Kaspersky finds AI-orchestrated CyberStrikeAI framework used in real attacks on education sector
- Severity
- High
- Sources
- 1
What happened
Kaspersky reports a campaign against education organisations in several African and Latin American countries in which CyberStrikeAI's LLM orchestrator, running on the C2 server, selected tools and generated commands for a classic non-AI implant, reaching full domain compromise. The initial foothold was a compromised SQL Server 16.0.1000, and the agent then used SMB and WMI for lateral movement, mass credential dumping and database export. Defenders can hunt for CyberStrikeAI artefacts described in the research, including the self-signed TLS certificate with the framework name in the issuer and subject, the build metadata path, and the fixed X-Implant-Token HTTP header unique to each C2 server. No CVE is identified in the excerpt.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Hunt for CyberStrikeAI artefacts such as the self-signed TLS certificate naming the framework and the X-Implant-Token HTTP header.
- Review SQL Server hosts for signs of compromise, particularly any running version 16.0.1000 that may be exposed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Malware
Companies