CyberStrikeAI hits Latin America schools

Attack chain and TTPs

The chain observed by Kaspersky combines manual initial access, rapid persistence, model-assisted reconnaissance, and a classic escalation phase that ends with credential theft and data extraction. The most relevant detail is not the appearance of a new vector, but the pace. Once the agent is implanted, the operation speeds up. Local reconnaissance and persistence are completed in minutes, domain reconnaissance takes hours, and the final exploitation phase is compressed into less than an hour.

The documented starting point was a Microsoft SQL Server version 16.0.1000. Initial activity was manual and came from sqlservr.exe. That detail matters because it places the entry point in an exposed service that was then controlled interactively by the operator. In one incident, the implant was deployed on an educational organization’s SQL server and collected database information through PowerShell, including database export and recursive file searches.

Persistence was achieved with a scheduled task called SystemUpdate or with the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key. On Linux, the same agent could use crontab @reboot or ~/.bashrc. When it had administrative privileges, it created remote scheduled tasks to run payloads with SYSTEM privileges. That flexibility explains why the implant could survive for months while the operator updated components on the control server, although Kaspersky observed only one agent version in each incident analyzed.

Command execution relied on PowerShell, with the option to encode commands in Base64. For script and payload distribution, Kaspersky observed administrative shared folders and WMI. Payloads could be split into several files and then reconstructed or decoded with certutil. At the same time, the main C2 channel allowed direct transfer over HTTP or TCP, with data Base64-encoded and wrapped in JSON responses from the agent.

Reconnaissance was broad and methodical. It included LDAP queries, domain information gathering, identification of accessible systems, WMI-based checks for agents, searches for Kerberoasting and AS-REP Roasting opportunities, LAPS detection, and checks for Microsoft Azure usage. Kaspersky also observed searches for paths related to SCCM compromise, exploitation of AlwaysInstallElevated, inventory of services running under domain accounts, tasks running as SYSTEM, periodic checks of Microsoft Defender, and searches for the .azcopy directory. In addition, the implant could automatically generate SQL and LDAP queries adapted to the task objective.

To obtain credentials, the operator used registry hive dumping through reg.exe and LSASS dumping through the MiniDump function in comsvcs.dll. After compromising privileged accounts, the operator also executed DCSync and Golden Ticket attacks using a renamed version of mimikatz. The official source pairs this with specific detections for LSASS, DCSync, Golden Ticket, and Mimikatz, confirming that the escalation chain was a central part of the intrusion.

Lateral movement used SMB and WMI. Kaspersky mentions WMIExec from the Impacket toolkit, Invoke-CimMethod, and the deployment of a reverse shell script named p1.ps1. That script connected to 185.186.245[.]144:5501. In one specific environment, the source records that the agent moved from one network to another, used lateral movement to reach systems with privileges, and then focused on gathering and exporting information. The flow shows no later stages, only the closeout with data collection.

The novel component in CyberStrikeAI is the orchestrator, not the implant. Kaspersky describes MCP tools exposed to the model for C2 functions, reconnaissance and exploitation utilities, webshell connection management, task assignment to agents, and result parsing. The human sets the objective and can approve or correct commands before execution. That reduces operational friction, but does not change the technical repertoire of the payloads used on the victim side.

Regional impact

Regional overview

The official source places the campaign in educational organizations in several countries across Latin America and Africa, but it does not publish specific countries, victims, or institutional names. That limits precise geographic analysis, though it does not prevent us from seeing the target profile. The focus was on environments with Windows infrastructure, SQL Server, Active Directory, and in some cases Linux, where the chain ended in data collection and export.

Kaspersky reconstructed a particularly clear case on a compromised SQL server. From there, the attacker advanced to domain reconnaissance, credentials, and lateral movement, eventually reaching domain administrators. In another scenario, the implant was used to extract database information and perform recursive file searches. The source says collection from network resources began with recursive directory scanning to locate files of interest, and that the chain ended in data gathering with no further observed activity.

Regionally, the significance of the case is that there was no zero-day exploit or entirely new malware family. What changed was the combination of familiar tools with a large language model-assisted coordination layer. The operation was able to establish persistence, reconnaissance, lateral movement, and credential theft in very short windows once the agent was deployed, which matters for any defense team protecting educational environments with SQL Server and Active Directory.

Kaspersky also notes that the operation could stay active for months while components on the control server were updated. That means that even if observable activity on the victim side was limited, control on the operator side could persist and reactivate tasks when needed. The result is a regionally relevant threat with little public attribution, but a technically consistent profile and potential impact on academic data, credentials, and administrative systems.

Argentina

No additional verifiable facts are available for Argentina in the material provided. The official report does not break down countries or victims, so it is not possible to claim exposure, scope, or specific impact in the country based on these sources.

Chile

No additional verifiable facts are available for Chile in the material provided. The source only refers to educational organizations in several countries across Latin America and Africa, without identifying specific jurisdictions or national cases.

Paraguay

No additional verifiable facts are available for Paraguay in the material provided. The material does not allow this set of intrusions to be linked to Paraguayan institutions or to define a concrete impact surface.

Bolivia

No additional verifiable facts are available for Bolivia in the material provided. Kaspersky does not publish victim names or break down the scope by country within Latin America.

