LLMHigh
LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack
- Occurred
- Jul 10, 2025
- Published
- Jul 17, 2025
- Source
- AI Incident Database
Summary
Ukraine's CERT-UA and Cato CTRL reported LAMEHUG, the first known malware to integrate a large language model (Qwen2.5-Coder-32B-Instruct via Hugging Face) for real-time command generation. Attributed with moderate confidence to APT28 (Fancy Bear), the malware reportedly targeted Ukrainian officials through phishing emails. The LLM is reported to have dynamically generated reconnaissance and data-exfiltration commands executed on infected systems.
Developers
- hugging face
- Alibaba
Deployers
- Fancy Bear
- APT28
Harmed parties
- Ukrainian government officials
- Ukrainian government ministries
- State institutions targeted by espionage operations
- Public sector information systems
- National cybersecurity infrastructure of Ukraine
- Government of Ukraine
- National security and intelligence stakeholders
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: First known malware integrating LLM for real-time command generation in APT28 cyberattack targeting Ukrainian officials.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8