Last week it was Vapor Panda running ARTEX against 200+ organizations. Yesterday it was Aur0ra ransomware putting AI agents on the night shift. Today Kaspersky added another one, and this time the attacker didn't build anything. They downloaded it.
What Kaspersky Found
Kaspersky's researchers published an analysis of intrusions at education-sector organizations in several African and Latin American countries. The tool was CyberStrikeAI, an open-source penetration testing framework written in Go. It bundles an LLM orchestrator, a C2 server and implants into one process, and it exposes the C2 functions to the model as MCP tools.
The split of work is the interesting part:
- The implant is dumb. It has no AI in it. It polls the server and runs shell commands.
- The model is on the attacker's server. The operator sets the goal in general terms, and the model picks which commands to send and in what order.
- A human can still step in. The framework has a human-in-the-loop option to approve or correct the model's commands.
How One Intrusion Played Out
- Initial access: a compromised SQL Server. The first malicious commands ran under
sqlservr.exe, typed by a human. - Manual phase: about a day of profiling and recon, then a two-week pause.
- Agent phase: persistence and local recon within about two minutes of deploying the agent. Roughly five hours of domain mapping. Then, after another pause, lateral movement, mass credential dumping and a database export in about an hour.
- End state: domain admin, three to four days after the agent went in.
The techniques were all familiar: Kerberoasting and AS-REP roasting, LSASS dumps through comsvcs.dll, DCSync and Golden Tickets with a renamed Mimikatz, WMIExec for lateral movement, a scheduled task named SystemUpdate for persistence. Kaspersky's own read is that AI orchestration "has lowered the skill requirements for the operator" without inventing new techniques.
On attribution, Kaspersky points to a Chinese-speaking operator (Chinese comments in scripts, use of dnslog[.]cn, restarts during UTC+8 business hours) but says the data does not link the activity to any known group.
Why This Matters
Three agentic intrusion reports in about a week, and the pattern is getting clear:
- The barrier is gone. ARTEX looked like a state-backed toolkit. CyberStrikeAI is public. Anyone with a compromised SQL Server and an API key can now run an AD takedown at a speed that used to need a skilled team.
- Detection still works, if you have it. Every step Kaspersky documented is a known technique with a known detection. The model didn't invent a new way to dump LSASS. It just did it faster and without getting tired.
- Speed is the new problem. One hour from lateral movement to database export doesn't leave room for a ticket to sit in a queue overnight. Schools, which tend to have small teams and flat networks, are exactly where that gap hurts.
What To Do
- Get database servers off the internet. An exposed SQL Server was the door here. Nobody outside should be able to reach it directly.
- Alert on
sqlservr.exespawning shells or PowerShell. That's rarely legitimate. - Watch the AD attack basics: bursts of TGS requests (Kerberoasting), LSASS access,
comsvcs.dllMiniDump, replication requests from non-DCs (DCSync), and remote scheduled tasks. - Fix the things Kerberoasting feeds on: long, random passwords or managed service accounts, and no accounts with pre-auth disabled unless you know why.
- Segment so one server isn't a path to everything. If a database host can talk WMI and SMB to every machine in the domain, the agent will notice before you do.
- Make response automatic where you can. If containment needs a human to wake up, an agent working at machine speed has already finished.
Bottom Line
The scary part of CyberStrikeAI isn't the AI. It's that it's free, it works, and it used nothing you can't already detect. If your team can catch Kerberoasting and DCSync, keep doing it, and make sure you can act on it in minutes. If you can't, an open-source agent just made that gap a lot more expensive.
Sources: Kaspersky Securelist, CyberStrikeAI attacks educational institutions and Help Net Security