Source: www.infosecurity-magazine.com – Author:
A new malware that leverages an AI-powered large language model (LLM) to generate commands for execution on compromised Windows systems has been identified by Ukrainian authorities.
The National Computer Emergency Response Team of Ukraine (CERT-UA) identified the malware, dubbed LameHug, in new cyber-attacks targeting the nation’s security and defense sector.
The attacks have been linked, with moderate confidence, to the ATP28 hacking group which is known to be controlled by Russian special services.
In an update published on July 17, CERT-UA said emails containing an attachment named “Додаток.pdf.zip” (Attachment.pdf.zip) were disseminated among executive bodies, purportedly sent from a representative of a relevant ministry.
This ZIP archive contained a similarly named file with a .pif extension. This file, converted using the Python-based PyInstaller tool, has been classified by CERT-UA as the malicious software LameHug.
LameHug Malware Leverages Open Source LLM
The malware is developed in Python and relies on the Hugging Face API to interact with the open-source Qwen2.5-Coder-32B-Instruct LLM from Alibaba.
An IBM X-Force OSINT advisory noted that the use of LLMs to generate the execution commands is unique.
“This innovative approach allows threat actors to adapt their tactics during a compromise without needing new payloads, potentially making the malware harder to detect by security software or static analysis tools,” said the X-Force OSINT advisory.
CERT-UA specialists said that a compromised email account was used to disseminate emails containing the malicious software.
A Longstanding Cyber-Threat to Ukraine
APT28 is a group linked with the Russian military intelligence agency (GRU) and is also known as Fancy Bear, Sednit, Pawn Storm, Forest Blizzard and Sofacy Group. It has been active since at least 2004.
It has long been targeting Ukraine with cyber-attacks. In 2023, CERT-US said the threat actor group attempted a cyber-attack against a Ukrainian critical power infrastructure facility.
In 2025, research identified that APT28 had successfully leveraged a zero-day vulnerability in MDaemon Email Server (CVE-2024-11182) against Ukrainian companies.
The group has also been known to target organizations supporting Ukraine in its war effort against the Russian Federation.
In May, it was reported that Western logistics and tech firms delivering aid to Ukraine had been targeted by an APT28 cyber-espionage campaign over the past two years.
Original Post URL: https://www.infosecurity-magazine.com/news/new-lamehug-malware-deploys/
Category & Tags: –
Views: 1
