APT28-attributed malware LAMEHUG/PROMPTSTEAL used Qwen2.5-Coder via Hugging Face to write data-theft commands in Ukraine
Malware known as LAMEHUG (CERT-UA) or PROMPTSTEAL (Google) asked Qwen2.5-Coder-32B-Instruct, through the Hugging Face API, to write Windows commands that collected system information and documents from infected machines. CERT-UA attributes it to APT28 with medium confidence; Google called it the first malware it had seen querying an LLM in live operations.
On July 10, 2025, CERT-UA received reports of malicious emails, sent from compromised accounts and impersonating ministry officials, that tried to plant Python malware it named LAMEHUG in executive government bodies. CERT-UA attributes the activity with medium confidence to the Russian group APT281. Google Threat Intelligence Group (GTIG) tracks the same malware as PROMPTSTEAL and also ties it to APT28 (aka FROZENLAKE)2.
Instead of carrying hard-coded commands, the malware asks Qwen2.5-Coder-32B-Instruct, Alibaba Cloud's open model, through the Hugging Face API, to write one-line Windows commands21. The prompts ask for commands that gather computer, hardware, process, network, and AD domain information and recursively copy Office, PDF, and text documents from the Documents, Downloads, and Desktop folders. The malware "blindly" runs whatever comes back and sends the results to an attacker-controlled server. It poses as an "image generation" program and likely uses stolen API tokens2.
GTIG called it "our first observation of malware querying an LLM deployed in live operations," and has seen newer samples with added obfuscation and a different C2 method2. Whether the LLM-generated commands succeeded wasn't disclosed1.
CERT-UA received reports on July 10, 2025 of malicious emails sent from compromised accounts and impersonating ministry officials, which attempted to distribute the malware to executive government bodies.
“on July 10 about malicious emails sent from compromised accounts and impersonating ministry officials”
CERT-UA attributes the activity with medium confidence to the Russian threat group APT28.
“The Ukrainian agency attributes this activity with medium confidence to the Russian threat group APT28.”
GTIG says it identified the Russian government-backed actor APT28 (aka FROZENLAKE) using new malware against Ukraine that GTIG tracks as PROMPTSTEAL and that CERT-UA reported as LAMEHUG.
“In June, GTIG identified the Russian government-backed actor APT28 (aka FROZENLAKE) using new malware against Ukraine we track as PROMPTSTEAL and reported by CERT-UA as LAMEHUG.”
The malware is written in Python and uses the Hugging Face API to query Qwen2.5-Coder-32B-Instruct to generate one-line Windows commands.
“It contains a compiled script that uses the Hugging Face API to query the LLM Qwen2.5-Coder-32B-Instruct to generate one-line Windows commands.”
Qwen2.5-Coder-32B-Instruct is an open-source model created by Alibaba Cloud and designed to generate code.
“Created by Alibaba Cloud, the LLM is open-source and designed specifically to generate code”
GTIG says the prompts ask the LLM for commands to collect system information and to copy documents to a specified directory. The malware executes the output blindly and then exfiltrates it.
“The output from these commands are then blindly executed locally by PROMPTSTEAL before the output is exfiltrated.”
GTIG says PROMPTSTEAL executes the commands and sends the collected data to an adversary-controlled server.
“PROMPTSTEAL then executes the commands and sends the collected data to an adversary-controlled server.”
GTIG says the malware masquerades as an "image generation" program and queries the Hugging Face API in the background.
“It masquerades as an "image generation" program that guides the user through a series of prompts to generate images while querying the Hugging Face API to generate commands for execution in the background.”
GTIG assesses that PROMPTSTEAL likely uses stolen API tokens to query the Hugging Face API.
“PROMPTSTEAL likely uses stolen API tokens to query the Hugging Face API.”
GTIG described APT28's use of PROMPTSTEAL as its first observation of malware querying an LLM deployed in live operations.
“APT28's use of PROMPTSTEAL constitutes our first observation of malware querying an LLM deployed in live operations.”
GTIG reported continued development of the malware, with new samples adding obfuscation and changing the C2 method.
