Loading malware…
LameHug, also referred to as PROMPTSTEAL, is a Python-based Windows infostealer associated with APT28, the Russia-linked threat group also known as Fancy Bear or UAC-0001. It is notable for delegating part of its operational logic to a live large language model during execution, making it one of the earliest publicly documented examples of LLM-assisted malware used in an espionage context.
The malware has been used against Ukrainian government and security-sector targets. Its core behavior is to query a Hugging Face-hosted Qwen 2.5-Coder-32B-Instruct model to generate host-specific Windows command lines on demand, rather than relying solely on hard-coded command sequences. Those generated commands are then executed locally to perform reconnaissance and collect documents and other information of intelligence value. Reported reconnaissance actions include gathering system and user context and enumerating host characteristics, while collection behavior includes recursively copying targeted files from selected directories into a local staging area before exfiltration.
LameHug has been observed staging collected information locally and then transmitting it to attacker-controlled infrastructure. Reported exfiltration methods include HTTPS-based transfer and SSH-based transfer. Variants have also used decoy content to distract victims while malicious collection proceeds in a separate execution thread. The malware’s use of a live LLM can produce environment-specific command output, complicating static analysis and signature-based detection compared with more conventional stealers.
Delivery has been linked to spearphishing campaigns, including emails impersonating Ukrainian government officials and lures masquerading as AI-related software or benign documents. The malware has been described as part of APT28’s broader evolution toward disposable, specialized tooling and experimentation with AI-enabled offensive tradecraft alongside other established implants and exfiltration tools.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT28 evolved PixyNetLoader, utilizing COM persistence, PNG steganography, and FILEN-based cloud C2, and expanded its tactics to include X-Agent, X-Tunnel, and LameHug (malware that generates commands using an LLM and collects documents for Information Theft).
„PROMPTSTEAL ist demnach die erste in freier Wildbahn beobachtete Malware, die LLMs abfragt… Um Befehle zu generieren, verwende dieser Data Miner die Hugging Face API…“
24 distinct techniques documented for this family, organized by ATT&CK tactic.
AI-generated code: A threat actor uses a coding assistant, such as Cursor, to create scripts, exploits, payloads, and/or tools, which the human operator then deploys.
Both malware strains can "dynamically generate malicious scripts, obfuscate their own code to evade detection and leverage AI models to create malicious functions on demand," according to the report.
The following analytic detects the enumeration of Windows services using the net start command, which is a built-in utility that lists all running services on a system.
"data stolen: system inventories, network layouts, Active Directory hierarchies"
Kimsuky used malicious LNK files, the Dropbox API, GitHub Releases, and Google Drive for Information Theft and command execution.
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
The dynamically generated commands enable the malware to gather system information and identify sensitive files before transmitting them across the network to an adversary-controlled server.
The content repeatedly describes threat actors, malware, and campaigns using HTTP, HTTPS, HTTP GET/POST, cookies in headers, WebSockets/WSS, and web APIs for command and control or related communications.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
75 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Data-mining malware that contacts a live LLM to generate host-specific command chains during execution.
Malware that generates commands using an LLM and collects documents for information theft.
LLM-assisted malware in which a human-defined workflow uses a public LLM to generate reconnaissance and data-theft commands on the fly, rather than autonomously operating end-to-end.
Python-based malware that dynamically queried an LLM to generate Windows reconnaissance and data-theft commands at runtime, varying commands by environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.