SOC Prime Bias: Medium

13 Feb 2026 17:23
newspaper icon Bitdefender Labs

LummaStealer Is Getting a Second Life Alongside CastleLoader

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
LummaStealer Is Getting a Second Life Alongside CastleLoader
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

LummaStealer is an infostealer that has re-emerged following a major 2025 law-enforcement disruption. Recent activity pivots to CastleLoader, a script-based loader that delivers LummaStealer through social-engineering lures like fake “cracked” software and counterfeit CAPTCHA pages. The chain emphasizes in-memory execution, aggressive obfuscation, and shared infrastructure across both malware families. Defenders can prioritize hunting for unusual DNS behavior, AutoIt execution traces, and common persistence patterns.

Investigation

Bitdefender researchers analyzed fresh samples and confirmed CastleLoader as LummaStealer’s main delivery mechanism. Written in AutoIt, the loader performs sandbox checks, establishes persistence in Local AppData, and generates a distinctive network signal via repeated failed DNS queries. Analysts also noted infrastructure overlap with GrayBravo-linked services. Relevant command-line strings and code snippets were extracted to support detection-rule development.

Mitigation

Reduce exposure by blocking downloads of cracked software, game installers, and other untrusted media packages. Prevent or tightly control execution of unknown AutoIt scripts, and monitor for file creation under CraftStitch Studios Inc-named paths. Enforce MFA and rotate credentials after suspected compromise. Apply network controls to flag or block the characteristic failed DNS lookups and the associated malicious IP infrastructure.

Response

If CastleLoader or LummaStealer artifacts are found, isolate the host, stop suspicious AutoIt processes, and remove persistence artifacts from %LocalAppData%\CraftStitch Studios Inc. Preserve evidence by collecting the dropped payload, relevant network telemetry, and any created shortcuts. Reset exposed credentials and invalidate active browser sessions. Update detections using the extracted IOCs to identify additional impacted hosts.

"graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef operator fill:#ff9900 classDef builtin fill:#cccccc %% Nodes u2013 Initial Access init_user_execution["<b>Action</b> – <b>T1204 User Execution</b>: Victims run fake cracked software or game/movie installers.<br/><b>Description</b>: Execution of malicious code by the user."] class init_user_execution action init_mal_copy_paste["<b>Action</b> – <b>T1204.004 Malicious Copy and Paste</b>: Users follow ClickFix CAPTCHA instructions to copy and paste malicious commands.<br/><b>Description</b>: Attacker guides victim to execute attackeru2011controlled code."] class init_mal_copy_paste action %% Nodes u2013 Loader Deployment loader_autoit["<b>Tool</b> – <b>T1059.010 AutoIt Interpreter</b>: Compiled CastleLoader script.<br/><b>Description</b>: Executes heavily obfuscated AutoIt code."] class loader_autoit tool obfuscation["<b>Action</b> – <b>T1027.009 Embedded Payloads</b>: Obfuscated AutoIt script hides malicious payload.<br/><b>Description</b>: Uses encoding and packing to evade analysis."] class obfuscation action masquerading["<b>Action</b> – <b>T1036 Masquerading</b>: Loader disguised as a legitimate installer with common software extensions.<br/><b>Description</b>: Appears benign to the user and security tools."] class masquerading action %% Nodes u2013 Persistence persistence_shortcut["<b>Action</b> – <b>T1547.009 Shortcut Modification</b>: Creates .lnk and .url files in the Startup folder.<br/><b>Description</b>: Persists by launching on user logon."] class persistence_shortcut action persistence_task["<b>Action</b> – <b>T1053 Scheduled Task</b>: VBA script registers a scheduled task for repeated execution.<br/><b>Description</b>: Runs payload at defined intervals."] class persistence_task action persistence_init["<b>Action</b> – <b>T1037 Logon Initialization Scripts</b> and <b>T1547.014 Active Setup</b>: Executes scripts during user logon via registry keys.<br/><b>Description</b>: Ensures code runs each login."] class persistence_init action hijack_execution["<b>Action</b> – <b>T1574 Hijack Execution Flow</b>: Reflective loading of the malicious payload into memory.<br/><b>Description</b>: Executes without writing files to disk."] class hijack_execution action %% Nodes u2013 Defense Evasion defense_virtual["<b>Action</b> – <b>T1497 Virtualization/Sandbox Evasion</b> and <b>T1497.002 User Activity Checks</b>: Detects analysis environment and aborts execution.<br/><b>Description</b>: Avoids sandbox detection."] class defense_virtual action defense_reflective["<b>Action</b> – <b>T1620 Reflective Code Loading</b>: Loads code via reflection to hide activity.<br/><b>Description</b>: Bypasses static analysis tools."] class defense_reflective action %% Nodes u2013 Command and Control c2_dga["<b>Action</b> – <b>T1568.002 Domain Generation Algorithms</b>: Generates pseudou2011random domains causing failed DNS lookups.<br/><b>Description</b>: Provides dynamic C2 endpoints."] class c2_dga action c2_dns["<b>Action</b> – <b>T1071.004 DNS Protocol</b>: Communicates over DNS queries and responses.<br/><b>Description</b>: Uses applicationu2011layer DNS for C2."] class c2_dns action c2_web["<b>Action</b> – <b>T1102 Web Service</b>: Bidirectional communication via HTTPS web service.<br/><b>Description</b>: Serves as primary C2 channel."] class c2_web action %% Nodes u2013 Credential Access cred_browser["<b>Action</b> – <b>T1555.003 Credentials from Web Browsers</b>: Steals stored passwords, cryptou2011wallet files and session data.<br/><b>Description</b>: Extracts credentials from Chrome, Firefox, etc."] class cred_browser action cred_cookie["<b>Action</b> – <b>T1550.004 Web Session Cookie</b>: Uses stolen cookies as alternate authentication material.<br/><b>Description</b>: Reu2011uses valid web sessions."] class cred_cookie action forge_cookie["<b>Action</b> – <b>T1606.001 Forge Web Credentials</b>: Creates forged cookies to impersonate victims.<br/><b>Description</b>: Enables unauthorized access to web services."] class forge_cookie action %% Nodes u2013 Exfiltration exfil_c2["<b>Action</b> – <b>T1041 Exfiltration Over C2 Channel</b>: Sends harvested data through the webu2011service C2.<br/><b>Description</b>: Data leaves the network via the same channel used for command and control."] class exfil_c2 action %% Connections u2013 Attack Flow init_user_execution –>|leads_to| loader_autoit init_mal_copy_paste –>|leads_to| loader_autoit loader_autoit –>|uses| obfuscation loader_autoit –>|masquerades_as| masquerading loader_autoit –>|establishes| persistence_shortcut loader_autoit –>|establishes| persistence_task loader_autoit –>|establishes| persistence_init persistence_shortcut –>|enables| hijack_execution persistence_task –>|enables| hijack_execution persistence_init –>|enables| hijack_execution hijack_execution –>|employs| defense_virtual hijack_execution –>|employs| defense_reflective hijack_execution –>|connects_to| c2_dga c2_dga –>|resolves_via| c2_dns c2_dns –>|communicates_via| c2_web c2_web –>|steals| cred_browser c2_web –>|captures| cred_cookie c2_web –>|enables| forge_cookie cred_browser –>|provides| exfil_c2 cred_cookie –>|provides| exfil_c2 forge_cookie –>|provides| exfil_c2 %% Styling class init_user_execution,init_mal_copy_paste action class loader_autoit,obfuscation,masquerading tool class persistence_shortcut,persistence_task,persistence_init,hijack_execution,defense_virtual,defense_reflective,cred_browser,cred_cookie,forge_cookie action class c2_dga,c2_dns,c2_web,exfil_c2 action "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

