TexasBitcoin

Justice Department Seizes Domains Behind Major Information-Stealing Malware Operation

May 21, 2025 · Sourced to the U.S. Department of Justice

The charges described here are allegations. Any person charged is presumed innocent unless and until proven guilty in a court of law. This page reflects only what the Department of Justice has publicly announced, and links to the original release.

The Justice Department announced today the unsealing of two warrants authorizing the seizure of five internet domains used by malicious cyber actors to operate the LummaC2 information-stealing malware service.

Announced

May 21, 2025

Status

Announced

Financial actions

  • seizureSeizure of two internet domains used to operate the LummaC2 information-stealing malware service, seized on May 19, 2025
  • seizureSeizure of three new domains set up by LummaC2 administrators to host the user panel, seized on May 21, 2025

From the announcement

The Department will continue to use its unique tools, authorities, and partnerships to disrupt malicious cyber operations and criminal networks. Today's disruption is another instance where our prosecutors, agents, and private sector partners came together to protect us from the persistent cybersecurity threats targeting our country. We are grateful for their work and dedication.
Sue J. Bai, Head of the National Security Division, Justice Department
Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft. Today's announcement demonstrates that the Justice Department is resolved to use court-ordered disruptions like this one to protect the public from the theft of their personal information and their assets. The Department is also committed to working with and appreciates the efforts of the private sector to safeguard the public from cybercrime.
Matthew R. Galeotti, Head of the Criminal Division, Justice Department
The FBI is committed to disrupting the key services that cyber criminals rely on. That's why, with our partners, we took action against the most popular infostealer service available in online criminal markets, which is responsible for millions of attacks against victims. Thanks to partnerships with the private sector, we were able to disrupt the LummaC2 infrastructure and seize user panels. Together, we are making it harder, and more painful, for cyber criminals to operate.
Bryan Vorndran, Assistant Director, Cyber Division, FBI

Investigating agencies

Federal Bureau of InvestigationJustice Department National Security DivisionJustice Department Criminal DivisionU.S. Attorney's Office for the Northern District of TexasU.S. Department of State Diplomatic Security Service

Case details

Prosecuting office
Northern District of Texas
Cryptocurrency TheftDomain Seizure And Cyber DisruptionFederal Investigation And ProsecutionFinancial FraudInformation-Stealing Malware (Lummac2)National Security And Cybersecurity ThreatsPublic-Private PartnershipRewards For Justice Program

Primary source

Every fact above is drawn from the Department of Justice's own announcement — a public-domain government record.

Read the original DOJ release →

This is a research and reference page compiled from public DOJ announcements, not legal advice. Details reflect the government's statements as of its release date and may not capture later developments such as appeals, dismissals, or overturned convictions. Defendants are presumed innocent unless and until proven guilty.