LAMEHUG malware reportedly uses LLM for command generation in APT28 campaign
CERT-UA officially reported LAMEHUG, reportedly the first malware to integrate large language models for real-time command generation, targeting Ukrainian government officials through phishing emails. The attack is attributed with moderate confidence to APT28, with the malware using Qwen 2.5-Coder-32B-Instruct via Hugging Face API for dynamic command generation and data exfiltration capabilities.
What happened
On July 10, 2025, CERT-UA received reports of suspicious emails distributed among Ukrainian government officials, purportedly from representatives of relevant ministries, containing ZIP archive attachments named 'ΠΠΎΠ΄Π°ΡΠΎΠΊ.pdf.zip' with PyInstaller-compiled Python executables.
The malware, classified as LAMEHUG, reportedly integrates the LLM Qwen 2.5-Coder-32B-Instruct via Hugging Face API to generate commands based on statically entered text descriptions for execution on compromised computers.
Multiple LAMEHUG variants were discovered with functional differences in data exfiltration methods, including versions named 'ΠΠΎΠ΄Π°ΡΠΎΠΊ.pif', 'AI_generator_uncensored_Canvas_PRO_v0.9.exe', and 'image.py'.
Reported impact
The malware collects basic computer information including hardware details, running processes, services, and network connections, storing this data in '%PROGRAMDATA%\info\info.txt'.
LAMEHUG performs recursive searches for Microsoft Office documents and other files in standard user directories and copies them to '%PROGRAMDATA%\info\' for exfiltration via SFTP or HTTP POST requests.
Index analysis
CERT-UA attributed the activity with moderate confidence to UAC-0001 (APT28), suggesting this represents a proof-of-concept exploration of LLM integration in state-sponsored cyber operations.
The malware's use of an LLM for dynamic command generation represents a novel technical approach to malware functionality, with the attacker reportedly using approximately 270 Hugging Face authentication tokens.
Governance controls
The emails were distributed using compromised email accounts, and the command-and-control infrastructure was deployed on legitimate but compromised resources.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.