CyberStrikeAI carries AI-directed attacks through domain compromise
Kaspersky identified a campaign against educational organizations in several countries across Africa and Latin America, using CyberStrikeAI to automate post-compromise activity through a large language model (LLM). In one investigated incident, attackers first gained access through a compromised SQL Server.
After that foothold, an LLM orchestrator on the command-and-control server chose which tools and commands to use and in what order; an agent on the compromised machine carried them out. The operator set the broad goal, but the model handled the technical steps that took the intrusion from reconnaissance and lateral movement to domain compromise.
For organizations running SQL Server, a database-server intrusion can extend into domain infrastructure. The reported campaign shows that AI can drive follow-on activity after access, while the operator steers the objective rather than each move.
We analyze a series of attacks on educational institutions that were fully automated during the post-exploitation phase using the CyberStrikeAI penetration testing framework.