This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
LAMEHUG is a newly discovered malware attributed to APT28 that integrates LLMs (Qwen2.5-Coder-32B-Instruct) to dynamically generate and execute malicious commands on infected systems. The malware targets Ukrainian government officials via phishing emails and performs reconnaissance and data exfiltration. This incident represents a significant shift in threat actor tactics by incorporating AI directly into the malware's operational flow.
Ukraine's CERT-UA and Cato CTRL reported LAMEHUG, the first known malware to integrate a large language model (Qwen2.5-Coder-32B-Instruct via Hugging Face) for real-time command generation. Attributed with moderate confidence to APT28 (Fancy Bear), the malware reportedly targeted Ukrainian officials through phishing emails. The LLM is reported to have dynamically generated reconnaissance and data-exfiltration commands executed on infected systems.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
The malware's primary objective is to recursively harvest and exfiltrate sensitive office documents and system configuration data from infected government systems.
The attack relied on phishing emails impersonating government officials and decoy uncensored image generators to manipulate targets into executing the malware.
The incident involves state-sponsored threat actors (APT28) using an LLM to dynamically generate and execute malicious commands as part of a cyber espionage campaign targeting Ukrainian government officials.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was initiated by human threat actors (APT28) who intentionally deployed malware that utilizes a post-deployment LLM API to generate malicious commands.
The discovery of LAMEHUG represents the first documented case of state-sponsored malware integrating LLMs directly into its operational flow to dynamically generate malicious commands. While currently assessed as a proof-of-concept cyber espionage campaign targeting Ukrainian officials, it establishes a novel precedent for AI-enabled offensive cyber capabilities with notable national security implications.
The LLM is used as a tool to perform a specific, well-defined function: translating static text descriptions of malicious objectives into executable command-line instructions on direct input without maintaining an ongoing state or planning autonomously.
Limited Risk: The system involves AI-generated content, specifically generating command sequences and synthetic decoy images ('AI_generator_uncensored_Canvas_PRO_v0.9.exe'), which falls under the category of AI-generated content requiring transparency.
The primary function of the Qwen model in this incident is to generate command-line code for system reconnaissance and document harvesting. The secondary model (Flux) is used for image generation as a decoy lure.
The reports provide high-quality, highly technical details including the exact base64-decoded prompts, malware execution flow, and specific API endpoints used. The attribution to APT28 is made with moderate confidence by CERT-UA, and the analysis clearly delineates the role of the LLM in the malware's operation.
The LLM integration could be viewed as a gimmick or simple translation layer rather than a core functional component of the malware, given that the prompts are static.
Technology
Unrestricted Code-Generation LLM
Qwen2.5-Coder generated malicious commands without safety filters.
Dynamic Command Generation
AI-generated commands bypass traditional signature-based detection.
Abusable AI Image Generator API
Flux AI API used to generate provocative decoy images for lure.
Data Inputs
Base64 Obfuscated Prompts
Malware sent base64 prompts to LLM to bypass input moderation.
Statically Defined Attack Prompts
Pre-defined instructions fed to LLM to harvest system info.
Compromised HF API Tokens
Attackers used 270 leaked tokens to authenticate to AI services.
Human Factors
Susceptibility to AI-Lure Phishing
Users clicked files lured by AI-generated image generation themes.
Trust in Legitimate AI Traffic
Network defenders ignored malicious traffic disguised as AI API calls.
Lack of AI-Threat Awareness
Targeted officials lacked awareness of AI-driven malware capabilities.
Process and Methods
Inadequate AI API Monitoring
No process to audit or restrict outbound AI API traffic in government.
Lack of Dynamic Prompt Analysis
Security tools lacked real-time analysis of LLM prompts and outputs.
No Behavioral AI Defenses
Traditional defense processes failed to monitor LLM-driven behaviors.
Management
Inadequate Shadow AI Governance
Management failed to restrict unauthorized AI application usage.
Poor API Token Lifecycle Management
Failure to manage and revoke compromised Hugging Face API tokens.
Neglecting AI-Powered Threat Risks
Management did not assess risks of LLMs integrated into malware.
Regulatory Environment
Lack of LLM API Abuse Regulation
No regulations forcing AI hosts to monitor APIs for malicious use.
Undefined Standards for AI Safety
Absence of clear security standards for open-source model deployment.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
