AnnouncedNorthern Texas
Justice Department Seizes Domains Behind Major Information-Stealing Malware Operation
May 21, 2025 · Sourced to the U.S. Department of Justice
The charges described here are allegations. Any person charged is presumed innocent unless and until proven guilty in a court of law. This page reflects only what the Department of Justice has publicly announced, and links to the original release.
The Justice Department announced today the unsealing of two warrants authorizing the seizure of five internet domains used by malicious cyber actors to operate the LummaC2 information-stealing malware service.
Financial actions
- seizure — Seizure of two internet domains used to operate the LummaC2 information-stealing malware service, seized on May 19, 2025
- seizure — Seizure of three new domains set up by LummaC2 administrators to host the user panel, seized on May 21, 2025
From the announcement
“The Department will continue to use its unique tools, authorities, and partnerships to disrupt malicious cyber operations and criminal networks. Today's disruption is another instance where our prosecutors, agents, and private sector partners came together to protect us from the persistent cybersecurity threats targeting our country. We are grateful for their work and dedication.”
“Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft. Today's announcement demonstrates that the Justice Department is resolved to use court-ordered disruptions like this one to protect the public from the theft of their personal information and their assets. The Department is also committed to working with and appreciates the efforts of the private sector to safeguard the public from cybercrime.”
“The FBI is committed to disrupting the key services that cyber criminals rely on. That's why, with our partners, we took action against the most popular infostealer service available in online criminal markets, which is responsible for millions of attacks against victims. Thanks to partnerships with the private sector, we were able to disrupt the LummaC2 infrastructure and seize user panels. Together, we are making it harder, and more painful, for cyber criminals to operate.”
Investigating agencies
Federal Bureau of InvestigationJustice Department National Security DivisionJustice Department Criminal DivisionU.S. Attorney's Office for the Northern District of TexasU.S. Department of State Diplomatic Security Service
Case details
- Prosecuting office
- Northern District of Texas
Cryptocurrency TheftDomain Seizure And Cyber DisruptionFederal Investigation And ProsecutionFinancial FraudInformation-Stealing Malware (Lummac2)National Security And Cybersecurity ThreatsPublic-Private PartnershipRewards For Justice Program
Primary source
Every fact above is drawn from the Department of Justice's own announcement — a public-domain government record.
Read the original DOJ release →This is a research and reference page compiled from public DOJ announcements, not legal advice. Details reflect the government's statements as of its release date and may not capture later developments such as appeals, dismissals, or overturned convictions. Defendants are presumed innocent unless and until proven guilty.