{
 "id": "AIR-2025-0069",
 "slug": "lamehug-malware-uses-llms-for-dynamic-command-generation",
 "title": "LAMEHUG Malware Uses LLMs for Dynamic Command Generation",
 "summary": "The Russian state-backed group APT28 deployed LAMEHUG malware utilizing an LLM to dynamically generate commands on compromised hosts. The campaign was initiated via a phishing email leveraging a compromised government account.",
 "type": "ai_enabled_attack",
 "categories": [
  "ai_assisted_intrusion"
 ],
 "severity": 3,
 "targets": [
  "individual_victims",
  "enterprise_deployment"
 ],
 "products": [
  "LAMEHUG"
 ],
 "incident_date": "2025-06",
 "incident_date_precision": "month",
 "first_reported": "2025-12-24",
 "sources": [
  {
   "url": "https://atlas.mitre.org/studies/AML.CS0044",
   "publisher": "MITRE ATLAS",
   "title": "LAMEHUG: Malware Leveraging Dynamic AI-Generated Commands",
   "published_at": "2025-12-24"
  },
  {
   "url": "https://bleepingcomputer.com/news/security/lamehug-malware-uses-ai-llm-to-craft-windows-data-theft-commands-in-real-time",
   "publisher": "BleepingComputer",
   "title": "LameHug malware uses AI LLM to craft Windows data-theft commands in real-time",
   "published_at": "2025-12-24"
  },
  {
   "url": "https://cert.gov.ua/article/6284730",
   "publisher": "cert.gov.ua",
   "title": "UAC-0001 cyberattacks on the security and defense sector using the LAMEHUG software tool, which uses LLM (large language model) (CERT-UA#16039)",
   "published_at": "2025-12-24"
  },
  {
   "url": "https://logpoint.com/en/blog/apt28s-new-arsenal-lamehug-the-first-ai-powered-malware",
   "publisher": "logpoint.com",
   "title": "APT28's New Arsenal: LAMEHUG, the First AI-Powered Malware",
   "published_at": "2025-12-24"
  }
 ],
 "source_count": 4,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_atlas",
 "tags": [
  "lamehug",
  "apt28",
  "forest-blizzard"
 ],
 "created_at": "2026-10-18T06:55:08.239Z",
 "updated_at": "2026-10-18T06:55:08.239Z"
}