Hackers are using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed victims. The tool lets a language model decide which commands to run, so the operator no longer types each step by hand.
CyberStrikeAI Framework in Live Intrusions
CyberStrikeAI is an open-source, Go-based platform built for penetration testing. Criminals have already turned it toward real targets, and earlier reports showed attackers targeting Fortinet FortiGate devices with the same framework. The campaign shows the tool being used to move from a single weak server to full control of a network.
Analysts at Securelist identified the campaign during routine threat monitoring. They described it as one of the first public cases of a language model being used inside a live intrusion. The human operator sets a broad goal, and the AI model on the control server picks the tools, writes the commands, and reads the results. The malware on the victim machine is a plain implant with no AI inside it.
Intrusion Steps and Attack Timing
The intrusion began with a person. The operator got into a compromised SQL Server, collected basic host details, dropped tools, and scanned the network. That took almost a day, and the attackers then went quiet for about two weeks.
When they came back, the CyberStrikeAI agent took over. Within two minutes it set up persistence through a scheduled task named SystemUpdate and finished local checks. Over the next five hours it mapped the domain using PowerShell and LDAP queries. It also collected data needed for Kerberoasting and AS-REP Roasting, two methods for cracking account passwords.
After a short pause of a few days, the final phase ran in under an hour. The agent moved sideways through SMB and WMI, dumped credentials from many machines, and exported database content. It pulled passwords from registry files and from the LSASS process using the comsvcs.dll MiniDump function. After it compromised the built-in domain administrator, it ran DCSync and Golden Ticket techniques with a renamed Mimikatz tool.
The whole job, from agent install to domain admin, took only three to four days. The attackers tried to stay hidden. They encoded commands in Base64, split scripts into several files, and rebuilt them with certutil. They also named one beacon svchosts.exe so it looked like a normal Windows process. Some scripts contained Chinese comments, and the attackers used the Chinese service dnslog.cn to find victim IP addresses. Server restarts mostly fell within UTC+8 business hours.
Why The Activity Stands Out
The methods themselves are not new. The agent used well-known tools, and the AI made the work faster and easier. Because the model runs on the attacker’s server, defenders will not see AI traffic or unusual resource use inside their network. They will see the same actions a human intruder would take.
That means ordinary detection rules still work. Teams should watch for remote scheduled tasks created with schtasks.exe, LSASS memory access, and WMI or WinRM commands from unusual hosts. A DCSync attack steals password hashes by posing as a domain controller. Event ID 4662 helps catch it when the request comes from a system that is not a real domain controller.
The report also notes that rotating the krbtgt account twice after any domain admin compromise cancels forged Golden Tickets. It says defenders should check for commands running from the sqlservr.exe process, since that was the likely way in. It also says to patch and lock down exposed SQL Servers, turn on LAPS, limit replication rights, and keep logs for process launches, PowerShell activity, and logons. Microsoft recently described AI agents targeting Microsoft 365 tenants, so cloud accounts linked to the domain need the same care.
Indicators of compromise
| Type | Indicator | Description |
|---|---|---|
| Hash | D726A8B4886C636F76CA6D30EF6A6FF4 | CyberStrikeAI Windows beacon (c:\windows\temp\svchosts.exe) |
| Hash | 2770562d104391b92b42671c270079bb | CyberStrikeAI Windows beacon (c:\windows\temp\svcmon32.exe, c:\programdata\svcmon32.exe) |
| Hash | 09e1da2afa1216ecc55648ec8e122d2a | CyberStrikeAI Linux beacon |
| Hash | 805B9E4AE74C903787416800999B8418 | CyberStrikeAI Linux beacon |
| Hash | 29EFD64DD3C7FE1E2B022B7AD73A1BA5 | C:\Windows\Temp\wdiag2.exe (Mimikatz) |
| Hash | 74F57B3E897A4960DCDD5B7E8A54F9DF | c:\rwx\RogueWinRM.exe |
| Hash | 0BBD08AF95F877F1D568B03DE2EB76B4 | c:\ProgramData\p1.ps1 (reverse shell PowerShell script) |
| IP address | 185.186.245[.]144 | C2 for Windows beacon |
| Domain | fastcdn[.]bar | C2 for Windows beacon |
| Domain | media.fastcdn[.]bar | C2 for Linux beacon |
| IP address | 104.234.26[.]163 | C2 for payload delivery and Linux beacon |
Licensed under CC BY-ND 4.0 International