CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign
19.07.2025
11769
APT28 targets Ukrainian government officials with a phishing campaign delivering LAMEHUG malware, utilizing Alibaba Cloud’s LLM for data harvesting.
CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign
APT28, also known as Fancy Bear, has been caught red-handed targeting Ukrainian government officials with a sophisticated phishing campaign. The kicker? They're using Alibaba Cloud’s large language model (LLM) to harvest data like it's going out of style. The malware in question, dubbed LAMEHUG, is the latest tool in their cyber-espionage arsenal.
This isn't just any phishing campaign. It's a meticulously crafted operation leveraging the power of LLMs to create highly convincing phishing emails. The goal? To deliver the LAMEHUG malware, which then proceeds to siphon off sensitive data from its victims. It's a stark reminder of how advanced threat actors are getting in their methods.
- • APT28, linked to Russian intelligence, is behind this campaign.
- • The campaign specifically targets Ukrainian government officials.
- • Uses Alibaba Cloud’s LLM for crafting phishing emails.
- • Delivers LAMEHUG malware for data exfiltration.
The discovery by CERT-UA underscores the evolving threat landscape, where AI and machine learning tools are increasingly being weaponized. It's a wake-up call for cybersecurity professionals worldwide to stay ahead of these sophisticated tactics.
#malware#Artificial Intelligence#cybersecurity#cyber espionage#phishing
Got a topic? Write to ATLA WIRE on Telegram:t.me/atla_community
