LAMEHUG: An LLM-Driven Malware for Dynamic Reconnaissance and Data Exfiltration
A new AI-driven threat, identified as LAMEHUG, utilizes large language models (LLMs) available on Hugging Face to conduct adaptive reconnaissance and data exfiltration in real-time environments.
A new AI-driven threat, identified as LAMEHUG, utilizes large language models (LLMs) available on Hugging Face to conduct adaptive reconnaissance and data exfiltration in real-time environments.
LAMEHUG distinguishes itself by employing dynamic queries to a Qwen 2.5-Coder-32B-Instruct model through the Hugging Face API. This enables the generation of Windows command-shell instructions tailored to the existing environment, enhancing the complexity of detection and response efforts for security operations centers (SOCs) and blue teams.
Initially disclosed by CERT-UA in July, the LAMEHUG malware family represents a significant evolution in attacker methodologies by integrating LLMs into malware workflows. According to CERT-UA, LAMEHUG is distributed through spear-phishing emails containing malicious executables disguised as AI image-generation tools.
Upon execution, these loaders present a benign user interface for image requests while concurrently initiating a hidden thread to call the LLM_QUERY_EX() function, which manages the primary malicious activities.
This malware variant includes functionality to decode and deploy a decoy PDF file, designed to mislead users into executing the payload. Following the launch of the LLM thread, the xlsx_open() function decodes a large Base64 string representing the decoy PDF, which is then written to C:\ProgramData and executed via cmd.exe, often masquerading as a legitimate government or corporate document.
The core innovation within LAMEHUG is its LLM_QUERY_EX() routine. This component constructs prompts such as "Enumerate system hardware details" and dispatches them to the Qwen 2.5-Coder-32B-Instruct model at router.huggingface.co.
The model responds with custom Windows command sequences, such as invoking systeminfo, wmic cpu, wmic diskdrive, and dsquery, which the malware executes with elevated privileges to acquire system and network data.
LAMEHUG distinguishes itself by employing dynamic queries to a Qwen 2.5-Coder-32B-Instruct model through the Hugging Face API.
Through analysis, the Splunk Threat Research Team (STRT) has reconstructed several of these automated prompt-response cycles, uncovering precise instructions for:
System Information Discovery (T1082) : Collecting operating system, hardware, and environment details using systeminfo and wmic. Automated File Collection (T1119) : Recursively copying sensitive documents (e.g., .docx, .pdf) from user directories to C:\ProgramData\info using xcopy.exe.
This adaptive strategy permits LAMEHUG to refine its reconnaissance and collection logic based on real-time feedback from the target host, learning which commands succeed and modifying subsequent prompts accordingly.
LAMEHUG System Information Discovery and File Collection.
Post data consolidation, LAMEHUG exfiltrates the data via either SSH or HTTP channels. One variant utilizes an SSH session to a C2 server, authenticating with embedded credentials to transfer info.txt and collected files. Another variant Base64-encodes LLM prompt messages and collected data, posting them via HTTPS to a PHP endpoint.
LAMEHUG’s operations may resemble legitimate administrative activities due to its use of standard Windows utilities. However, several detection strategies can identify anomalies:
WMI Reconnaissance Detection : Monitoring WMIC commands for CPU, diskdrive, memorychip, nic, and computersystem queries can highlight suspicious enumeration consistent with T1082 activity. Net Service Enumeration : Detecting net start usage for listing services may indicate an interest in security-related processes by attackers. File Collection via Copy Utilities : Alerts on recursive xcopy.exe commands targeting user document extensions can identify automated data gathering. AI Platform DNS Queries : Observing DNS requests to router.huggingface.co from common host processes such as python.exe and powershell.exe can reveal unauthorized LLM interactions.
LAMEHUG’s integration of malware with LLMs signifies a paradigm shift towards attacks that dynamically adapt and craft commands to probe and exploit compromised systems.
Defenders must enhance telemetry for legitimate-looking utility usage, monitor unusual AI-service network activity, and employ behavior-based detections to counter these emerging threats.
By combining vigilant anomaly detection with targeted network and endpoint monitoring, SOC teams can disrupt LAMEHUG’s reconnaissance and data theft operations before significant damage occurs.
SHA256 Hashes Description 384e8f3d300205546fb8c9b9224011b3b3cb71adc994180ff55e1e6416f65715 LAMEHUG 766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777 LAMEHUG bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3 LAMEHUG d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e LAMEHUG
Based on reporting by GBHackers.