“Our analysis indicates continued development of this malware, with new samples adding obfuscation and changing the C2 method.”
BleepingComputer reports that CERT-UA did not state whether the LLM-generated commands were successful.
“CERT-UA did not state whether the LLM-generated commands executed by LameHug were successful.”
All 12 claims with their quotes (1 not linked to a sentence above)
- CERT-UA received reports on July 10, 2025 of malicious emails sent from compromised accounts and impersonating ministry officials, which attempted to distribute the malware to executive government bodies.1
“on July 10 about malicious emails sent from compromised accounts and impersonating ministry officials”
- CERT-UA attributes the activity with medium confidence to the Russian threat group APT28.1
“The Ukrainian agency attributes this activity with medium confidence to the Russian threat group APT28.”
- GTIG says it identified the Russian government-backed actor APT28 (aka FROZENLAKE) using new malware against Ukraine that GTIG tracks as PROMPTSTEAL and that CERT-UA reported as LAMEHUG.2
“In June, GTIG identified the Russian government-backed actor APT28 (aka FROZENLAKE) using new malware against Ukraine we track as PROMPTSTEAL and reported by CERT-UA as LAMEHUG.”
- The malware is written in Python and uses the Hugging Face API to query Qwen2.5-Coder-32B-Instruct to generate one-line Windows commands.21
“It contains a compiled script that uses the Hugging Face API to query the LLM Qwen2.5-Coder-32B-Instruct to generate one-line Windows commands.”
- Qwen2.5-Coder-32B-Instruct is an open-source model created by Alibaba Cloud and designed to generate code.1
“Created by Alibaba Cloud, the LLM is open-source and designed specifically to generate code”
- GTIG says the prompts ask the LLM for commands to collect system information and to copy documents to a specified directory. The malware executes the output blindly and then exfiltrates it.2
“The output from these commands are then blindly executed locally by PROMPTSTEAL before the output is exfiltrated.”
- GTIG says PROMPTSTEAL executes the commands and sends the collected data to an adversary-controlled server.2
“PROMPTSTEAL then executes the commands and sends the collected data to an adversary-controlled server.”
- GTIG says the malware masquerades as an "image generation" program and queries the Hugging Face API in the background.2
“It masquerades as an "image generation" program that guides the user through a series of prompts to generate images while querying the Hugging Face API to generate commands for execution in the background.”
- GTIG assesses that PROMPTSTEAL likely uses stolen API tokens to query the Hugging Face API.2
“PROMPTSTEAL likely uses stolen API tokens to query the Hugging Face API.”
- GTIG described APT28's use of PROMPTSTEAL as its first observation of malware querying an LLM deployed in live operations.2
“APT28's use of PROMPTSTEAL constitutes our first observation of malware querying an LLM deployed in live operations.”
- GTIG reported continued development of the malware, with new samples adding obfuscation and changing the C2 method.2
“Our analysis indicates continued development of this malware, with new samples adding obfuscation and changing the C2 method.”
- BleepingComputer reports that CERT-UA did not state whether the LLM-generated commands were successful.1
“CERT-UA did not state whether the LLM-generated commands executed by LameHug were successful.”
Sources
- [1]LameHug malware uses AI LLM to craft Windows data-theft commands in real-time
- [2]GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools
Editor notes
CERT-UA's primary advisory (https://cert.gov.ua/article/6284730) did not load (JavaScript-only page), so CERT-UA facts are sourced from BleepingComputer's coverage. Add the advisory if a human can read it. Date conflict: GTIG says it identified APT28 using the malware "In June" (the year is implied by the 2025 report), while CERT-UA received reports on July 10, 2025. The record uses 2025-07 (first public report). The success of the LLM-generated commands, the number of victims, and any data actually exfiltrated are unsourced. Hugging Face is listed as deployer because it served the model API the malware called. No source describes any Hugging Face response. The behavior "unauthorized-access" is the closest existing term. The model was not acting on its own; it generated intrusion and data-collection commands that a human-built malware ran.