APT28, also widely known as Fancy Bear, Pawn Storm, Sofacy, Sednit, STRONTIUM, Forest Blizzard, FROZENLAKE, and other aliases, is a highly active Russian state-sponsored cyber espionage group. It is attributed with high confidence to Russia’s General Staff Main Intelligence Directorate (GRU), specifically Unit 26165 (85th Main Special Service Center, GTsSS). The group has operated since

PromptSteal (also known as PROMPTSTEAL or tracked by Ukrainian CERT-UA as LAMEHUG) is a sophisticated AI-integrated data miner malware first observed in live operations in June 2025. It represents a landmark case: the first documented instance of malware actively querying a large language model (LLM) during execution in real-world cyberattacks, according to Google Threat Intelligence

PromptFlux (often stylized as PROMPTFLUX) is an experimental AI-generated malware family first identified by Google Threat Intelligence Group (GTIG) in early June 2025. It represents one of the earliest documented examples of malware that actively uses a large language model (LLM) during runtime to dynamically modify its own code — a technique Google describes as

AI-generated malware represents a rapidly evolving threat in the cybersecurity landscape as of March 2026. Powered by advancements in generative AI and agentic systems, attackers are using these technologies to create more sophisticated, adaptive, and scalable malicious code. This article explores the key aspects, drawing from recent reports and expert insights. Understanding AI-Generated Malware: The