Attackers use open-source AI framework CyberStrikeAI to take over Windows domains
AI SECURITYCyberStrikeAIredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Attackers used the open-source Go-based penetration testing platform CyberStrikeAI, where a language model on the control server selects and runs commands, to compromise a SQL Server, map a Windows domain, roast credentials and perform DCSync and Golden Ticket attacks. Securelist, which found the campaign during routine monitoring, reports education organisations in Africa and Latin America among the victims, and says the malware on victim machines contains no AI. Because the techniques are conventional, standard detection of remote scheduled tasks, LSASS access and WMI or WinRM use still applies.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Monitor for remote scheduled tasks created with schtasks.exe, LSASS memory access, and WMI or WinRM commands from unusual hosts.
- Alert on Event ID 4662 where replication requests come from systems that are not real domain controllers, which can indicate DCSync.
- Rotate the krbtgt account twice if any domain admin account has been compromised, to cancel forged Golden Tickets.
- Patch and lock down exposed SQL Servers, check for commands launched from sqlservr.exe, and enable LAPS.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Malware
Products