CyberStrikeAI: an LLM chose the commands in a 3 day domain takeover
CyberStrikeAI is an open-source AI pentest framework that Kaspersky now reports in real intrusions against schools.
· Kaspersky · Research by Kirill Antonov, Vladislav Vlasov, Dmitry Chizhmak
Kaspersky found CyberStrikeAI, an open-source AI pentest framework, in attacks on education organizations in Africa and Latin America. A server-side model chose each command, and the chain reached domain administrator in 3 to 4 days.
01What happened
Kaspersky published the case on November 2, 2026, written by Kirill Antonov, Vladislav Vlasov and Dmitry Chizhmak. Confirmed victims were education sector organizations in several countries across Africa and Latin America. Kaspersky calls the case one of the first public descriptions of a compromise involving a language model in the wild.
02How it works
CyberStrikeAI puts a language model, a command and control server and its agents in one Go process. The model reaches the command and control functions as MCP tools, so it runs recon utilities, assigns tasks to agents and reads the results back. The implant holds no model, no API keys and no decision logic: it polls a listener over HTTP, TCP or WebSocket, runs shell commands and returns files and screenshots. Kaspersky says the model, not the operator, picked the persistence method.
03Who is affected
Education sector organizations in Africa and Latin America are the confirmed victims, reached through a compromised Microsoft SQL Server. Post-exploitation targeted the Windows domain, and the implant also runs on Linux. Kaspersky could not tie the activity to a known group.
04What to do
Alert on remote scheduled task creation with the schtasks /s argument, on comsvcs.dll MiniDump access to LSASS, and on shell processes spawned by sqlservr.exe. Kaspersky lists hashes, paths, network indicators and the Windows and Linux audit events its detections rely on.
Sources 2 links, all fetched
- 1securelist.comSecurelist Report
- 2trendaisecurity.comTrendAI On CyberStrikeAI