A compromised SQL Server, a two-week pause, then three to four days to full domain control. That is the shape of one intrusion in a Kaspersky Securelist report on CyberStrikeAI. It is an open-source platform that pairs an AI-driven orchestrator with a command-and-control server and a set of deployable agents.
Securelist says confirmed victims sit in the education sector, in several countries across Africa and Latin America. It adds that it cannot tie the activity to any known group of attackers.
What CyberStrikeAI Actually Is
CyberStrikeAI is an open-source, modular platform written in Go for automating penetration testing, per Securelist. Its code lives on GitHub as aipentest/cyberstrikeai, released under the Apache 2.0 license. As of 2 November 2026 the project’s own GitHub page showed more than 8,000 stars, a sign that security teams, not only attackers, have picked it up for authorized work.
Securelist says the tool was developed within the Chinese cybersecurity community. That origin describes who built it, not who ran the intrusions it later found. The project’s own GitHub page frames CyberStrikeAI as a system for authorized penetration testing and security operations, not as attack software. Securelist’s report shows how a legitimate open-source project can still end up inside a real intrusion.
How the Orchestrator, the C2 Server and the Agents Split the Work
CyberStrikeAI combines three parts in one design. An LLM-based orchestrator plans and directs the operation. A built-in command-and-control (C2) server runs in the same server process and talks to the deployed agents. Securelist calls this combination “LLM-based attack orchestration and a built-in C2 server with agents (beacons) within a single server process.”
The agents themselves carry none of that intelligence. Securelist describes the implant as “a classic C2 agent with no AI functionality, no API keys, no calls to AI service APIs, and no autonomous logic.”
It only polls the control server over HTTP or HTTPS, TCP or WebSocket and carries out what it is told. Every decision about targets, timing and next steps stays on the operator’s own server, which is also where any penetration testing framework of this kind would normally keep its logic.
From a Compromised SQL Server to Domain Administrator
Securelist says it tracked two separate campaigns built on this tooling. The Windows and Linux implants in each share identical build metadata, but the two campaigns do not share C2 infrastructure, and each runs a different CyberStrikeAI version. Securelist cannot say the same operator runs both.
To show how fast one of these intrusions can move, Securelist walked through a single incident inside one of the two campaigns. The first phase runs the usual way: a human operator reaches the network through a compromised SQL Server, version 16.0.1000, with no CyberStrikeAI agent involved yet. A two-week pause follows before the agent appears.
- Compromised SQL Server (16.0.1000)Initial Accessmanual operator access, no agent yet
- CyberStrikeAI control serverControl Serveragent deployed after a two-week pause
- Windows or Linux beaconVictim Networkpersistence and local recon in 2 minutes
- Domain reconnaissanceVictim Network5 hours of AD and network mapping
- Credential dumping and DCSyncVictim Networkafter a further pause of several days
- Lateral movement via SMB and WMIVictim Networkmass credential dumping across hosts
- Database exportData
Once deployed, the agent sets up persistence and runs local reconnaissance in about two minutes, then spends roughly five hours mapping the domain. After a further pause of several days, Securelist says the operators moved fast. Lateral movement over SMB and WMI, mass credential dumping on hosts and a database export followed, with that whole final stage taking under an hour. From agent deployment to domain administrator, Securelist puts the entire run at three to four days.
The credential theft itself used ordinary, well-known tools. Securelist says the operators ran WMIExec, part of the Impacket toolkit, for the SMB and WMI moves. They dumped the lsass process with the MiniDump function in comsvcs.dll and read registry hives with the built-in reg.exe utility.
