Attackers use CyberStrikeAI to direct intrusions at schools
Original title: Hackers Weaponize Open-Source CyberStrikeAI Framework to Launch AI-Powered Network Intrusions
Kaspersky says a human operator used an LLM on the C2 server to pick tools while Go beacons ran commands on compromised hosts.
Kaspersky reports that attackers repurposed the open-source Go framework CyberStrikeAI against educational organizations in Africa and Latin America. An operator kept strategic control while a server-side LLM chose tools, generated commands, and interpreted results; the implant itself had no model, API keys, or autonomous reasoning. In one case, activity started from SQL Server 16.0.1000, then moved through persistence, Active Directory discovery, credential dumping, DCSync, Golden Ticket use, and database export. Researchers saw Chinese-language clues but did not name a known group or prove a shared controller, and they did not identify a vulnerability used for initial access.
Unconfirmed: Chinese-speaking operators are suggested by comments, services, and UTC+8 patterns, but no known group is identified.
- Agent deployment to domain-administrator compromise took three to four days in the reconstructed case.
- Persistence used a scheduled task named SystemUpdate and names such as svchosts.exe.
- Credential theft included LSASS via comsvcs.dll, renamed Mimikatz, Kerberoasting, and AS-REP roasting.
- Reported infrastructure includes 185.186.245.144, 104.234.26.163, and fastcdn.bar.
- Two sample clusters were split by build metadata, infrastructure, and server versions.
Impact: domain compromise, credential theft, and database collection
- 1.Hunt SQL Server child processes, encoded PowerShell, remote scheduled tasks, and LSASS access.
- 2.Watch for anomalous LDAP enumeration, WMI execution, and the listed file hashes.
- ATT&CK
- T1053.005 Scheduled TaskT1003.001 LSASS MemoryT1558.003 KerberoastingT1003.006 DCSyncT1047 Windows Management Instrumentation
- Products
- SQL Server
- Malware
- MimikatzCyberStrikeAI
- Organizations
- Kaspersky
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dnslog.cn | esses of the compromised machines using the Chinese service dnslog[.]cn. dnslog[.]cn (Source : Kaspersky). After another pause la |
| domain | fastcdn.bar | nfrastructure includes 185.186.245[.]144, 104.234.26[.]163, fastcdn[.]bar, and media.fastcdn[.]bar. Investigators also identified a |
| ipv4 | 104.234.26.163 | ontrol. Reported infrastructure includes 185.186.245[.]144, 104.234.26[.]163, fastcdn[.]bar, and media.fastcdn[.]bar. Investigators al |
| ipv4 | 185.186.245.144 | p or prove common control. Reported infrastructure includes 185.186.245[.]144, 104.234.26[.]163, fastcdn[.]bar, and media.fastcdn[.]bar |
| md5 | 2770562d104391b92b42671c270079bb | 26A8B4886C636F76CA6D30EF6A6FF4 c:\windows\temp\svchosts.exe 2770562d104391b92b42671c270079bb c:\windows\temp\svcmon32.exe c:\programdata\svcmon32.exe No |
| md5 | d726a8b4886c636f76ca6d30ef6a6ff4 | ions before privileged compromise. Indicators of compromise D726A8B4886C636F76CA6D30EF6A6FF4 c:\windows\temp\svchosts.exe 2770562d104391b92b42671c270079 |
From the original article
3 min read at gbhackers.com
Hackers are abusing CyberStrikeAI, an open-source penetration-testing framework, to orchestrate network intrusions against educational organizations across Africa and Latin America. The findings illustrate AI moving beyond attack preparation into operational decision-making.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.