Nov AI Threat Tracker

LAMEHUG has the ability to collect system information and files of interest from compromised systems.

LAMEHUG can gather service information on targeted systems.

LAMEHUG can enumerate network information on compromised hosts.

LAMEHUG payloads have been disguised with legitimate looking filenames including AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe.

LAMEHUG can exfiltrate collected system information and documents to C2.

LAMEHUG can gather process information on targeted systems.

LAMEHUG can use Python scripts for execution.

LAMEHUG can save collected data and files of interest in `C:\ProgramData\info\` to consolidate for exfiltration.

LAMEHUG has the ability to execute Windows commands returned from C2 to gather system information.

LAMEHUG can target directories on victim machines for file collection.

LAMEHUG has used the Hugging Face API to query the Qwen2.5-Coder-32B-Instruct LLM to generate one-line Windows commands for the collection of system information and documents in specific folders on compromised hosts. LAMEHUG subsequently executed the returned commands and exfiltrated the collected files and information to adversary-controlled C2 servers.

LAMEHUG can recursively copy files from targeted directories on victim hosts.

LAMEHUG can gather Active Directory domain information.

APT28 has deployed LAMEHUG which can can query an LLM to generate and return commands for post compromise activity on targeted systems.