government-of-ukraine

What changed

Ukraine's CERT-UA and Cato CTRL reported LAMEHUG, the first known malware to integrate a large language model (Qwen2.5-Coder-32B-Instruct via Hugging Face) for real-time command generation. Attributed with moderate confidence to APT28 (Fancy Bear), the malware reportedly targeted Ukrainian officials through phishing emails. The LLM is reported to have dynamically generated reconnaissance and data-exfiltration commands executed on infected systems.

Timeline

1. 4 Oct 2025LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack
   Incident82%

   • Cato CTRL™ Threat Research: Analyzing LAMEHUG – First Known LLM-Powered Malware with Links to APT28 (Fancy Bear)https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/
   • Кібератаки UAC-0001 на сектор безпеки та оборони із застосуванням програмного засобу LAMEHUG, що використовує LLM (вели…https://cert.gov.ua/article/6284730
   • AI Incident Database - Incident 1220https://incidentdatabase.ai/cite/1220/

   Cato CTRL™ Threat Research: Analyzing LAMEHUG – First Known LLM-Powered Malware with Links to APT28 (Fancy Bear)Кібератаки UAC-0001 на сектор безпеки та оборони із застосуванням програмного засобу LAMEHUG, що використовує LLM (вели…AI Incident Database - Incident 1220
2. 3 July 2025Reported AI-Generated Audio of Ukrainian Commander Andriy Biletsky Used in Russian Disinformation Campaign
   Incident78%

   • Russia has fabricated an audio track of an interview with the commander of the Third Army Corpshttps://www.ukrinform.net/rubric-factcheck/4010029-russia-spreads-fake-news-about-ukrainian-commander-andrii-biletskyi.html
   • AI Incident Database - Incident 1133https://incidentdatabase.ai/cite/1133/

   Russia has fabricated an audio track of an interview with the commander of the Third Army CorpsAI Incident Database - Incident 1133
3. 3 July 2025Reported Deepfakes of Ukrainian Deputy PM Olha Stefanishyna Allegedly Supporting Fictional Mobilization Plan for Women
   Incident82%

   • New fake of ru-propaganda about the mobilisation of women in Ukrainehttps://cpd.gov.ua/en/international-threats-en/usa/new-fake-of-ru-propaganda-about-the-mobilisation-of-women-in-ukraine/
   • Russian propagandists spread rumors about the mobilization of women in Ukraine: CPD debunked another fakehttps://unn.ua/en/news/russian-propagandists-spread-rumors-about-the-mobilization-of-women-in-ukraine-cpd-debunked-another-fake
   • AI Incident Database - Incident 1134https://incidentdatabase.ai/cite/1134/

   New fake of ru-propaganda about the mobilisation of women in UkraineRussian propagandists spread rumors about the mobilization of women in Ukraine: CPD debunked another fakeAI Incident Database - Incident 1134
4. 11 May 2025'Pravda' Network, Successor to 'Portal Kombat,' Allegedly Seeding AI Models with Kremlin Disinformation
   Incident82%

   • A well-funded Moscow-based global ‘news’ network has infected Western artificial intelligence tools worldwide with Russ…https://www.newsguardrealitycheck.com/p/a-well-funded-moscow-based-global
   • Exclusive: Russian disinformation floods AI chatbots, study findshttps://www.axios.com/2025/03/06/exclusive-russian-disinfo-floods-ai-chatbots-study-finds
   • AI Incident Database - Incident 968https://incidentdatabase.ai/cite/968/

   A well-funded Moscow-based global ‘news’ network has infected Western artificial intelligence tools worldwide with Russ…Exclusive: Russian disinformation floods AI chatbots, study findsAI Incident Database - Incident 968
5. 11 Mar 2025Purported Deepfake Audio Allegedly Impersonates U.S. Secretary of State Marco Rubio in Starlink Disinformation Campaign
   Incident78%

   • Fake Marco Rubio audio on Starlink, Ukraine spreads onlinehttps://factcheck.afp.com/doc.afp.com.36ZP828
   • AI Incident Database - Incident 974https://incidentdatabase.ai/cite/974/

   Fake Marco Rubio audio on Starlink, Ukraine spreads onlineAI Incident Database - Incident 974
6. 7 Mar 2025Purported Deepfake Targets Olena Zelenska in Alleged Russian Disinformation Campaign
   Incident82%

   • Deepfake video targeting Zelensky’s wife linked to Russian disinformation campaign, CNN analysis showshttps://www.cnn.com/2024/07/02/europe/deepfake-video-zelensky-wife-intl-latam/index.html
   • Deepfake targets Ukraine's first lady Olena Zelenksa with false claim she bought Bugattihttps://www.cbsnews.com/news/olena-zelenska-false-claim-she-bought-bugatti/
   • AI Incident Database - Incident 755https://incidentdatabase.ai/cite/755/

   Deepfake video targeting Zelensky’s wife linked to Russian disinformation campaign, CNN analysis showsDeepfake targets Ukraine's first lady Olena Zelenksa with false claim she bought BugattiAI Incident Database - Incident 755

PSF mapping