The Case of LummaC2 v4.0

The Case of LummaC2 v4.0 | eSentire Get Started What We Do How We Do It Resources Company Partners Get Started What we do How we do it Resources Company Partners Get Started Back What We Do AI-DRIVEN SECURITY OPERATIONS Atlas Security Operations Platform Task-specific Atlas Agents investigate threats at machine speed with full transparency, expert validation, and explainable outcomes you can trust. Atlas Extended Detection and Response Open XDR with Agentic AI & machine learning that eliminates noise, enables real-time detection and response, and automatically blocks threats. Atlas User Experience See what our SOC sees, review investigations, and see how we are protecting your business. Atlas Platform Integrations Seamless integrations and threat investigation that adapts to your tools and evolves with your business. EXPERT-VALIDATED DEFENSE Security Operations Center (SOC) 24/7 SOC-as-a-Service with unlimited threat hunting and incident handling. Threat Response Unit (TRU) Proactive threat intelligence, original threat research and a world-class team of seasoned industry veterans. Cyber Resilience Team Extend your team capabilities and prevent business disruption with expertise from eSentire. Response and Remediation We balance automated blocks with rapid human-led investigations to manage threats. ESENTIRE SERVICES Managed Detection and Response Combine AI-driven security operations, multi-signal attack surface coverage and 24/7 Elite Threat Hunters to help you take your security program to the next level. All-in-One eSentire MDR MDR for Microsoft Digital Forensics and Incident Response Get unlimited Incident Response with threat suppression guarantee - anytime, anywhere. Continuous Threat Exposure Management (CTEM) CTEM and advisory programs that identify security gaps and build proactive strategies to address them. Back How We Do It MDR Packages and 24/7 Protection MDR Pricing and Packages Flexible MDR pricing and packages that fit your unique security requirements. Atlas Essentials Entry level foundational MDR coverage Atlas Advanced Comprehensive Next Level eSentire MDR Atlas Complete Next Level eSentire MDR with Cyber Risk Advisors to continuously advance your security program Explore MDR Packages → Build Your MDR Package → 24/7 Coverage Endpoint Network Log Cloud Identity INDUSTRIES Insurance Construction Finance Legal Manufacturing Private Equity Healthcare Retail Food Supply Government and Education Automotive Dealerships USE CASES Ransomware Stop ransomware before it spreads. Identity Response Stop identity-based cyberattacks. Zero Day Attacks Detect and respond to zero-day exploits. Cybersecurity Compliance Meet regulatory compliance mandates. Third-Party Risk Defend third-party and supply chain risk. Cloud Misconfiguration End misconfigurations and policy violations. Cyber Risk Adopt a risk-based security approach. Mid-Market Security Mid-market security essentials to prioritize. Sensitive Data Security Protect your most sensitive data. Cyber Insurance Meet insurability requirements with MDR. Cyber Threat Intelligence Operationalize cyber threat intelligence. Security Leadership Build a proven security program. Back Resources Resources Resource Library Video Library Case Studies Compare MDR Vendors TRU Intelligence Center Monthly Threat Intelligence Briefings Cybersecurity Tools Cybersecurity Glossary Real vs. Fake MDR Blogs Security Advisories SECURITY ADVISORIES Mar 31, 2026 Axios npm Packages Compromised On March 31st, 2026, threat actors compromised the Axios npm (Node Package Manager) package, publishing two malicious versions, 1.14.1 and 