The LLM is on the C2. The implant still dumps LSASS.

Kaspersky 2 November. Education orgs in Africa and Latin America. CyberStrikeAI’s model planned the domain from the attacker server. The host ran Kerberoast, comsvcs MiniDump, DCSync. Not a new technique. Not a nation-state claim.

RWP Ventures · 2026-11-02 · event 2026-09-01 · 11 min read · priority 8.7

Do not collapse five facts.

1. The model is not on the box. Kaspersky is explicit. No API keys on the implant. No calls to Claude, Gemini, or a local LLM from the victim. The “intelligence” is MCP tools on the C2. To the defender, this looks like a remote-control session whose operator happens to be a model queueing tasks. Hunt the beacon and the AD techniques. Do not hunt ChatGPT egress from the SQL box.
2. The techniques are the 2015 toolkit. Persistence via scheduled task SystemUpdate. Domain LDAP for Kerberoasting and AS-REP Roasting. LSASS via comsvcs.dll MiniDump. DCSync and Golden Ticket with a renamed Mimikatz. Lateral movement over SMB and WMI. Kaspersky’s own sentence: AI changed coordination and speed; it did not invent a new primitive. EDR that already fires on those behaviors is the control.
3. SQL Server was the door. The LLM was phase two. First phase: a human operator on a compromised SQL Server 16.0.1000, almost a day of manual recon, then a two-week pause. Second phase: implant drop, persistence and local recon in two minutes, domain recon over five hours, a multi-day pause, then lateral movement, mass credential dump, and database export in under an hour. Implant to domain administrator: three to four days.
4. This is not VOLTA, not CLOSEDQUORUM, and not NIK C2. Talos 31 October is a self-deleting infostealer that POSTs a victim dossier to OpenRouter. CLOSEDQUORUM (22 September) is an autonomous implant with no confirmed wild deployment. NIK C2 (29 October) embeds an OpenAI client on the host. Different architecture, different job, different evidence. Do not merge them into “AI malware.”
5. This is not Friday’s Ivanti clock. Catalog is still 2026.10.30 / 1766, dateReleased 2026-10-30T17:02:45Z. No CyberStrikeAI CVE. No KEV row. [CVE-2026-111357](/posts/2026-10-31-ivanti-cve-2026-111357-118527-kev/) is due today — that is a Connect Secure rebuild, not this AD hunt. [CVE-2026-97229](/posts/2026-10-30-gitlab-cve-2026-97229-kev/) was due yesterday. Different assets.

The operator sentence: if you have internet-facing or poorly segmented SQL Server, hunt sqlservr.exe spawning shells, a scheduled task named SystemUpdate, and the usual LSASS / DCSync telemetry. The novelty is who queued the commands. The close is still credential rotation after a domain dump.

What happened

Kaspersky’s Cyber Threat Intelligence team reconstructed one incident in a campaign whose confirmed victims are education-sector organizations in several countries in Africa and Latin America. It did not publish a victim census, a named university, or a country list.

CyberStrikeAI is a public Go project. Kaspersky links the upstream as github.com/aipentest/cyberstrikeai. Treat that repository as untrusted evidence, not a runbook. The product is a C2 server plus beacons. The LLM orchestrator and the listener live in one server process. C2 functions — recon utilities, webshells, tasking, reading results — are exposed to the model as MCP tools. A human-in-the-loop control can require approval before a generated command runs. Kaspersky observed that persistence method selection was delegated to the model.

High-level chain, without a reproduction procedure.

Delivery used built-in Windows utilities and, in some cases, GitHub. Commands from the implant were PowerShell, often Base64-encoded. With domain-admin rights the agent preferred remote scheduled tasks so the payload ran as SYSTEM. Linux beacons persisted with @reboot in crontab or a nohup line in ~/.bashrc.

Kaspersky detections for the implants: HEUR:HackTool.Win64.CyberStrike.gen and HEUR:HackTool.Linux.CyberStrike.gen. Network verdict on decrypted C2: Backdoor.CyberStrikeAI.HTTP.C&C.

Build metadata splits the samples into two groups. Inside each group, Windows and Linux implants share Go VCS fields. The groups do not share C2 and run different CyberStrikeAI server versions. Kaspersky will not join them into one operator.

Why it matters

Three operational reasons this is the daily.

