Take Down a Stealer and Its Market Moves to the Next One. Two Takedowns, Checked Against Four Sources.
When Microsoft and the U.S. Department of Justice took down the Lumma infostealer in May 2025, its share of new command-and-control certificates fell from 290 a quarter to 8 within two quarters. Vidar rose from 39 to 196 over the same stretch and has led every quarter since. A takedown removes one operator. It does not remove the demand, and the demand moves. Here is that pattern in certificate data, checked against three outside sources and our own feed, and what a defender can do with it.
The certificate record
abuse.ch's SSLBL project lists the TLS certificates that malware command-and-control servers present, with a listing date and the family. Counting new listings per quarter, by family, gives a rough view of where analysts are finding live infrastructure. It measures what SSLBL listed, not how many machines were infected, so read the shapes, not the absolute numbers.
Three things stand out:
Lumma: 290 certificates in 2025 Q1, 149 in Q2, 85 in Q3, 8 in Q4. The takedown landed in May 2025.
Rhadamanthys: a peak of 142 in 2025 Q3, then 86, then none. It was disrupted in November 2025.
Vidar: 39 in 2025 Q3, then 131, then roughly 160 to 200 a quarter through 2026. Acreed (listed by SSLBL as ACRStealer) climbed from 15 to about 50 a quarter alongside it.
Checked against other sources
One data source shows a trend. It takes a second, independent one to say it is real. Three outside reports and our own feed agree:
The takedown itself. Microsoft's Digital Crimes Unit, with the DOJ, Europol and Japan's JC3, seized or sinkholed about 2,300 Lumma domains in May 2025 (Microsoft).
The successor. Intrinsec reports that Vidar has been the most-used infostealer on the Russian Market since November 2025, after Lumma's disruption in May and Rhadamanthys's in November, with Acreed surging too (Intrinsec, via Dark Reading). The certificate record turns in the same quarter.
Why Vidar. Trend Micro ties the rise to Vidar 2.0, released in October 2025 as Lumma activity declined (Trend Micro).
Our own feed. In the ThreatFox and MalwareBazaar records we carry, Vidar outnumbers Lumma about 48 to 1 (13,587 to 280 indicators) and 18 to 1 (1,092 to 61 samples). Those records cover 2026, not 2025, so they confirm who leads now, not the handoff itself.
The steady line: remote-management tools
The flattest line on the chart is the most useful one. Certificates for abused remote-management tools (ConnectWise, ScreenConnect, SimpleHelp, HardConnect, DocConnect, AxisControl) stay between 30 and 96 a quarter through both takedowns, around 70 a quarter all through 2026. Attackers do not need a stealer when a legitimate remote-support tool gives them the keyboard. Acronis documented this trend accelerating through 2025, Securonix described a recent campaign using SimpleHelp for commands and ScreenConnect for desktop control, and SANS logged a ScreenConnect phishing installer on October 1. Our feed carries 636 MalwareBazaar file hashes and 64 URLhaus URLs attributed to ConnectWise.
What to do with it
Expect a successor. When a family is taken down, keep your detections for the next likely one ready rather than celebrating the drop. In 2025 that was Vidar and Acreed.
Treat unsanctioned remote-management tools as an incident. If your organization does not use ScreenConnect or SimpleHelp, an install is a finding, not a helpdesk ticket.
Match on certificates where you have nothing else. For some families a certificate is the only network-level indicator anyone has. OffLoader is the clearest case: 103 listed certificates in the last 90 days and no IP or domain indicators in our corpus. Since today our feed serves SSLBL's certificates as a CSV and as Suricata TLS-fingerprint rules, credited to abuse.ch, with a column marking the families where the certificate is the only network handle. Details are on our updates page.
What we fixed in our own data on the way
Checking these numbers meant checking our own fields first, and several were wrong while every status read healthy. 41,140 ThreatFox records were stored under the SSLBL name at a higher confidence. 102,150 URLhaus records had a list of tags where the malware family belongs. Our AI cost meter booked $0 for 10,536 calls because its price table was empty; the real figure is about $31 a month. Each correction is listed with before-and-after numbers on the updates page. We now run a daily check for those shapes. If you run a feed, two habits caught most of it: confirm a field against a second source before trusting it, and treat a value missing from a capped count as unknown, not zero.
The certificate counts come from SSLBL as published today and the comparisons from the reports linked above. We checked each figure before publishing. At least 5% of what remains is still wrong, and we don't know which.
If this was useful, or if it wasn't, rate it at the bottom of the page. It is the only direct signal we get.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=take-down-a-stealer-and-its-market-moves-to-the-next-one-two-takedowns-checked-against-four-source
Comments