Attackers use open-source AI framework CyberStrikeAI to take over Windows domains
- Severity
- High
- Sources
- 1
What happened
Securelist reports a live intrusion using CyberStrikeAI, with the LLM running on the attacker's server and a non-AI implant on hosts; the chain began on a compromised SQL Server (sqlservr.exe), moved to persistence via scheduled task SystemUpdate, used PowerShell/LDAP for AD enumeration, Kerberoasting and AS-REP Roasting prep, then SMB/WMI lateral movement, LSASS dumping via comsvcs.dll MiniDump, and DCSync and Golden Ticket with renamed Mimikatz. Defenders should hunt for remote schtasks.exe, LSASS access, and Event ID 4662 from non-DC hosts; rotate krbtgt twice after domain admin compromise; patch and restrict exposed SQL Servers; enable LAPS; limit replication rights; and block the listed IoCs. No CVE is identified in the source.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Monitor for remote scheduled tasks created with schtasks.exe, LSASS memory access, and WMI or WinRM commands from unusual hosts.
- Alert on Event ID 4662 where replication requests come from systems that are not real domain controllers, which can indicate DCSync.
- Rotate the krbtgt account twice if any domain admin account has been compromised, to cancel forged Golden Tickets.
- Patch and lock down exposed SQL Servers, check for commands launched from sqlservr.exe, and enable LAPS.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Malware
Products