Daily Briefing for 05.22.25

At a glance.

• Law enforcement shutters Lumma Stealer malware operation.
• Marks & Spencer expects to lose over $400 million due to cyberattack.
• DragonForce gang targets rival ransomware operators.

Law enforcement shutters Lumma Stealer malware operation.

Law enforcement agencies in the US, Europe, and Japan have disrupted the Lumma Stealer malware operation, seizing the infostealer's infrastructure, domains, and marketplaces. Europol calls Lumma "the world’s largest infostealer," noting that "[s]tolen credentials, financial data, and personal information were harvested and sold through a dedicated marketplace, making Lumma a central tool for identity theft and fraud worldwide."

Microsoft, which assisted in the takedown, stated, "Between March 16, 2025, and May 16, 2025, Microsoft identified over 394,000 Windows computers globally infected by the Luma malware. Working with law enforcement and industry partners, we have severed communications between the malicious tool and victims. Moreover, more than 1,300 domains seized by or transferred to Microsoft, including 300 domains actioned by law enforcement with the support of Europol, will be redirected to Microsoft sinkholes."

Marks & Spencer expects to lose over $400 million due to cyberattack.

British retailer Marks & Spencer (M&S) expects the cyberattack the company sustained last month to cause losses of around £300 million ($402 million), nearly one-third of the company's annual profits, CNBC reports. The retailer doesn't expect to fully recover from the incident until July.

M&S's CEO Stuart Machin disclosed that the hackers gained access through a third-party contractor, stating, "Unable to get into our systems by breaking through our digital defences, the attackers did try another route resorting to social engineering and entering through a third party rather than a system weakness." Reuters cites a source as saying this contractor was Tata Consulting Services, which M&S uses for helpdesk support.

BleepingComputer says the incident was a ransomware attack in which "threat actors used a DragonForce encryptor to encrypt virtual machines on VMware ESXi hosts."

DragonForce gang targets rival ransomware operators.

Sophos has published a report on the DragonForce ransomware-as-a-service operation, noting that the gang is attacking rival ransomware groups in an attempt to claim dominance in the ransomware ecosystem. The gang defaced leak sites belonging to the BlackLock and Mamona ransomware groups, and appears to have conducted a hostile takeover of the RansomHub gang.

Sophos explains, "When DragonForce emerged in August 2023, it offered a traditional RaaS scheme. On March 19, 2025, the group announced a rebrand as a ‘cartel’ to expand its reach, hoping to emulate the success of LockBit and other mature ransomware-as-a-service (RaaS) groups. In practice, it isn’t a cartel operation but an offering that gives affiliates the flexibility to leverage DragonForce’s infrastructure and ransomware tools while operating under their own brands."