In the wild
Realized harm
LAMEHUG: first known malware to call an LLM at runtime to generate its reconnaissance and exfiltration commands, used against Ukrainian officials
AIR-2025-0059 AIR record · 2025-07-apt28-lamehug-llm-malware
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
- Technical Innovation: Malware uses LLM Qwen2.5-Coder-32B-Instruct for real-time command generation.cert.gov.ua
The record
Disclosed
2025-07-17
Occurred
2025-07-10
Vendor
Hugging Face (relay); Ukrainian government (targeted)
Product
Qwen2.5-Coder-32B-Instruct accessed via Hugging Face API
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Sensitive data exposure
System type
Generative model
Who acted
Agent acted (contested) — the malware executed the commands the LLM generated, with no human in between
Attack surface
Autonomous operations
Autonomy level
Semi-autonomous
Initial vector
Phishing email attachment
Impact type
Data exfiltration, Information disclosure, Espionage
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Ukrainian executive-branch officials targeted by phishing impersonating a ministry representative; roughly 270 Hugging Face tokens abused for authentication
Capability abused
Defense & remediation
Recorded defense
endpoint detection; Hugging Face API abuse controls
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
CERT-UA published indicators; abused API tokens revoked
Taxonomy & references
Curator notes
A genuine first: the malware ships intent, not commands, and asks a hosted model to write the commands per host at runtime — Cato CTRL recovered the actual prompts, which read as plain-English tasking. That defeats static signatures (the payload differs every execution) and turns a legitimate inference API into a tasking channel indistinguishable from ordinary HTTPS to a trusted domain. CERT-UA attributes to APT28 with moderate confidence and Cato assesses it as a proof-of-concept. AI Incident Database incident 1220. | Merged from duplicate id `2025-07-lamehug-llm-driven-malware-apt28`. Also reported under the titles: 'LAMEHUG / PROMPTSTEAL: APT28 malware that queries an LLM at runtime to generate its own commands'; 'LAMEHUG: APT28 malware that queries an LLM at runtime to generate the commands it executes'.
Supporting sources
- https://cert.gov.ua/article/6284730
- https://incidentdatabase.ai/cite/1220
- https://thehackernews.com/2025/07/cert-ua-discovers-lamehug-malware.html
- https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools
- https://www.bleepingcomputer.com/news/security/lamehug-malware-uses-ai-llm-to-craft-windows-data-theft-commands-in-real-time/
- https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/v6/ATLAS-2026.07.yaml
Cite as
Enkrypt AI. "LAMEHUG: first known malware to call an LLM at runtime to generate its reconnaissance and exfiltration commands, used against Ukrainian officials". AIR, AIR-2025-0059. https://agentincident.vercel.app/i/AIR-2025-0059/ (accessed 2026-10-19).