MITRE ATT&CKsoftware (malware)

S9035 LAMEHUG

Published 2026-04-21 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
PROMPTSTEAL
Version
1.0
Created
2026-04-21

Description

LAMEHUG is Python-based information stealer first identified in July 2025 by Ukraine's Computer Emergency Response Team (CERT-UA) in phishing emails targeting Ukrainian government officials. LAMEHUG is the first known malware to integrate artificial intelligence (AI) directly into its attack workflow by querying large language models (LLMs) hosted on Hugging Face to dynamically generate reconnaissance, data theft, and system manipulation commands in real time. LAMEHUG has been attributed to APT28.

Related

Uses · MITRE ATT&CK (25)

  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1102.002 Bidirectional Communication sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.006 Python sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1069.002 Domain Groups sub-technique
  • T1087.002 Domain Account sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1482 Domain Trust Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1007 System Service Discovery technique
  • T1016 System Network Configuration Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1047 Windows Management Instrumentation technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1119 Automated Collection technique
  • T1132 Data Encoding technique

Referenced by MITRE ATT&CK · uses (1)

References