# CyberStrikeAI: an LLM chose the commands in a 3 day domain takeover

> CyberStrikeAI is an open-source AI pentest framework that Kaspersky now reports in real intrusions against schools.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Attack
- **Published by:** Kaspersky
- **Disclosed:** 2026-11-02
- **Affects:** CyberStrikeAI, Microsoft SQL Server, Windows, Active Directory
- **Research by:** Kirill Antonov, Vladislav Vlasov, Dmitry Chizhmak
- **Primary source:** https://securelist.com/cyberstrikeai-attacks/121715/
- **Page:** https://theinjection.dev/items/kaspersky-cyberstrikeai-education-intrusions/

Kaspersky found CyberStrikeAI, an open-source AI pentest framework, in attacks on education organizations in Africa and Latin America. A server-side model chose each command, and the chain reached domain administrator in 3 to 4 days.

## What happened

Kaspersky published the case on November 2, 2026, written by Kirill Antonov, Vladislav Vlasov and Dmitry Chizhmak. Confirmed victims were education sector organizations in several countries across Africa and Latin America. Kaspersky calls the case one of the first public descriptions of a compromise involving a language model in the wild.

## How it works

CyberStrikeAI puts a language model, a command and control server and its agents in one Go process. The model reaches the command and control functions as MCP tools, so it runs recon utilities, assigns tasks to agents and reads the results back. The implant holds no model, no API keys and no decision logic: it polls a listener over HTTP, TCP or WebSocket, runs shell commands and returns files and screenshots. Kaspersky says the model, not the operator, picked the persistence method.

## Who is affected

Education sector organizations in Africa and Latin America are the confirmed victims, reached through a compromised Microsoft SQL Server. Post-exploitation targeted the Windows domain, and the implant also runs on Linux. Kaspersky could not tie the activity to a known group.

## What to do

Alert on remote scheduled task creation with the schtasks /s argument, on comsvcs.dll MiniDump access to LSASS, and on shell processes spawned by sqlservr.exe. Kaspersky lists hashes, paths, network indicators and the Windows and Linux audit events its detections rely on.

## Quick facts

- **Victims:** Education sector, several countries in Africa and Latin America
- **Tool abused:** CyberStrikeAI, an open-source AI pentest framework written in Go
- **Entry point:** Compromised Microsoft SQL Server, followed by manual recon
- **Time to domain admin:** 3 to 4 days from agent deployment
- **Where the AI runs:** Server side only, the implant carries no model or API keys
- **Attribution:** None established; Chinese-language comments and UTC+8 timing only
- **Technique novelty:** Kaspersky calls the techniques well documented, not new

## Sources

1. [Securelist Report](https://securelist.com/cyberstrikeai-attacks/121715/)
2. [TrendAI On CyberStrikeAI](https://www.trendaisecurity.com/en-us/resources-insights/deep-research/not-only-artex-the-different-levels-ai-is-used-in-attacks-targeting-japan)