LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack

On July 10, 2025, Ukraine's CERT-UA discovered LAMEHUG, the first known malware integrating large language model capabilities directly into its attack methodology. The malware was attributed to APT28 (Fancy Bear) with moderate confidence and targeted Ukrainian government officials through phishing emails impersonating ministry officials. The emails contained ZIP archives with PyInstaller-compiled Python executables disguised as PDF attachments. LAMEHUG's defining characteristic was its integration of the Qwen2.5-Coder-32B-Instruct LLM via Hugging Face API, using approximately 270 tokens for authentication. The malware sent base64-encoded prompts to the LLM requesting commands for system information gathering and document harvesting. Multiple variants were discovered including files named 'Додаток.pif', 'AI_generator_uncensored_Canvas_PRO_v0.9.exe', and 'AI_image_generator_v0.95.exe'. The LLM generated comprehensive reconnaissance commands that collected hardware information, running processes, network configuration, user details, and complete Active Directory structure enumeration. Data exfiltration occurred through SFTP servers and HTTP POST requests to compromised hosting resources. CERT-UA assessed this as a proof-of-concept exploration of LLM integration in state-sponsored cyber operations.