Kaspersky links AI driven CyberStrikeAI attacks to school intrusions

Kaspersky researchers have identified a new wave of intrusions described as CyberStrikeAI framework attacks, targeting educational organisations in Africa and Latin America. The operations hinge on a modular Go-based platform that embeds a language model directly into the command-and-control server.

The campaign unfolded in two phases: an initial manual breach of an exposed Microsoft SQL Server database, followed by a period of dormant activity, then a rapid post-exploitation phase once the CyberStrikeAI beacon was deployed. The early stage involved collecting basic system data and deploying tools such as RogueWinRM and GodPotato, with the manual access consuming about a day and a half before operations paused for roughly two weeks.

In the subsequent AI-driven phase, the beacon autonomously receives instructions from the server while the operator sets the high-level task. The server model generates custom PowerShell commands to map the victim environment; persistence is established within minutes via a scheduled task named SystemUpdate, with additional hooks in registry Run keys or Linux bash profiles. The automated agent performs LDAP searches to enumerate users, subnets and Azure credentials, then moves laterally over SMB and WMI.

Credential theft follows, including registry hive dumps and LSASS memory extraction, culminating in domain administrator compromises used to execute DCSync and Golden Ticket attacks with a renamed Mimikatz. Student and staff records are exfiltrated via targeted SQL queries. While Kaspersky has not linked the campaign to a named APT group, indicators such as inline Chinese comments in PowerShell scripts, use of DNSLog[.]cn, and build metadata suggest a Chinese-speaking operator with moderate confidence. The researchers note the threat’s speed: domain controllers can be conquered within three to four days of implant deployment.