LAMEHUG: Malware Leveraging Dynamic AI-Generated Commands

Summary

In July 2025, Ukrainian authorities reported the emergence of LAMEHUG, a new AI-powered malware attributed to the Russian state-backed threat actor [APT28](https://attack.mitre.org/groups/G0007/) (also tracked as Forest Blizzard or UAC-0001). LAMEHUG uses a large language model (LLM) to dynamically generate commands on the infected hosts. The campaign began with a phishing attack leveraging a compromised government email account to deliver a malicious ZIP archive disguised as Appendix.pdf.zip. The archive contained the LAMEHUG malware, a Python-based executable, packed with PyInstaller. When executed, the malware, makes calls to an LLM endpoint to generate malicious from natural language prompts. Dynamically generated commands may make the malware harder to detect. LAMEHUG was configured to collect files from the local system and exfiltrate them. Target: Ukraine’s security and defense sector Actor: APT28 Reporter: CERT-UA Procedure: 1. APT28 gained access to a compromised official email account. 2. APT28 sent a phishing email from the compromised account with an attachment containing malware. 3. The email impersonated a government ministry representative. 4. The attachment was called “Appendix.pdf.zip” which could confuse the recipient into thinking it was a legitimate PDF file. 5. The attachment contained an executable file with a .pif extension, created using PyInstaller from Python source code which CERT-UA classified it as LAMEHUG malware. Files with the .pif extension are executable on Windows. 6. The LAMEHUG malware abused the Qwen 2.5 Coder 32B Instruct model Hugging Face API to generate malicious commands from natural language prompts. 7. The LAMEHUG malware used the AI generated commands to collect system information (saved to `%PROGRAMDATA%\info\info.txt`) and recursively searched Documents, Desktop, and Downloads to stage files for exfiltration. 8. The LAMEHUG malware exfiltrated collected data to attacker controlled servers via SFTP or HTTP POST requests.

Deployers

• Ukraine’s security and defense sector

Tags

• MITRE ATLAS
• AML.CS0044