Threat Actors Target U.S. Critical Infrastructure with LummaC2 Malware

Executive Summary

CISA and the FBI released a joint cybersecurity advisory, LummaC2 Malware Targeting U.S. Critical Infrastructure Sectors (AA25-141B), detailing the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) linked to threat actors deploying LummaC2 malware. The malware is capable of infiltrating networks and exfiltrating sensitive information across U.S. critical infrastructure sectors. Threat actors were observed using LummaC2 as recently as May 2025, and the advisory includes IOCs tied to infections from November 2023 through May 2025.

Municipal Impact

Municipal organizations across critical infrastructure sectors should review the advisory and implement recommended mitigations to reduce exposure to infostealer malware.

SMB Impact

SMBs should review the advisory and IOCs to detect potential LummaC2 infections and reduce exfiltration risk.

Recommended Actions

1. Review the joint cybersecurity advisory AA25-141B and implement the recommended mitigations.
2. Review the included indicators of compromise (IOCs) and hunt for signs of infection.
3. Reduce exposure and impact of credential-stealing malware through network and endpoint protections.

Grey Matter Analysis