LAMEHUG: An LLM-Driven Malware for Dynamic Reconnaissance and Data Exfiltration

LAMEHUG is described as an LLM-driven malware designed for dynamic reconnaissance and data exfiltration, rather than relying on static payloads. It queries a Qwen 2.5-Coder-32B-Instruct model via the Hugging Face API to generate Windows command-shell instructions tailored to the infected environment, enabling on-the-fly reconnaissance and adaptive evasion.

CERT-UA publicly disclosed the malware family in July, noting its use of spear-phishing emails that carry loaders masquerading as AI image-generation tools with filenames such as AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe. After execution, the loader spawns a hidden thread to trigger LLM_QUERY_EX(), which dispatches prompts like “Enumerate system hardware details” to obtain system and network data, and culminates in data exfiltration over SSH or HTTP channels.

One variant exfiltrates via an SSH session to a C2 server with embedded credentials, while another encodes prompt messages and data in Base64 and posts them to a PHP endpoint at stayathomeclasses[.]com/slpw/up.php. According to CERT-UA, the threat blurs with legitimate admin activity, complicating early detection.