Kaspersky: CyberStrikeAI hit education networks

Executive summary

Kaspersky reconstructed an intrusion against educational organizations in which CyberStrikeAI, an open source modular framework, was used to speed up post-exploitation through an LLM hosted on the C2 server. The source does not identify specific countries in Latin America or Africa, and it does not firmly attribute the campaign to a known group, but it does document a complete technical chain, with a human operator setting broad goals and a model planning actions, choosing tools, generating commands and analyzing results.

The timeline shows a segmented operation, with very different timings between initial access, persistence and the final phase. The initial entry came through a compromised SQL Server, version 16.0.1000. That was followed by nearly a day of network reconnaissance, tool preparation and basic host collection. After that first stage, Kaspersky observed a two-week pause before the CyberStrikeAI implant was deployed. Once installed, persistence and local reconnaissance took about two minutes, domain reconnaissance continued for five hours and, after another pause of several days, the final phase began. From agent deployment to the takeover of domain administrator accounts, three to four days passed, according to Kaspersky.

The final stretch was short and aggressive. The full operation lasted no more than an hour and included lateral movement through SMB and WMI, remote execution with Impacket’s WMIExec, use of administrative shares, network distribution of the p1.ps1 script, mass credential dumping, LSASS access, LDAP queries tied to Kerberoasting and AS-REP Roasting, DCSync, Golden Ticket activity and database export. The report also documents persistence through the SystemUpdate scheduled task or the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key on Windows, and through crontab with @reboot or ~/.bashrc on Linux.

A central point in the report is CyberStrikeAI’s architecture. The implant does not contain AI, does not call services such as ChatGPT or Claude, and does not use API keys. It functions as a conventional C2 agent that periodically queries the server over HTTP/S, TCP or WebSocket, executes shell commands and manipulates files. The intelligence layer sits in the C2: there, the LLM selects tools, writes commands, analyzes responses and can produce SQL and LDAP queries adapted to the task. In other words, the automation is not on the endpoint, but in the remote orchestration, with a human-in-the-loop mechanism that leaves the operator able to approve or correct actions.

For regional readers, the report’s value lies in both its scope and its limits. Kaspersky places the activity in the environment of educational institutions in Latin America and Africa, but does not publish countries or specific victims for this case. It also cannot establish with certainty that the same operator is behind both campaigns or the full infrastructure identified. It does note signs, such as Chinese comments in scripts, the use of Chinese services, server reboots on UTC+8 schedules and traits of the framework itself, that suggest a possible connection to a Chinese-speaking operator, although the source itself says that does not prove identity or location. Softonic, based on the report, suggested this would be one of the first publicly observed in-the-wild cases in which an LLM had a central operational role, but that reading is not an independent verification.

Context and background

Kaspersky’s report describes a framework that did not begin as traditional malware, but as a modular open source environment written in Go for automating penetration testing. CyberStrikeAI combines a C2 server, agents or beacons and an orchestration layer based on an LLM in a single process. That architecture matters because it shifts operational intelligence to the attacker’s side, not to the compromised machine. The implant handles transport and execution, while the C2 decides what to do with the information it receives.

In this case, the report stresses that the agent does not contain any AI functionality. There are no API keys and no calls to external LLM services from the endpoint. The beacon, instead, behaves like a classic C2 client, with periodic check-ins and ordinary shell and file system capabilities. That distinction matters because it separates the marketing claim of "AI in malware" from what Kaspersky actually observed: automated orchestration in the attacker’s infrastructure.

The material also places the campaign in educational environments. Softonic, citing the Kaspersky report, frames the sector as attractive because of student records, financial data, credentials and research. But that publication does not provide its own measurement of Latin American or African victims, and it does not add geographic identification that would allow country-level scope to be narrowed. For that reason, the regional report from Whalemate Labs must keep its focus on technique and on attribution limits.

Key facts table

Operation timeline

Attack chain and TTPs

The chain Kaspersky observed is more interesting for its architecture than for the novelty of its individual pieces. Initial access through a compromised SQL Server is not unusual, but the later use of an LLM hosted in the C2 changes the speed and coordination of the operator. Instead of a manual sequence of one command at a time, the system could suggest actions, prepare commands and evaluate results around the goals set by the person in charge.

The report shows that the Windows implant used PowerShell and Base64 for commands, and that persistence was established through the SystemUpdate scheduled task or the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key. On Linux, persistence was documented through crontab with @reboot or ~/.bashrc. The beacon does not perform intelligent processing on the endpoint. It checks in to the server over HTTP/S, TCP or WebSocket, executes shell commands and works with files like any conventional C2 agent.

