LAMEHUG：利用动态 AI 生成命令的恶意软件 (AML.CS0044)

一句话通俗理解

APT28 的新玩具：命令由 LLM 动态生成——特征库追不上每台机器都不一样的恶意指令。

案例速览

事件经过

2025 年 7 月乌克兰安全部门披露 LAMEHUG——归因于俄属 APT28 的新型 AI 增强恶意软件：恶意命令由大模型动态生成，每台感染机器的命令形态都不同，规避静态特征检测；收集的数据经 SFTP/HTTP POST 外传至攻击者服务器。

运用的 ATLAS 技术

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0044 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

S00

• 有效账户 (AML.T0012)

  APT28 gained access to a compromised official email account.

S01

• 网络钓鱼 (AML.T0052)

  APT28 sent a phishing email from the compromised account with an attachment containing malware.

S02

• 冒充 (AML.T0073)

  The email impersonated a government ministry representative.

S03

• 伪装 (AML.T0074)

  The attachment was called “Appendix.pdf.zip” which could confuse the recipient into thinking it was a legitimate PDF file.

S04

• 用户执行 (AML.T0011)

  The attachment contained an executable file with a .pif extension, created using PyInstaller from Python source code which CERT-UA classified as LAMEHUG malware. Files with the .pif extension are executable on Windows.

S05

• 生成恶意命令 (AML.T0102)

  The LAMEHUG malware abused the Qwen 2.5 Coder 32B Instruct model via its Hugging Face API to generate malicious commands from natural language prompts.

S06

• 来自本地系统的数据 (AML.T0037)

  The LAMEHUG malware used the AI generated commands to collect system information (saved to %PROGRAMDATA%\info\info.txt) and recursively searched Documents, Desktop, and Downloads to stage files for exfiltration.

S07

• 通过网络手段渗漏 (AML.T0025)

  The LAMEHUG malware exfiltrated collected data to attacker controlled servers via SFTP or HTTP POST requests.

关联战术

• 初始访问 (AML.TA0004)
• 防御规避 (AML.TA0007)
• 执行 (AML.TA0005)
• AI 攻击适配 (AML.TA0001)
• 收集 (AML.TA0009)
• 数据渗漏 (AML.TA0010)

参考资料

以下为 MITRE ATLAS 官方案例收录的参考来源：

• LameHug malware uses AI LLM to craft Windows data-theft commands in real-time

• UAC-0001 cyberattacks on the security and defense sector using the LAMEHUG software tool, which uses LLM (large language model) (CERT-UA#16039)

• APT28’s New Arsenal: LAMEHUG, the First AI-Powered Malware

• MITRE ATLAS 官方案例页 (AML.CS0044)

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0