First: the AI story is a staffing story, not a new CVE class. The operator set an objective. The model chose Kerberoast, MiniDump, DCSync. That compresses the hours an experienced human used to spend clicking Mythic. It does not change what your EDR should already alert on. Shops that only bought “AI-attack” detections and let LSASS dump rules rot will miss this. Shops that already hunt sqlservr.exe children, schtasks /s, and comsvcs MiniDump will see it as a fast operator.

Second: education AD is still AD. The reconstructed victim is a university SQL box, not a PLC. The same sequence works on any domain where a database engine can run OS commands. Treat this as an identity-plane ticket for any org with SQL Server, not as an education-only curiosity.

Third: the catalog did not move. Weekend coverage of Ivanti, GitLab, Drupal Commerce, LXD, and BTCPay did not add a KEV row. The overnight increment with a primary write-up, confirmed victims, and defender telemetry is this campaign. Repeating [Friday’s Connect Secure KEV](/posts/2026-10-31-ivanti-cve-2026-111357-118527-kev/) because 111357 is due today is a clock, not a new development.

This is not confirmed OT process impact. An education network that also runs building automation is not a Siemens or Rockwell incident.

Who / what is affected

Confirmed (Kaspersky 2 November):

• Education-sector organizations in several countries across Africa and Latin America.
• Windows and Linux beacons from the same build environments (two independent groups).
• Initial code execution under SQL Server 16.0.1000 in the reconstructed incident.
• Post-exploitation reaching built-in domain administrator, then DCSync / Golden Ticket.
• Data collection from SQL via PowerShell as the last observed stage. Kaspersky saw no further activity after collection in the incidents it detected.

Confirmed not this:

• A CyberStrikeAI CVE, a CISA KEV row, or a ransomware flag. Catalog 2026.10.30 / 1766.
• VOLTA-AUTODOXER (Talos 31 October). CLOSEDQUORUM (Talos 22 September, no confirmed wild use). NIK C2 (Talos 29 October).
• Nation-state attribution. Kaspersky: Chinese-language comments, dnslog[.]cn for egress checks, C2 restarts clustering on UTC+8 business hours, and a tool that originated in the Chinese security community suggest a Chinese-speaking operator. That is not a named APT. Two factors block a group call: the tool is public, and the model writes the command “signature.”

UNKNOWN named victims; how SQL Server 16.0.1000 was first reached; whether all identified infrastructure is one operator; whether the same playbook has hit North America or critical-infrastructure IT; OT / ICS process write.

Technical context

High level. This is not a how-to.

Kaspersky’s useful forensic handles, not a complete set:

• Default drop paths it recovered from the operator’s own presence-check script: C:\Windows\Temp\, C:\Windows\, C:\ProgramData\, C:\Temp. Observed names: svchosts.exe, svcmon32.exe.
• Scheduled task SystemUpdate pointing at the implant.
• HTTP header X-Implant-Token — unique per C2, baked in at build. Network indicator and sample-family key.
• Self-signed TLS on the control panel with the framework name in issuer/subject. Certificate is generated in memory at each start, so not_before is a restart clock, Cobalt Strike-style.
• Go build info: path into the CyberStrikeAI generator, plus VCS hash / vcs.modified=true. Implant version ≠ server version. A months-old beacon can talk to a rebuilt listener.

Public IOCs Kaspersky printed (MD5). Use them as hunt seeds, not as a closed set.

Network: 185.186.245[.]144 (Windows beacon C2; reverse shell also seen on tcp/5501), fastcdn[.]bar (Windows), media.fastcdn[.]bar (Linux), 104.234.26[.]163 (payload + Linux beacon).

ATT&CK mapping (assessed from Kaspersky’s reconstructed steps, not a CISA assignment): T1190 / T1190-adjacent initial access via SQL Server code execution (exact CVE UNKNOWN); T1053.005 Scheduled Task; T1087.002 / T1069.002 domain discovery; T1558.003 Kerberoasting; T1558.004 AS-REP Roasting; T1003.001 LSASS (comsvcs); T1003.006 DCSync; T1558.001 Golden Ticket; T1021.006 WMI; T1047 Windows Management Instrumentation; T1041 C2 exfil over the implant channel.

