LAMEHUG
Software · ATTACK:enterprise:S9035
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9035",
"title": "LAMEHUG",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9035",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--c55e0410-842d-4365-a2c8-26c0330f85b8",
"external_id": "S9035",
"domain": "enterprise",
"created": "2026-04-21T12:07:59.044Z",
"modified": "2026-05-12T15:12:00.739Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "PROMPTSTEAL"
},
{
"source_name": "Splunk LAMEHUG SEP 2025",
"url": "https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"
},
{
"source_name": "Nov AI Threat Tracker",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"
},
{
"source_name": "Cato LAMEHUG JUL 2025",
"url": "https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"
}
]
}Explicit source assertions (26)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--036d0469-5302-48c9-b957-ae52cee49861
Splunk LAMEHUG SEP 2025 · Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05615e68-064a-467c-99eb-e5d7b510afcc
Splunk LAMEHUG SEP 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--170e1e46-f3ea-4edb-a115-dde5a7c13e0f
Splunk LAMEHUG SEP 2025 · Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1af945ec-f8bf-4aa9-9756-47e0d41690e3
Splunk LAMEHUG SEP 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24e3810a-7d05-4ccc-9326-80a5ac72cd55
Splunk LAMEHUG SEP 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1132
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26cded5f-d5ac-48cd-b042-d91e497ed3e9
Splunk LAMEHUG SEP 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4dee672e-a7ed-41de-94b6-83246688171d
Splunk LAMEHUG SEP 2025 · Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54a5c9b4-7447-44fd-8aca-4162e6d51c85
Cato LAMEHUG JUL 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63180054-9c6f-4a15-8361-a946d3bb26bb
Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6460c09b-2bde-4c4a-9765-591405d4ea8f
Splunk LAMEHUG SEP 2025 · Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cf769d6-3d2d-44a8-a8d0-dbf1da1f98d4
Splunk LAMEHUG SEP 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f1a8581-a028-4c0e-8445-cb25295bbb3a
Splunk LAMEHUG SEP 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89977608-f01e-4e84-88dc-532145b24943
Cato LAMEHUG JUL 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b737b16-0495-40cb-8719-68cb4d283c61
Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--903b7f1b-48e2-4f01-a9e5-454cb2c8ccb7
Nov AI Threat Tracker · Cato LAMEHUG JUL 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aad16378-db29-4ba9-b65b-90531ff20fd6
Splunk LAMEHUG SEP 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae68b625-d13e-45ae-8de9-dcb750499c7d
Splunk LAMEHUG SEP 2025ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S9035
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b016557c-86f6-4a2d-8963-4b580b8d5dcf
Nov AI Threat Tracker · Cato LAMEHUG JUL 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bab58303-c3d2-45c8-b175-e2cb6f19b720
Splunk LAMEHUG SEP 2025 · Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd097aa0-33e4-47a7-8ef4-b765aae9e76f
Splunk LAMEHUG SEP 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c469874c-492d-4975-abc1-1668fc65a70a
Splunk LAMEHUG SEP 2025 · Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3d8bcd3-9ea1-4bea-bcce-d8c302680c7a
Nov AI Threat Tracker · Cato LAMEHUG JUL 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8a1fe73-2234-4d74-a09c-a84b9cf3e7d1
Splunk LAMEHUG SEP 2025 · Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e67b8df0-ca16-467a-9d42-57ac9dee685a
Splunk LAMEHUG SEP 2025 · Nov AI Threat TrackerATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f028f4d1-4e68-4092-abc6-4d144d2f95a7
Splunk LAMEHUG SEP 2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ffd420b6-6edc-4d0d-8aa2-b5e94af4add0
Splunk LAMEHUG SEP 2025 · Nov AI Threat Tracker