Phishing CERT-UA links to APT28 delivered LAMEHUG, malware that asks an LLM for commands
CERT-UA says that on 10 July 2025 it learned of emails sent to Ukrainian executive bodies from a compromised account posing as a ministry official, with a ZIP holding LAMEHUG. The malware sends text prompts to the Qwen 2.5-Coder-32B-Instruct model through the Hugging Face API, runs the commands it gets back, and collects system data and documents for exfiltration. CERT-UA links it to UAC-0001 (APT28) with moderate confidence.
Sources
- Primary: https://cert.gov.ua/article/6284730
- Upstream: Editorial
- Entered by the cybermap.lol editors, with sources on the entry
Defenses for this class of incident
all categoriesAn AI-era incident sits in these classes of the AI-security landscape. The companies below work on that class of problem. This is a taxonomy, not a claim that any of them would have changed this incident.
Vendor data: AI Security Startups Map by Prompt Security (CC BY 4.0), synced daily. startups.prompt.security. Paid placements are labelled Sponsored; HeimWall, which runs this site, is labelled Operator. 452 companies in the directory.
Wrong or missing? Email founders@heimwall.ai. Corrections are logged here, in place. How corrections and takedowns work.