Inside Microsoft’s Global Operation to Disrupt Lumma Stealer’s 2,300-Domain Malware Network

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Richard Boscovich and Derek Richardson from Microsoft’s Digital Crimes Unit to unpack the global takedown of Lumma Stealer, one of the world’s largest infostealer malware operations. They discuss how creative legal tools like RICO and centuries-old trespass laws, deep collaboration with global partners, and innovative technical strategies came together to seize 2,300 domains and protect nearly 400,000 victims. The episode explores how the DCU is shifting toward persistent, cost-imposing disruption of cybercrime as a service, and what this means for defenders everywhere. In this episode you’ll learn: How Microsoft took down one of the world’s largest infostealer malware operations The global partnerships with Europol, Japan, and private companies in cyber takedowns What happens to stolen victim data during a takedown operation Some questions we ask: How did you first identify Lumma as a high-priority threat? Is persistent disruption now the new normal for DCU operations? Do you see more operations like this coming from DCU in the future? Resources: View Richard Boscovich on LinkedIn View Sherrod DeGrippo on LinkedIn Disrupting Lumma Stealer: Microsoft Leads Global Action Against Favored Cybercrime Tool Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.