  • Attack Narrative & Commands:

    1. Initial Drop: The attacker gains user context (e.g., via phishing) and uses the legitimate explorer.exe process to launch the malicious payload located on a mounted network share: \Device\HarddiskVolumeX\NFS\Need for Speed Hot Pursuit\Setup.exe.
    2. Persistence & Launcher: After the malicious Setup.exe runs, it drops a batch script (Pros.cmd) into the same directory. The attacker then uses cmd.exe /c copy Pros Pros.cmd & Pros.cmd to execute the script, which loads additional payloads.
    3. AutoIt Proxy: In parallel, the loader may invoke AutoIt3.exe with an embedded script (V.a3x) to bypass AppLocker. This mirrors the selection_autoit condition.

    These steps generate the exact three telemetry patterns required by the Sigma rule:

    • explorer.exe with the hard‑coded malicious Setup.exe path, and
    • cmd.exe with /c plus either a copy‑and‑execute chain or an AutoIt execution.

  • Regression Test Script:

    # -----------------------------------------------
# LummaStealer / CastleLoader simulation script
# -----------------------------------------------
$maliciousDir = "$env:ProgramDataNFSNeed for Speed Hot Pursuit"
$setupPath    = Join-Path $maliciousDir "Setup.exe"
$batchPath    = Join-Path $maliciousDir "Pros.cmd"
$autoItPath   = Join-Path $maliciousDir "V.a3x"

# 1. Create directory structure
New-Item -Path $maliciousDir -ItemType Directory -Force | Out-Null

# 2. Place dummy malicious files (empty files are enough for logging)
New-Item -Path $setupPath    -ItemType File -Force | Out-Null
New-Item -Path $batchPath    -ItemType File -Force | Out-Null
New-Item -Path $autoItPath   -ItemType File -Force | Out-Null

# 3. Simulate explorer.exe launching the malicious Setup.exe
Start-Process -FilePath "explorer.exe" -ArgumentList $setupPath

# Small pause to ensure the first event is logged
Start-Sleep -Seconds 2

# 4a. Trigger the cmd.exe copy‑and‑execute chain
cmd.exe /c "copy Pros.cmd $batchPath & $batchPath"

# 4b. (Alternative) Trigger AutoIt execution – uncomment if testing this path
# Start-Process -FilePath "AutoIt3.exe" -ArgumentList $autoItPath

# 5. Wait for events to flow to SIEM
Start-Sleep -Seconds 5

  • Cleanup Commands:

    # Remove all artefacts created by the simulation
Remove-Item -Path "$env:ProgramDataNFS" -Recurse -Force -ErrorAction SilentlyContinue

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free