Splunk LAMEHUG SEP 2025

LAMEHUG has the ability to collect system information and files of interest from compromised systems.

LAMEHUG can use `whoami` to enumerate the system user.

LAMEHUG payloads have been disguised with legitimate looking filenames including AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe.

LAMEHUG can exfiltrate collected system information and documents to C2.

LAMEHUG can use wmic to collect system information.

LAMEHUG can use `cmd.exe` to display a decoy file to spearphishing victims.

LAMEHUG can use Python scripts for execution.

LAMEHUG can use HTTP POST requests to exfiltrate data from compromised hosts to C2.

LAMEHUG can save collected data and files of interest in `C:\ProgramData\info\` to consolidate for exfiltration.

LAMEHUG has the ability to execute Windows commands returned from C2 to gather system information.

LAMEHUG can target directories on victim machines for file collection.

LAMEHUG has used the Hugging Face API to query the Qwen2.5-Coder-32B-Instruct LLM to generate one-line Windows commands for the collection of system information and documents in specific folders on compromised hosts. LAMEHUG subsequently executed the returned commands and exfiltrated the collected files and information to adversary-controlled C2 servers.

LAMEHUG can recursively copy files from targeted directories on victim hosts.

LAMEHUG can encode queries sent to LLMs.

LAMEHUG can decode and drop a decoy file attached to spearphishing emails.

LAMEHUG has been executed through victim interaction with malicious email attachments made to look like legitimate AI applications or documents.

LAMEHUG can xcopy for file collection on targeted systems.

LAMEHUG has been distributed through spearphishing emails with various AI-themed malicious attachments.

LAMEHUG can use SSH to transfer information to C2.