New LameHug Malware Integrates LLM for Dynamic Command Generation

Cybersecurity firm Picus Security has identified and detailed LameHug, a novel piece of malware that marks a significant evolution in cyber threats. It is the first publicly documented instance of malware operationally integrating a Large Language Model (LLM) to dynamically generate commands. This malware is attributed to the Russian state-sponsored threat actor APT28, also known as Fancy Bear or Sofacy.

Discovered in mid-2025, LameHug was deployed in a campaign targeting Ukrainian government agencies amid the ongoing conflict. Its defining characteristic is its ability to leverage a cloud-hosted LLM, such as Alibaba Cloud's Qwen model, to translate attacker-provided instructions into machine-executable commands. This capability allows the malware to adapt to its target environment without requiring code updates to the malicious binary itself.

The campaign initiated with spear-phishing emails disguised as official correspondence, targeting entities within Ukraine's security and defense sectors. These messages contained archive files that, when executed, deployed the LameHug payload. The malware was observed to perform rapid data collection, swiftly stealing and exfiltrating targeted files before self-terminating, consistent with espionage objectives.

Picus Security's analysis reveals that LameHug uses the LLM to generate command chains that gather system information, details on running processes, and network configurations. It also searches for documents on user desktops and download folders. The stolen data is then exfiltrated via SFTP or through direct web requests, often using compromised websites. This novel use of AI significantly enhances the malware's adaptability and stealth, posing new challenges for detection and defense.