Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Cato CTRL™ Threat Research: Analyzing LAMEHUG – First Known LLM-Powered Malware with Links to APT28 (Fancy Bear)
Threat Actors
Excerpt
Executive Summary On July 17, 2025, Ukraine’s Computer Emergency Response Team (CERT-UA) publicly reported LAMEHUG, which is being documented as the first known malware that integrates large language model (LLM) capabilities directly into its attack methodology. Key Facts: Discovery Date : July 10, 2025 Attribution : APT28 (Fancy Bear) with moderate confidence, according to CERT-UA. Target : Ukrainian government officials. …
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 144.126.202.227 | Medium | Score 70/100 | First seen |
| SHA256 | 766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777 | Medium | Score 53/100 | First seen |
| SHA256 | d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e | Medium | Score 53/100 | First seen |
| boroda70@meta.ua | High | Score 58/100 | First seen | |
| MD5 | 81cd20319c8f0b2ce499f9253ce0a6a8 | Medium | Score 53/100 | First seen |
| MD5 | 3ca2eaf204611f3314d802c8b794ae2c | Medium | Score 53/100 | First seen |
| URL | https://stayathomeclasses.com/slpw/up.php | High | Score 58/100 | First seen |
| SHA256 | 384e8f3d300205546fb8c9b9224011b3b3cb71adc994180ff55e1e6416f65715 | Medium | Score 53/100 | First seen |
| MD5 | abe531e9f1e642c47260fac40dc41f59 | High | Score 73/100 | First seen |
| SHA256 | bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3 | Medium | Score 53/100 | First seen |
| Domain | image.py | High | Score 58/100 | First seen |
| IP | 192.36.27.37 | High | Score 58/100 | First seen |
| MD5 | f72c45b658911ad6f5202de55ba6ed5c | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…