Kaspersky finds AI-run command server driving attacks on schools

Key Points

1. Kaspersky says attackers used an LLM-orchestrated framework, CyberStrikeAI, to fully compromise victim domains.
2. Confirmed victims were education-sector organizations in several African and Latin American countries, researchers said.
3. Kaspersky calls it one of the first public accounts of an in-the-wild LLM-driven compromise.

The latest:

Attackers have moved a language model into the operational core of an intrusion, Kaspersky researchers reported, using the open-source CyberStrikeAI framework to carry victims from reconnaissance to full domain compromise. The company’s Cyber Threat Intelligence team said confirmed targets were education-sector organizations across several countries in Africa and Latin America, with the model planning steps and selecting tools from the command-and-control server.

Details:

• How it works: Kaspersky described CyberStrikeAI as a modular Go platform combining an LLM orchestrator with a built-in command-and-control server. The model plans actions and generates commands; the implant on the victim host executes them, carrying no AI functionality, no API keys and no autonomous logic.
• Division of labor: Decisions are split across two levels, according to the report: the human operator defines the task broadly, while the model decides which commands to send and in what order. Strategic planning stays with the operator; the technical sequence is delegated to the model.
• Initial access: Researchers traced the first malicious commands to the sqlservr.exe process on a compromised SQL Server running version 16.0.1000, identified as the likely initial access vector. That opening phase, they said, was manual operator work rather than automated implant activity.
• The timeline: Kaspersky reconstructed one incident as two phases. Human-led host collection, tool deployment and network reconnaissance took nearly a day, followed by a two-week pause before the AI agent was deployed.
• The speed: Once the agent was running, persistence and local reconnaissance took 2 minutes and domain reconnaissance 5 hours, the researchers said. After a pause of several days, lateral movement over SMB and WMI, mass credential dumping and database export were completed in under an hour.
• Persistence methods: On Windows the agent created a scheduled task named SystemUpdate pointing to the implant, with a registry Run key as an alternative. On Linux, Kaspersky said persistence used either a crontab reboot entry or a line appended to the user’s bashrc.
• Evasion: Commands were Base64-encoded to defeat keyword detection, SQL and LDAP queries were obfuscated, and payloads were split across multiple files later reassembled with certutil. The agent was also disguised under names mimicking legitimate system processes such as svchost.exe.
• Attribution clues: Kaspersky listed detection artifacts including a self-signed TLS certificate naming the framework, build metadata exposing a fixed package path, and a unique “X-Implant-Token” header per server. Some delivered scripts contained comments in Chinese.
• Human oversight: The choice of persistence method is delegated to the model, but a human-in-the-loop mechanism lets the operator approve or correct generated commands before execution, the researchers said. One payload was a reverse shell connecting to 185.186.245.144 on port 5501.

Background:

Kaspersky said language models had until recently been confined to preparatory stages of attacks: drafting phishing emails, debugging code and hunting vulnerabilities. Post-exploitation, the phase the company describes as traditionally requiring manual work by an experienced operator, had stayed human.

Between the lines:

The researchers argue the implant is no longer a simple command-execution tool. The reported speed supports that reading: domain-wide credential dumping and database export inside an hour suggests machine pacing rather than operator typing. Kaspersky also cautioned that an implant’s build date marks the earliest possible deployment of the infrastructure, not the length of the compromise, since servers are updated while agents stay unchanged.

What’s next

Watch whether other vendors publish matching CyberStrikeAI detections, and whether the listed indicators, including the implant token header and the self-signed certificate fields, surface in intrusions outside the education sector.