US and Europe Join Forces to Take Down Major Hacking Tool Used by Cybercriminals Worldwide

US and European authorities have launched a powerful crackdown on a notorious hacking tool that has fueled countless cyberattacks across the globe. Known as Lumma, this tool has been linked to ransomware attacks, bank thefts, and other serious digital crimes, affecting hundreds of organizations worldwide.

On Wednesday, the US Justice Department announced it seized the computer systems that hackers used to access Lumma. Meanwhile, Microsoft successfully took control of or shut down 2,300 websites tied to this cybercriminal network, thanks to a court order.

This operation delivers a serious blow to a sprawling hacking enterprise that had been causing chaos, especially over the past two months. Microsoft reported discovering nearly 394,000 Windows computers infected with Lumma across the world.

Authorities say Lumma-powered attacks targeted a wide range of victims — including airlines, universities, hospitals, banks, US state governments, and even Fortune 500 companies. The FBI estimates that in 2023 alone, hackers using Lumma caused credit card fraud losses of $36.5 million.

However, the fight against Lumma hasn’t been straightforward. The lead developer of the software reportedly operates out of Russia, where versions of Lumma are openly sold on Telegram and other Russian forums for prices ranging from $250 to $1,000, according to Microsoft analysts.

US prosecutors have charged numerous Russian hackers in the past decade for cybercrimes against American targets, but only a few have been brought to justice in US courts. Russian officials have also resisted efforts to extradite accused cybercriminals.

When asked if the FBI knows whether Lumma’s developer is based in Russia or if they have contacted Russian authorities, Brett Leatherman, the FBI’s deputy assistant director for cyber operations, said he could not comment.

But Leatherman emphasized that the FBI’s strategy focuses on disrupting the entire hacking ecosystem — not just individual actors — to provide relief to victims.

“This is about cutting off the tools and infrastructure these criminals rely on,” Leatherman said. “Even if we can’t charge every individual, taking down this network helps protect the victims.”

This global crackdown involved a coordinated effort from Europol, American and European tech companies, and a Japanese cybersecurity group. This collaborative approach reflects the growing role tech firms play in tackling cybercrime worldwide.

Leatherman expressed hope that this takedown would also sow distrust within the cybercriminal network, further weakening their operations.

“This is part of a broader investigation into the group behind Lumma,” he said. “We aim to fracture their trust and dismantle their network.”