Kaspersky reveals LLM-orchestrated post-exploitation via CyberStrikeAI

1. Executive summary

Kaspersky's Cyber Threat Intelligence team has published an investigation of a campaign in which an open-source framework, CyberStrikeAI, used a server-side LLM orchestrator to plan and drive post-exploitation on compromised hosts, with confirmed victims in the education sector across several countries in Africa and Latin America. The implant is a conventional C2 agent that polls its listener over HTTP/S, TCP or WebSocket; the model, running on the attacker's server, selects tools and generates the commands the implant executes. Kaspersky reports that the full chain, from agent deployment to domain administrator compromise, completed within 3 to 4 days, and that the techniques used (Kerberoasting, AS-REP Roasting, LSASS dumping, DCSync, Golden Ticket) are established domain-compromise methods rather than new exploits. No CVE is associated with this item and no verified severity score applies; the risk to EMEA financial services is indirect, resting on the possibility that the same framework is reused against other sectors, not on any reported financial-sector victim. Kaspersky states the available data does not link the activity to any known threat group.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

Kaspersky reconstructed the chain from one incident within the campaign. The first phase was manual: a human operator gained access to the victim's infrastructure through a compromised SQL Server running version 16.0.1000, collected basic host information, deployed tools and conducted network reconnaissance. That activity took nearly a day, followed by a two-week pause. The second phase was driven by the CyberStrikeAI agent.

Confirmed steps, in the order Kaspersky reports them:

1. Initial access through the compromised SQL Server (16.0.1000). The first malicious commands on victim systems originated from the sqlservr.exe process, which Kaspersky treats as the likely initial access vector and the context in which the attackers gained code execution. Commands executed before agent installation were run manually by the operator inside that process.
2. Manual pre-deployment activity: host information gathering with standard commands, an internet-access check using the Chinese service dnslog[.]cn (the attackers resolve a generated random third-level domain to obtain the host's external IP), and a PowerShell script that checks for the agent's presence at its default deployment paths: C:\Windows\Temp\, C:\Windows\, C:\ProgramData\, C:\Temp. The agent name can be disguised as a legitimate system process; Kaspersky's example mimics svchost.exe as svchosts.exe.
3. Agent deployment and persistence. The agent created a scheduled task named SystemUpdate pointing at the implant path. Kaspersky's source-code review found an alternative: a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the same name. On Linux, persistence is either the entry @reboot & in the user's crontab or the line (nohup &>/dev/null &) in ~/.bashrc. Kaspersky reports persistence and local reconnaissance completed within 2 minutes of deployment.
4. Execution. The agent uses PowerShell to run payloads, with commands Base64-encoded to evade keyword detection. Where administrative privileges were available (for example a domain administrator account), the agent on remote hosts often created scheduled tasks so the payload ran as SYSTEM, either through schtasks or by creating the task via the Schedule.Service COM object. Payloads were also split across multiple files and reassembled; Kaspersky shows fragments written to d3.b64, decoded with certutil and executed. One assembled script decrypts DPAPI secrets from C:\ProgramData\dsn_line.txt, a file populated by a command that copies a DSN connection string out of the SQL Server Reporting Services configuration file rsreportserver.config. Kaspersky notes some delivered scripts contain Chinese-language comments.
5. Discovery. The agent generated PowerShell to map a privilege-escalation path by compromising SCCM or exploiting msiexec via the AlwaysInstallElevated key, and inventoried services running under domain accounts and tasks running under SYSTEM. It periodically checked for Microsoft Defender detections. Network reconnaissance used PowerShell's built-in functionality rather than nmap or fscan, LDAP queries against Active Directory objects, and WMI to verify agent presence on remote hosts. Domain reconnaissance included LDAP queries to gather data for Kerberoasting and AS-REP Roasting, checks for LAPS and Microsoft Azure, and a search for the .azcopy directory in user home directories. Kaspersky reports domain reconnaissance ran over the next 5 hours.
6. Credential access. The agent dumped registry hives with reg.exe, dumped lsass.exe using the MiniDump function of comsvcs.dll (using the target PID rather than process name to frustrate command-line detection), and after compromising the built-in domain administrator account carried out DCSync and Golden Ticket attacks through a renamed mimikatz.
7. Lateral movement. The attackers used Impacket's WMIExec, identifiable by its characteristic command line, and once installed the agent preferred standard OS mechanisms such as shared network administrative folders. A second WMI method used the Invoke-CimMethod cmdlet. The p1.ps1 reverse shell, which connects to 185.186.245[.]144:5501, was distributed this way using compromised accounts with local administrator rights on target hosts.
8. Collection and exfiltration. On an education-sector SQL server, the agent collected database information via PowerShell, first checking the privileges of the account it connected under. File collection was preceded by a recursive directory scan. The implant has a built-in interface for direct upload and download over the main encrypted C2 channel (HTTP or TCP), with data Base64-encoded inside the agent's standard JSON responses. It can also take screenshots on command from the orchestrator, on both Windows and Linux. Kaspersky reports data collection was the final stage observed; the chain ended there.

Architecture and detection artefacts. CyberStrikeAI is written in Go and combines LLM orchestration with a C2 server and beacons in one server process. C2 functions are exposed to the model as MCP tools. The implant has no AI functionality: no API keys, no calls to AI service APIs, no autonomous logic. It polls the listener over HTTP/S, TCP or WebSocket. Kaspersky names three artefacts for linking samples to infrastructure: the not_before field of the self-signed TLS certificate, which records process start time and lets restart chronology be reconstructed as with Cobalt Strike; the Go build path (go version -m), which contains a temporary directory with the build identifier and is identical across payloads, plus VCS metadata; and the X-Implant-Token HTTP header, a fixed value unique to each C2 server and embedded at build time. Implant version does not track server version, and a single agent version was used throughout the observed incidents.

