CyberStrikeAI: LLM-orchestrated C2 used to breach education-sector networks in Africa and Latin America via SQL Server

Linha do tempo

1. gbhackers.com ↗ · pub. 02/11/2026 07:55 · coletado 02/11 08:00

   Attackers abuse open-source CyberStrikeAI framework for LLM-orchestrated intrusions against education targets in Africa and Latin America

   ler a análise desta fonte ocultar

   Kaspersky reports that threat actors are abusing CyberStrikeAI, an open-source Go-based penetration-testing framework, to run human-directed, LLM-orchestrated intrusions against educational organizations in Africa and Latin America. A server-side LLM selects tools, generates commands, interprets results and decides next steps, while conventional beacons execute them on victims. Kaspersky calls this among the earliest publicly documented real-world compromises involving LLM orchestration. Chinese-language artifacts and UTC+8 activity patterns suggest Chinese-speaking operators, but no known group was identified.

   Technical Details

   • The implant contains no AI functionality or API keys; the intelligence stays on the attacker's server, where C2 functions are exposed as MCP tools. The beacon polls over HTTP/S, TCP or WebSocket.
   • In one incident, initial access was via a compromised SQL Server 16.0.1000, with commands spawned from sqlservr.exe. No specific vulnerability was established.
   • Timeline: about one day of manual recon and tooling, a two-week pause, then persistence and local recon within two minutes and about five hours of domain discovery. After another pause, lateral movement, credential dumping and database export took about an hour. Agent deployment to domain-admin compromise took 3-4 days.
   • Persistence used a scheduled task named SystemUpdate; payloads masqueraded as svchosts.exe. PowerShell was Base64-encoded and scripts were reassembled with certutil.
   • LDAP queries mapped Active Directory and identified Kerberoasting and AS-REP Roasting opportunities. Credential theft used registry-hive dumping, LSASS dumping via comsvcs.dll and renamed Mimikatz, followed by DCSync and Golden Ticket attacks.
   • Lateral movement used SMB admin shares, WMI and Impacket WMIExec; generated SQL queries drove database collection.
   • The external IP was checked via the Chinese service dnslog[.]cn. Two sample clusters with distinct infrastructure and server versions were observed.
   • IOCs: 185.186.245[.]144, 104.234.26[.]163, fastcdn[.]bar, media.fastcdn[.]bar, an X-Implant-Token HTTP header, framework-branded self-signed certificates and Go build artifacts.

   Remediation

   • Monitor suspicious SQL Server child processes, encoded PowerShell, remote scheduled tasks, LSASS access, anomalous LDAP enumeration and WMI execution.
   • Existing behavioral detections remain valid; correlate endpoint, identity and network telemetry to catch activity before privileged compromise.
2. securelist.com ↗ · pub. 02/11/2026 05:00 · coletado 02/11 06:00 primeiro registro

   CyberStrikeAI LLM-orchestrated C2 agents used to compromise education sector networks in Africa and Latin America

   ler a análise desta fonte ocultar

   Kaspersky's CTI team identified a campaign in which attackers used the open-source CyberStrikeAI framework, where an LLM orchestrator on the C2 server plans actions and generates commands that a classic implant executes. Confirmed victims were education sector organizations in several countries across Africa and Latin America. Initial access was a compromised SQL Server (16.0.1000), followed by manual reconnaissance, a two-week pause, and then LLM-driven post-exploitation that reached domain administrator compromise within 3-4 days. Attribution to a known group is not possible, but Chinese-language script comments, use of dnslog[.]cn, and server restarts during UTC+8 business hours suggest a Chinese-speaking operator.

   Technical Details

   • Architecture: CyberStrikeAI is a Go platform with the LLM layer and C2 server in a single process; C2 functions are exposed to the model as MCP tools. The implant has no AI functionality and polls over HTTP/S, TCP or WebSocket. A human-in-the-loop mechanism lets the operator approve or edit commands.
   • Initial access and staging: the first commands came from the sqlservr.exe process. Scripts were split into Base64 files (e.g. d3.b64), decoded with certutil, and bore hallmarks of LLM generation. One script decrypts DPAPI secrets from C:\ProgramData\dsn_line.txt, populated from the SSRS rsreportserver.config. The attackers checked for internet access via dnslog[.]cn.
   • Execution: PowerShell with Base64-encoded commands. With admin rights, scheduled tasks (schtasks or the Schedule.Service COM object) run payloads as SYSTEM. The p1.ps1 reverse shell connects to 185.186.245[.]144:5501. Agent paths include C:\Windows\Temp, C:\Windows, C:\ProgramData\ and C:\Temp, and the agent was disguised as svchosts.exe.
   • Persistence: scheduled task SystemUpdate, or the HKCU Run key. On Linux, a crontab @reboot entry or a ~/.bashrc nohup line.
   • Discovery and privilege escalation: PowerShell host discovery, LDAP queries, WMI checks, Kerberoasting and AS-REP Roasting queries, LAPS and Azure checks (.azcopy directory), SCCM and AlwaysInstallElevated checks, and periodic Microsoft Defender detection checks.
   • Credential access: reg.exe hive dumps, LSASS dump via comsvcs.dll MiniDump using the PID, DCSync and Golden Ticket with a renamed mimikatz.
   • Lateral movement: Impacket WMIExec, SMB admin shares, WMI including Invoke-CimMethod.
   • Collection: LLM-generated SQL and LDAP queries, recursive file listing, file transfer over the C2 channel in Base64 JSON, and screenshots on Windows and Linux. Data collection was the last observed stage.
   • Detection and attribution artifacts: a self-signed TLS certificate with the framework name, regenerated on each start (not_before reveals the restart time); Go build metadata (go version -m) with an identical temp build path and VCS hash, time and vcs.modified=true; and the X-Implant-Token HTTP header, unique per C2 server. Samples fall into two unlinked groups with different C2 infrastructure and server versions.

   Remediation

   The techniques are well-known, so tuned correlation and behavioral rules suffice. Monitor remote schtasks.exe use (/s), scheduled tasks created as SYSTEM, PowerShell in scheduled tasks, and LSASS dumping via comsvcs.dll MiniDump. Kaspersky Next EDR Expert rules cited: create_task_on_remote_host_using_standard_tool, scheduled_task_creation_as_system_via_schtasks, scheduled_task_with_powershell_execution. Hunt for the TLS certificate, build-path and X-Implant-Token artifacts.