Description
CyberStrikeAI is an open-source, modular framework written in Go and designed for automating penetration-testing activities. Its architecture combines a built-in C2 server, an LLM-based orchestration layer and agents known as beacons.
Kaspersky reported that threat actors used the framework during attacks against educational organizations in multiple countries across Africa and Latin America.
The framework's main distinction is that the AI component operates on the attacker's C2 server rather than directly on the victim's endpoint. The human operator defines the overall objective, while the LLM determines the technical steps needed to accomplish it. The implant then executes the generated commands.
This architecture allowed attackers to automate several post-compromise activities, including host discovery, domain reconnaissance, credential collection and lateral movement.
Technical Description
CyberStrikeAI follows a client-server architecture with three primary components:
LLM Orchestrator: Runs on the attacker's C2 server. It interprets objectives, analyzes returned information, selects tools and generates commands.
Command-and-Control Server: Coordinates agent communication, manages tasks and provides access to reconnaissance and exploitation utilities through MCP tools.
Implant (Beacon): Runs on compromised systems. It periodically communicates with the C2 infrastructure, executes received commands and interacts with the host's file system.
The implant itself does not contain AI functionality. It does not require AI API keys or communicate directly with external AI platforms. Instead, the LLM operates remotely and sends tasks through the attacker's infrastructure.
The framework supports communication over HTTP/S, TCP and WebSocket. This separation allows the attacker to update the orchestration logic without necessarily changing the deployed implant.
Attack Overview
Kaspersky's investigation describes an attack sequence involving the following stages:
Initial Access: The attackers gained access to the victim's infrastructure through a compromised SQL Server environment.
Initial Reconnaissance: The operator manually collected system information, deployed tools and examined the network.
Agent Deployment: The CyberStrikeAI beacon was introduced into compromised systems.
Persistence: The agent established mechanisms to survive system restarts and maintain access.
Discovery: The framework collected host, network and Active Directory information.
Credential Access: Attackers obtained credentials using registry access, LSASS memory dumping and other credential-theft techniques.
Lateral Movement: Compromised accounts and tools such as Impacket, WMI and administrative network shares were used to move between systems.
Collection and Exfiltration: The attackers collected database information and files and transferred data through the C2 communication channel.
In one investigated incident, Kaspersky observed persistence and local reconnaissance being established within approximately two minutes, followed by several hours of domain reconnaissance. Later, lateral movement, credential dumping and database export were completed within approximately one hour.
These timings describe the investigated incident and should not be treated as universal performance benchmarks.
Technical Analysis
1. AI-Based Attack Orchestration
The most significant aspect of CyberStrikeAI is its use of an LLM as a decision-making layer.
The operator provides a general objective, and the model selects appropriate tools, generates commands and evaluates their results. This reduces the need for an operator to manually plan every individual action.
A human-in-the-loop mechanism can also be used, allowing the operator to review or modify generated commands before execution.
2. Execution and Stealth
The attackers used PowerShell to execute payloads on Windows systems. Some commands were encoded using Base64, making simple keyword-based detection more difficult.
Malicious files were placed in common directories, including:
C:\Windows\Temp\C:\Windows\C:\ProgramData\C:\Temp\
Some payloads were named to resemble legitimate Windows processes, such as svchosts.exe.
Kaspersky also observed malicious scripts being split into multiple files and subsequently assembled and executed.
3. Persistence
The framework supported different persistence mechanisms across Windows and Linux systems.
On Windows:
Scheduled tasks, including a task named
SystemUpdate.Registry Run-key modifications.
On Linux:
User crontab entries.
Modifications to
~/.bashrc.
The LLM selected persistence methods based on the environment and available privileges.
4. Discovery and Credential Access
After deployment, the agent performed local and domain reconnaissance.
Activities included:
Identifying accessible hosts and network resources.
Querying Active Directory through LDAP.
Identifying opportunities for Kerberoasting and AS-REP Roasting.
Checking for Microsoft LAPS and Azure-related environments.
Inspecting services and scheduled tasks.
For credential access, attackers used techniques including registry hive extraction and LSASS memory dumping through comsvcs.dll.
Kaspersky also reported DCSync and Golden Ticket activity using a renamed version of Mimikatz.
5. Lateral Movement
The attackers used compromised accounts and legitimate administrative mechanisms to move across the network.
Observed methods included:
Impacket WMIExec.
Windows Management Instrumentation (WMI).
Administrative network shares.
PowerShell-based remote execution.
These techniques allowed the attackers to distribute payloads and execute commands on additional systems.
6. Collection and Exfiltration
The framework generated SQL and LDAP queries based on the operator's objectives.
In one investigated incident, the attackers collected information from an educational organization's SQL Server database. The implant also supported file uploads, downloads and screenshots.
