PROMPTSTEAL/LAMEHUG: APT28's LLM-Powered Malware Against Ukraine

What Happened

Between June and July 2025, Russian state-sponsored actor APT28 deployed PROMPTSTEAL (CERT-UA designation: LAMEHUG) against Ukrainian government and defense-sector targets. Victims received phishing emails impersonating a ministry official, carrying a ZIP attachment ("Appendix.pdf.zip") that dropped a PyInstaller-packaged Python executable; a second lure variant masqueraded as an "AI image generator" tool. Once running, the malware queried Qwen2.5-Coder-32B-Instruct via the Hugging Face API to generate, on the fly, Windows commands for system reconnaissance (systeminfo, wmic, whoami, dsquery) and document harvesting (xcopy of Office/PDF/TXT files from Documents, Downloads, and Desktop), staged the results under C:ProgramDatainfo, and exfiltrated them via SFTP/SSH or HTTP POST to attacker infrastructure. CERT-UA received the initial incident reports on 10 July 2025 and published its advisory (attributing the activity with moderate confidence to UAC-0001/APT28) around 17-28 July 2025. Google's GTIG independently corroborated the campaign in its 5 November 2025 "Advances in Threat Actor Usage of AI Tools" report, describing PROMPTSTEAL as GTIG's first observed case of malware calling an LLM during live operations to dynamically generate malicious functionality rather than having it hard-coded.

How the Attack Worked

PROMPTSTEAL (tracked by CERT-UA as LAMEHUG) is a Python data-miner packaged with PyInstaller and disguised as an AI image-generation tool (samples included "AI_generator_uncensored_Canvas_PRO_v0.9.exe" and "image.py"). Instead of hard-coding its reconnaissance and exfiltration logic, the malware sends a prompt (base64-encoded in some samples) to the Hugging Face-hosted Qwen2.5-Coder-32B-Instruct model at runtime, asking it to generate one-line Windows commands. The malware then blindly executes whatever command text the model returns. Reconstructed prompts asked the model to produce commands that: (1) gather system/hardware/process/service/network/Active Directory information and write it to C:ProgramDatainfoinfo.txt using tools like systeminfo, wmic, whoami, and dsquery; and (2) recursively copy Office, PDF, and TXT documents from the Documents, Downloads, and Desktop folders into C:ProgramDatainfo using xcopy. The staged data was then exfiltrated to attacker-controlled infrastructure via SFTP/SSH (an observed server at 144.126.202.227) or via HTTP POST (an observed endpoint at stayathomeclasses[.]com/slpw/up.php).

The Lure & the Tell

The lure was a phishing email impersonating a ministry representative, carrying a ZIP attachment named "Додаток.pdf.zip" / "Appendix.pdf.zip" that unpacked to a PyInstaller executable (one variant with a .pif extension), a classic double-extension/fake-document trick to get past casual inspection. A second observed variant disguised the payload as an "AI image generator" tool (e.g., "AI_generator_uncensored_Canvas_PRO_v0.9.exe"), exploiting curiosity about generative-AI tools as the pretext. The giveaway, in retrospect: a "PDF appendix" or "AI art generator" that is actually a compiled Python/PyInstaller binary with an unusual extension, and a process that reaches out to a public LLM inference API (Hugging Face) and then immediately runs system-recon and file-copy commands.

Outcome

CERT-UA disrupted/detected the campaign and published a public advisory with indicators of compromise and moderate-confidence attribution to UAC-0001 (APT28). Google's GTIG independently corroborated the malware's AI-runtime behavior in its November 2025 report. The report does not document a specific Google-side asset-disabling action for PROMPTSTEAL itself (it operates via third-party Hugging Face/Qwen infrastructure, not Google's own AI platform); the report's disabled-assets mitigations apply to other malware/actors in the same report (e.g., PROMPTFLUX, which abuses Google's Gemini API, and a Gemini-abusing CTF actor) and should not be attributed to this incident. For PROMPTSTEAL specifically, GTIG instead notes continued malware development, with newer samples adding obfuscation and changing the C2 method. No breach notification, litigation, or quantified loss has been publicly reported; the operation is characterized by researchers as espionage-oriented and still experimental/proof-of-concept in its use of AI.

Why It Matters

This is one of the first publicly documented, attributed cases of "just-in-time" AI-enabled malware: malware that outsources command generation to a live LLM at execution time instead of shipping hard-coded logic. That architecture makes static signature-based detection harder (the actual commands executed vary per run, generated fresh from the model) and signals a maturing trend among state-sponsored actors of embedding commercial/open LLMs directly into intrusion tooling rather than only using AI for offline development support. For defenders, it shifts part of the detection surface toward monitoring outbound calls to LLM inference APIs and behavioral/EDR rules rather than static IOCs, and underscores that nation-state phishing operations against government targets in active conflict zones (Ukraine) are early adopters of this technique.

Defenses

Treat unsolicited ZIP attachments claiming to be government/ministry documents (e.g., "Appendix.pdf.zip") as high-risk, especially those unpacking to executables with unusual extensions (.pif) or PyInstaller-built binaries disguised as "AI image generator" tools. Monitor for outbound traffic to LLM inference APIs (e.g., Hugging Face) from endpoints that have no legitimate developer/AI use case, and for staging directories such as C:ProgramDatainfo. Flag processes that spawn native recon/exfil commands (systeminfo, wmic, whoami, dsquery, xcopy) shortly after network calls to generative-AI API endpoints, since this command-generation-then-execution pattern is atypical of conventional scripted malware. Organizations should apply egress controls/allow-listing for AI API endpoints and behavioral EDR rules rather than relying on static signatures, since the LLM generates commands dynamically at runtime, evading hard-coded-IOC detection. Government/defense-sector organizations in conflict zones should assume nation-state phishing lures will keep pace with AI tooling and prioritize attachment sandboxing and macro/executable-in-archive blocking.