0.30.4, to the npm registry. This supply chain… Read More Mar 30, 2026 F5 BIG-IP APM Flaw CVE-2025-53521 Exploited in the Wild On March 27th, 2026, F5 confirmed exploitation of a previously known vulnerability in its BIG-IP Access Policy Manager (APM) versions. The flaw, tracked as CVE-2025-53521 (CVSS: 9.3),… Read More View Advisories From The Blog Apr 08, 2026 STX RAT: A new RAT in 2026 with Infostealer Capabilities Read More Apr 07, 2026 Examining the Blast Radius from the Axios npm Supply Chain Compromise Read More Apr 01, 2026 Tycoon 2FA Infrastructure Update: Threat Actors Adapt Following Global… Read More VIEW ARTICLES Back Company ABOUT ESENTIRE eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. About Us Leadership Careers Event Calendar → Newsroom → Aston Villa Football Club → EVENT CALENDAR Apr 14 April TRU Intelligence Briefing Apr 15 Philadelphia Cybersecurity Summit Apr 23 Aston Villa CISO Round Table May 07 Seattle FutureCon May 12 May TRU Intelligence Briefing View Calendar → LATEST PRESS RELEASE Mar 19, 2026 eSentire Appoints Cybersecurity Industry Veteran James C. Foster as Chief Executive Officer Read More View Newsroom → OUR PARTNERSHIPS Aston Villa Football Club AVFC takes its cyber protection to the Next Level with eSentire as its official cybersecurity partner. Learn More Back Partners PARTNER PROGRAM We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today. LEARN MORE → Apply to become an e3 ecosystem partner with eSentire today. APPLY NOW → Sign in to the Partner Portal to access exclusive resources, campaigns, training, sales tools, and support. LOGIN NOW → Back Search Search our site Quick Links ALL-IN-ONE ESENTIRE MDR → Multi-Signal MDR with 300+ technology integrations to support your existing investments. 24/7 SOC SUPPORT → 24/7 SOC-as-a-Service with unlimited threat hunting and incident handling. MDR PRICING AND PACKAGES → We offer three flexible MDR pricing packages that can be customized to your unique needs. TRU INTELLIGENCE CENTER → The latest security advisories, blogs, reports, industry publications and webinars published by TRU. MDR VENDOR COMPARISONS → Compare eSentire to other Managed Detection and Response vendors to see how we stack up against the competition. MDR CASE STUDIES → See why 2000+ organizations globally have chosen eSentire for their MDR Solution. Back Get Started Get Started Build A Quote Become A Partner Breached? Call Us Now Home Resources Blog The Case of LummaC2 v4.0 Threat Response Unit The Case of LummaC2 v4.0 Attacks/Breaches Threat Intelligence Threat Response Unit TRU Positive/Bulletin eSentire Threat Response Unit (TRU) September 7, 2023 11 MINS READ Share this article BlogBody__Content wrappers as needed --> Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes. We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware. Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team. In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward. Here’s the latest from our TRU Team… What did we find? Since the beginning of August 2023, the eSentire Threat Response Unit (TRU) has observed 5 cases of Lumma Stealer infections across manufacturing, retail, and business industries. The infostealer was delivered via drive-by downloads disguised as fake installers such as Chrome and Edge browser installers. and some of them were distributed via PrivateLoader (a loader known to drop malware such as Redline, DCRat, and RaccoonStealer in the past). eSentire TRU recently published a TRU Positive on LummaC2 delivering Amadey and PrivateLoader; you can access the article here . Lumma Stealer, also known as LummaC2, first appeared on