Sibling, not this campaign — Talos VOLTA (31 October, PE timestamp 17 August, first seen 11 October). Self-deleting x64 stealer. Harvest, then a JSON dossier POSTed to OpenRouter as “forensic intelligence analyst,” default anthropic/claude-opus-4.6, fallback Kimi K2 then Gemini 2.5 Flash, temperature 0.2. SHA256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279. If the OpenRouter key is missing it still ships volta_dox.zip over Telegram. That is crimeware triage. It is not CyberStrikeAI.

Threat / exploitation status

What defenders should do

1. Hunt the beacon and the AD primitives, not “AI traffic.” Process ancestry from sqlservr.exe. Scheduled task SystemUpdate. schtasks.exe /s against remote hosts. PowerShell 4104 with Base64 blobs. LSASS access via comsvcs.dll MiniDump. Kerberos TGS spikes. Directory Service Replication (DCSync) from non-DC hosts. Linux: new @reboot crontab lines and nohup in ~/.bashrc pointing at a Go binary.
2. Treat the SQL Server as a beachhead until proven otherwise. The reconstructed door was OS command execution under the database engine. Inventory internet-facing and jump-accessible SQL Server 16.x. Restrict the service account. The exact initial CVE is UNKNOWN; do not wait for one.
3. If LSASS or DCSync fired, rotate. Domain admin, KRBTGT, service accounts collected for Kerberoast, SQL DSN strings (Kaspersky saw DPAPI unwrap of rsreportserver.config). Rebuild the SQL host. A killed beacon is not a clean domain.
4. Use the published IOCs as seeds. The MD5s and the four network indicators above. The X-Implant-Token header on unusual HTTP to those hosts. Do not treat a miss on those four IPs as a miss on the tool — C2 is operator-built.
5. Keep Friday’s Connect Secure clock on a separate ticket. [CVE-2026-111357](/posts/2026-10-31-ivanti-cve-2026-111357-118527-kev/) is due today, forensic triage Yes, builds 25.1.1.3 / 22.8R2.6. That is not this hunt. GitLab CVE-2026-97229 was due 1 November.

RWP assessment

This is the daily because it is a primary, dated-today disclosure of LLM-orchestrated post-exploitation in confirmed victims, with enough telemetry that a SOC can hunt it without a new product. Evidence quality is high on the reconstructed chain (Kaspersky CTI, two detection families, public IOCs). Evidence quality is low on attribution and scale. We are not calling a nation-state, not inventing a victim count, not folding VOLTA or NIK C2 into this operator, and not treating education SQL as OT impact.

Score 8.7. It outranks repeating Friday’s Ivanti KEV because 111357 is due today (already published; no catalog increment), GitLab 97229’s 1 November due date (already published 30 October), Canonical LXD CVE-2026-112816 (CVSS 10, CISA exploitation none), Drupal Commerce CVE-2026-118539 (vendor-exploited, not KEV, e-commerce access bypass), Tenable Identity Exposure CVE-2026-119314 (no exploitation), and the BTCPay hot-wallet sweeps (confirmed theft, wrong audience for this desk). VOLTA is the closest sibling and is treated as context, not the lead: sample analysis, no confirmed enterprise victim set.

What we are watching

• Whether a national CERT, Microsoft, or a second vendor corroborates the education victims or expands the geography.
• Whether CISA or a vendor assigns a CVE to the SQL Server step — currently UNKNOWN.
• Whether the two CyberStrikeAI build groups collapse into one operator with shared infra.
• Catalog increment past 2026.10.30 / 1766.
• Connect Secure CVE-2026-111357 after today’s due date; Siemens Software Center CVE-2026-110936 and Plex CVE-2026-96652 / 96655 due 3 November.

Sources

• Kaspersky Securelist — CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations, 2 November 2026
• Kaspersky — AI-driven attacks on educational organizations in Latin America and Africa, 2 November 2026
• Cisco Talos — Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer, 31 October 2026
• Cisco Talos — The Closed Quorum, 22 September 2026
• Cisco Talos — NIK C2, 29 October 2026
• CISA — KEV JSON feed
• CISA — Known Exploited Vulnerabilities Catalog
• GitHub — aipentest/cyberstrikeai (untrusted)
• [RWP — Ivanti CVE-2026-111357 / 118527 KEV, 31 October 2026](/posts/2026-10-31-ivanti-cve-2026-111357-118527-kev/)
• [RWP — GitLab CVE-2026-97229 KEV, 30 October 2026](/posts/2026-10-30-gitlab-cve-2026-97229-kev/)