Cobalt Strike
Latest
Kaspersky finds AI-orchestrated CyberStrikeAI framework used in real attacks on education sector
Kaspersky's threat intelligence team found a campaign using CyberStrikeAI, an open-source Go-based penetration testing platform that combines LLM-driven orchestration with a built-in C2 server. A human operator first gained access through a compromised Microsoft SQL Server 16.0.1000, after which the LLM chose and sequenced commands for persistence, reconnaissance, SMB and WMI lateral movement, credential dumping and database export, reaching full domain compromise.
Aur0ra ransomware group uses Cursor AI agents to reach domain admin and steal data
The Aur0ra ransomware group, tracked as GOLD OGRE, used Cursor AI agents, including its Composer model and models from Anthropic, xAI and Moonshot, to move from stolen credentials to domain admin access in Active Directory environments. The agents mapped networks, tried password spraying, Kerberoasting and NTLM relay, and staged data for exfiltration to S3-compatible storage before ransomware deployment. Sophos says the group also used AI to test evasion of EDR products, and it expects other ransomware groups to adopt similar agents.