CyberStrikeAI LLM-orchestrated C2 agents used to compromise education sector networks in Africa and Latin America

Linha do tempo

1. securelist.com ↗ · pub. 02/11/2026 05:00 · coletado 02/11 06:00 primeiro registro

   CyberStrikeAI LLM-orchestrated C2 agents used to compromise education sector networks in Africa and Latin America

   ler a análise desta fonte ocultar

   Kaspersky's CTI team identified a campaign in which attackers used the open-source CyberStrikeAI framework, where an LLM orchestrator on the C2 server plans actions and generates commands that a classic implant executes. Confirmed victims were education sector organizations in several countries across Africa and Latin America. Initial access was a compromised SQL Server (16.0.1000), followed by manual reconnaissance, a two-week pause, and then LLM-driven post-exploitation that reached domain administrator compromise within 3-4 days. Attribution to a known group is not possible, but Chinese-language script comments, use of dnslog[.]cn, and server restarts during UTC+8 business hours suggest a Chinese-speaking operator.

   Technical Details

   • Architecture: CyberStrikeAI is a Go platform with the LLM layer and C2 server in a single process; C2 functions are exposed to the model as MCP tools. The implant has no AI functionality and polls over HTTP/S, TCP or WebSocket. A human-in-the-loop mechanism lets the operator approve or edit commands.
   • Initial access and staging: the first commands came from the sqlservr.exe process. Scripts were split into Base64 files (e.g. d3.b64), decoded with certutil, and bore hallmarks of LLM generation. One script decrypts DPAPI secrets from C:\ProgramData\dsn_line.txt, populated from the SSRS rsreportserver.config. The attackers checked for internet access via dnslog[.]cn.
   • Execution: PowerShell with Base64-encoded commands. With admin rights, scheduled tasks (schtasks or the Schedule.Service COM object) run payloads as SYSTEM. The p1.ps1 reverse shell connects to 185.186.245[.]144:5501. Agent paths include C:\Windows\Temp, C:\Windows, C:\ProgramData\ and C:\Temp, and the agent was disguised as svchosts.exe.
   • Persistence: scheduled task SystemUpdate, or the HKCU Run key. On Linux, a crontab @reboot entry or a ~/.bashrc nohup line.
   • Discovery and privilege escalation: PowerShell host discovery, LDAP queries, WMI checks, Kerberoasting and AS-REP Roasting queries, LAPS and Azure checks (.azcopy directory), SCCM and AlwaysInstallElevated checks, and periodic Microsoft Defender detection checks.
   • Credential access: reg.exe hive dumps, LSASS dump via comsvcs.dll MiniDump using the PID, DCSync and Golden Ticket with a renamed mimikatz.
   • Lateral movement: Impacket WMIExec, SMB admin shares, WMI including Invoke-CimMethod.
   • Collection: LLM-generated SQL and LDAP queries, recursive file listing, file transfer over the C2 channel in Base64 JSON, and screenshots on Windows and Linux. Data collection was the last observed stage.
   • Detection and attribution artifacts: a self-signed TLS certificate with the framework name, regenerated on each start (not_before reveals the restart time); Go build metadata (go version -m) with an identical temp build path and VCS hash, time and vcs.modified=true; and the X-Implant-Token HTTP header, unique per C2 server. Samples fall into two unlinked groups with different C2 infrastructure and server versions.

   Remediation

   The techniques are well-known, so tuned correlation and behavioral rules suffice. Monitor remote schtasks.exe use (/s), scheduled tasks created as SYSTEM, PowerShell in scheduled tasks, and LSASS dumping via comsvcs.dll MiniDump. Kaspersky Next EDR Expert rules cited: create_task_on_remote_host_using_standard_tool, scheduled_task_creation_as_system_via_schtasks, scheduled_task_with_powershell_execution. Hunt for the TLS certificate, build-path and X-Implant-Token artifacts.