Kaspersky finds AI-orchestrated CyberStrikeAI framework used in real attacks on education sector
AI SECURITYCobalt Strikeredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Kaspersky's threat intelligence team found a campaign using CyberStrikeAI, an open-source Go-based penetration testing platform that combines LLM-driven orchestration with a built-in C2 server. A human operator first gained access through a compromised Microsoft SQL Server 16.0.1000, after which the LLM chose and sequenced commands for persistence, reconnaissance, SMB and WMI lateral movement, credential dumping and database export, reaching full domain compromise.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Hunt for CyberStrikeAI artefacts such as the self-signed TLS certificate naming the framework and the X-Implant-Token HTTP header.
- Review SQL Server hosts for signs of compromise, particularly any running version 16.0.1000 that may be exposed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Kaspersky Securelist
Who and what is in it
Malware
Companies