Water Kurita

Executive Summary

Water Kurita is a financially motivated cybercriminal group that operates the Lumma Stealer MaaS platform, using stealthy browser deliveries and process injection to exfiltrate credentials on a mass‑scale. The group’s recent 2025 doxxing campaign exposed its core members and temporarily disrupted its infrastructure, but activity resumed quickly through new C2 channels and diversified delivery vectors. It primarily monetizes stolen data by reselling credentials via subscription services, targeting a wide array of sectors across China, Iran, Israel, and Japan.

Goals & Targeting

Water Kurita’s primary objective is financial gain through large‑scale credential theft and data monetization. The group specifically targets sectors that handle sensitive or highly profitable information, including media, financial services, pharmaceuticals, critical infrastructure, aviation, government, and defense. The actor focuses on threat landscapes in China, Iran, Israel, and Japan, exploiting localized supply chains and leveraging local regulatory gaps to maximize the value of stolen data.

Key Capabilities

• Doxxing and information exfiltration via Lumma Stealer
• Browser fingerprinting for detection evasion and sandbox avoidance
• Stealthy installation and persistence mechanisms
• GitHub-based delivery through FakeGit campaign
• Process injection from MicrosoftEdgeUpdate.exe into Chrome processes
• Selective payload deployment based on victim environment
• Data exfiltration over HTTP to C&C endpoints
• Use of GhostSocks secondary payload for detection or movement
• Exploitation of IDRAC remote‑management controller vulnerability for disk wiping
• Phishing sites masquerading as control panels for data harvesting
• Cloudflare CDN usage to mask true C&C origins
• Malvertising, search engine manipulation, and JavaScript redirection to drive downloads
• Creation of fake GitHub repositories with AI‑generated README files
• Leverage social media platforms for bulk malware distribution

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Water Kurita operates at an opportune tempo, rapidly rebuilding its infrastructure after each takedown. Known campaigns include the high‑volume FakeGit GitHub repo abuse and a 2025 doxxing incident that forced operational pivots. Victim profiles span mid‑market organizations in finance, media, pharmaceuticals, critical infrastructure, aviation, government, and defense across China, Iran, Israel, and Japan. The actor’s modus operandi blends multiple delivery vectors—malvertising, social‑media, GitHub, and phishing—to maximize reach, while its use of cloud proxies and CDN masking enables resilient command & control despite defensive countermeasures.

IOC Patterns

• Domain name
• Email address
• File hash (SHA-256)
• Endpoint path (/api/set_agent)
• HTTP GET query parameters (uid, auth token)
• IDRAC firmware vulnerability indicator
• Phishing URL masquerade
• Malvertising redirect pattern
• JavaScript‑based redirection to secondary download sites
• Cloudflare CDN obfuscation
• GitHub repository README content

Recommended Actions

• Block known Lumma Stealer C&C domains and IPs via threat intelligence feeds.
• Monitor for process injection into browsers (e.g., chrome.exe) and alert on anomalous execution from MicrosoftEdgeUpdate.exe.
• Apply endpoint behavioral analytics to detect VM/sandbox evasion indicators such as browser fingerprinting signatures.
• Inspect outbound HTTP traffic for suspicious API endpoints like /api/set_agent and flagged query parameters.
• Harden Dell IDRAC infrastructure: enforce firmware updates, restrict remote access protocols, and monitor for abnormal delete/wipe activity.
• Block phishing sites that mimic legitimate control panels; integrate URL reputation checks in gateway firewalls.
• Implement web filtering to block JavaScript redirect loops to TDS/secondary download sites and mitigate malvertising campaigns.
• Flag or quarantine suspicious GitHub repositories containing AI‑generated README content or game cheat promotions.
• Deploy robust ad‑blockers and safe browsing extensions on endpoints, and enable anti‑malvertising controls.
• Maintain up‑to‑date antivirus signatures for Lumma Stealer variants and GhostSocks, and deploy host‑based intrusion detection systems.

Suggested Tags