Water KuritaThreat actor
Water Kurita is a financially motivated cybercriminal entity associated with the Lumma Stealer infostealer-as-a-service operation, primarily active on underground forums and marketplaces. It focuses on credential and information theft at scale, monetizing access via subscription-based malware distribution and resale of stolen data to other actors.From MISP Galaxy
Last reported 8 days ago, by Help Net Security2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1055Process Injection
“Process injection and browser hijacking”
- T1176.001Browser Extensions
“…ish approved software repositories, as malware often spreads through fake software installers, cracked applications, and malicious browser extensions downloaded from unofficial sources”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Stolen AI API keys are paying for hackers’ autonomous scans“Forum members are dissecting FakeGit, a campaign attributed to the actor Water Kurita in which roughly 7,600 fraudulent GitHub repositories spread SmartLoader malware.”
-
Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics“…led to a decline in activity, but Trend™ Research observed an increase in Lumma Stealer-related activity (which Trend Micro tracks as Water Kurita) since the week of October 20, as well as new behaviors and C&C techniques.”
Indicators in its reports
named in the reports above- jamelik[.]asiain 1 report
- 516cd47d091622b3…9082395e65e5in 1 report
- pabuloa[.]asiain 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.