LAMEHUG Malware Integrates LLM for Real-Time Command Generation

# LAMEHUG Malware Integrates LLM for Real-Time Command Generation

https://gcdradar.vercel.app/incidents/lamehug-malware-integrates-llm-for-real-time-command-generat · AIR-2025-0125 · closed 2025-07-24

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2025-07-10
- AI role: AI-enabled attack
- Products: LAMEHUG, Qwen2.5-Coder-32B-Instruct

## Summary

The LAMEHUG malware integrated an open-weight large language model to dynamically generate reconnaissance and exfiltration commands during attacks against Ukrainian officials. The campaign was linked with moderate confidence to APT28.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-07-10: LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack (https://incidentdatabase.ai/cite/1220)

## Sources

- 2025-07-10 AI Incident Database: LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack https://incidentdatabase.ai/cite/1220

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.