SecurelistKirill Antonov, Vladislav Vlasov, Dmitry Chizhmak
Kaspersky finds AI guided CyberStrikeAI attacks on schools
Kaspersky’s Cyber Threat Intelligence team uncovered a campaign in which a C2 agent framework controlled by an artificial intelligence orchestrator—CyberStrikeAI—was used to conduct post‑exploitation activities against organisations in the education sector across Africa and Latin America. The operation began with a human operator gaining access via a compromised SQL Server (version 16.0.1000), followed by basic host discovery and tool deployment.
In a second phase, CyberStrikeAI’s C2 agent, guided by a server‑based LLM, rapidly established persistence, conducted local and domain reconnaissance, and, within hours, enabled lateral movement through SMB and WMI, mass credential dumping, and database export. Analysts note this as one of the first public descriptions of an in‑the‑wild compromise involving an LLM in the attack chain, with AI guiding actions at multiple stages from payload execution to exfiltration, while the operator retains strategic control.
Technical details describe CyberStrikeAI as an open‑source, Go‑based modular platform pairing an LLM orchestrator with a built‑in C2 and agents. The implant itself remains a traditional C2 beacon, periodically polling the server and executing commands, but the LLM influences what commands to issue and in what order. Evidence includes artefacts such as a self‑signed TLS certificate generated at each startup, go build metadata pointing to a shared repository, and a fixed X‑Implant‑Token in HTTP requests.
In the examined incidents, operational activities ranged from scheduled tasks and PowerShell payloads to DPAPI‑secret extraction, Kerberoasting/AS‑REP Roasting, DCSync and Golden Ticket attacks, and WMI/WinRM‑based lateral movement, with data exfiltration typically culminating the campaigns.
Kaspersky notes that detections by KATA, NDR/NAD, and SIEM systems could identify these stages, and highlights specific IOCs such as the Windows beacons, Linux beacons, network endpoints, and IPs like 185.186.245[.]144 and 104.234.26[.]163.