The credential phase is one of the densest parts of the case. Kaspersky documented LDAP queries associated with Kerberoasting and AS-REP Roasting, registry hive extraction with reg.exe, LSASS dumping through comsvcs.dll MiniDump, and then DCSync and Golden Ticket activity with a renamed version of Mimikatz. That progression suggests an organized sequence to expand privileges, consolidate access and move laterally inside the domain. A binary identified as wdiag2.exe also appears, which the source classifies as Mimikatz.

Documented lateral movement used Impacket’s WMIExec, administrative shares, WMI and Invoke-CimMethod. The p1.ps1 script was distributed across the network using those same capabilities. Kaspersky also reported file transfer over the main encrypted channel with the C2, through HTTP or TCP, with data in Base64 and encapsulated in JSON responses from the agent. Added to that is screenshot capture ordered by the LLM orchestrator and executed by the implant.

Persistence and execution on Windows and Linux

Kaspersky’s persistence findings show that CyberStrikeAI did not rely on a single method. On Windows, using SystemUpdate as a scheduled task and the Run key under HKCU provides redundancy. On Linux, the combination of crontab with @reboot and ~/.bashrc serves a similar purpose. These are known mechanisms, but in the context of the case they are useful because they fit an operation that tried to survive reboots without adding unnecessary complexity.

The detail of PowerShell with Base64 encoding also matters. The report says the Windows implant used that pattern for its commands, and Kaspersky reflected it in specific detection rules. Operationally, that leaves consistent traces both on endpoints and in process telemetry. It is not unique to this campaign, but it is part of the documented technical signature.

Credentials, domain and escalation

The sequence of Kerberoasting, AS-REP Roasting, registry hive extraction, LSASS dumping, DCSync and Golden Ticket indicates a stepped escalation toward domain control. This was not a single strike, but a progressive construction of privileges and reach. The turning point is clear: from agent deployment to the takeover of domain administrator accounts, three to four days passed, with a very concentrated final stretch that exploited access already in place.

The material does not allow a statement on how many hosts were compromised or the real size of each domain. It does show that the credential phase was a priority. Kaspersky even published SIEM and EDR rules for detecting those patterns, which suggests the report was designed not only as a retrospective analysis, but also as a hunting guide for defenders.

Regional impact

The available reconstruction does not allow a country-specific statement about Latin America or Africa. Kaspersky places the case in educational organizations in those regions, but does not publish detailed geography for the victims and does not attribute the whole infrastructure to a single actor. As a result, regional impact should be read as a technical warning about a type of intrusion, not as a country-by-country measurement.

Regional overview

The case combines a relatively classic initial access with a later stage that was heavily accelerated by LLM-based orchestration. For educational institutions, that has a clear effect on the response window. The first phase left time, with nearly a day of reconnaissance and a two-week pause before the implant. After that, however, activity compressed sharply: persistence in minutes, domain access in hours and the final phase in less than an hour.

That pattern matters for environments with hybrid networks, multiple subdomains, legacy services and shared credentials. The report documents that the operation ended with domain privilege takeover, lateral movement and database export. In an educational setting, that could mean access to identities, records, financial information and research, although Kaspersky does not quantify those assets for victims in the region.

Operational reading for Latin America

The material does not offer confirmed cases by country in Latin America. Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Brazil, Mexico, Uruguay and the United States appear in the editorial template, but the research does not provide verifiable facts specific to those jurisdictions in this campaign. Any national conclusion would therefore be speculative.

What is verifiable is something else. The observed TTPs, such as WMIExec, administrative shares, PowerShell with Base64, LSASS dumping, DCSync and Golden Ticket, are concrete enough to guide hunting and detection. So is the published infrastructure, which can be used for defensive searches in logs, network telemetry and process data. The geographic map remains open, but the technique is well defined.

Technical indicators

IOC and infrastructure traces

The IOC published by Kaspersky cover domains, IPs, hashes and file paths. On Windows, there are beacons associated with svchosts.exe and svcmon32.exe, plus a separate hash for p1.ps1 and for wdiag2.exe, identified as Mimikatz. On Linux, the source published two beacon hashes. fastcdn[.]bar, media.fastcdn[.]bar and 104.234.26[.]163 also appear as part of the observed infrastructure.

