Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Hackers are abusing CyberStrikeAI, an open-source penetration-testing framework, to orchestrate network intrusions against educational organizations across Africa and Latin America.

The findings illustrate AI moving beyond attack preparation into operational decision-making.

Published November 2, Kaspersky’s investigation describes a human-directed operation in which an LLM selects tools, generates commands, interprets results, and determines subsequent actions.

The operator retains strategic control, while conventional implants execute the model’s instructions on compromised systems.

Kaspersky characterizes the activity as among the earliest publicly documented real-world compromises involving LLM orchestration.

Written in Go, CyberStrikeAI combines AI orchestration, command-and-control infrastructure, and endpoint beacons.

Its legitimate project documentation describes an authorized security-testing platform with Model Context Protocolintegrations, attack-chain workflows, and human approval mechanisms.

Attackers repurposed these capabilities for malicious operations.

Crucially, the implant contains no AI functionality, API keys, or autonomous reasoning. Intelligence remains on the attacker’s server, where C2 functions are exposed as MCP tools.

The beacon polls its listener over HTTP/S, TCP, or WebSocket, executes commands, and returns results. Consequently, compromised endpoints exhibit familiar remote-control behavior rather than direct interactions with AI providers.

In one reconstructed incident, the operator initially accessed a compromised SQL Server running version 16.0.1000.

Commands originated from sqlservr.exe, indicating the execution context, although the report does not establish a specific vulnerability responsible for access.

Kaspersky researchers documented, attackers using server-side large language models to direct post-exploitation activity, progressing from reconnaissance to domain compromise and database collection.

Timeline of the attack (Source : Kaspersky).

Manual reconnaissance and tool deployment occupied nearly one day, followed by a two-week pause.

After deployment, CyberStrikeAI established persistence and performed local reconnaissance within two minutes. Domain discovery continued for approximately five hours.

The attackers also manually checked for internet access and obtained the external IP addresses of the compromised machines using the Chinese service dnslog[.]cn.

![Image 2: dnslog[.]cn (Source : Kaspersky).](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/10/30191947/cyberstrikeai-attacks22-680x350.png)

dnslog[.]cn (Source : Kaspersky).

After another pause lasting several days, the group completed lateral movement, widespread credential dumping, and database export within an hour. Agent deployment to domain-administrator compromise took three to four days.

Persistence included a scheduled task named SystemUpdate, while payloads masqueraded as legitimate processes using names such as svchosts.exe.

PowerShell commands were Base64-encoded, and fragmented scripts were reconstructed using certutil. Generated LDAP queries mapped Active Directory and identified opportunities for Kerberoasting and AS-REP Roasting.

Credential theft relied on registry-hive dumping, LSASS memory extraction through comsvcs.dll, and renamed Mimikatz binaries.

Attackers subsequently performed DCSync and Golden Ticket attacks. SMB administrative shares, WMI, and Impacket’s WMIExec supported lateral movement, while generated SQL queries enabled targeted database collection.

Build metadata separated samples into two clusters with distinct infrastructure and server versions.

Chinese-language script comments, Chinese services, and UTC+8 restart patterns suggested Chinese-speaking operators, but researchers could not identify a known threat group or prove common control.

Reported infrastructure includes 185.186.245[.]144, 104.234.26[.]163, fastcdn[.]bar, and media.fastcdn[.]bar.

Investigators also identified an X-Implant-Token HTTP header embedded during payload compilation, framework-branded self-signed certificates, and Go build artifacts as useful correlation points.

Defenders should prioritize suspicious SQL Server child processes, encoded PowerShell, remote scheduled tasks, LSASS access, anomalous LDAP enumeration, and WMI execution.

Kaspersky emphasizes that established behavioral detections remain applicable: AI accelerates and adapts familiar intrusion techniques rather than making endpoint activity fundamentally invisible.

Correlating endpoint, identity, and network telemetry remains central to detecting these operations before privileged compromise.

Indicators of compromise

D726A8B4886C636F76CA6D30EF6A6FF4 c:\windows\temp\svchosts.exe 2770562d104391b92b42671c270079bb c:\windows\temp\svcmon32.exe c:\programdata\svcmon32.exe

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.