Attackers used a language model to choose their next moves inside compromised educational networks, progressing to domain administrator access and database collection. Kaspersky’s November 2 investigation describes CyberStrikeAI operations in Africa and Latin America during September and October. The revealing detail is where the AI sat: on the attackers’ control server, while an ordinary implant carried out its instructions on victims’ machines.
This was a human-directed intrusion with AI-assisted execution. A person established the initial foothold and set objectives; the model helped turn those objectives into commands. That distinction explains both the operation’s speed and why familiar Windows security controls could still detect it.
A manual break-in, then a two-week pause
In the reconstructed incident, the first malicious commands came from sqlservr.exe. Kaspersky assesses a compromised SQL Server as the likely entry context; that observation does not establish a particular SQL vulnerability or explain exactly how access was obtained. The operator collected host information, prepared tools and explored the network for nearly a day, then went quiet for about two weeks.
When activity resumed, the attackers deployed CyberStrikeAI. Persistence and local reconnaissance followed within two minutes, with domain reconnaissance continuing over roughly five hours. After another pause of several days, the final burst combined movement between machines, credential collection and database export in no more than an hour. The researchers put the progression from implant deployment to domain administrator compromise at three to four days. The one-hour figure describes the closing sequence, not the entire intrusion.
The model made decisions; the implant executed them
CyberStrikeAI is an open-source penetration-testing framework. Its server combines command-and-control functions with an LLM that can choose tools, generate commands and read their results. The operator can retain approval over proposed actions. On an infected host, the Go implant is a conventional remote-control agent: it runs commands and transfers files, without containing the model, AI service keys or its own autonomous planning.
For defenders, that location matters. Looking only for a compromised computer contacting ChatGPT or Claude would miss this architecture. The victim communicates with the attackers’ control infrastructure; the interaction with a language model happens elsewhere. This is different from VOLTA’s use of AI to appraise stolen victim information: here, the model helped decide what to do next inside the network.
Ordinary Windows actions produced extraordinary access
The attackers disguised one implant as svchosts.exe, resembling the legitimate svchost.exe, and established persistence through a scheduled task named SystemUpdate. Those names are investigation clues, not verdicts by themselves. The important relationship is between a file’s location, its launch mechanism and the activity that follows.
After reconnaissance, the operation collected credentials, accessed the Windows LSASS process and used compromised privileged accounts to reach other hosts through SMB shares and Windows Management Instrumentation. With domain administrator privileges, the attackers also performed DCSync and Golden Ticket attacks: techniques for obtaining domain authentication secrets and abusing forged authentication tickets. In other words, the model did not need to invent a new exploit to turn an existing foothold into wider control.
One database-collection sequence checked the account’s permissions before generating and running SQL queries. The implant could also transfer files and return screenshots through its normal control channel. Kaspersky observed no further activity after collection in the investigated chains; the report does not identify a victim count or quantify the stolen records.
Investigate the chain, not an “AI process”
For a Windows administrator reviewing a suspected incident, the useful starting points remain concrete: unexpected child commands from SQL Server, newly created tasks pointing to unusual executables, access to credential memory and remote execution across multiple machines. Correlate these with accounts, timestamps and the report’s indicators. A task name alone should not trigger deletion, and removing one implant is not a complete response when privileged credentials have already been exposed.
The report also stops short of naming an attacker group. Build metadata separated samples into two groups without enough evidence to link them. Chinese-language artifacts do not establish a particular organization or government sponsor. The defensible conclusion is narrower and useful: a human operator delegated technical choices to a remote model, while leaving a recognizable trail of credential theft and domain compromise.
References
- Kirill Antonov, Vladislav Vlasov and Dmitry Chizhmak. “CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations.” Securelist, November 2, 2026; accessed November 2, 2026. CyberStrikeAI investigation and indicators.
