LAMEHUG
- ID
- S9035
- Type
- Malware
- Associated names
- PROMPTSTEAL
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
LAMEHUG is Python-based information stealer first identified in July 2025 by Ukraine's Computer Emergency Response Team (CERT-UA) in phishing emails targeting Ukrainian government officials. LAMEHUG is the first known malware to integrate artificial intelligence (AI) directly into its attack workflow by querying large language models (LLMs) hosted on Hugging Face to dynamically generate reconnaissance, data theft, and system manipulation commands in real time. LAMEHUG has been attributed to APT28. [1][2][3]
Techniques used (25)
- T1005 Data from Local System
- T1007 System Service Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1047 Windows Management Instrumentation
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1069.002 Domain Groups
- T1071.001 Web Protocols
- T1074.001 Local Data Staging
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087.002 Domain Account
- T1102.002 Bidirectional Communication
- T1119 Automated Collection
- T1132 Data Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1204.002 Malicious File
- T1482 Domain Trust Discovery
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1573.002 Asymmetric Cryptography