What Is LameHug? How APT28 is using LLMs to generate attack commands

LameHug is a Python-based information stealer identified by CERT‑UA that uniquely leverages an LLM (Qwen 2.5-Coder-32B-Instruct) to dynamically generate data-extraction commands; ThreatLocker’s analysis ties the malware to APT28 (Fancy Bear), details technical differences between versions, provides multiple SHA256 hashes, domains and IPs as IOCs, and recommends mitigations such as application allowlisting, ringfencing, storage control, and EDR detection.