerprint across 36 domains sharing a single hosting IP represents a durable pivot point: any newly registered domain resolving to 193.106.174.218 (or reusing the identical redirect-to-documentcloud.org/harvardlawreview.org pattern) should be treated as part of this cluster and blocked pending validation.

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1053.005 Scheduled Task
- T1218.007 Msiexec
- T1218.011 Rundll32
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1564.004 NTFS File Attributes
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1070.004 File Deletion
- T1055.012 Process Hollowing
- T1087.002 Domain Account
- T1482 Domain Trust Discovery
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1069 Permission Groups Discovery
- T1057 Process Discovery
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1021 Remote Services
- T1005 Data from Local System
- T1115 Clipboard Data
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1104 Multi-Stage Channels
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1132.001 Standard Encoding

## Sources

- [Phishing Domain Analysis With Passive DNS (Latrodectus)](https://www.embeeresearch.io/phishing-domain-analysis-with-passive-dns-latrodectus/)
- [Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns](https://thehackernews.com/2024/05/latrodectus-malware-loader-emerges-as.html)
- [Latrodectus Malware Analysis: IcedID 2.0](https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice)
- [Analyzing Latrodectus: The New Face of Malware Loaders](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/analyzing-latrodectus-the-new-face-of-malware-loaders/)
- [Pulsedive Threat Research - Latrodectus Loader](https://blog.pulsedive.com/threat-research-latrodectus/)
- [New Malware "Latrodectus" Linked to IcedID](https://www.infosecurity-magazine.com/news/malware-latrodectus-linked-icedid/)
- [Latrodectus, Software S1160 | MITRE ATT&CK](https://attack.mitre.org/software/S1160/)
- [Latrodectus Malware Loader Found in Phishing Campaigns, Replacing IcedID – Active IOCs](https://www.rewterz.com/threat-advisory/latrodectus-malware-loader-found-in-phishing-campaigns-replacing-icedid-active-iocs)
- [Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)
- [Lumma Stealer Malware Profile & 7d C2 Tracker](https://www.derp.ca/lumma/)
- [LummaC2 stealer: Everything you need to know](https://outpost24.com/blog/everything-you-need-to-know-lummac2-stealer/)
- [Lumma Stealer - Certego](https://www.certego.net/blog/lummastealer/)
- [Lumma Stealer Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/lumma/)
- [New Updates to LummaC2 Stealer Malware](https://spycloud.com/blog/lummac2-malware-stealthier-capabilities/)
- [Lumma Stealer Analysis](https://www.trellix.com/en-in/blogs/research/lumma-stealer-analysis/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1483