2024 had its fair share of high-profile cyber attacks, with companies as big as Dell and TicketMaster falling victim to data breaches and other infrastructure compromises. In 2025, this trend will continue. So, to be prepared for any kind of malware attack, every organization needs to know its cyber enemy in advance. Here are 5 common malware families that you can start preparing to counter right now.

Lumma#

Lumma is a widely available malware designed to steal sensitive information. It has been openly sold on the Dark Web since 2022. This malware can effectively collect and exfiltrate data from targeted applications, including login credentials, financial information, and personal details.

Lumma is regularly updated to enhance its capabilities. It can log detailed information from compromised systems, such as browsing history and cryptocurrency wallet data. It can be used to install other malicious software on infected devices. In 2024, Lumma was distributed through various methods, including fake CAPTCHA pages, torrents, and targeted phishing emails.

Analysis of a Lumma Attack#

Proactive analysis of suspicious files and URLs within a sandbox environment can effectively help you prevent Lumma infection.

Let's see how you can do it using ANY.RUN's cloud-based sandbox. It not only delivers definitive verdicts on malware and phishing along with actionable indicators but also allows real-time interaction with the threat and the system.

Take a look at this analysis of a Lumma attack.

ANY.RUN lets you manually open files and launch executables

It starts with an archive which contains an executable. Once we launch the .exe file, the sandbox automatically logs all processes and network activities, showing Lumma's actions.

Suricata IDS informs us about a malicious connection to Lumma's C2 server

It connects to its command-and-control (C2) server.

Malicious process responsible for stealing data from the system

Next, it begins to collect and exfiltrate data from the machine.

You can use the IOCs extracted by the sandbox to enhance your detection systems

After finishing the analysis, we can export a report on this sample, featuring all the important indicators of compromise (IOCs) and TTPs that can be used to enrich defenses against possible Lumma attacks in your organization.

Try all features of ANY.RUN's Interactive Sandbox for free with a 14-day trial

ial.