{
 "id": "AIR-2025-0125",
 "slug": "lamehug-malware-integrates-llm-for-real-time-command-generat",
 "title": "LAMEHUG Malware Integrates LLM for Real-Time Command Generation",
 "summary": "The LAMEHUG malware integrated an open-weight large language model to dynamically generate reconnaissance and exfiltration commands during attacks against Ukrainian officials. The campaign was linked with moderate confidence to APT28.",
 "type": "ai_enabled_attack",
 "categories": [
  "ai_generated_malware",
  "ai_assisted_intrusion"
 ],
 "severity": 3,
 "targets": [
  "open_weight_model",
  "enterprise_deployment"
 ],
 "products": [
  "LAMEHUG",
  "Qwen2.5-Coder-32B-Instruct"
 ],
 "incident_date": "2025-07-10",
 "incident_date_precision": "day",
 "first_reported": "2025-07-10",
 "sources": [
  {
   "url": "https://incidentdatabase.ai/cite/1220",
   "publisher": "AI Incident Database",
   "title": "LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack",
   "published_at": "2025-07-10"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_aiid",
 "tags": [
  "lamehug",
  "apt28",
  "qwen",
  "malware",
  "llm"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:59:35.797Z"
}