LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack
Description
Ukraine's CERT-UA and Cato CTRL reported LAMEHUG, the first known malware to integrate a large language model (Qwen2.5-Coder-32B-Instruct via Hugging Face) for real-time command generation. Attributed with moderate confidence to APT28 (Fancy Bear), the malware reportedly targeted Ukrainian officials through phishing emails. The LLM is reported to have dynamically generated reconnaissance and data-exfiltration commands executed on infected systems.
Actors
Alleged Deployers
- fancy-bear
- apt28
Alleged Developers
- hugging-face
- alibaba
Harmed Parties
- ukrainian-government-officials
- ukrainian-government-ministries
- state-institutions-targeted-by-espionage-operations
- public-sector-information-systems
- national-cybersecurity-infrastructure-of-ukraine
- government-of-ukraine
- national-security-and-intelligence-stakeholders
Classification
Risk Domain
Malicious Actors & MisuseRisk Subdomain
4.2. Cyberattacks, weapon development or use, and mass harm
MIT Risk Profile
Source
Related Incidents (Malicious Actors & Misuse)
View all →Female Students at Westfield High School in New Jersey Reportedly Targeted with Deepfake Nudes
Oct 2023
ChatGPT Was Alleged to Have Aided Planning of Florida State University Mass Shooting
Apr 2025
Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers
Research Papers on This Topic
How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs
AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
Regulating ChatGPT and other Large Generative AI Models
Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack
Source Reports(2 total)
Cato CTRL™ Threat Research: Analyzing LAMEHUG – First Known LLM-Powered Malware with Links to APT28 (Fancy Bear)
Кібератаки UAC-0001 на сектор безпеки та оборони із застосуванням програмного засобу LAMEHUG, що використовує LLM (велику мовну модель) (CERT-UA#16039)