Leaderboard / Case No. FB-2025-07-10-alibaba-apt28-lamehug-qwen
Russia's APT28 sent Ukrainian government bodies malware that asked Qwen2.5-Coder, through the Hugging Face API, to write the Windows commands it then ran to profile each machine and gather documents for theft.
Score breakdown
| Component | Value | Reasoning |
|---|---|---|
| Sentence-Years | 5 | 18 USC 1030(a)(2)(C). Running a data miner on government computers to steal documents is unauthorized access to obtain information, done here for state espionage, the five-year tier of 18 USC 1030(c)(2)(B)(ii). This is APT28's exposure. |
| × Contribution | 2 | Ran the operation: GTIG says the malware "uses the Hugging Face API to query the LLM Qwen2.5-Coder-32B-Instruct to generate one-line Windows commands", whose output "are then blindly executed locally by PROMPTSTEAL before the output is exfiltrated". The model chose and wrote the commands run on victims' machines, live, so it ran that part of the operation. |
| × Blast Radius | 3 | Foreign government: CERT-UA's alert, reported by Security Affairs, says the phishing campaign targeted Ukraine's executive authorities with an archive disguised as a ministry document. GTIG says APT28 used the malware "against Ukraine". |
| × Legal status | 1 | Crime. |
| + Tradecraft | 0 | GTIG thinks the Hugging Face API tokens were probably stolen, but those were the attackers' access to the model, not a technique the model used against victims. The model's commands only gathered system information and documents, so no rubric technique is credited. |
| + Guardrails | 0 | Guardrails intact: The open-weight model was queried as published on Hugging Face, and GTIG says probably with stolen API tokens. No jailbreak or removal of safety training is described. |
| + Dwell Time | 3 | CERT-UA identified the campaign on July 10, 2025, and GTIG says it saw APT28 using the malware in June. July 10 is used as the latest possible date and dwell is 0. CERT-UA, a third party, found it. |
| Total | 33 |
Charges the human could face
18 USC 1030(a)(2)(C)Up to 5 yearsCriminal Code of Ukraine art. 361 (unauthorized interference with computers and networks)UA