Skip to navigation

Threat reportMalwareTL-2026-2559

AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)

mediumACTIVE

Google's Threat Intelligence Group (GTIG) documented the first malware families that query large language models during live execution rather than at development time: PROMPTFLUX, an experimental VBScript dropper that calls the Gemini API hourly to rewrite and re-obfuscate its own source code, and PROMPTSTEAL (CERT-UA designation: LAMEHUG), a Python data miner tied to Russian state actor APT28 that queries the Hugging Face-hosted Qwen2.5-Coder-32B-Instruct model to generate one-line Windows reconnaissance and exfiltration commands on demand. First disclosed .

Key facts for APT28 LAMEHUG LLM-Powered

IdentifiersTL-2026-2559
Also known asLAMEHUG
SeverityMEDIUM
First disclosed
Exploitation statusExploited in the wild
Affected productsGoogle Gemini API (model gemini-1.5-flash-latest); Hugging Face Hosted Inference API / Qwen2.5-Coder-32B-Instruct (Alibaba Cloud model); Microsoft Windows (Windows Script Host / VBScript, cmd.exe, PyInstaller-compiled Python binaries)
AttributionAPT28 (medium confidence)
Nation-state nexusRussia
MalwareLAMEHUG, LAMEHUG - S9035, PROMPTFLUX
ToolsQwen2.5-Coder-32B-Instruct, SOURFACE
MITRE ATT&CK techniquesT1005 Data from Local System, T1027 Obfuscated Files or Information, T1036.005 Match Legitimate Resource Name or Location, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.006 Python, T1071.001 Web Protocols, T1074.001 Local Data Staging, T1082 System Information Discovery, T1091 Replication Through Removable Media, T1102.002 Bidirectional Communication, T1119 Automated Collection and 6 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, defense
Target regionsukraine, Global
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for APT28 LAMEHUG LLM-Powered

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2559 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LAMEHUG/PROMPTSTEAL Phishing Lure Execution — AI-Themed Decoy Payload (APT28/UAC-0001)

Detects execution of the AI-image-generator-themed lure executables and the .pif loader delivered in the CERT-UA #16039 phishing campaign (Додаток.pdf.zip) that impersonated Ukrainian ministry officials and staged the PROMPTSTEAL/LAMEHUG Python data miner, attributed to APT28/UAC-0001.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.001, T1204.002, T1036.005
  • Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval img=lower(Image)
| eval sha256=lower(mvindex(split(Hashes,","),0))
| where match(img, "ai_generator_uncensored_canvas_pro.*\.exe$")
   OR match(img, "ai_image_generator.*\.exe$")
   OR match(img, "\.pif$")
   OR in(sha256, "d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e", "bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3", "766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777")
| eval parent=lower(ParentImage)
| where match(parent, "explorer\.exe$") OR match(parent, "outlook\.exe$") OR match(parent, "winword\.exe$") OR match(parent, "wscript\.exe$")
| table _time, host, User, Image, ParentImage, CommandLine, sha256
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "AI_generator_uncensored_Canvas_PRO_v0.9.exe"
   or FileName =~ "AI_image_generator_v0.95.exe"
   or FileName endswith ".pif"
   or SHA256 in~ ("d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e","bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3","766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777")
| where InitiatingProcessFileName in~ ("explorer.exe","outlook.exe","winword.exe","wscript.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: LAMEHUG/PROMPTSTEAL AI-Themed Phishing Lure Execution (APT28/UAC-0001)
id: 7c1e2a44-9b3f-4d1a-9e6c-2f4b8d7a1c30
status: experimental
description: Detects execution of AI-image-generator-themed lure executables and the .pif loader delivered in the CERT-UA #16039 phishing campaign attributed to APT28, which stages the PROMPTSTEAL/LAMEHUG Python data miner.
references:
    - https://cert.gov.ua/article/6284730
    - https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-18
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.group.apt28
    - attack.software.s9035
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith:
            - '\AI_generator_uncensored_Canvas_PRO_v0.9.exe'
            - '\AI_image_generator_v0.95.exe'
    selection_ext:
        Image|endswith: '.pif'
    selection_hash:
        Hashes|contains:
            - 'd6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e'
            - 'bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3'
            - '766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777'
    condition: selection_name or selection_ext or selection_hash
falsepositives:
    - Legitimate AI image-generation software with a coincidentally similar filename (rare; verify hash)
    - Internal QA testing of legacy .pif shortcuts (extremely rare in modern estates)
level: high

