Shifts in the Underground: The Impact of Water Kurita’s (Lumma Stealer) Doxxing

### Executive summary Trend telemetry observed a marked decline in Lumma Stealer (Water Kurita) detections and C2 infrastructure in Sept–Oct 2025 that coincided with an underground exposure/doxxing campaign and reported compromise of Lumma’s Telegram accounts; the disclosures of alleged operator PII and operational details disrupted communications, eroded trust, and prompted customers to migrate to alternatives such as Vidar and StealC, reshaping the infostealer MaaS ecosystem.