AI-Powered LAMEHUG Malware from APT28 Targets Windows Users

Novel Malware from APT28

Recent attacks by the Russian cyberespionage group APT28 have seen the deployment of malware that generates commands by querying large language models (LLMs). This malware, known as LAMEHUG, has been used in spear phishing campaigns aimed at Ukrainian government entities. The CERT-UA report indicates that phishing emails were sent from a compromised email account, impersonating ministry representatives.

Image courtesy of CSO Online

The malware was contained in a ZIP archive with a .pif file extension, although other extensions such as .exe and .py have also been observed. This group, also known as Sofacy or Fancy Bear, is linked to the GRU, Russia's military intelligence service, and has been active in cyber operations since 2004.

Querying LLM APIs in Real-Time

LAMEHUG's unique feature is its direct querying capability to LLM APIs. It utilizes the APIs from Hugging Face, a major platform for hosting LLMs. The malware generates commands by instructing the Qwen 2.5-Coder-32B-Instruct model to behave as a Windows system administrator. It collects system information and executes commands to exfiltrate data, including recursively copying documents from user folders.

The malware is written in Python and compiled into an executable binary using PyInstaller. Variants of LAMEHUG have been identified with different functionalities regarding data exfiltration. The command-and-control server for the malware was hosted on compromised infrastructure.

Phishing Campaign and Malware Distribution

On July 10, 2025, CERT-UA identified the phishing campaign targeting executive authorities in Ukraine. The emails contained ZIP files labeled as ministry documents, leading to the download of the LAMEHUG payload. The malware's ability to adapt its command generation through LLMs marks a significant evolution in attack strategies.

Image courtesy of Cyber Insider

The attackers utilized a compromised email account for distribution, and the malware's data exfiltration capabilities included sending captured information to attacker-controlled servers via SFTP or HTTP POST requests. The flexibility of LAMEHUG allows it to adapt across different environments, enhancing the malware's effectiveness while reducing detection risk.

Implications for Cybersecurity

The emergence of LAMEHUG illustrates the increasing sophistication of cyber threats. By leveraging AI to dynamically generate commands, attackers can automate and adapt their strategies in real-time. This trend emphasizes the need for robust cybersecurity solutions, such as Gopher Security's AI-Powered Zero Trust Platform, which provides comprehensive security across various devices, apps, and environments by utilizing peer-to-peer encrypted tunnels and quantum-resistant cryptography.

As threats evolve, organizations must remain vigilant and consider advanced technologies like Gopher Security's AI Ransomware Kill Switch and Micro-Segmentation for Secure Environments to enhance their defenses against such attacks.