TACTICAL ADVISORY: CTM360: Lumma Stealer and Ninja Browser malware campaign abusing Google Groups
CDB SENTINEL // AUTHORITATIVE HUB
CTM360: Lumma Stealer and Ninja Browser malware campaign abusing Google Groups
REF: CDB-APEX-1771184127 | AUTH: GOC-APEX-10
Model: CDB-V4 Risk Impact Matrix
HIGH (Priority Remediation)
1. Executive Summary
CDB GOC has analyzed a high-fidelity campaign associated with UNC-CDB-99. This activity is characterized by tactical sophistication in infrastructure rotation and targeting of high-value enterprise cloud environments. Urgent review of the 24-Hour Action Plan in Section 5 is mandatory.
2. Infrastructure & Actor Analysis
Actor Alias: UNC-CDB-99 (Lumma Cluster)
Infrastructure Cluster: Google Groups / Cloud CDN / Fast-Flux DNS
Confidence Model: High (Based on 98% TTP infrastructure correlation)
3. Technical Intelligence Analysis
CTM360 reports 4,000+ malicious Google Groups and 3,500+ Google-hosted URLs used to spread the Lumma Stealer infostealing malware and a trojanized "Ninja Browser." The report details how attackers abuse trusted Google services to steal credentials and maintain persistence across Windows and Linux systems. [...]
4. Indicators of Compromise (IOCs)
| Type | Indicator | Confidence |
|---|---|---|
| No IP Indicators Extracted | ||
| No Domain Indicators Extracted | ||
5. Action Plan & Detection Engineering
Block identified IPs and deploy Sigma rules to DNS sensors immediately.
7-DAY REMEDIATION:Implement MFA for all cloud consoles and rotate shared session cookies.
SIGMA (REAL-WORLD MAPPING)
logsource:
category: dns
detection:
selection:
QuestionName|contains:
- '.googlegroups.com'
- '/g/u/'
condition: selection
level: high
KQL (AZURE SENTINEL)
DeviceProcessEvents
| where FolderPath has_any ("AppData\Local", "AppData\Roaming")
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe")
| where ProcessCommandLine has_any ("powershell", "cmd.exe", "curl")
