Attackers abuse open-source CyberStrikeAI framework for LLM-orchestrated intrusions against education targets in Africa and Latin America
Kaspersky reports that threat actors are abusing CyberStrikeAI, an open-source Go-based penetration-testing framework, to run human-directed, LLM-orchestrated intrusions against educational organizations in Africa and Latin America. A server-side LLM selects tools, generates commands, interprets results and decides next steps, while conventional beacons execute them on victims. Kaspersky calls this among the earliest publicly documented real-world compromises involving LLM orchestration. Chinese-language artifacts and UTC+8 activity patterns suggest Chinese-speaking operators, but no known group was identified.
Detalhes técnicos
- The implant contains no AI functionality or API keys; the intelligence stays on the attacker's server, where C2 functions are exposed as MCP tools. The beacon polls over HTTP/S, TCP or WebSocket.
- In one incident, initial access was via a compromised SQL Server 16.0.1000, with commands spawned from sqlservr.exe. No specific vulnerability was established.
- Timeline: about one day of manual recon and tooling, a two-week pause, then persistence and local recon within two minutes and about five hours of domain discovery. After another pause, lateral movement, credential dumping and database export took about an hour. Agent deployment to domain-admin compromise took 3-4 days.
- Persistence used a scheduled task named SystemUpdate; payloads masqueraded as svchosts.exe. PowerShell was Base64-encoded and scripts were reassembled with certutil.
- LDAP queries mapped Active Directory and identified Kerberoasting and AS-REP Roasting opportunities. Credential theft used registry-hive dumping, LSASS dumping via comsvcs.dll and renamed Mimikatz, followed by DCSync and Golden Ticket attacks.
- Lateral movement used SMB admin shares, WMI and Impacket WMIExec; generated SQL queries drove database collection.
- The external IP was checked via the Chinese service dnslog[.]cn. Two sample clusters with distinct infrastructure and server versions were observed.
- IOCs: 185.186.245[.]144, 104.234.26[.]163, fastcdn[.]bar, media.fastcdn[.]bar, an X-Implant-Token HTTP header, framework-branded self-signed certificates and Go build artifacts.
Remediação
- Monitor suspicious SQL Server child processes, encoded PowerShell, remote scheduled tasks, LSASS access, anomalous LDAP enumeration and WMI execution.
- Existing behavioral detections remain valid; correlate endpoint, identity and network telemetry to catch activity before privileged compromise.
Linha do tempo
-
Attackers abuse open-source CyberStrikeAI framework for LLM-orchestrated intrusions against education targets in Africa and Latin America
ler a análise desta fonte ocultar
Kaspersky reports that threat actors are abusing CyberStrikeAI, an open-source Go-based penetration-testing framework, to run human-directed, LLM-orchestrated intrusions against educational organizations in Africa and Latin America. A server-side LLM selects tools, generates commands, interprets results and decides next steps, while conventional beacons execute them on victims. Kaspersky calls this among the earliest publicly documented real-world compromises involving LLM orchestration. Chinese-language artifacts and UTC+8 activity patterns suggest Chinese-speaking operators, but no known group was identified.
Technical Details
- The implant contains no AI functionality or API keys; the intelligence stays on the attacker's server, where C2 functions are exposed as MCP tools. The beacon polls over HTTP/S, TCP or WebSocket.
- In one incident, initial access was via a compromised SQL Server 16.0.1000, with commands spawned from sqlservr.exe. No specific vulnerability was established.
- Timeline: about one day of manual recon and tooling, a two-week pause, then persistence and local recon within two minutes and about five hours of domain discovery. After another pause, lateral movement, credential dumping and database export took about an hour. Agent deployment to domain-admin compromise took 3-4 days.
- Persistence used a scheduled task named SystemUpdate; payloads masqueraded as svchosts.exe. PowerShell was Base64-encoded and scripts were reassembled with certutil.
- LDAP queries mapped Active Directory and identified Kerberoasting and AS-REP Roasting opportunities. Credential theft used registry-hive dumping, LSASS dumping via comsvcs.dll and renamed Mimikatz, followed by DCSync and Golden Ticket attacks.
- Lateral movement used SMB admin shares, WMI and Impacket WMIExec; generated SQL queries drove database collection.
- The external IP was checked via the Chinese service dnslog[.]cn. Two sample clusters with distinct infrastructure and server versions were observed.
- IOCs: 185.186.245[.]144, 104.234.26[.]163, fastcdn[.]bar, media.fastcdn[.]bar, an X-Implant-Token HTTP header, framework-branded self-signed certificates and Go build artifacts.
Remediation
- Monitor suspicious SQL Server child processes, encoded PowerShell, remote scheduled tasks, LSASS access, anomalous LDAP enumeration and WMI execution.
- Existing behavioral detections remain valid; correlate endpoint, identity and network telemetry to catch activity before privileged compromise.