CampaignPublished 7 Aug 2025

New Arsenal: LAMEHUG, the First AI-Powered Malware

Source AlienVault OTX General

Description

APT28, a Russian threat group, has developed LAMEHUG, a Python-based malware that utilizes AI to generate and execute system commands. This malware, targeting Ukraine's security and defense sector, begins with a phishing email containing a malicious attachment. LAMEHUG employs the Qwen 2.5-Coder-32B-Instruct model via Hugging Face API to translate text instructions into system commands. It performs system reconnaissance, data theft, and exfiltration using AI-generated commands. The malware collects system information, searches for documents, and exfiltrates data via SFTP or HTTP POST requests. Multiple variants of LAMEHUG have been identified, each with different data exfiltration methods. This marks a significant evolution in malware capabilities, incorporating large language models to enhance attack flexibility and sophistication.

Impact

For European organizations, particularly those involved in defense, security, and critical infrastructure, LAMEHUG poses a substantial risk. The malware’s AI-driven command generation can bypass traditional signature-based detection and static analysis, increasing the likelihood of successful infiltration and prolonged undetected presence. The ability to perform extensive system reconnaissance and targeted data theft threatens confidentiality and integrity of sensitive information, including classified or strategic data. Data exfiltration via multiple protocols can lead to loss of intellectual property, operational secrets, and personal data, potentially resulting in reputational damage, regulatory penalties under GDPR, and national security implications. The campaign’s origin from APT28, a group historically linked to Russian state-sponsored espionage, raises concerns about politically motivated cyberattacks against European defense and governmental entities. Additionally, the phishing vector exploits human factors, which remain a common vulnerability in European organizations. The AI-powered adaptability of LAMEHUG could facilitate rapid evolution of attack tactics, complicating incident response and forensic investigations. Overall, the threat could disrupt operations, compromise sensitive data, and undermine trust in affected organizations.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to counter AI-powered malware like LAMEHUG. Specific recommendations include: 1) Enhance phishing defenses by deploying advanced email filtering solutions that use machine learning to detect malicious attachments and links, combined with regular user awareness training focused on spear-phishing tactics. 2) Monitor and restrict API calls to external AI services such as Hugging Face, especially from endpoints that do not require such access, to detect or block suspicious AI model usage. 3) Employ behavior-based endpoint detection and response (EDR) tools capable of identifying anomalous command execution patterns and unusual data exfiltration activities, including monitoring for uncommon SFTP or HTTP POST traffic. 4) Implement strict network segmentation and least privilege access controls to limit lateral movement and data access by compromised accounts or malware. 5) Conduct regular threat hunting exercises focusing on indicators of compromise such as the provided file hashes and suspicious domains. 6) Maintain up-to-date threat intelligence feeds and integrate them into security operations to rapidly identify emerging variants. 7) Deploy data loss prevention (DLP) solutions to detect and block unauthorized data transfers. 8) Establish incident response plans that include AI-specific threat scenarios and ensure forensic capabilities to analyze AI-generated command patterns. These targeted measures go beyond generic advice by addressing the unique AI integration and phishing delivery mechanisms of LAMEHUG.

Indicators of compromise

Domains 1

stayathomeclasses.com

Hashes 12

3ca2eaf204611f3314d802c8b794ae2c
abe531e9f1e642c47260fac40dc41f59
f72c45b658911ad6f5202de55ba6ed5c
4cf6812ef24341b512ee8e76226a649f0efe4f65
6591e6eee4fefaee9f214dfa872e15d426f695fc
cc06e6373be0a426e741f97f560d4d97a3f28dfa
384e8f3d300205546fb8c9b9224011b3b3cb71adc994180ff55e1e6416f65715
766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777
8013b23cb78407675f323d54b6b8dfb2a61fb40fb13309337f5b662dbd812a5d
a30930dfb655aa39c571c163ada65ba4dec30600df3bf548cc48bedd0e841416

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Aug 2025, 22:03 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 12

Community reviews

Related threats