DNS Deep Dive: LummaStealer + CastleLoader = Larger Threat

LummaStealer, an information-stealing malware family, continued operating despite a major law-enforcement disruption in 2025 by shifting hosting providers and adopting alternative loaders and delivery techniques such as ClickFix.

Bitdefender uncovered¹ a new LummaStealer campaign that used CastleLoader as its main delivery mechanism. After extracting domains from IoC-tagged subdomains and excluding those belonging to legitimate organizations, we analyzed 211 IoCs in all, comprising two subdomains, 180 domains, and 29 IP addresses. Using our homegrown tools to investigate the threat, we uncovered these findings:

• Three domains classified as IoCs were bulk-registered with 2–5 look-alikes each
• 49 domains named as IoCs seemed to have been registered with malicious intent from the get-go
• 103,038 unique potential victim IP addresses communicated with 10 IP addresses categorized as IoCs
• 129 email-connected domains, 26 of which were deemed malicious
• 200 additional IP addresses, 196 of which turned out to be malicious
• 813 IP-connected domains, 229 of which have already been weaponized for attacks
• 404 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.bitdefender.com/en-us/blog/labs/lummastealer-second-life-castleloader