A renamed copy of mimikatz handled OS credential dumping, including DCSync and Golden Ticket attacks. Files left the network through the same encrypted channel the beacon already used to reach its C2 server. Securelist published indicators from the case, listed below exactly as reported.
| Type | Indicator | Note |
|---|---|---|
| Hash | D726A8B4886C636F76CA6D30EF6A6FF4 | Windows beacon |
| Hash | 2770562d104391b92b42671c270079bb | Windows beacon |
| Hash | 09e1da2afa1216ecc55648ec8e122d2a | Linux beacon |
| Hash | 805B9E4AE74C903787416800999B8418 | Linux beacon |
| Hash | 29EFD64DD3C7FE1E2B022B7AD73A1BA5 | mimikatz, renamed wdiag2.exe |
| Hash | 74F57B3E897A4960DCDD5B7E8A54F9DF | RogueWinRM.exe |
| Hash | 0BBD08AF95F877F1D568B03DE2EB76B4 | PowerShell reverse shell |
| IP | 185.186.245[.]144 | Windows beacon C2 |
| Domain | fastcdn[.]bar | Windows beacon C2 |
| Domain | media.fastcdn[.]bar | Linux beacon C2 |
| IP | 104.234.26[.]163 | Linux beacon C2 and payload delivery |
Who Is Behind It, and How Far the Tooling Has Spread
Securelist is direct about the limits of what it knows. It says the available data “does not allow us to link the activity to any known group of attackers.” It adds that it cannot “state with certainty that the same operator is behind both campaigns.”
Securelist does add one soft signal, not a conclusion. Chinese-language comments in the attackers’ scripts and the use of Chinese services “suggest a connection between the activity and a Chinese-speaking operator.” No group name is given either way.
That gap is becoming a pattern of its own. Open, well-documented frameworks like this one hand any operator a working threat actor toolkit without the fingerprints a custom-built one would leave. Our own checks, run on 2 November 2026, show how far the tooling and the story have already travelled.
- Named threat actorNo, Securelist says the data does not link the activity to any known group of attackers (2 Nov 2026)
- Chinese-speaking operator linkUnknown, Chinese-language code comments and infrastructure suggest a link, but Securelist names no operator (2 Nov 2026)
- GitHub activity6 repositories matching its name made or updated since 1 Oct 2026, from our own search (2 Nov 2026)
- Public and dark-web mentions135 X posts since 20 Oct and 13 Telegram, forum and Discord posts since 27 Oct, from our own checks (2 Nov 2026)
The 6 repositories our GitHub search found include direct copies of the project under different accounts and at least one public fork built on top of it. The 13 Telegram, forum and Discord mentions in Brandefense Blackhole are mostly channels that forward published security coverage rather than underground sales activity. None of this changes Securelist’s own attribution: a busy open-source ecosystem, still no named group.
What Changes for Defenders
The timeline itself is the lesson. Most of the dwell time in this case sat in two quiet pauses: two weeks, then several days. The damage came in the gaps between them: two minutes to persistence, five hours to map the domain, and under an hour to reach a database export. A defense built only around periodic scans will miss both the quiet stretches and the fast ones.
Three checks follow directly from how Securelist describes the tool. Watch for comsvcs.dll being called against the lsass process, a known way to dump credentials without touching disk. Alert on DCSync requests from accounts that have no business replicating directory data. Baseline normal SMB and WMI traffic between servers, so a sudden burst of connections to many hosts at once stands out instead of blending in.
Because the control server, not the implant, carries every decision CyberStrikeAI makes, egress monitoring still matters more than hunting for AI logic on the endpoint itself. A beacon polling an unfamiliar domain or IP over HTTPS, raw TCP or WebSocket on a schedule is still the most visible part of the chain. Teams building that kind of visibility across their own exposure are the same audience Cyber Threat Intelligence programs are built for.
CyberStrikeAI is not the only AI-linked tool Brandefense has covered this week. A separate report traced a ransomware crew’s own AI coding agent running network recon and lateral movement with limited human oversight. Another covered an infostealer that asks an AI model to rank stolen data.
Different platforms and operators, the same direction: more of the attack chain now runs on AI help. Defenders still need to watch the parts of it that show up on a wire, a log or a C2 connection.