Lamehug
LameHug, also known as PROMPTSTEAL, is a Windows-focused AI-enabled malware family and infostealer first identified by CERT-UA in July 2025. It has been linked with moderate confidence to UAC-0001 / APT28, a Russian military intelligence-linked threat actor, and was reported in attacks against Ukrainian targets, including the security and defense sector and other Ukrainian entities. The malware has been described by Google Threat Intelligence Group as an early real-world example of "just-in-time" AI malware.
LameHug/PROMPTSTEAL integrates a large language model directly into its execution flow. It uses the Hugging Face Inference API, specifically the Qwen 2.5-Coder-32B-Instruct model, to generate one-line Windows commands on demand during runtime rather than relying only on hard-coded command logic. Reported generated commands supported reconnaissance, system information gathering, credential harvesting, document collection, and data theft. Reconstructed command activity included use of systeminfo, wmic, whoami, dsquery, net start, tasklist, and xcopy.exe.
Observed delivery was via spear-phishing attachments. Lures included executables masquerading as AI image or canvas generator tools, with filenames such as AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe. Reporting also describes phishing ZIP archives containing decoy .pif executables disguised as PDF or image viewers, and variants that dropped a dummy PDF decoy into C:\ProgramData and executed it via cmd.exe while malicious activity ran in a separate thread.
During execution, LameHug queried Hugging Face infrastructure, including router.huggingface.co, and used returned LLM output to drive host discovery and file collection. It collected system information and saved output to C:\ProgramData\info\info.txt, and recursively copied targeted documents into C:\ProgramData\info\ for staging prior to exfiltration. One variant Base64-encoded the LLM query prompt message.
Exfiltration was reported through adversary-controlled command-and-control infrastructure using either SSH/SFTP-based transfer or HTTPS POST requests. A specifically identified HTTPS endpoint was stayathomeclasses[.]com/slpw/up[.]php.
High-confidence behavioral indicators mentioned in the content include outbound requests from python.exe or PyInstaller-packaged processes to the Hugging Face API and Qwen 2.5-Coder-32B-Instruct model, DNS queries to router.huggingface.co, WMIC-based discovery, service enumeration with net start, recursive file copy activity with xcopy.exe, and local staging under %ProgramData%\info\ or C:\ProgramData\info.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
17.07.2025 Кібератаки UAC-0001 на сектор безпеки та оборони із застосуванням програмного засобу LAMEHUG, що використовує LLM (велику мовну модель) (CERT-UA#16039)
Known for blending cutting-edge tools such as the large language model (LLM) ‘LAMEHUG’ with proven, longstanding techniques, Forest Blizzard consistently evolves its tactics to stay ahead of defenders.
„PROMPTSTEAL ist demnach die erste in freier Wildbahn beobachtete Malware, die LLMs abfragt… Um Befehle zu generieren, verwende dieser Data Miner die Hugging Face API…“
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueAccording to CERT-UA, this malware was distributed as a phishing attachment disguised as an AI canvas or image generator application.
Execution
4 techniquesLAMEHUG has used the Hugging Face API to query the Qwen2.5-Coder-32B-Instruct LLM to generate one-line Windows commands for the collection of system information and documents in specific folders on compromised hosts. LAMEHUG subsequently executed the returned commands.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
"Once opened, a decoy PDF appears while the hidden binary executes in the background"
Stealth
3 techniquesBoth malware strains can "dynamically generate malicious scripts, obfuscate their own code to evade detection and leverage AI models to create malicious functions on demand," according to the report.
"ZIP archives entitled “Додаток.pdf.zip.” Once opened, a decoy PDF appears while the hidden binary executes in the background"
Discovery
6 techniquesThe following analytic detects the enumeration of Windows services using the net start command, which is a built-in utility that lists all running services on a system.
"gather computer, hardware, service, and network information"
"data stolen: system inventories, network layouts, Active Directory hierarchies"
Ember Bear gathers victim system information such as enumerating the volume of a given device; Frankenstein used Empire to gather various local system information; many malware entries state they collect system information from compromised hosts.
The dynamically generated commands enable the malware to gather system information and identify sensitive files before transmitting them across the network to an adversary-controlled server.
Detection should also flag execution of AI-generated command chains invoking utilities like ... dsquery ...
Collection
4 techniquesAmong the malware families in the intro table, LameHug/PROMPTSTEAL is the cleanest example of this route in the wild: it calls HuggingFace’s Inference API for Qwen 2.5-Coder-32B-Instruct to drive reconnaissance and data theft...
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
Recursively copy documents from various targeted directories into C:\ProgramData\info, consolidating sensitive files for potential exfiltration.
"recursively harvested Office, PDF, and text documents are staged in %PROGRAMDATA%\info"
Command and Control
3 techniquesThe dynamically generated commands enable the malware to gather system information and identify sensitive files before transmitting them across the network to an adversary-controlled server.
The content repeatedly describes threat actors, malware, and campaigns using HTTP, HTTPS, HTTP GET/POST, cookies in headers, WebSockets/WSS, and web APIs for command and control or related communications.
LAMEHUG can use SSH to transfer information to C2. ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.
Exfiltration
4 techniquesAll of the data and information collected by LAMEHUG malware is exfiltrated to its command-and-control (C2) server.
It uses the Paramiko SSH module for Python to upload the stolen files using hardcoded IP (144[.]126[.]202[.]227) credentials.
"exfiltration via either an SFTP tunnel to 144.126.202.227"
"or an HTTP POST to the compromised domain stayathomeclasses.com/slpw/up.php"
IOCs tracked for this family
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
65 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
AI-enabled malware that uses HuggingFace’s Inference API and Qwen 2.5-Coder-32B-Instruct to support reconnaissance, Windows command generation, and data theft.
Self-morphing malware with built-in AI capabilities; no further technical detail provided in the content.
Malware used by UAC-0001 (APT28).
AI-enabled malware strain that uses an open-source language model to generate malicious system commands dynamically via natural-language prompts.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.