CyberStrikeAI used in real attacks on African and Latin American education organizations
Original title: CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations
Kaspersky reports a campaign deploying open-source CyberStrikeAI framework with LLM orchestrator targeting education organizations in Africa and Latin America.
Kaspersky's Cyber Threat Intelligence team identified a malicious campaign using CyberStrikeAI, an open-source framework combining LLM-based orchestration on the C2 server with agent implants. Confirmed victims include organizations in the education sector in several countries across Africa and Latin America. The framework automates post-exploitation phases such as persistence, reconnaissance, lateral movement, credential dumping, and data exfiltration. The campaign progresses from initial SQL Server compromise to full domain compromise.
Unconfirmed: Specific threat actors are not named in the report.
- CyberStrikeAI is a Go-based modular platform isolating the LLM orchestrator on the control server.
- Attacks include a two-week pause after initial reconnaissance and a rapid 2-minute persistence phase followed by domain reconnaissance.
- Lateral movement uses SMB and WMI with mass credential dumping completed in under one hour.
- Detection artifacts include self-signed TLS certificates in the control panel and unique build metadata paths.
- Implant uses fixed X-Implant-Token in HTTP headers for C2 communication.
Impact: AI-assisted automated post-exploitation and lateral movement
- Vendors
- Kaspersky
- Products
- SQL Server
- Malware
- CyberStrikeAI
- Countries
- AfricaLatin America
- AI models
- LLM
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dnslog.cn | esses of the compromised machines using the Chinese service dnslog[.]cn. The service generates a random third-level domain, after |
| ipv4 | 185.186.245.144 | ple above is a reverse shell that connects to the server at 185.186.245[.]144:5501: The p1.ps1 payload and similar scripts were distrib |
From the original article
13 min read at securelist.com
We analyze a series of attacks on educational institutions that were fully automated during the post-exploitation phase using the CyberStrikeAI penetration testing framework.
By Kirill Antonov, Vladislav Vlasov, Dmitry Chizhmak · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.