CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations

Kaspersky discovered a real-world attack campaign leveraging an open-source AI-powered C2 framework called CyberStrikeAI, which uses a server-side LLM orchestrator to automate post-exploitation activities. The attacks targeted educational organizations in Africa and Latin America, achieving full domain compromise through automated reconnaissance, lateral movement, credential access, and data exfiltration. The implant, deployed after initial access via a compromised SQL Server, executes commands generated by the LLM, enabling rapid progression from initial foothold to domain dominance within 3–4 days. The campaign demonstrates the emerging use of AI to lower operator skill requirements while using known TTPs, making detection reliant on behavioral analysis rather than novel signatures.

AI-extracted · verify before operational use