{
 "public_id": "AIR-2025-0059",
 "incident_id": "2025-07-apt28-lamehug-llm-malware",
 "date_disclosed": "2025-07-17",
 "date_occurred": "2025-07-10",
 "title": "LAMEHUG: first known malware to call an LLM at runtime to generate its reconnaissance and exfiltration commands, used against Ukrainian officials",
 "class": "in_the_wild",
 "attack_surface": "autonomous_ops",
 "initial_vector": "phishing_email_attachment",
 "agent_capability_abused": [
  "runtime_command_generation",
  "reconnaissance",
  "data_exfiltration",
  "runtime_llm_command_generation",
  "hosted_model_api_abuse",
  "llm_command_generation",
  "file_collection",
  "exfiltration"
 ],
 "target_product": "Qwen2.5-Coder-32B-Instruct accessed via Hugging Face API",
 "target_vendor": "Hugging Face (relay); Ukrainian government (targeted)",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "data_exfiltration",
  "information_disclosure",
  "espionage"
 ],
 "blast_radius": "Ukrainian executive-branch officials targeted by phishing impersonating a ministry representative; roughly 270 Hugging Face tokens abused for authentication",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI03"
  ],
  "mitre_atlas": [
   "AML.CS0044"
  ],
  "labels": [
   "llm_in_the_loop_malware",
   "apt28",
   "nation_state",
   "dynamic_tasking",
   "legitimate_api_as_c2",
   "first_of_kind",
   "llm_in_malware",
   "state_sponsored",
   "dynamic_command_generation"
  ]
 },
 "defense_present": "endpoint detection; Hugging Face API abuse controls",
 "defense_bypassed": true,
 "fix_shipped": "CERT-UA published indicators; abused API tokens revoked",
 "primary_sources": [
  "https://cert.gov.ua/article/6284730",
  "https://incidentdatabase.ai/cite/1220",
  "https://thehackernews.com/2025/07/cert-ua-discovers-lamehug-malware.html",
  "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools",
  "https://www.bleepingcomputer.com/news/security/lamehug-malware-uses-ai-llm-to-craft-windows-data-theft-commands-in-real-time/",
  "https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/v6/ATLAS-2026.07.yaml"
 ],
 "verified_quote": "- Technical Innovation: Malware uses LLM Qwen2.5-Coder-32B-Instruct for real-time command generation.",
 "confidence": "high",
 "notes": "A genuine first: the malware ships intent, not commands, and asks a hosted model to write the commands per host at runtime — Cato CTRL recovered the actual prompts, which read as plain-English tasking. That defeats static signatures (the payload differs every execution) and turns a legitimate inference API into a tasking channel indistinguishable from ordinary HTTPS to a trusted domain. CERT-UA attributes to APT28 with moderate confidence and Cato assesses it as a proof-of-concept. AI Incident Database incident 1220. | Merged from duplicate id `2025-07-lamehug-llm-driven-malware-apt28`. Also reported under the titles: 'LAMEHUG / PROMPTSTEAL: APT28 malware that queries an LLM at runtime to generate its own commands'; 'LAMEHUG: APT28 malware that queries an LLM at runtime to generate the commands it executes'.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Persistence & Covert C2",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the malware executed the commands the LLM generated, with no human in between",
 "vector_family": "other",
 "vector_detail": "phishing_email_attachment",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1220
  ],
  "atlas": [
   "AML.CS0044"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI03",
 "agent_framework": "unknown",
 "model_provider": "alibaba",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "data_exfiltration_channels",
  "sensitive_data_exposure"
 ],
 "eai_reason": "subcategory: Persistence & Covert C2",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI03 (eai_category=privilege_escalation, no code execution)",
 "submitted_by": "EAI Internal"
}