CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations
Kaspersky researchers have uncovered a new cyberattack campaign, dubbed CyberStrikeAI, that uses artificial intelligence to compromise educational institutions across Africa and Latin America.
The campaign, detected by Kaspersky’s Cyber Threat Intelligence team, represents one of the first public examples of a compromise involving a large language model (LLM) in the wild.
The attackers used the CyberStrikeAI framework to automate the post-exploitation phase, progressing from reconnaissance to full domain compromise in a matter of hours.
Evolution of AI in cyberattacks
The use of AI in cyberattacks is evolving rapidly, moving beyond preparatory tasks like writing phishing emails or debugging code.
In this campaign, the language model is embedded into the core of the attack, automating actions at every stage, including payload execution, persistence, discovery, lateral movement, and data exfiltration.
A key feature of the scheme is that the implant ceases to be a simple tool for executing commands; instead, decisions are distributed across two levels.
The operator defines the task in general terms, while the model determines how to execute it – specifically, which commands to send to the host and in what sequence.
Automated attack timeline
The attack begins with a human operator gaining access to a victim's infrastructure via a compromised SQL Server (version 16.0.1000).
After nearly a day of manual reconnaissance, the second phase begins with the deployment of the CyberStrikeAI C2 agent.
The agent establishes persistence and conducts local reconnaissance within just two minutes, followed by domain reconnaissance over the next five hours.
The final stage involves lateral movement via SMB and WMI, mass credential dumping, and database export, all completed within one hour.
Technical details of the framework
CyberStrikeAI is an open-source, modular platform written in Go that combines LLM-based attack orchestration with a built-in command-and-control server.
The implant is a classic C2 agent with no AI functionality; it periodically polls the server and executes shell commands.
Detection is possible through specific artifacts, including a self-signed TLS certificate generated at startup and a unique X-Implant-Token header in HTTP requests.
Initial access and stealth
The first malicious commands originated from the sqlservr.exe process, indicating the likely initial access vector.
Attackers checked for the agent's presence using a PowerShell script and disguised its name as a legitimate system process like svchost.exe.
To bypass detection, commands were encoded in Base64, and the malicious payload was split into multiple files, some of which contained researcher comments in Chinese.
Persistence and data collection
Once deployed, the agent created a scheduled task named SystemUpdate to ensure persistence on the target system.
The attackers used the certutil utility to decode and assemble the payload, which was a tool for decrypting DPAPI secrets from a specific file.
The scripts were distributed across the network using shared administrative folders and the WMI protocol, facilitating the spread of the malware.
Related
