Threat video1:00
Lumma, Warden, Vidar Infostealer Week: Detection & IOCs
Lumma hit 136 machines and Warden 4 in one week of Hudson Rock telemetry. Covered by 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for Lumma, Warden, Vidar Infostealer Week: Detection & IOCs →
Chapters
- 0:00The hookInfostealers compromised 12,382 machines.
- 0:05The storyMost were classed as generic stealers.
- 0:11Attack pathEndpoint protection was mostly Windows Defender.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromiseNo malicious indicators were published.
- 0:37MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to collection.
- 0:42Remediation3 steps now: Reset passwords and revoke active sessions, cookies and OAuth/SSO tokens.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Infostealers compromised 12,382 machines.
0:05Most were classed as generic stealers.
0:08Lumma led the named families.
0:11Endpoint protection was mostly Windows Defender.
0:14Stolen data holds authentication and remote-access context.
0:19Immediate action: reset passwords and revoke sessions.
0:23Re-image or fully remediate confirmed hosts.
0:28No threat actor is attributed. Confidence: low.
0:32No malicious indicators were published.
0:387 ATT&CK techniques, from initial access to collection.
0:423 steps now: Reset passwords and revoke active sessions, cookies and OAuth/SSO tokens.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.