LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S9035: LAMEHUG

LAMEHUG is Python-based information stealer first identified in July 2025 by Ukraine's Computer Emergency Response Team (CERT-UA) in phishing emails targeting Ukrainian government officials. LAMEHUG is the first known malware to integrate artificial intelligence (AI) directly into its attack workflow by querying large language models (LLMs) hosted on Hugging Face to dynamically generate reconnaissance, data theft, and system manipulation commands in real time. LAMEHUG has been attributed to APT28. [1][2][3]

EnterpriseS9035MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S9035: LAMEHUG describes [LAMEHUG](https://attack.mitre.org/software/S9035) is Python-based information stealer first identified in July 2025 by Ukraine's Computer Emergency Response Team (CERT-UA) in phishing emails targeting Ukrainian government officials. [LAMEHUG](https://attack.mitre.org/software/S9035) is the first known malware to integrate artificial intelligence (AI) directly into its attack workflow by querying large language models (LLMs) hosted on Hugging Face to dynamically generate reconnaissance, data theft, and system manip...

Executive priority

S9035: LAMEHUG is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S9035: LAMEHUG by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata
  • Network, endpoint, and security-tool telemetry

Detection direction

  • Validate whether S9035: LAMEHUG appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

LAMEHUG

LAMEHUG is Python-based information stealer first identified in July 2025 by Ukraine's Computer Emergency Response Team (CERT-UA) in phishing emails targeting Ukrainian government officials. LAMEHUG is the first known malware to integrate artificial intelligence (AI) directly into its attack workflow by querying large language models (LLMs) hosted on Hugging Face to dynamically generate reconnaissance, data theft, and system manipulation commands in real time. LAMEHUG has been attributed to APT28. [1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

25 rows
DomainIDNameRelationship / procedure
EnterpriseT1041Exfiltration Over C2 Channel

LAMEHUG can exfiltrate collected system information and documents to C2.[1][2]

EnterpriseT1047Windows Management Instrumentation

LAMEHUG can use wmic to collect system information.[1]

EnterpriseT1082System Information Discovery

LAMEHUG has the ability to execute Windows commands returned from C2 to gather system information.[1][2]

EnterpriseT1071.001Web ProtocolsSub-technique

LAMEHUG can use HTTP POST requests to exfiltrate data from compromised hosts to C2.[1]

EnterpriseT1033System Owner/User Discovery

LAMEHUG can use `whoami` to enumerate the system user.[1]

EnterpriseT1132Data Encoding

LAMEHUG can encode queries sent to LLMs.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

LAMEHUG payloads have been disguised with legitimate looking filenames including AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe.[1][2]

EnterpriseT1087.002Domain AccountSub-technique

LAMEHUG can use dsquery to enumerate domain user information.[3]

EnterpriseT1482Domain Trust Discovery

LAMEHUG can gather Active Directory domain information.[2]

EnterpriseT1005Data from Local System

LAMEHUG has the ability to collect system information and files of interest from compromised systems.[1][2]

EnterpriseT1140Deobfuscate/Decode Files or Information

LAMEHUG can decode and drop a decoy file attached to spearphishing emails.[1]

EnterpriseT1573.002Asymmetric CryptographySub-technique

LAMEHUG can use SSH to transfer information to C2.[1]

EnterpriseT1069.002Domain GroupsSub-technique

LAMEHUG can use dsquery to gather domain group information.[3]

EnterpriseT1016System Network Configuration Discovery

LAMEHUG can enumerate network information on compromised hosts.[2]

EnterpriseT1057Process Discovery

LAMEHUG can gather process information on targeted systems.[2][3]

EnterpriseT1204.002Malicious FileSub-technique

LAMEHUG has been executed through victim interaction with malicious email attachments made to look like legitimate AI applications or documents.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

LAMEHUG can use `cmd.exe` to display a decoy file to spearphishing victims.[1]

EnterpriseT1119Automated Collection

LAMEHUG can recursively copy files from targeted directories on victim hosts.[1][2]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

LAMEHUG has been distributed through spearphishing emails with various AI-themed malicious attachments.[1]

EnterpriseT1074.001Local Data StagingSub-technique

LAMEHUG can save collected data and files of interest in `C:\ProgramData\info\` to consolidate for exfiltration.[1][2]

EnterpriseT1007System Service Discovery

LAMEHUG can gather service information on targeted systems.[2][3]

EnterpriseT1102.002Bidirectional CommunicationSub-technique

LAMEHUG has used the Hugging Face API to query the Qwen2.5-Coder-32B-Instruct LLM to generate one-line Windows commands for the collection of system information and documents in specific folders on compromised hosts. LAMEHUG subsequently executed the returned commands and exfiltrated the collected files and information to adversary-controlled C2 servers.[2][1]

EnterpriseT1083File and Directory Discovery

LAMEHUG can target directories on victim machines for file collection.[1][2]

EnterpriseT1560.001Archive via UtilitySub-technique

LAMEHUG can xcopy for file collection on targeted systems.[1]

EnterpriseT1059.006PythonSub-technique

LAMEHUG can use Python scripts for execution.[1][2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Relationship explorer

All related ATT&CK context

uses · GroupG0007: APT28Enterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1132: Data EncodingEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1087.002: Domain AccountEnterpriseuses · TechniqueT1482: Domain Trust DiscoveryEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1069.002: Domain GroupsEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1102.002: Bidirectional CommunicationEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.0
Created
Modified
Raw hash
7baef16d5aeaaa8e...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.0Current bundle7baef16d5aea…
19.11.0Older bundle7baef16d5aea…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Splunk LAMEHUG SEP 2025

    Conteras, T., Splunk Research Team. (2025, September 25). From Prompt to Payload: LAMEHUG’s LLM-Driven Cyber Intrusion. Retrieved April 21, 2026.

    Open source URL
  2. [2]
    Nov AI Threat Tracker

    Google Threat Intelligence Group. (2025, November 5). GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. Retrieved March 31, 2026.

    Open source URL
  3. [3]
    Cato LAMEHUG JUL 2025

    Simonovich, V. (2025, July 23). Cato CTRL™ Threat Research: Analyzing LAMEHUG – First Known LLM-Powered Malware with Links to APT28 (Fancy Bear) . Retrieved April 21, 2026.

    Open source URL
  4. [4]
    PROMPTSTEAL

    (Citation: Nov AI Threat Tracker)

  5. [5]
    mitre-attackS9035
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use