Known false positives:

  • Legitimate AI image-generation software coincidentally sharing a lure filename — verify file hash before escalation.
  • Internal red-team/purple-team exercises replaying the CERT-UA #16039 sample set.

Tuning notes: Maintain the confirmed hash IOC list as a lookup and refresh it as CERT-UA/GTIG publish new PROMPTSTEAL samples; scope the parent-process filter to mail-client and shell spawns to cut noise from software deployment tools.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • LAMEHUG/PROMPTSTEAL Phishing Lure Execution — AI-Themed Decoy Payload (APT28/UAC-0001) · unlock with TL Creds
  • PROMPTFLUX Gemini Self-Rewrite/Startup Persistence & PROMPTSTEAL Recon Staging · unlock with TL Creds
  • AI-Malware LLM-API-as-C2 Abuse and Confirmed PROMPTSTEAL/LAMEHUG Exfiltration Infrastructure · unlock with TL Creds
  • LAMEHUG/PROMPTSTEAL Phishing Lure Execution — AI-Themed Decoy Payload (APT28/UAC-0001) · unlock with TL Creds
  • PROMPTFLUX Gemini Self-Rewrite/Startup Persistence & PROMPTSTEAL Recon Staging · unlock with TL Creds
  • AI-Malware LLM-API-as-C2 Abuse and Confirmed PROMPTSTEAL/LAMEHUG Exfiltration Infrastructure · unlock with TL Creds
  • PROMPTFLUX Gemini Self-Rewrite/Startup Persistence & PROMPTSTEAL Recon Staging · unlock with TL Creds
  • AI-Malware LLM-API-as-C2 Abuse and Confirmed PROMPTSTEAL/LAMEHUG Exfiltration Infrastructure · unlock with TL Creds

Indicators of compromise for APT28 LAMEHUG LLM-Powered

As of 2026-09-18, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-2559.

Sample indicators (3 of 25)

  • IP address: 144.126.202[.]227
  • Domain: stayathomeclasses[.]com
  • File hash: 8013b23cb78407675f323d54b6b8dfb2a61fb40fb13309337f5b662dbd812a5d

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

25 indicators of compromise · unlock with TL Creds. Compare plans

How APT28 LAMEHUG LLM-Powered works

LAMEHUG was used in a July 2025 phishing campaign against Ukrainian government/defense officials.

In a report published November 5, 2025 ('Advances in Threat Actor Usage of AI Tools'), GTIG disclosed that it had for the first time observed malware embedding LLM queries directly into its execution logic, rather than using AI only as a development aid.

PROMPTFLUX is an experimental VBScript dropper first observed by GTIG in June 2025. Its core innovation is a component GTIG calls the 'Thinking Robot' (evolved in later samples into a function named 'Thinging'): it sends a hard-coded API key to the Gemini API (model 'gemini-1.5-flash-latest', chosen with the '-latest' alias specifically for resilience against model deprecation) with a machine-parsable prompt instructing Gemini to act as an 'expert VBScript obfuscator' and return only executable code, no markdown. The returned code is logged to %TEMP%\thinking_robot_log.txt and written to the Windows Startup folder, combining runtime polymorphism with persistence. The 'Thinging' variant queries Gemini roughly once per hour to regenerate its entire source, and Morphisec researchers documented samples producing more than 70 distinct variants within a four-hour window -- a mutation rate that renders hash-based detection lists obsolete essentially as fast as they can be built. PROMPTFLUX also copies itself to removable drives and mapped network shares. A commented-out 'AttemptToUpdateSelf' function indicates the author intends true self-modification once complete. GTIG assesses PROMPTFLUX remains in a development/testing phase with no demonstrated ability to compromise a victim network, and attributes it only to an unidentified, likely financially motivated actor based on decoy filenames (e.g. 'crypted_ScreenRec_webinstall').