Attribution caveats. Kaspersky states the available data does not link the activity to any known group and does not establish that one operator is behind both sample clusters. Build metadata divides samples into two independent groups with no shared C2 infrastructure and different CyberStrikeAI server versions. Chinese-language comments in the scripts, use of Chinese services, and C2 restarts clustering in UTC+8 business hours suggest a Chinese-speaking operator, in Kaspersky's wording; this is an inference, not an attribution. No MITRE ATT&CK profile is recorded for any actor in this item, so attribution is unconfirmed. All technical detail here is single-sourced to Kaspersky; verify before enforcement.

4. Mitigation & containment

P1 within 24h

• Hunt for the scheduled task named SystemUpdate and for a value of the same name under HKCU\Software\Microsoft\Windows\CurrentVersion\Run; remove both and quarantine the referenced binary.
• Search for implants at C:\Windows\Temp\, C:\Windows\, C:\ProgramData\ and C:\Temp, including masquerading names such as svchosts.exe and svcmon32.exe, and block the hashes in §5.
• Block egress to 185.186.245[.]144, fastcdn[.]bar, media.fastcdn[.]bar and 104.234.26[.]163 at proxy and firewall.
• Audit SQL Server 16.0.1000 instances for unexpected sqlservr.exe child processes, particularly PowerShell, certutil, schtasks and net.exe. Restrict SQL Server service account rights and review how the service account can reach the network.
• Reset credentials for any account with domain administrator rights on affected segments and rotate the krbtgt account twice if DCSync or Golden Ticket activity is suspected.

P2 within 72h

• Alert on certutil decoding of .b64 files and on PowerShell launched from sqlservr.exe.
• Review rsreportserver.config access and the presence of C:\ProgramData\dsn_line.txt; treat any host with that file as compromised.
• Enable PowerShell script block logging and command-line auditing, and forward WMI and scheduled-task creation events to the SIEM.
• Check for renamed mimikatz binaries and for comsvcs.dll MiniDump usage against lsass.exe by PID.
• Review Linux hosts for @reboot entries in user crontabs and nohup lines in ~/.bashrc referencing unknown binaries.

P3 within 7 days

• Inventory SCCM clients and remove AlwaysInstallElevated where set; review LAPS deployment and Azure credential exposure on database and application servers.
• Restrict WMI and SMB lateral movement paths between server tiers and require tiered administration for domain controllers.
• No fixed release is named in public reporting because this is an attacker-operated framework, not a vulnerable product; the SQL Server version is the access context Kaspersky observed, not a patched CVE.

5. Indicators of compromise

All indicators below are single-sourced to Kaspersky. Hash labels follow digest length.

md5  d726a8b4886c636f76ca6d30ef6a6ff4
md5  2770562d104391b92b42671c270079bb
md5  09e1da2afa1216ecc55648ec8e122d2a
md5  805b9e4ae74c903787416800999b8418
md5  29efd64dd3c7fe1e2b022b7ad73a1ba5
md5  74f57b3e897a4960dcdd5b7e8a54f9df
md5  0bbd08af95f877f1d568b03de2eb76b4
ipv4  185.186.245[.]144
domain  fastcdn[.]bar
domain  media.fastcdn[.]bar
ipv4  104.234.26[.]163

Behavioural indicators

6. Detection

rule CyberStrikeAI_Implant_Go
{
    meta:
        author = "Adverse Trace"
        date = "2026-11-02"
        reference = "https://securelist.com/tr/cyberstrikeai-attacks/121715/"
        description = "Detects CyberStrikeAI Go implants by build path and implant token header"
    strings:
        $go = "Go build"
        $token = "X-Implant-Token"
        $mcp = "MCP"
    condition:
        uint32(0) == 0x464c457f or uint16(0) == 0x5a4d
        and $go and $token
}

title: CyberStrikeAI Persistence and Execution
id: 8f2c1a44-6b7e-4d21-9c3a-cyberstrikeai
status: experimental
author: Adverse Trace
date: 2026/11/02
references:

    - https://securelist.com/tr/cyberstrikeai-attacks/121715/
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\sqlservr.exe'
    selection_child:
        Image|endswith:

            - '\powershell.exe'
            - '\certutil.exe'
            - '\schtasks.exe'
            - '\net.exe'
    condition: selection_parent and selection_child
fields:

    - Image
    - CommandLine
    - ParentImage
falsepositives:

    - Legitimate SQL Server maintenance scripts
level: high

7. Sources

• Kaspersky Securelist, "CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations", https://securelist.com/tr/cyberstrikeai-attacks/121715/, 2026-11-02

8. Adverse Trace position

Adverse Trace assesses this as a medium-severity item for EMEA financial services: no financial-sector victim is reported, no CVE or verified CVSS score applies, and the techniques Kaspersky describes are established domain-compromise methods that well-tuned detection already covers. The material change is speed and reduced operator skill, with domain administrator compromise reached in 3 to 4 days. The technical detail and the indicator set are single-sourced to Kaspersky and should be verified before enforcement, and the suggested Chinese-speaking operator link is Kaspersky's inference, not an attribution. We will monitor for further reporting on CyberStrikeAI reuse against other sectors and will update this advisory if a financial-sector victim or a second independent source emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.