Tag: lamehug

3 Attack Reports | 0 Vulnerabilities

Attack reports

Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware

This research explores the challenges posed by LLM-enabled malware, which can generate malicious logic at runtime. The study identifies characteristics of such malware, including embedded API keys and specific prompt structures. Notable cases like PromptLock and APT28's LameHug are examined. The re…
threat hunting
lamehug
promptlock
2025-09-25
rkor
llm-enabled malware
offensive tools
api keys
malterminal
prompts
Published: September 25, 2025
Downloadable IOCs: 39

Analyzing LAMEHUG

LAMEHUG, discovered on July 10, 2025, is the first known malware integrating large language model capabilities into its attack methodology. Attributed to APT28 (Fancy Bear) with moderate confidence, it targeted Ukrainian government officials through phishing emails containing malicious executables.…
phishing
apt28
ukraine
exfiltration
reconnaissance
llm
proof-of-concept
lamehug
2025-08-24
ai-generated commands
Published: August 24, 2025
Downloadable IOCs: 0

New Arsenal: LAMEHUG, the First AI-Powered Malware

APT28, a Russian threat group, has developed LAMEHUG, a Python-based malware that utilizes AI to generate and execute system commands. This malware, targeting Ukraine's security and defense sector, begins with a phishing email containing a malicious attachment. LAMEHUG employs the Qwen 2.5-Coder-32…
phishing
python
ukraine
reconnaissance
data exfiltration
2025-08-07
ai-powered malware
hugging face api
lamehug
Published: August 7, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports