Threats Tagged 'llm'

LAMEHUG, discovered on July 10, 2025, is the first known malware integrating large language model capabilities into its attack methodology. Attributed to APT28 (Fancy Bear) with moderate confidence, it targeted Ukrainian government officials through phishing emails containing malicious executables. The malware uses the LLM Qwen2.5-Coder-32B-Instruct via Hugging Face's API to generate dynamic attack commands. Multiple variants were identified, with different data exfiltration methods. The attack appears to be a proof-of-concept exploration of LLM integration in state-sponsored cyber operations, demonstrating sophisticated reconnaissance capabilities through AI-generated commands. This development signals a new era of AI-incorporated malware operations, posing challenges for traditional cybersecurity approaches.

MediumMalwareUkrainePolandGermany+5#apt28#proof-of-concept#ukraine

Trojan horses, once rare, are making a resurgence due to AI and Large Language Models (LLMs). These new trojans, disguised as legitimate applications like recipe apps or AI-powered image search tools, are evading traditional security measures. They appear professional, pass VirusTotal scans, and exploit users' trust. Examples include JustAskJacky, which executes hidden commands, and TamperedChef, which hides malicious code in recipe whitespace. LLMs enable threat actors to create convincing websites and functional applications easily, making trojans indistinguishable from legitimate software. This trend challenges conventional user caution and static antivirus scanning, necessitating advanced security measures like context, behavior, and dynamic analysis for detection.

MediumMalwareGermanyFranceUnited Kingdom+4#justaskjacky#virustotal#antivirus evasion