Mimikatz

Attackers use open-source AI framework CyberStrikeAI to take over Windows domains

Attackers used the open-source Go-based penetration testing platform CyberStrikeAI◆, where a language model on the control server selects and runs commands, to compromise a SQL Server, map a Windows domain, roast credentials and perform DCSync and Golden Ticket attacks. Securelist, which found the campaign during routine monitoring, reports education organisations in Africa and Latin America among the victims, and says the malware on victim machines contains no AI. Because the techniques are conventional, standard detection of remote scheduled tasks, LSASS access and WMI or WinRM use still applies.