Trojanised / pirated software

Cracked apps bundled with stealers or loaders

Example: Lumma via file-sharing sites

Classification

34 values: 20 imported, 2 derived, 12 machine-classified. What do these mean?

Exploitability

Impact & scope

Detection & telemetry

Detection & response

Mitigated by 27

• M1017 attack-mitigation
• M1018 attack-mitigation
• M1022 attack-mitigation
• M1038 attack-mitigation
• M1040 attack-mitigation
• M1045 attack-mitigation
• M1047 attack-mitigation
• M1049 attack-mitigation
• D3-CF d3fend
• D3-CM d3fend
• D3-CQ d3fend
• D3-DA d3fend
• D3-DF d3fend
• D3-EAL d3fend
• D3-EDL d3fend
• D3-EFA d3fend
• D3-FA d3fend
• D3-FE d3fend
• D3-FEV d3fend
• D3-FIM d3fend
• D3-LFP d3fend
• D3-RF d3fend
• D3-RFAM d3fend
• D3-SCA d3fend
• D3-SCF d3fend
• D3-SFA d3fend
• D3-SJA d3fend

Detected by 133

• DET0127 attack-detection-strategy
• DET0294 attack-detection-strategy
• 00d0b5ab-1f55-4120-8e83-487c0a7baf19 sigma
• 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d sigma
• 0718cd72-f316-4aa2-988f-838ea8533277 sigma
• 0b0cd537-fc77-4e6e-a973-e53495c1083d sigma
• 0ba1da6d-b6ce-4366-828c-18826c9de23e sigma
• 0c92f2e6-f08f-4b73-9216-ecb0ca634689 sigma
• 0cf2e1c6-8d10-4273-8059-738778f981ad sigma
• 1193d960-2369-499f-a158-7b50a31df682 sigma
• 12fbff88-16b5-4b42-9754-cd001a789fb3 sigma
• 1327381e-6ab0-4f38-b583-4c1b8346a56b sigma
• 1337afba-d17d-4d23-bd55-29b927603b30 sigma
• 13c02350-4177-4e45-ac17-cf7ca628ff5e sigma
• 15b75071-74cc-47e0-b4c6-b43744a62a2b sigma
• 18da1007-3f26-470f-875d-f77faf1cab31 sigma
• 1a1ed54a-2ba4-4221-94d5-01dee560d71e sigma
• 1c12727d-02bf-45ff-a9f3-d49806a3cf43 sigma
• 1cfac73c-be78-4f9a-9b08-5bde0c3953ab sigma
• 208748f7-881d-47ac-a29c-07ea84bf691d sigma
• 28208707-fe31-437f-9a7f-4b1108b94d2e sigma
• 289dfa9e-e378-4a56-a9d4-7ed5ee218029 sigma
• 29fd07fc-9cfd-4331-b7fd-cc18dfa21052 sigma
• 2ad78473-6978-40f5-b8f1-89c7e1c27a1a sigma
• 2ddef153-167b-4e89-86b6-757a9e65dcac sigma
• 2e65275c-8288-4ab4-aeb7-6274f58b6b20 sigma
• 30a8cb77-8eb3-4cfb-8e79-ad457c5a4592 sigma
• 312b42b1-bded-4441-8b58-163a3af58775 sigma
• 3215aa19-f060-4332-86d5-5602511f3ca8 sigma
• 32e280f1-8ad4-46ef-9e80-910657611fbc sigma
• 33339be3-148b-4e16-af56-ad16ec6c7e7b sigma
• 340a090b-c4e9-412e-bb36-b4b16fe96f9b sigma
• 36480ae1-a1cb-4eaa-a0d6-29801d7e9142 sigma
• 3711eee4-a808-4849-8a14-faf733da3612 sigma
• 39466c42-c189-476a-989f-8cdb135c163a sigma
• 396f6630-f3ac-44e3-bfc8-1b161bc00c4e sigma
• 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e sigma
• 3d7679bd-0c00-440c-97b0-3f204273e6c7 sigma
• 3dfd06d2-eaf4-4532-9555-68aca59f57c4 sigma
• 3f7f5b0b-5b16-476c-a85f-ab477f6dd24b sigma
• … and 93 more in the database

Tested by 37

• 02f35d62-9fdc-4a97-b899-a5d9a876d295 atomic
• 0330a5d2-a45a-4272-a9ee-e364411c4b18 atomic
• 03ae82a6-9fa0-465b-91df-124d8ca5c4e8 atomic
• 1214f818-673b-4494-9fbd-99af0e185866 atomic
• 22386853-f68d-4b50-a362-de235127c443 atomic
• 24136435-c91a-4ede-9da1-8b284a1c1a23 atomic
• 24fd9719-7419-42dd-bce6-ab3463110b3c atomic
• 26cde240-0112-4806-8c97-bdde43dab298 atomic
• 35eb8d16-9820-4423-a2a1-90c4f5edd9ca atomic
• 3a2a578b-0a01-46e4-92e3-62e2859b42f0 atomic
• 3f3120f0-7e50-4be2-88ae-54c61230cb9f atomic
• 3f3af983-118a-4fa1-85d3-ba4daa739d80 atomic
• 4449c89b-ec82-43a4-89c1-91e2f1abeecc atomic
• 4ea1fc97-8a46-4b4e-ba48-af43d2a98052 atomic
• 51005ac7-52e2-45e0-bdab-d17c6d4916cd atomic
• 5202ee05-c420-4148-bf5e-fd7f7d24850c atomic
• 581d7521-9c4b-420e-9695-2aec5241167f atomic
• 5ba5a3d1-cf3c-4499-968a-a93155d1f717 atomic
• 812c3ab8-94b0-4698-a9bf-9420af23ce24 atomic
• 83810c46-f45e-4485-9ab6-8ed0e9e6ed7f atomic
• 89a7dd26-e510-4c9f-9b15-f3bae333360f atomic
• 8bebc690-18c7-4549-bc98-210f7019efff atomic
• 9215ea92-1ded-41b7-9cd6-79f9a78397aa atomic
• a19ee671-ed98-4e9d-b19c-d1954a51585a atomic
• a315bfff-7a98-403b-b442-2ea1b255e556 atomic
• ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa atomic
• ad4b73c2-d6e2-4d8b-9868-4c6f55906e01 atomic
• add560ef-20d6-4011-a937-2c340f930911 atomic
• b721c6ef-472c-4263-a0d9-37f1f4ecff66 atomic
• b95ce2eb-a093-4cd8-938d-5258cef656ea atomic
• bc15c13f-d121-4b1f-8c7d-28d95854d086 atomic
• c3d24a39-2bfe-4c6a-b064-90cd73896cb0 atomic
• c7fa0c3b-b57f-4cba-9118-863bf4e653fc atomic
• d7c03c7e-31cd-43c7-859a-ec053f73b23a atomic
• dac81590-8b63-4769-8b82-310beedc4f09 atomic
• f0e3aaea-5cd9-4db6-a077-631dd19b27a8 atomic
• f9f2fe59-96f7-4a7d-ba9f-a9783200d4c9 atomic

Attack relationships

• Parent: Baiting

Framework references

• Primary source: https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/
• attack: T1204.002 (primary)
• attack: T1036

Evidence & sources

• ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 114 of Cyber-Attack-Taxonomy.md
• ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1204.002, attack:T1036 as the nearest framework entries; ids verified to exist in the cached catalogues.
• ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 196 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
• ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 60 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)