APT28 Deleted the Payload. A Worm Deleted the Operator. OIDC Deleted the Password. That's One Pattern.
- Patrick Duggan
- 2 days ago
- 6 min read
Security tools are built to catch a thing. Antivirus catches a payload. Secret-scanning catches a credential. Behavioral analytics catches an operator — a human doing human-shaped work at human-shaped hours. Every one of those defenses is an assumption wearing a product badge: it assumes the thing it looks for is present to be found.
The most interesting attacks of the last twelve months have a single move in common, and once you see it you cannot unsee it. They win by deleting the thing the defense assumes is there. Not evading it. Deleting it. If there is no payload, the payload scanner has nothing to score. If there is no stored credential, the secret-scanner has nothing to flag. If there is no human, the "attackers work nine to five" heuristic has no clock to read. Three different campaigns, three different crews, one grammar: subtraction.
We have covered two of the three as they landed. The third we never named, because when it appeared a year ago it was a curiosity, not a pattern. It takes three points to draw a line, and the third point only just arrived. Here is the line.
July 2025: APT28 deletes the payload
The origin is a piece of malware called LAMEHUG, and to be precise about the calendar — because precision is the whole job — it is not new. Ukraine's CERT-UA disclosed it on July 17, 2025, after reports on July 10 of phishing emails sent from compromised accounts impersonating Ukrainian ministry officials. Cato's researchers and others analyzed it through the back half of 2025. We are not reporting it as breaking. We are reporting it as the thing that started a pattern we can only now see whole.
What LAMEHUG did was quietly radical. It was a PyInstaller-compiled Python program, delivered in a ZIP, and attributed with moderate confidence to APT28 — Fancy Bear, the crew Western agencies tie to GRU Unit 26165. But the binary did not carry its attack. It carried a phone number. At runtime it base64-decoded a plain-English prompt — "gather system information," "find documents on the desktop" — and sent it over HTTPS to the Hugging Face API, where the open-source Qwen2.5-Coder model (built by Alibaba Cloud, designed to turn English into shell commands) wrote the actual Windows commands back. LAMEHUG then ran them: recon into an info.txt, a recursive sweep of Documents, Desktop, and Downloads, exfiltration over SFTP or HTTP POST. The operators authenticated to the model with roughly 270 Hugging Face tokens.
Sit with what that means for a payload scanner. There was no malicious command in the file to sign. The offensive logic did not exist until the moment of execution, and it was manufactured on demand by a legitimate AI service reachable over ordinary TLS. You cannot write a YARA rule for a payload that has not been generated yet. LAMEHUG deleted the payload and replaced it with an API call. First corner.
December 2025 onward: Shai-Hulud deletes the operator
The second corner is one we have written on more than once, because it kept coming back. Shai-Hulud is the first genuinely self-replicating worm the npm ecosystem has seen. We published our anatomy of the V2 wave in December, and watched it recur through the spring — Nx, the mini variants, the dev-tooling soft surface bleeding month after month.
Its propagation is the point. A developer installs a poisoned package. A lifecycle script — post-install in the first wave, moved earlier to pre-install in the 2.0 wave to widen the blast radius into CI/CD before anyone can react — pulls down TruffleHog, the legitimate secret-scanner that recognizes more than eight hundred credential formats, and turns it on the victim's own machine. It finds the developer's npm token, authenticates as them, enumerates every other package they maintain, injects itself, and republishes. Then it commits the harvested secrets to a fresh public GitHub repo under the victim's name. The latest wave touched tens of thousands of repositories across roughly 350 accounts.
Nowhere in that chain is there a human operator making decisions. There is no command-and-control session for a defender to catch mid-keystroke, no working hours to profile, no operator fatigue, no time zone. The crew wrote the loop once and walked away; the loop does the spreading. Behavioral defenses that model an adversary as a person have nothing to model. Shai-Hulud deleted the operator. Second corner.
July 2026: AsyncAPI deletes the credential
The third corner landed five days ago, and we covered it on July 15 — though we led with a different angle then, the IPFS payload-hosting trick, because that was the part with our own tooling receipt attached. Standing next to the other two, its real significance snaps into focus.
On July 14, an attacker published five poisoned versions across four packages in the @asyncapi npm namespace — packages pulling more than two million downloads a week. The detail that matters for this pattern is the one thing the attacker did not need: a stolen token. There was no compromised npm credential. The attacker pushed to a branch in the project's own GitHub repository, and the project's own CI pipeline — configured for trusted publishing via GitHub Actions OIDC — minted a short-lived publish credential and shipped the packages as itself. The trust was not stolen. It was borrowed from the pipeline, on demand, exactly as designed.
Trusted publishing with OIDC exists precisely so maintainers stop keeping long-lived npm tokens lying around to be phished. It is good security advice. It removes the stored secret. And that is the point an attacker turned inside-out: if you have removed the credential so it cannot be stolen, then compromising the workflow that summons the credential is worth more than any token ever was, because there is no token to rotate, revoke, or scan for. AsyncAPI deleted the credential. Third corner.
The line the three points draw
Read them together and the grammar is undeniable. LAMEHUG removed the payload and reached for a model. Shai-Hulud removed the operator and reached for a loop. AsyncAPI removed the credential and reached for a pipeline's own trust. Each one subtracted the exact artifact a category of defense was built to detect, and each one substituted a legitimate service — Hugging Face, the npm registry, GitHub Actions OIDC — doing exactly what it was designed to do.
That is the pattern, and it is why we think it earns a number of its own rather than a footnote under supply-chain. We have called the supply-chain family Pattern 38 since the stolen-2023-credentials era, but Pattern 38 assumes a stolen secret is the crime. This is the negative of that photograph. The defining feature is absence: the malware you cannot scan because it was never written down, the operator you cannot profile because there isn't one, the credential you cannot revoke because it lived for ninety seconds inside a pipeline you trust. We are filing it as Pattern 52: the Subtraction Attack.
If we are right, the defensive implication is uncomfortable and clarifying at once. You cannot catch a subtraction by looking harder for the thing that was removed — that is looking for a shadow with a brighter flashlight. You catch it at the substitute. The outbound TLS to an AI inference endpoint from a process that has no business talking to one. The lifecycle script that reaches for a secret-scanner. The pipeline that publishes without a human in the loop, from a branch push that never went through review. Watch the borrowed trust, not the missing artifact.
We put our confidence at about 95 percent that these three are one pattern and not three coincidences, and we will say plainly where the last 5 percent hides: three points is the minimum a line needs, and a line drawn on the minimum is the easiest kind to be wrong about. If the fourth campaign subtracts something these three did not — the network path, the file on disk, the process itself — the shape holds and the name was right. If instead the crews go back to stealing tokens and shipping signed payloads because subtraction turned out to be harder to operationalize than to admire, then we named a moment, not a movement, and we will say so. But the origin was a year ago and the newest corner was last week, and the trend line between them does not point back toward the old way.
The honest read on our own coverage is worth stating too, since we hold ourselves to naming the miss. We wrote the descendants and never wrote the ancestor. LAMEHUG sat in our blind spot for a year because, alone, it looked like a clever one-off from a Russian military crew, not the first move in a grammar. It took the other two corners to make the first one legible. That is what a pattern costs: you usually cannot see the first instance until the third one shows up to explain it.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments