Kaspersky reports CyberStrikeAI: AI-driven C2 compromises domains in under an hour
cyb3rops · x · 2026-11-05
Kaspersky's CTI team has disclosed a real-world campaign, CyberStrikeAI, using AI-controlled C2 agents, with confirmed victims including educational institutions.
- No novel techniques, just speed: credential theft, SMB/WMI lateral movement, and domain compromise completed in under an hour
- Samples linked via Go build metadata, TLS certificates, and an X-Implant-Token header
- Full kill-chain breakdown (execution, persistence, discovery, exfiltration) with IOCs included
More from Safety
- Rep. Ted Lieu says Congress will hold AI hearings and pass 'reasonable' guardrails — GarrisonLovely · 2026-11-05
- Apple flags rogue AI agents in its 10-K, using the words conceal and manipulate — Dapper-Tale-4021 · 2026-11-05
- Coinspect researcher escapes AWS Firecracker sandbox with AI agents' help — evilsocket · 2026-11-05
- MCP proxy that blocks exfil addresses from tool output: 48/164 attacks to 0, but blocks legit sends too — eccentric_ez · 2026-11-05
- CrowdStrike CEO George Kurtz: security is now the gas pedal, not the brake, for AI adoption — No Priors · 2026-11-05
- Cresta AI Agent earns AIUC-1 certification via independent audit and thousands of adversarial tests — timshi_ai · 2026-11-05