CyberStrikeAI agents used in Windows domain takeovers
Original title: Hackers Use CyberStrikeAI Agents to Automate Windows Domain Takeovers and Credential Theft
Securelist says education networks in Africa and Latin America were taken from SQL Server to domain admin in days.
Securelist says criminals used the open-source Go framework CyberStrikeAI so a language model on the attacker's server chose tools and commands during live intrusions. Confirmed victims include education organizations in Africa and Latin America. After a human foothold on a SQL Server and a roughly two-week pause, the agent mapped domains, collected Kerberoasting and AS-REP Roasting data, moved via SMB and WMI, dumped credentials, then used a renamed Mimikatz for DCSync and Golden Ticket. Securelist could not tie the activity to a known group.
Unconfirmed: Securelist suggests a Chinese-speaking operator but could not attribute the campaign to a known group.
- The implant on victims has no AI; the model runs on the control server.
- Persistence used a scheduled task named SystemUpdate.
- From agent install to domain admin took three to four days.
- Clues include Chinese script comments, dnslog.cn, and UTC+8 hours.
- Defenders are told to watch schtasks, LSASS access, Event ID 4662, and sqlservr.exe.
Impact: Domain admin, credential theft, and database export
- 1.Watch for remote schtasks.exe tasks, LSASS access, and WMI or WinRM from unusual hosts.
- 2.Use Event ID 4662 to spot DCSync from non-domain controllers.
- 3.Rotate krbtgt twice after domain-admin compromise and restrict exposed SQL Servers.
- ATT&CK
- T1558.003 KerberoastingT1558.004 AS-REP RoastingT1003.001 LSASS MemoryT1003.006 DCSyncT1558.001 Golden Ticket
- Vendors
- Microsoft
- Products
- WindowsSQL Server
- Malware
- CyberStrikeAIMimikatz
- Organizations
- Securelist
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dnslog.cn | scripts into several files, and rebuilt them with certutil. DNSLog.cn (Source – Securelist) They also named one beacon svchosts.e |
| domain | fastcdn.bar | ) IP address 185.186.245[.]144 C2 for Windows beacon Domain fastcdn[.]bar C2 for Windows beacon Domain media.fastcdn[.]bar C2 for L |
| ipv4 | 104.234.26.163 | n Domain media.fastcdn[.]bar C2 for Linux beacon IP address 104.234.26[.]163 C2 for payload delivery and Linux beacon Note: IP address |
| ipv4 | 185.186.245.144 | ramData\p1.ps1 (reverse shell PowerShell script) IP address 185.186.245[.]144 C2 for Windows beacon Domain fastcdn[.]bar C2 for Windows |
| md5 | 09e1da2afa1216ecc55648ec8e122d2a | indows\temp\svcmon32.exe, c:\programdata\svcmon32.exe) Hash 09e1da2afa1216ecc55648ec8e122d2a CyberStrikeAI Linux beacon Hash 805B9E4AE74C903787416800999 |
| md5 | 0bbd08af95f877f1d568b03de2eb76b4 | 74F57B3E897A4960DCDD5B7E8A54F9DF c:\rwx\RogueWinRM.exe Hash 0BBD08AF95F877F1D568B03DE2EB76B4 c:\ProgramData\p1.ps1 (reverse shell PowerShell script) IP |
| md5 | 2770562d104391b92b42671c270079bb | StrikeAI Windows beacon (c:\windows\temp\svchosts.exe) Hash 2770562d104391b92b42671c270079bb CyberStrikeAI Windows beacon (c:\windows\temp\svcmon32.exe, |
| md5 | 29efd64dd3c7fe1e2b022b7ad73a1ba5 | E4AE74C903787416800999B8418 CyberStrikeAI Linux beacon Hash 29EFD64DD3C7FE1E2B022B7AD73A1BA5 C:\Windows\Temp\wdiag2.exe (Mimikatz) Hash 74F57B3E897A4960 |
| md5 | 74f57b3e897a4960dcdd5b7e8a54f9df | 2B022B7AD73A1BA5 C:\Windows\Temp\wdiag2.exe (Mimikatz) Hash 74F57B3E897A4960DCDD5B7E8A54F9DF c:\rwx\RogueWinRM.exe Hash 0BBD08AF95F877F1D568B03DE2EB76B4 |
| md5 | 805b9e4ae74c903787416800999b8418 | a2afa1216ecc55648ec8e122d2a CyberStrikeAI Linux beacon Hash 805B9E4AE74C903787416800999B8418 CyberStrikeAI Linux beacon Hash 29EFD64DD3C7FE1E2B022B7AD73 |
| md5 | d726a8b4886c636f76ca6d30ef6a6ff4 | tors of compromise (IoCs):- Type Indicator Description Hash D726A8B4886C636F76CA6D30EF6A6FF4 CyberStrikeAI Windows beacon (c:\windows\temp\svchosts.exe) |
From the original article
4 min read at cybersecuritynews.com
Hackers are now using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed victims. The tool lets a language model decide which commands to run, so the operator no longer types each step by hand.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.