Peru

No additional verifiable facts are available for Peru in the material provided. The available coverage does not individualize incidents or Peruvian entities within the analyzed set.

Colombia

No additional verifiable facts are available for Colombia in the material provided. Kaspersky’s report only confirms a regional presence in education, without a national breakdown.

Brazil

No additional verifiable facts are available for Brazil in the material provided. Although the set includes Latin America, there is no public confirmation of Brazilian victims.

Mexico

No additional verifiable facts are available for Mexico in the material provided. The document does not assign incidents to a specific country or list affected organizations.

USA

No additional verifiable facts are available for the United States in the material provided. The described campaign is limited to educational organizations in Latin America and Africa, with no evidence of impact in that country.

Uruguay

No additional verifiable facts are available for Uruguay in the material provided. The source does not provide a geographic breakdown that would allow local exposure to be validated.

Technical indicators

Analysis for security teams

The operational lesson from this case is fairly clear. The priority should not be looking for an exotic artifact, but for the full sequence. Kaspersky published rules to detect a shell launched by a web application, downloaded PowerShell execution, suspicious schtasks.exe arguments, memory dumping through comsvcs.dll, suspicious access to LSASS, DC Sync attacks, Golden Ticket activity, and lateral movement with WMIExec and Impacket. That combination suggests the most effective defense is event correlation, not reliance on a single alert.

On Windows, monitoring 4688, 4104, 4624, 4768, 4769, 4662, 4663, 4656, and 5145 is part of the coverage suggested by the source itself. On Linux, Kaspersky recommends watching execve and openat in auditd. If the target has SQL Server, it also makes sense to pay close attention to processes like sqlservr.exe acting as the starting point, to PowerShell calls, and to any file or database manipulation that does not fit expected administrative work.

There are three moments where detection value rises sharply. The first is initial access and persistence creation, especially if scheduled tasks appear with unnatural names such as SystemUpdate or if Run keys are changed. The second is reconnaissance, where the actor queries LDAP, WMI, LAPS, Azure, SCCM, AlwaysInstallElevated, and Kerberoasting or AS-REP Roasting patterns. The third is escalation, when LSASS, reg.exe, MiniDump, DCSync, or golden tickets appear.

IOC deduplication also matters. Kaspersky observed that payloads could arrive split into fragments and be rebuilt with certutil, and that distribution could pass through administrative shared folders and WMI. That makes hash tracking useful, but insufficient. Network controls should combine network IOCs, process telemetry, authentication events, and remote administration traces.

The tactical side of the orchestrator deserves attention, even if it does not appear directly on the victim system. The platform exposes MCP tools to the model and leaves command approval or correction to the human operator. That means command adaptation to a target can be fast and contextual, with less friction than in a fully manual operation. For defenders, the issue is not detecting AI itself, but detecting a known chain of actions executed with fewer pauses and more consistency than usual.

Frequently asked questions

What was the most novel aspect of CyberStrikeAI in these intrusions?

The novelty was not an unfamiliar intrusion technique, but the operational acceleration. Kaspersky and Help Net Security agree that the AI ran on the C2 server, while the victim implants still used known techniques such as PowerShell, WMI, Kerberoasting, LSASS, DCSync, and Golden Ticket. The difference was speed and orchestration.

What part of the chain happened inside the compromised systems, and what ran on the control server?

Persistence, reconnaissance, command execution, credential theft, lateral movement, and exfiltration happened inside the compromised systems. The AI layer ran on the control server, where it exposed MCP tools to assign tasks, read results, and assist with SQL or LDAP queries. The implants had no autonomous logic or calls to AI services.

Why does Kaspersky not attribute the campaign to a specific group?

Because the samples were split into two independent groups with different Go build metadata, no shared C2 infrastructure, and different versions of the framework. That prevents a single attribution. Help Net Security adds tentative indicators of a Chinese-speaking operator, but presents them as indirect signals rather than conclusive operational evidence.

Which published detections cover this operation best?

Kaspersky published the Backdoor.CyberStrikeAI.HTTP.C&C detection and rules for remote tasks, PowerShell, schtasks, LSASS dumping with comsvcs.dll, reconnaissance through LDAP, remote execution via WMI or WinRM, DC Sync, Golden Ticket, and lateral movement with WMIExec and Impacket. Correlating those alerts with Windows events 4688, 4104, 4624, 4768, 4769, 4662, 4663, 4656, and 5145 improves coverage.

What geographic scope does the report cover, and which countries cannot be confirmed?

The confirmed scope is regional, with educational organizations in several countries across Latin America and Africa, but without named countries or victims. For that reason, Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Brazil, Mexico, the United States, and Uruguay cannot be confirmed as specific targets. The material supports a regional view, not a detailed national map.

Material limitations

The available material does not publish exact dates for each incident, victim counts, organization names, or specific countries within Latin America or Africa. It also does not support attributing the activity to a known group, and the Chinese-speaking hypothesis appears only as a tentative indicator in independent coverage. The official source describes two independent sample groups, with no shared C2 infrastructure.

No additional verifiable information is available for the national blocks covering Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Brazil, Mexico, the United States, and Uruguay. The body of the report therefore relies on the regional picture and the technical reconstruction of the most detailed incident. Any inference beyond what the official source and independent coverage explicitly support should be treated with caution.