Kaspersky reports real-world CyberStrikeAI attack: LLM orchestrator drove recon to full domain compromise
cyb3rops · x · 2026-11-03
Kaspersky's CTI team has disclosed a real-world cyberattack against educational institutions in Africa and Latin America where the open-source CyberStrikeAI framework played a key role in post-exploitation: an LLM orchestrator on the C2 server plans actions, selects tools, and generates commands, while an implant executes them on compromised hosts.
The attack timeline shows a manual phase (initial access, local recon, tooling like RogueWinRM and GodPotato) followed by 2 weeks of dormancy; then the CyberStrike agent took over, completing local and domain reconnaissance within minutes, lateral movement via SMB and WMI in 30 minutes, and mass credential dumping in 9 minutes, plus database access and exfiltration.
One of the first documented cases of an AI-orchestrated attack framework used in the wild; full technical analysis and IOCs published by Kaspersky.
More from Safety
- Cryptographer Matthew Green pushes back on LLM cryptanalysis fears: best AES-128 attacks still need 2^89 work — matthew_d_green · 2026-11-03
- WaPo Investigation: LLMs Got Voters' Congressional Districts Wrong 48% of the Time — Polymarket · 2026-11-03
- SafeTulu: scalable gradient attribution filters benign-looking data that erodes LLM safety — pratyushmaini · 2026-11-03
- Debate Fri 11/6: Should we stop trusting AI agents with our information? — mer__edith · 2026-11-03
- AI safety founders publish personal cyber-defense and preparedness guide for the AI age — harris_edouard · 2026-11-03
- US court dismisses air purifier maker's defamation suit against Elsevier — skdh · 2026-11-03