PROMPTSTEAL -- publicly disclosed first by Ukraine's CERT-UA on July 10, 2025 under the name LAMEHUG (CERT-UA alert #16039) -- is a PyInstaller-compiled Python data miner that GTIG separately attributes to APT28 (FROZENLAKE) and calls 'the first known instance of malware... querying an LLM' in a live operation. It contains no hard-coded collection commands; instead, masquerading as an 'image generation' program, it sends natural-language prompts in the background to the Hugging Face Inference API to invoke Alibaba Cloud's Qwen2.5-Coder-32B-Instruct model (using an estimated ~284 leaked/compromised Hugging Face API tokens), which returns one-line Windows shell commands. Observed prompts request: (1) creation of C:\ProgramData\info and collection of hardware, process, service, network, and Active Directory domain information into info.txt, and (2) recursive copying of Office/PDF/TXT documents from the user's Documents, Downloads, and Desktop folders into the same staging directory. Captured data is exfiltrated via SFTP or HTTP POST to attacker infrastructure. CERT-UA's initial campaign delivered LAMEHUG via phishing emails impersonating Ukrainian ministry officials, sent from a compromised mailbox (boroda70@meta.ua) partly through a VPN exit node (192.36.27.37), containing a ZIP archive ('Додаток.pdf.zip') with a PIF loader, a PDF decoy, and AI-themed lure executables ('AI_generator_uncensored_Canvas_PRO_v0.9.exe', 'AI_image_generator_v0.95.exe') plus a Python component (image.py). One observed variant exfiltrated over SSH to 144.126.202.227; another POSTed to https://stayathomeclasses.com/slpw/up.php. CERT-UA attributes the campaign to APT28/UAC-0001 with medium confidence and notes the malware was under active, iterative development (new obfuscation layers, evolving C2 methods) rather than a single static build.

Both families were disclosed in the same GTIG report alongside three other AI-abusing malware families GTIG identified in 2025 -- FRUITSHELL (PowerShell reverse shell with hard-coded prompts designed to bypass LLM-based security classifiers), PROMPTLOCK (experimental Go/Lua cross-platform ransomware PoC that generates encryption scripts via a local LLM), and QUIETVAULT (JavaScript GitHub/NPM token stealer that uses on-host AI CLI tools to hunt for additional secrets). Google states it disabled the Gemini projects/accounts and Hugging Face-linked infrastructure associated with the identified PROMPTFLUX and PROMPTSTEAL activity, and strengthened Gemini's classifiers and model-level safeguards to refuse this class of prompt.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1074.001 Local Data Staging; T1119 Automated Collection; T1560.001 Archive via Utility

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1573.002 Asymmetric Cryptography

Discovery

T1082 System Information Discovery

Lateral Movement

T1091 Replication Through Removable Media

Persistence

T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566.001 Spearphishing Attachment

Remediation for APT28 LAMEHUG LLM-Powered

Immediate actions

  • Alert on and block outbound connections from unmanaged scripts/executables (cscript.exe, wscript.exe, unsigned PyInstaller binaries) to generativelanguage.googleapis.com and huggingface.co API endpoints
  • Block/hunt the confirmed CERT-UA #16039 network indicators: 144.126.202.227, 192.36.27.37, stayathomeclasses.com, https://stayathomeclasses.com/slpw/up.php
  • Sweep endpoints and email gateways for the six CERT-UA-confirmed LAMEHUG/PROMPTSTEAL file hashes
  • Alert on creation of C:\ProgramData\info\ and %TEMP%\thinking_robot_log.txt, both used as malware staging/logging artifacts

Workarounds

  • Disable Windows Script Host (wscript.exe/cscript.exe) organization-wide where VBScript execution is not a business requirement
  • Restrict or proxy-inspect direct endpoint access to public LLM inference APIs from standard user workstations
  • Block execution of unsigned PyInstaller-packaged binaries via application allowlisting, particularly those with AI/image-generation-themed filenames

