Case lamehug-apt28State actor AI opsUkraine
LameHug: APT28-linked malware queries Qwen LLM to generate commands
CERT-UA reported phishing that delivered LameHug, a Python stealer using Qwen 2.5-Coder via Hugging Face's API to craft recon and theft commands, attributed to APT28 with moderate confidence.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 17, 2025
- Location
- Ukraine
- Target
- Ukrainian government bodies
- Severity
- High
- Triggered by
- APT28 (Russian GRU-linked, aka Fancy Bear / UAC-0001)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
CERT-UA reported phishing that delivered LameHug, a Python stealer using Qwen 2.5-Coder via Hugging Face's API to craft recon and theft commands, attributed to APT28 with moderate confidence.
Impact: Targeted Ukrainian government bodies; malware collected system information and Office, PDF and TXT documents for exfiltration via SFTP or HTTP POST; number of victims not disclosed
Who triggered it
Actor: APT28 (Russian GRU-linked, aka Fancy Bear / UAC-0001)
Attribution: Attributed by CERT-UA with moderate (medium) confidence
Motive: Espionage against Ukrainian security and defence sector
How it happened
Attack vector: Phishing from compromised accounts impersonating ministry officials with a ZIP holding a PyInstaller .pif executable that queries Qwen2.5-Coder-32B via the Hugging Face API for commands
Root cause: Email account compromise enabling convincing lures; LLM API calls to a legitimate service blend malicious command generation into normal traffic
Timeline
- CERT-UA receives reports of phishing emails targeting executive government bodies
- CERT-UA publishes LameHug analysis and APT28 attribution
- Cato Networks estimates roughly 270 Hugging Face tokens were used by the operators
Response
CERT-UA issued an advisory with IOCs; Hugging Face reportedly notified; defenders urged to block the delivery infrastructure
Current status: Contained
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- Security Affairs securityaffairs.com
- Infosecurity Magazine infosecurity-magazine.com
Cite this case
LameHug: APT28-linked malware queries Qwen LLM to generate commands. AI Threat Watch, case lamehug-apt28, Jul 17, 2025. https://aithreat.io/cases/lamehug-apt28/
Permanent link: https://aithreat.io/cases/lamehug-apt28/