Attackers use CyberStrikeAI against education networks
November 2: GBHackers adds SQL Server 16.0.1000, two sample clusters split by build metadata, infrastructure 185.186.245.144, 104.234.26.163, and fastcdn.bar, and says no initial-access flaw was identified.
Kaspersky says open-source CyberStrikeAI automated post-exploitation on education networks in Africa and Latin America; no group is named.
Kaspersky’s Cyber Threat Intelligence team says attackers used the open-source Go framework CyberStrikeAI against education organizations in several countries in Africa and Latin America. A human operator kept strategic control while a language model on the control server chose tools, generated commands, and interpreted results; the victim implant has no model or API keys. After a foothold on SQL Server—version 16.0.1000 in one case—and a roughly two-week pause, activity reached domain administrator in three to four days through persistence, Active Directory discovery, SMB and WMI movement, credential dumping, DCSync, and Golden Ticket use. Researchers saw Chinese-language clues but did not name a known group, prove a shared controller, or identify the initial-access vulnerability.
- The victim implant has no AI; the LLM orchestrator stays on the control server.
- Persistence used a scheduled task named SystemUpdate and names such as svchosts.exe.
- In one case, agent install to domain admin took three to four days.
- Credential theft included LSASS, renamed Mimikatz, Kerberoasting, and AS-REP roasting.
- Clues include Chinese comments, dnslog.cn, UTC+8 hours, and a fixed X-Implant-Token header.
- Researchers did not name a group or identify an initial-access vulnerability.
What each outlet adds
beyond the shared facts- Kaspersky SecurelistDescribes the two-week pause, SMB and WMI movement, and X-Implant-Token.
- Cyber Security NewsAdds the SystemUpdate task, three-to-four-day timeline, dnslog.cn, and UTC+8.
- GBHackersAdds SQL Server 16.0.1000, two clusters, and listed infrastructure.
- Products
- SQL ServerWindows
- Malware
- MimikatzCyberStrikeAI
- Organizations
- KasperskySecurelist
- Countries
- AfricaLatin America
- AI models
- LLM
Coverage
oldest first · one row per article · UTC- · 1d ago
Kaspersky SecurelistFirst report
CyberStrikeAI used in real attacks on African and Latin American education organizations
Kaspersky reports a campaign deploying open-source CyberStrikeAI framework with LLM orchestrator targeting education organizations in Africa and Latin America.
- · 1d ago
Cyber Security News
CyberStrikeAI agents used in Windows domain takeovers
Securelist says education networks in Africa and Latin America were taken from SQL Server to domain admin in days.
- · 1d ago
GBHackers
Attackers use CyberStrikeAI to direct intrusions at schools
Kaspersky says a human operator used an LLM on the C2 server to pick tools while Go beacons ran commands on compromised hosts.