Do Son 
Timeline of the attack | Image: Kaspersky Labs
TL;DR
Kaspersky researchers discovered a new wave of network intrusions driven by the CyberStrikeAI framework. During these intrusions, threat actors used language models to automate post-exploitation tasks on compromised networks. Consequently, the CyberStrikeAI framework attacks moved from initial database access to full domain administrative control in just a few days.
What Happened in the Attacks
Kaspersky analysts identified live intrusions targeting educational organizations in Africa and Latin America. According to a detailed report on the CyberStrikeAI attacks, the intruders relied on a modular Go-based platform. “According to our data, this is one of the first public descriptions of a compromise involving an LLM in the wild,” the researchers noted. The platform embeds a language model directly into the command-and-control server.
The attack unfolded in two distinct phases. First, a human operator breached an exposed Microsoft SQL Server database. The operator then collected basic system data and deployed local utilities like RogueWinRM and GodPotato. However, this initial manual phase required nearly 24 hours of effort. After establishing access, the attackers paused operations for approximately two weeks.
The AI Post-Exploitation Phase
Activity resumed when the operators deployed the CyberStrikeAI beacon to execute automated tasks. The implant itself contains no artificial intelligence logic or external API keys. Instead, it functions as a lightweight client that receives instructions from the server. “Decisions are distributed across two levels: the operator defines the task in general terms, while the model determines how to execute it,” Kaspersky explained.
Furthermore, the server model generates custom PowerShell commands to map the local machine. Within two minutes of deployment, the beacon installed persistence through a scheduled task named SystemUpdate. The model also created alternative persistence hooks using registry Run keys or Linux bash profiles. Next, the agent executed LDAP search queries to identify user accounts, subnets, and Azure credentials.
The automated agent moved laterally across the network using SMB administrative shares and WMI commands. To steal credentials, it dumped registry hives with reg.exe and extracted memory from lsass.exe via comsvcs.dll. Once the attackers acquired domain administrator credentials, they launched DCSync and Golden Ticket attacks using a renamed Mimikatz utility. Finally, the agent generated targeted SQL queries to steal student and staff records from database tables.
Who Is Behind the Activity
Kaspersky analysts have not linked the campaign to a specific advanced persistent threat group. However, technical evidence points toward a Chinese-speaking operator with moderate confidence. For example, several malicious PowerShell scripts contained inline comments written in simplified Chinese characters. Additionally, the attackers used the Chinese DNSLog.cn platform to verify internet access from victim hosts.
Binary artifacts also reveal important attribution clues. The Go compiler left unique build paths and version control metadata inside the compiled executables. Furthermore, the self-signed TLS certificates on the control dashboards regenerated during business hours in the UTC+8 time zone. The platform itself originated within the Chinese security research community before appearing in public repositories.
Impact and Speed of the Attacks
The documented campaign directly impacted educational institutions across multiple nations in Africa and Latin America. By combining human direction with model-generated commands, the attackers compressed intrusion timelines dramatically. Key operational phases, such as lateral movement and credential harvesting, took only a few hours to complete.
“The novelty of the attack lies not in the methods themselves, but in the speed and ease with which they were executed,” the Kaspersky report emphasized. While the underlying techniques relied on well-known living-off-the-land binaries, automated tasking removed manual human delays. Therefore, the threat actors conquered domain controllers within three to four days of deploying the implant.
How Organizations Can Stay Protected
Defenders should recognize that artificial intelligence automation does not change core operating system behaviors. Although the language model generates diverse command syntax, the underlying attack actions leave standard forensic footprints. For instance, security teams should monitor for unusual scheduled tasks named SystemUpdate and inspect lsass.exe memory dump attempts. Organizations must also restrict access to Microsoft SQL Server instances from public networks.
Furthermore, administrators should enforce strict network segmentation to limit lateral movement over SMB and WMI protocols. Disabling NTLM and enabling Kerberos pre-authentication will help defeat credential extraction attempts. Finally, security operations centers should search network traffic for the custom X-Implant-Token HTTP header used by the beacon. By maintaining proactive monitoring and rapid patch cycles, defenders can disrupt these automated intrusions before attackers gain administrative control.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
