Attackers who broke into education organizations across Africa and Latin America handed much of the hands-on work to an AI. According to a new report from Kaspersky's Cyber Threat Intelligence team, written by Kirill Antonov, Vladislav Vlasov and Dmitry Chizhmak, the intruders used CyberStrikeAI, an open-source penetration testing framework, to let a large language model decide which commands to run on compromised machines, all the way from reconnaissance to full domain compromise.
Kaspersky describes it as one of the first public descriptions of a compromise involving an LLM in the wild. It joins recent reports of AI hacking agents running real break-ins from Google and an AI-driven cloud intrusion from Wiz, but adds a step-by-step reconstruction on Windows domain networks.
The human opens the door, the model walks through
In the incident Kaspersky walks through, the first phase looked entirely conventional. A human operator got in through a compromised Microsoft SQL Server (version 16.0.1000), gathered basic host information, deployed tools and scouted the network. That took nearly a day, followed by a two-week pause.
The second phase began with the CyberStrikeAI agent. Once it was running, it set up persistence and finished local reconnaissance within 2 minutes, then spent the next 5 hours mapping the domain. After a pause of several days, the final stage, covering lateral movement over SMB and WMI, mass credential dumping and a database export, took no more than an hour. From agent deployment to the compromise of domain administrators, the whole attack took 3 to 4 days.
An implant with no AI inside it
CyberStrikeAI is written in Go and bundles an LLM orchestrator with a built-in command-and-control (C2) server. The model plans actions, picks tools and generates commands, which it reaches as MCP tools on the server. The implant on the victim's machine is a plain C2 agent with no API keys and no AI logic of its own. To the victim it looks like an ordinary remote-control session, with a model queueing tasks instead of a live operator. The operator still sets the goal and can approve or correct generated commands before they run.
What the agent actually did was textbook domain compromise: Base64-encoded PowerShell, scheduled tasks named SystemUpdate for persistence, LDAP queries to prepare Kerberoasting and AS-REP Roasting, LSASS dumps via comsvcs.dll, registry hive dumps, Impacket's WMIExec for lateral movement, and DCSync and Golden Ticket attacks with a renamed copy of Mimikatz. In one case it wrote its own SQL queries to pull data from a database, the last stage Kaspersky observed.
Who was behind it is still open
Kaspersky could not tie the activity to a known group, or say for certain that a single operator ran both clusters it found. The implant samples split into two groups by their build metadata, with separate C2 servers running different CyberStrikeAI versions. Chinese-language comments in the attackers' scripts, use of the Chinese service dnslog[.]cn, and C2 restarts that mostly fell in UTC+8 business hours suggest a Chinese-speaking operator, the researchers say. The tool itself came out of the Chinese security community. Because the model writes the commands, behavioral fingerprints are weaker too.
Hunt the C2, not the AI
The AI sits entirely on the attacker's server, so what reaches the host is the familiar domain-takeover playbook, just faster. Detection that already covers LSASS dumping, DCSync, WMI lateral movement and SQL Server process abuse still applies. Kaspersky also lists framework-specific artifacts:
- A self-signed control-panel TLS certificate carrying the framework's name, regenerated at every restart.
- Implant Go build metadata pointing to the CyberStrikeAI generator path, identical across payloads.
- A fixed X-Implant-Token HTTP header, unique to each C2 server.
- Malicious commands spawned by sqlservr.exe, and agent files in C:\Windows\Temp, C:\Windows, C:\ProgramData or C:\Temp, sometimes named to imitate svchost.exe.
Indicators published in the report include the reverse-shell server 185[.]186[.]245[.]144 (port 5501) and 104[.]234[.]26[.]163, plus seven MD5 hashes, including d726a8b4886c636f76ca6d30ef6a6ff4 and 2770562d104391b92b42671c270079bb; the full list is in the report.
The lesson in Kaspersky's account is less about new attacks than about who can now run old ones. AI orchestration lowered the operator's skill bar without moving the attack beyond what defenders can already catch, so the gap that matters now is response time.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.