Russian-speaking forums at the end of 2022. The stealer is written in C++, and the build size is approximately 150-396 KB. The pricing for the stealer is divided into three categories: Experienced - $250/month : Includes capabilities such as downloading logs in bulk and the ability to filter the logs by specific parameters. Professional - $500/month : Includes capabilities such as creating an unlimited number of rules for the stealer, sharing the statistics with other people, non-residential loader, etc. Corporate - $1000/month : The developer claims that with the corporate plan, the user gets a random build by the morpher, which means each generated build is different from the other, implemented Heaven’s Gate (a technique used by malware to transition from 32-bit code execution to 64-bit code execution on x64 Windows systems, it’s used to bypass dynamic analysis by sandboxes and debuggers). Figure 1: Stealer advertisement on Russian speaking forums The stealer features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell: Figure 2: Non-resident loader Some other notable features of the stealer include: Control Flow Flattening – code obfuscation technique used to make the program's control flow more complex and harder to analyze. “ Spreading without the crypt protection” – if the generated stealer build is not crypted, the pop-up message will show up for the user upon running the build, as shown in Figure 3. Flexible file grabber – the ability to directly change the rules in the profile to grab specific data. Figure 3: Pop-up message if the build is not crypted Technical Analysis From the previous versions of the stealer (the sample we observed in June, MD5: a4e04604c178fe4fd19996b4d48b8885), as an obfuscation method, the stealer appends strings such as “576xe” to the data. Figure 4: String obfuscation for previous versions of LummaC2 But with the latest versions (version 4.0), the stealer obfuscates the strings with an XOR algorithm. It converts the hexadecimal characters in the string into the decimal value. The first four bytes of the byte array of the string are used as the XOR key. Each subsequent byte in the array is XORed with the mentioned four bytes in a cyclic manner. The decryption is shown algorithm is shown in the screenshot below. Figure 5: LummaC2 decryption algorithm Figure 6: String decrypter implementation in Python The stealer uses MurmurHash2 hashing algorithm to resolve the APIs, in our example the seed is 0x20. The API hashing function is obfuscated with control flow flattening as the rest of the code (Figure 8). Figure 7: Snippet of code with control flow flattening Figure 8: API hashing function We wrote the script to produce the hash values based on the seed for each API call within the DLL library found in the stealer. C2 Communication Upon the initial infection, the stealer retrieves the configuration from the C2 (/c2conf). @Jane_0sint provided insights on decrypting the configuration using the first 32-byte of the base64-encoded string as the key. That means that the crypto wallet extensions, applications, and list of browsers are not embedded in the stealer build anymore compared to previous versions of the stealer. Here is the example of the decrypted configuration retrieved from C2 (JSON format): { "v": 1, "c": [ { "t": 0, "p": "%userprofile%", "m": "*.txt", "z": "Important Files/Profile", "d": 1 }, { "t": 0, "p": "%userprofile%", "m": "*key*", "z": "Important Files/Profile", "d": 1 }, { "t": 