Longer-term hardening

  • Deploy EDR/AMSI behavioral rules that flag processes which make outbound LLM API calls and then execute the returned text as a command or script (the shared PROMPTFLUX/PROMPTSTEAL TTP)
  • Instrument logging/anomaly detection for enterprise use of public LLM APIs (Gemini, Hugging Face, OpenAI) to catch malware-as-API-consumer patterns distinct from legitimate developer traffic
  • Audit for exposed/leaked Hugging Face and Gemini API keys in internal repos and tooling; GTIG observed PROMPTSTEAL using an estimated 284 compromised Hugging Face tokens
  • Shift static/hash-based detection toward behavioral and content-based detection for VBScript/Python droppers, since AI-driven hourly re-obfuscation defeats hash and simple-signature approaches

Affected and fixed versions

  • Google — Gemini API (model gemini-1.5-flash-latest)
    Vulnerable versions: Abused as an external code-generation oracle by PROMPTFLUX's 'Thinking Robot'/'Thinging' component via a hard-coded API key
    Fixed in: Google disabled the associated projects/accounts and strengthened Gemini classifiers/model-level safeguards to refuse this prompt pattern (per Nov 5, 2025 GTIG report)
  • Hugging Face — Hosted Inference API / Qwen2.5-Coder-32B-Instruct (Alibaba Cloud model)
    Vulnerable versions: Queried by PROMPTSTEAL/LAMEHUG using an estimated ~284 leaked or compromised Hugging Face API tokens to generate Windows reconnaissance/exfiltration commands on demand
    Fixed in: No vendor patch applicable; Google reports disabling associated accounts it identified, token rotation/monitoring recommended for affected organizations
  • Microsoft — Windows (Windows Script Host / VBScript, cmd.exe, PyInstaller-compiled Python binaries)
    Vulnerable versions: All Windows versions supporting WSH/VBScript execution and standalone PyInstaller executables
    Fixed in: Not a vulnerability; mitigated via WSH restriction, AMSI integration, and EDR behavioral detection rather than a patch

Timeline of APT28 LAMEHUG LLM-Powered

  • GTIG first observes locked-ioc-24, an experimental VBScript dropper whose 'Thinking Robot' component queries the Gemini API to obtain AV-evasion code; assessed to be in development/testing with no demonstrated compromise capability.
  • CERT-UA receives reports of phishing emails impersonating Ukrainian ministry officials, sent from a compromised mailbox (locked-ioc-19), delivering a ZIP archive containing the locked-ioc-25/locked-ioc-23 loader, a PDF decoy, and AI-themed lure executables.
  • CERT-UA publishes advisory #16039 attributing locked-ioc-25 to APT28/UAC-0001 with medium confidence, describing it as the first publicly documented malware to query an LLM (Hugging Face-hosted locked-ioc-16) live in operations for on-demand Windows command generation.
  • Later locked-ioc-24 samples replace the 'Thinking Robot' function with 'Thinging', which queries Gemini roughly hourly to regenerate the malware's entire source; Morphisec documents a sample producing over 70 distinct variants within four hours.
  • Google states it disabled the Gemini projects/accounts and Hugging Face-linked infrastructure associated with the identified locked-ioc-24 and locked-ioc-23 activity, and strengthened Gemini's classifiers and model-level safeguards against this prompt pattern.
  • Google Threat Intelligence Group publishes 'Advances in Threat Actor Usage of AI Tools,' formally documenting locked-ioc-24 and locked-ioc-23 alongside FRUITSHELL, PROMPTLOCK, and QUIETVAULT as the first cohort of malware observed querying LLMs during live execution.
  • GBHackers and Morphisec publish follow-on coverage recapping GTIG's findings on AI-driven polymorphic malware, prompting this threat-intel hunt entry.

Sources cited for APT28 LAMEHUG LLM-Powered

More from APT28

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats