Loading malware…
LAMEHUG, also referred to as PromptSteal, is a Windows-focused AI-assisted infostealer associated with APT28, also known as Fancy Bear or UAC-0001, and used in campaigns targeting Ukrainian government and security-sector entities. The malware is notable for delegating part of its operational logic to a live large language model at runtime, querying a Hugging Face-hosted coding model to generate host-specific Windows command sequences on demand rather than relying solely on fully hardcoded logic.
LAMEHUG performs reconnaissance and document theft. Reported behaviors include collecting system information, enumerating host details and services, identifying and copying files from targeted directories, staging collected material locally, and exfiltrating the results to attacker-controlled infrastructure. The malware has been observed consolidating stolen information before transfer and using both HTTPS-based and SSH-based channels for exfiltration. Its use of dynamically generated commands can reduce the value of static signatures and complicate analysis because command content may vary by victim environment.
Observed delivery has included spearphishing, including lures impersonating Ukrainian government officials and attachments masquerading as AI-related software or benign documents. Some variants display decoy content while malicious collection runs in a separate execution thread. Public reporting describes Python-based implementations as well as variants that decode decoy documents and invoke the LLM to produce one-line Windows commands for reconnaissance and file collection.
LAMEHUG is best understood as an AI-augmented espionage malware family rather than a fully autonomous agentic threat. Human operators still define the broader workflow and targeting, while the malware uses external LLM inference to adapt command generation during execution. Its emergence marked an early publicly documented case of state-linked malware operationally integrating a live LLM for reconnaissance and information theft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2025-07-23 ⋅ Cato Networks ⋅ Analyzing LAMEHUG – First Known LLM-Powered Malware with Links to APT28 (Fancy Bear)
„PROMPTSTEAL ist demnach die erste in freier Wildbahn beobachtete Malware, die LLMs abfragt… Um Befehle zu generieren, verwende dieser Data Miner die Hugging Face API…“
23 distinct techniques documented for this family, organized by ATT&CK tactic.
There were no new MITRE attack techniques. Seven of eight operations ran T1059, Command & Scripting Interpreter, the single most ordinary technique in the framework.
The following analytic detects the enumeration of Windows services using the net start command, which is a built-in utility that lists all running services on a system.
Kimsuky used malicious LNK files, the Dropbox API, GitHub Releases, and Google Drive for Information Theft and command execution.
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
The dynamically generated commands enable the malware to gather system information and identify sensitive files before transmitting them across the network to an adversary-controlled server.
The content repeatedly describes threat actors, malware, and campaigns using HTTP, HTTPS, HTTP GET/POST, cookies in headers, WebSockets/WSS, and web APIs for command and control or related communications.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
77 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Data-mining malware that contacts a live LLM to generate host-specific command chains during execution.
Described as the first known LLM-powered malware, linked to APT28/Fancy Bear and used against security and defense sector targets.
Malware that generates commands using an LLM and collects documents for information theft.
LLM-assisted malware in which a human-defined workflow uses a public LLM to generate reconnaissance and data-theft commands on the fly, rather than autonomously operating end-to-end.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.