Water Kurita
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:25:34
Targeted industries: financial-services retail-and-hospitality technology-and-telecommunications
Context
Water Kurita is a financially motivated cybercriminal entity associated with the Lumma Stealer infostealer-as-a-service operation, primarily active on underground forums and marketplaces. It focuses on credential and information theft at scale, monetizing access via subscription-based malware distribution and resale of stolen data to other actors. The group demonstrates solid operational security and marketing tactics typical of mature MaaS ecosystems, although a 2025 doxxing campaign exposing alleged core members (personal and financial data) significantly disrupted its activity and drove customers toward competing infostealers.
Reports & references
- Trend Micro — Ai Assisted Fake Github Repositories (report)
- Trend Micro — Lumma Stealer Returns (report)
- Trend Micro — The Impact Of Water Kurita Lumma Stealer Doxxing (report)
- Trend Micro — Lumma Stealer Browser Fingerprinting (report)