The domain dnslog[.]cn appears with a different use, tied to checking Internet connectivity and obtaining the external IP. Kaspersky also mentions searching for the .azcopy directory as an indicator of Microsoft Azure Storage Copy use. That is not a classic network IOC, but it is a useful clue for hunting in environments where exfiltration or staging with cloud storage tools is being investigated.

Analysis for security teams

The first defensive takeaway is that deploying an LLM in the C2 does not erase known techniques, but it does speed up how they are chained together. That changes the kind of alerting that should be prioritized. If the final phase can run in less than an hour once access is consolidated, late detection loses value. The focus should be on early observation of reconnaissance, persistence and the credential sequence.

On Windows, the rules published by Kaspersky provide a direct guide. Signals around schtasks.exe, PowerShell being downloaded and executed, shells launched by the scheduler, suspicious LSASS access, dumping with comsvcs.dll, use of Mimikatz, DCSync and Golden Ticket activity form a very concrete hunting matrix. On the network side, the combination of Impacket’s WMIExec, administrative shares and WMI used to move scripts like p1.ps1 helps prioritize remote execution telemetry.

The source also published EDR Expert and SIEM rules aimed at those behaviors. These include create_task_on_remote_host_using_standard_tool, scheduled_task_creation_as_system_via_schtasks, scheduled_task_with_powershell_execution, dumping_memory_with_com_services_dll, suspicious_lsass_memory_access, using_powershell_for_remote_execution_via_wmi and winrm_send_command. In SIEM, there are also R034_01_Multiple TGS ticket requests, R452_18_AS-REP Roasting, R230_02_Copying data containing credentials from the Windows registry, R073_DC Sync attack and R450_41_Golden Ticket Attack.

Defenders also need to think about the first phase. Initial access came through a compromised SQL Server. If that vector stays out of scope, the pre-implant window can be lost entirely. In this case there was nearly a day of reconnaissance and a two-week wait before the beacon. That creates room for detection of database anomalies, network enumeration, movement from a SQL host and early staging artifacts.

Practical prioritization

First, review SQL Server exposure and hardening, especially if the host functions as an internal pivot point. Second, watch scheduled tasks, Run keys, crontab and shell modifications on Linux. Third, look for anomalous authentication patterns and repeated TGS requests, along with credential extraction from the registry and LSASS access. Fourth, monitor WMI, WinRM and SMB when they are used in sequence to distribute scripts or binaries.

The most operational finding in the report is that the LLM helps compress decision-making, not hide the technique. That means behavior-based detection remains the most useful. If the attacker can generate LDAP or SQL queries faster, the telemetry from the domain and endpoint will still show Kerberoasting, AS-REP Roasting, DCSync, Golden Ticket activity and lateral movement. The challenge is to connect scattered signals before the final phase reaches its target.

Frequently asked questions

What does the use of an LLM in the C2 change in this campaign?

It changes the speed of orchestration, not the type of techniques used. According to Kaspersky, the LLM lives on the C2 server, plans actions, chooses tools, generates commands and analyzes results. The implant remains conventional. That accelerates post-exploitation, but it does not replace signals like WMI, LSASS dumping, DCSync or Golden Ticket activity.

Did Kaspersky identify specific Latin American countries affected?

No. The report places the case in educational organizations in Latin America and Africa, but it does not publish specific countries or specific victims. It also does not allow impact to be separated by jurisdiction. The Regional impact section summarizes what could be verified and marks the lack of national segmentation.

Which credential techniques were most relevant in the operation?

The chain included Kerberoasting, AS-REP Roasting, registry hive extraction, LSASS dumping through comsvcs.dll, DCSync and Golden Ticket activity. Kaspersky also linked the case to renamed Mimikatz and published SIEM rules for several of those patterns. The report’s technical section brings the full sequence and its operational reading together.

Which public IOCs can be used to look for this activity?

The source published 185.186.245[.]144, fastcdn[.]bar, media.fastcdn[.]bar, 104.234.26[.]163, dnslog[.]cn, Windows and Linux beacon hashes, and paths such as c:\windows\temp\svchosts.exe, c:\windows\temp\svcmon32.exe and c:\ProgramData\p1.ps1. The Technical indicators table lists them with their use context.

Why does Kaspersky not attribute this activity with certainty?

Because the available data does not allow the operation to be tied to a known group or to confirm that the same operator is behind both campaigns or the entire infrastructure. The source mentions indicators such as Chinese comments, Chinese services and UTC+8 timing, but considers them insufficient for a firm attribution.