0, "p": "%userprofile%", "m": "*bitcoin*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*binance*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*exodus*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*coinbase*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*wallet*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*seed*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*pass*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*ledger*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*trezor*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*metamask*", "z": "Important Files/Profile", "d": 3 }, { "t": 0, "p": "%userprofile%", "m": "*crypto*", "z": "Important Files/Profile", "d": 1 }, { "t": 0, "p": "%appdata%\\Binance", "m": "app-store.json", "z": "Wallets/Binance", "d": 1 }, { "t": 0, "p": "%appdata%\\Binance", "m": ".finger-print.fp", "z": "Wallets/Binance", "d": 1 }, { "t": 0, "p": "%appdata%\\Binance", "m": "simple-storage.json", "z": "Wallets/Binance", "d": 1 }, { "t": 0, "p": "%appdata%\\Electrum\\wallets", "m": "*", "z": "Wallets/Electrum", "d": 1 }, { "t": 0, "p": "%appdata%\\Ethereum", "m": "keystore", "z": "Wallets/Ethereum", "d": 1 }, { "t": 0, "p": "%appdata%\\Exodus\\exodus.wallet", "m": "*", "z": "Wallets/Exodus", "d": 2 }, { "t": 0, "p": "%appdata%\\Ledger Live", "m": "*", "z": "Wallets/Ledger Live", "d": 2 }, { "t": 0, "p": "%appdata%\\atomic\\Local Storage\\leveldb", "m": "*", "z": "Wallets/Atomic", "d": 2 }, { "t": 0, "p": "%localappdata%\\Coinomi\\Coinomi\\wallets", "m": "*", "z": "Wallets/Coinomi", "d": 2 }, { "t": 0, "p": "%appdata%\\Authy Desktop\\Local Storage\\leveldb", "m": "*", "z": "Wallets/Authy Desktop", "d": 2 }, { "t": 0, "p": "%appdata%\\Bitcoin\\wallets", "m": "*", "z": "Wallets/Bitcoin core", "d": 2 }, { "t": 0, "p": "%appdata%\\com.liberty.jaxx\\IndexedDB", "m": "*.leveldb", "z": "Wallets/JAXX New Version", "d": 2 }, { "t": 0, "p": "%appdata%\\Electrum\\wallets", "m": "*", "z": "Wallets/Electrum", "d": 2 }, { "t": 0, "p": "%appdata%\\AnyDesk", "m": "*.conf", "z": "Applications/AnyDesk", "d": 2 }, { "t": 0, "p": "%appdata%\\FileZilla", "m": "recentservers.xml", "z": "Applications/FileZilla", "d": 2 }, { "t": 0, "p": "%appdata%\\FileZilla", "m": "sitemanager.xml", "z": "Applications/FileZilla", "d": 2 }, { "t": 0, "p": "%userprofile%", "m": "*.kbdx", "z": "Applications/KeePass", "d": 2 }, { "t": 0, "p": "%programfiles%\\Steam", "m": "ssfn*", "z": "Applications/Steam", "d": 2 }, { "t": 0, "p": "%programfiles%\\Steam\\config", "m": "*", "z": "Applications/Steam/config", "d": 2 }, { "t": 0, "p": "%appdata%\\Telegram Desktop", "m": "*s", "z": "Applications/Telegram", "d": 2 }, { "t": 1, "e": [ { "en": "ejbalbakoplchlghecdalmeeeajnimhm", "ez": "MetaMask" }, { "en": "nkbihfbeogaeaoehlefnkodbefgpgknn", "ez": "MetaMask" }, { "en": "egjidjbpglichdcondbcbdnbeeppgdph", "ez": "Trust Wallet" }, { "en": "ibnejdfjmmkpcnlpebklmnkoeoihofec", "ez": "TronLink" }, { "en": "fnjhmkhhmkbjkkabndcnnogagogbneec", "ez": "Ronin Wallet" }, { "en": "fhbohimaelbohpjbbldcngcnapndodjp", "ez": "Binance Chain Wallet" }, { "en": "ffnbelfdoeiohenkjibnmadjiehjhajb", "ez": "Yoroi" }, { "en": "jbdaocneiiinmjbjlgalhcelgbejmnid", "ez": "Nifty" }, { "en": "afbcbjpbpfadlkmhmclhkeeodmamcflc", "ez": "Math" }, { "en": "hnfanknocfeofbddgcijnmhnfnkdnaad", "ez": "Coinbase" }, { "en": "hpglfhgfnhbgpjdenjgmdgoeiappafln", "ez": "Guarda" }, { "en": "blnieiiffboillknjnepogjhkgnoapac", "ez": "EQUA" }, { "en": "cjelfplplebdjjenllpjcblmjkfcffne", "ez": "Jaxx Liberty" }, { "en": "fihkakfobkmkjojpchpfgcmhfjnmnfpi", "ez": "BitApp" }, { "en": "kncchdigobghenbbaddojjnnaogfppfj", "ez": "iWlt" }, { "en": "kkpllkodjeloidieedojogacfhpaihoh", "ez": "EnKrypt" }, { "en": "amkmjjmmflddogmhpjloimipbofnfjih", "ez": "Wombat" }, { "en": "nlbmnnijcnlegkjjpcfjclmcfggfefdm", "ez": "MEW