Collected information was transferred through the encrypted C2 communication channel using HTTP or TCP.
Kaspersky reported that data collection was the final observed stage of the investigated activity.
7. Attribution Challenges
Kaspersky could not confidently associate the observed activity with a known threat group or establish that the separate activity clusters were operated by the same actor.
Although Chinese-language comments and the use of Chinese services suggested a possible connection to a Chinese-speaking operator, these observations do not establish definitive attribution.
The public availability of CyberStrikeAI and the use of LLM-generated commands further complicate attribution.
Indicators of Compromise (IOCs)
The following indicators were published in Kaspersky's investigation.
File-based indicators
| Indicator | Associated file or purpose |
|---|---|
D726A8B4886C636F76CA6D30EF6A6FF4 | Windows beacon – C:\Windows\Temp\svchosts.exe |
2770562d104391b92b42671c270079bb | Windows beacon – C:\Windows\Temp\svcmon32.exe |
09e1da2afa1216ecc55648ec8e122d2a | Linux beacon |
805B9E4AE74C903787416800999B8418 | Linux beacon |
29EFD64DD3C7FE1E2B022B7AD73A1BA5 | Mimikatz – C:\Windows\Temp\wdiag2.exe |
74F57B3E897A4960DCDD5B7E8A54F9DF | RogueWinRM.exe |
0BBD08AF95F877F1D568B03DE2EB76B4 | Reverse-shell PowerShell script – C:\ProgramData\p1.ps1 |
Network-based indicators
| Indicator | Observed purpose |
|---|---|
185.186.245[.]144 | Windows beacon C2 |
fastcdn[.]bar | Windows beacon C2 |
media.fastcdn[.]bar | Linux beacon C2 |
104.234.26[.]163 | Payload delivery and Linux beacon C2 |
Note: The Linux beacon entries did not include file paths in the source. The indicators above are reproduced from Kaspersky's report. Validate them with current threat-intelligence sources before operational blocking or detection deployment.
Potential Impact
The observed campaign demonstrates several risks to affected organizations:
Domain Compromise: Theft of privileged credentials can provide attackers with extensive access to organizational infrastructure.
Data Exposure: Access to SQL Server databases and shared resources can lead to unauthorized collection and exfiltration.
Credential Theft: LSASS dumping, DCSync and other techniques can expose sensitive authentication information.
Lateral Movement: Compromised accounts can allow attackers to expand their presence across connected systems.
Operational Disruption: Unauthorized access to educational infrastructure can affect administrative systems and institutional operations.
Increased Attack Efficiency: AI-assisted orchestration can accelerate post-exploitation activities and reduce the need for continuous manual intervention.
Recommendations
Immediate Actions
Search endpoint and network telemetry for the published file hashes, C2 IP addresses and domains.
Investigate suspicious PowerShell activity, especially encoded commands and unusual execution chains.
Review SQL Server process activity for unexpected command execution originating from
sqlservr.exe.Investigate unauthorized scheduled tasks, particularly unexpected tasks named
SystemUpdate.Monitor suspicious LSASS access, credential dumping, DCSync and Golden Ticket activity.
Review WMI, SMB and remote PowerShell activity for unusual lateral movement.
If compromise is suspected, isolate affected systems, preserve forensic evidence, rotate exposed credentials and investigate privileged accounts.
Preventive Measures
Keep SQL Server and other exposed infrastructure updated and securely configured.
Apply least-privilege access controls to service accounts and administrative identities.
Enable PowerShell Script Block Logging and relevant Windows security auditing.
Monitor scheduled-task creation, registry Run-key modifications and Linux startup configuration changes.
Deploy EDR and NDR monitoring with behavioral detection and event correlation.
Protect Active Directory and monitor for Kerberoasting, AS-REP Roasting and DCSync activity.
Restrict unnecessary SMB, WMI and remote administrative access between systems.
Maintain regular, isolated backups and test recovery procedures.
Train security teams to recognize AI-assisted attack patterns while continuing to monitor established attacker techniques.
Conclusion
The CyberStrikeAI campaign highlights an important development in the use of artificial intelligence by threat actors. AI is moving beyond supporting activities such as phishing content generation and code assistance and is increasingly being integrated into the operational stages of cyberattacks.
The investigation demonstrates that an LLM can help coordinate reconnaissance, persistence, credential access, lateral movement and data collection through an external command-and-control infrastructure.
However, the underlying techniques remain familiar to cybersecurity defenders. The main change is the speed, coordination and reduced manual effort enabled by AI orchestration.
Organizations should therefore strengthen existing endpoint, identity, network and behavioral monitoring capabilities rather than assuming that AI-assisted attacks require entirely new defensive approaches.