ドメイン押収後のLummaStealerの動向

This report analyzes post-domain-seizure activity of the LummaStealer info-stealer: affiliate-disclosed infection counts (tens to hundreds of thousands), domain registration and reporting trends, and a shift from Cloudflare-based C2 to direct IP resolution. Although affiliates continue to generate infections and infrastructure remains in use, the transition to a small set of resolvable IPs makes network-level blocking and disruption substantially easier, indicating reduced operational flexibility for operators despite continued activity.