LAMEHUG Malware Uses LLMs for Dynamic Command Generation

# LAMEHUG Malware Uses LLMs for Dynamic Command Generation

https://gcdradar.vercel.app/incidents/lamehug-malware-uses-llms-for-dynamic-command-generation · AIR-2025-0069 · closed 2026-01-07

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2025-12-24 (happened 2025-06)
- AI role: AI-enabled attack
- Products: LAMEHUG

## Summary

The Russian state-backed group APT28 deployed LAMEHUG malware utilizing an LLM to dynamically generate commands on compromised hosts. The campaign was initiated via a phishing email leveraging a compromised government account.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-12-24: APT28's New Arsenal: LAMEHUG, the First AI-Powered Malware (https://logpoint.com/en/blog/apt28s-new-arsenal-lamehug-the-first-ai-powered-malware)
- 2025-12-24: UAC-0001 cyberattacks on the security and defense sector using the LAMEHUG software tool, which uses LLM (large language model) (CERT-UA#16039) (https://cert.gov.ua/article/6284730)
- 2025-12-24: LameHug malware uses AI LLM to craft Windows data-theft commands in real-time (https://bleepingcomputer.com/news/security/lamehug-malware-uses-ai-llm-to-craft-windows-data-theft-commands-in-real-time)
- 2025-12-24: LAMEHUG: Malware Leveraging Dynamic AI-Generated Commands (https://atlas.mitre.org/studies/AML.CS0044)

## Sources

- 2025-12-24 MITRE ATLAS: LAMEHUG: Malware Leveraging Dynamic AI-Generated Commands https://atlas.mitre.org/studies/AML.CS0044
- 2025-12-24 BleepingComputer: LameHug malware uses AI LLM to craft Windows data-theft commands in real-time https://bleepingcomputer.com/news/security/lamehug-malware-uses-ai-llm-to-craft-windows-data-theft-commands-in-real-time
- 2025-12-24 cert.gov.ua: UAC-0001 cyberattacks on the security and defense sector using the LAMEHUG software tool, which uses LLM (large language model) (CERT-UA#16039) https://cert.gov.ua/article/6284730
- 2025-12-24 logpoint.com: APT28's New Arsenal: LAMEHUG, the First AI-Powered Malware https://logpoint.com/en/blog/apt28s-new-arsenal-lamehug-the-first-ai-powered-malware

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.