CX" }, { "en": "nanjmdknhkinifnkgdcggcfnhdaammmj", "ez": "Guild" }, { "en": "nkddgncdjgjfcddamfgcmfnlhccnimig", "ez": "Saturn" }, { "en": "cphhlgmgameodnhkjdmkpanlelnlohao", "ez": "NeoLine" }, { "en": "nhnkbkgjikgcigadomkphalanndcapjk", "ez": "Clover" }, { "en": "kpfopkelmapcoipemfendmdcghnegimn", "ez": "Liquality" }, { "en": "aiifbnbfobpmeekipheeijimdpnlpgpp", "ez": "Terra Station" }, { "en": "dmkamcknogkgcdfhhbddcghachkejeap", "ez": "Keplr" }, { "en": "fhmfendgdocmcbmfikdcogofphimnkno", "ez": "Sollet" }, { "en": "cnmamaachppnkjgnildpdmkaakejnhae", "ez": "Auro" }, { "en": "jojhfeoedkpkglbfimdfabpdfjaoolaf", "ez": "Polymesh" }, { "en": "flpiciilemghbmfalicajoolhkkenfe", "ez": "ICONex" }, { "en": "nknhiehlklippafakaeklbeglecifhad", "ez": "Nabox" }, { "en": "hcflpincpppdclinealmandijcmnkbgn", "ez": "KHC" }, { "en": "ookjlbkiijinhpmnjffcofjonbfbgaoc", "ez": "Temple" }, { "en": "mnfifefkajgofkcjkemidiaecocnkjeh", "ez": "TezBox" }, { "en": "lodccjjbdhfakaekdiahmedfbieldgik", "ez": "DAppPlay" }, { "en": "ijmpgkjfkbfhoebgogflfebnmejmfbm", "ez": "BitClip" }, { "en": "lkcjlnjfpbikmcmbachjpdbijejflpcm", "ez": "Steem Keychain" }, { "en": "onofpnbbkehpmmoabgpcpmigafmmnjh", "ez": "Nash Extension" }, { "en": "bcopgchhojmggmffilplmbdicgaihlkp", "ez": "Hycon Lite Client" }, { "en": "klnaejjgbibmhlephnhpmaofohgkpgkd", "ez": "ZilPay" }, { "en": "aeachknmefphepccionboohckonoeemg", "ez": "Coin98" }, { "en": "bhghoamapcdpbohphigoooaddinpkbai", "ez": "Authenticator" }, { "en": "dkdedlpgdmmkkfjabffeganieamfklkm", "ez": "Cyano" }, { "en": "nlgbhdfgdhgbiamfdfmbikcdghidoadd", "ez": "Byone" }, { "en": "infeboajgfhgbjpjbeppbkgnabfdkdaf", "ez": "OneKey" }, { "en": "cihmoadaighcejopammfbmddcmdekcje", "ez": "Leaf" }, { "en": "gaedmjdfmmahhbjefcbgaolhhanlaolb", "ez": "Authy" }, { "en": "oeljdldpnmdbchonielidgobddfffla", "ez": "EOS Authenticator" }, { "en": "ilgcnhelpchnceeipipijaljkblbcob", "ez": "GAuth Authenticator" }, { "en": "imloifkgjagghnncjkhggdhalmcnfklk", "ez": "Trezor Password Manager" }, { "en": "bfnaelmomeimhlpmgjnjophhpkkoljpa", "ez": "Phantom" }, { "en": "ppbibelpcjmhbdihakflkdcoccbgbkpo", "ez": "UniSat" } ], "n": [ { "p": "%localappdata%\\Google\\Chrome\\User Data", "z": "Chrome" }, { "p": "%localappdata%\\Chromium\\User Data", "z": "Chromium" }, { "p": "%localappdata%\\Microsoft\\Edge\\User Data", "z": "Edge" }, { "p": "%localappdata%\\Kometa\\User Data", "z": "Kometa" }, { "p": "%appdata%\\Opera Software\\Opera Stable", "z": "Opera Stable" }, { "p": "%appdata%\\Opera Software\\Opera GX Stable", "z": "Opera GX Stable" }, { "p": "%appdata%\\Opera Software\\Opera Neon\\User Data", "z": "Opera Neon" }, { "p": "%localappdata%\\BraveSoftware\\Brave-Browser\\User Data", "z": "Brave Software" }, { "p": "%localappdata%\\Comodo\\Dragon\\User Data", "z": "Comodo" }, { "p": "%localappdata%\\CocCoc\\Browser\\User Data", "z": "CocCoc" } ] }, { "t": 2, "p": "%appdata%\\Mozilla\\Firefox\\Profiles", "z": "Mozilla Firefox" } ] } Figure 9: Output of the configuration extractor script Example of additional data obtained from C2: lid=KjGtqi--VIKKY&j=e799236f7a828928688bbd10d343328e&ver=4.0, where the lid is the LummaC2 ID, the value “VIKKY” is likely the build ID assigned and the stealer version (ver=). The logs are exfiltrated over the ZIP archive, as shown in the screenshot below (/c2sock). Figure 10: Exfiltrated logs Figure 11: Log formatting (System.txt) Figure 12: Function responsible for collecting system information and parsing it to the System.txt file Figure 13: The contents of the ZIP archive (Source: Dark2Web) What did we do? Our team of 24/7 SOC Cyber Analysts isolated affected