CyberStrikeAI Uses LLM Orchestration to Automate Post-Exploitation in Education-Sector Attacks
Summary
Kaspersky details attacks on education organizations in Africa and Latin America using CyberStrikeAI, an LLM-orchestrated C2 framework. The investigation describes familiar domain-compromise techniques executed rapidly and explains how defenders can detect them.
Key points
- Kaspersky reports confirmed victims in the education sector across several countries in Africa and Latin America; it says initial access likely came through a compromised SQL Server.
- CyberStrikeAI keeps its LLM orchestrator on the C2 server; the implant has no AI functionality and executes commands selected by the model, subject to operator oversight.
- The reported activity included scheduled-task persistence, domain reconnaissance, credential dumping, DCSync and Golden Ticket attacks, and lateral movement using WMI and SMB.
- In one incident, the campaign progressed from agent deployment to domain-administrator compromise within 3–4 days; data collection was the final observed stage.
- Build metadata linked samples within two groups, but investigators could not establish that the groups shared an operator or connect them to a known threat group.
- Kaspersky says the attacks used familiar techniques and recommends established behavioral and correlation detections; it cites rules for remote scheduled tasks, LSASS dumping, WMI activity, and LDAP reconnaissance.
Article Details
- Attack Vectors
- The first malicious commands originated from sqlservr.exe on a compromised SQL Server; the article identifies this as the likely initial access vector but does not specify how the server was compromised.
- Attackers used PowerShell to execute payloads, with commands additionally encoded in Base64.
- The CyberStrikeAI agent established persistence using scheduled tasks; the framework also supports registry Run keys, Linux crontab entries, and .bashrc modifications.
- Lateral movement included WMI and SMB, including distribution of a reverse-shell script through administrative network shares.
- Credential access included LSASS memory dumping, registry hive dumping, DCSync, and Golden Ticket attacks.
- The agent collected database and network-share files and could transfer files over its encrypted C2 channel.
- Defensive Notes
- Monitor creation of schtasks.exe processes with the /s argument and scheduled tasks that execute PowerShell.
- Monitor LSASS access and memory dumping through comsvcs.dll, including calls to its MiniDump function.
- Use correlation and behavioral analysis for remote execution via WMI and WinRM, reconnaissance, credential access, and lateral movement.
- Analyze decrypted network traffic for CyberStrikeAI agent communication patterns and use network anomaly detection to identify suspicious LDAP reconnaissance.
- Collect relevant process creation, PowerShell, login, object-access, and shared-resource events; the article specifies Windows security events 4688, 4624, 4768, 4769, 4662, 4663, 4656, and 5145, plus PowerShell event 4104 and Linux auditd events execve and openat.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fastcdn[.]bar | C2 domain for the Windows Beacon. |
| HOSTNAME | media[.]fastcdn[.]bar | C2 hostname for the Linux Beacon. |
| IPV4 | 104[.]234[.]26[.]163 | Attacker infrastructure used for payload delivery and by the Linux Beacon. |
| IPV4 | 185[.]186[.]245[.]144 | C2 server for the Windows Beacon. |
| MD5 | 09e1da2afa1216ecc55648ec8e122d2a | Hash of a CyberStrikeAI Linux Beacon. |
| MD5 | 0bbd08af95f877f1d568b03de2eb76b4 | Hash of a PowerShell reverse-shell script identified in the attackers’ tools and scripts. |
| MD5 | 2770562d104391b92b42671c270079bb | Hash of a CyberStrikeAI Windows Beacon. |
| MD5 | 29efd64dd3c7fe1e2b022b7ad73a1ba5 | Hash of a mimikatz tool identified in the attackers’ tools and scripts. |
| MD5 | 74f57b3e897a4960dcdd5b7e8a54f9df | Hash of RogueWinRM identified in the attackers’ tools and scripts. |
| MD5 | 805b9e4ae74c903787416800999b8418 | Hash of a CyberStrikeAI Linux Beacon. |
| MD5 | d726a8b4886c636f76ca6d30ef6a6ff4 | Hash of a CyberStrikeAI Windows Beacon. |
MITRE ATT&CK
T1003.001 · LSASS MemoryThe attackers dumped lsass.exe using the MiniDump function in comsvcs.dll.T1003.006 · DCSyncAfter compromising privileged domain accounts, the attackers performed DCSync through the agent.T1018 · Remote System DiscoveryThe agent used PowerShell to identify accessible hosts on the network.T1021.002 · SMB/Windows Admin SharesThe attackers used SMB and shared administrative network folders to distribute scripts across the network.T1041 · Exfiltration Over C2 ChannelCollected files were transferred directly over the agent’s encrypted C2 communication channel.T1047 · Windows Management InstrumentationThe attackers used WMI for remote command execution and to distribute a reverse-shell script.T1053.003 · CronThe framework supports Linux persistence by adding an @reboot entry to the user’s crontab.T1053.005 · Scheduled TaskThe agent established persistence with Windows scheduled tasks and used scheduled tasks on remote hosts to run payloads.T1059.001 · PowerShellThe attackers used PowerShell to execute payloads and generated commands on compromised hosts.T1071.001 · Web ProtocolsThe implant polled its listener server over HTTP/S as one of its C2 communication methods.T1546.004 · Unix Shell Configuration ModificationThe framework supports Linux persistence by adding a command to ~/.bashrc to start the agent when an interactive shell opens.T1547.001 · Registry Run Keys / Startup FolderThe framework’s source code supports persistence by adding a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.T1558.001 · Golden TicketAfter compromising privileged domain accounts, the attackers conducted Golden Ticket attacks using a renamed mimikatz utility.T1558.003 · KerberoastingThe agent made LDAP queries to gather information for Kerberoasting.T1558.004 · AS-REP RoastingThe agent made LDAP queries to gather information for AS-REP Roasting.
Vendors
KasperskyAs part of proactive threat monitoring, Kaspersky’s Cyber Threat Intelligence team identified a malicious campaign involving C2 agents controlled by artificial intelligence.Microsoftcode revealed an alternative method of persistence: by adding a value to the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, where the name of the created value matches the task name (SystemUpdate).
Products
Kaspersky Anti Targeted AttackKaspersky Anti Targeted Attack (KATA) is used to detect malicious activity in network traffic.Kaspersky Next EDR ExpertHere are a few examples of how Kaspersky Next EDR Expert successfully detects the attack described:Kaspersky SIEMKaspersky SIEM detects all stages of an attack by the CyberStrikeAI agent.Microsoft AzureFinally, the agent was used to check the domain for the presence of LAPS and Microsoft Azure:Microsoft Defender Antimalware PlatformDuring their activity, the attackers periodically checked for Microsoft Defender detections:SQL Servera standard approach: a human operator gains access to the victim’s infrastructure via a compromised SQL Server (version 16.0.1000), then collects basic information about the host, deploys tools, and conducts
Tools
CyberStrikeAICyberStrikeAI played a key role in the post-exploitation phase.ImpacketTo spread across the network using compromised accounts, the attackers employed utilities from the Impacket toolkit, specifically WMIExec, as indicated by the utility’s characteristic command line:Mimikatzattackers also carried out DCSync and Golden Ticket attacks via the agent using a renamed version of the mimikatz utility:RogueWinRMc:\rwx\RogueWinRM.exewmiexecTo spread across the network using compromised accounts, the attackers employed utilities from the Impacket toolkit, specifically WMIExec, as indicated by the utility’s characteristic command line: