Ryan Fetterman

Security Researcher, Cisco Foundation AI | Splunk SURGe.

Ryan highlights a recent case, initially reported in July 2025 by Ukraine’s CERT-UA which first publicly released a report on a novel malware strain dubbed LameHug, attributing it to APT28 with moderate confidence. The Python-based malware (delivered as .pif, .exe, and .py files compiled via PyInstaller) had no static defaults — instead, it contains base64-encoded prompts that are decoded at runtime and sent to the Qwen 2.5-Coder-32B-Instruct model through the Hugging Face API. The LLM responds with system-appropriate commands (e.g., for reconnaissance or document collection), which the malware immediately executes on the victim host — enabling truly dynamic, on-the-fly adaptation during an active attack.

MySec.TV

AI attackers on adoption curve with first report of a novel malware strain