host to contain the infection. We also provided remediation recommendations and support to the customer. What can you learn from this TRU positive? LummaC2, which is written in C++, is delivered via drive-by downloads. The new version of the stealer (4.0) uses the XOR algorithm for string encryption. It applies control flow flattening to complicate the analysis as well as API hashing using the MurmurHash2 hashing algorithm. LummaC2 Stealer is sold in three different tiers: Experienced, Professional, and Corporate. The last one comes with a Heaven’s Gate technique. Recommendations from our Threat Response Unit (TRU): Protecting against information stealers requires a multi-layered defense approach to defend endpoints from malware and detect or block unauthorized login activity against applications and remote access services. Therefore, we recommend: Protecting endpoints against malware. Ensure antivirus signatures are up to date. Use a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) product to detect and contain threats. If an information stealing malware is identified, reset the user’s credentials and terminate logon sessions immediately. Encouraging good cybersecurity hygiene among your users by using Phishing and Security Awareness Training (PSAT) when downloading software from the Internet. Restricting access to enterprise applications from personal devices outside the scope of security monitoring. Ensuring adequate logging is in place for remote access services such as VPNs and using modern authentication methods, which support MFA and conditional access. Prevent web browsers from automatically saving and storing passwords. It is recommended to use password managers instead. Indicators of Compromise Name Indicators C2 gservice-node[.]io C2 gstatic-node[.]io C2 balancelag[.]xyz C2 doorblu[.]xyz Payload c9094685ae4851fd5a5b886b73c7b07efd9b47ea0bdae3f823d035cf1b3b9e48 Payload 3bf4b365d61c1e9807d20e71375627450b8fea1635cb6ddb85f2956e8f6b3ec3 Payload a9c7c4df7e39b8bc7b03b7d4053066d26154bc76c3e261fff84f2339d44a474e Payload b803e8d9da6efe7b0220f654c7afb784d21dc222afd4a4e41396e74f861cbf30 Yara rule LummaC2 { meta: author = "RussianPanda" description = "LummaC2 Detection" strings: $p1="lid=%s&j=%s&ver" $p2= {89 ca 83 e2 03 8a 54 14 08 32 54 0d 04} condition: all of them and filesize <= 500KB } Reference https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://twitter.com/Jane_0sint/status/1672374464418394112?s=20 To learn how your organization can build cyber resilience and prevent business disruption with eSentire’s Next Level MDR, connect with an eSentire Security Specialist now. GET STARTED ABOUT ESENTIRE’S THREAT RESPONSE UNIT (TRU) The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats. Back to blog Take Your Cybersecurity Program to the Next Level with eSentire MDR. BUILD A QUOTE in this blog View More... Read Similar Blogs EXPLORE MORE BLOGS Blog STX RAT: A new RAT in 2026 with Infostealer Capabilities Learn More Blog Examining the Blast Radius from the Axios npm Supply Chain Compromise Learn More Blog Tycoon 2FA Infrastructure Update: Threat Actors Adapt Following Global… Learn More Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of cookies. Visit our Privacy Policy to learn more. Accept ARE YOU EXPERIENCING A SECURITY INCIDENT OR HAVE YOU BEEN BREACHED? Call 1-866-579-2200 The Proven Choice for Managed Detection and Response GET STARTED → PARTNER LOGIN → Sales and Customer Support NORTH AMERICA 1-866-579-2200 EMEA (0)8000-443242 ANZ/APAC 1-519-651-2200 What we do How we do it Industries Use Cases Resources Tools Company 2026 eSentire, Inc. All Rights Reserved.