Kaspersky's Threat Research team disclosed on November 2 that attackers used the open-source framework CyberStrikeAI to direct intrusions against educational institutions in Africa and Latin America: the large model sat on the attackers' server choosing tools, writing commands, and analyzing results, while the implant only executed them on victim machines. It took just 3 to 4 days from implant deployment to compromising domain administrator accounts. The case matters because real intrusion records show agents can already take over most post-compromise work, while defenders are still watching the same familiar techniques.
Kaspersky observed the attacks in September and October 2026, and reconstructed the chain in three steps: 1. Attackers first worked manually through a compromised SQL Server to gather information and prepare tools, then paused for about two weeks; 2. When they returned, they deployed the CyberStrikeAI implant, with the model directing operations from the server while the implant carried out reconnaissance, privilege escalation, lateral movement, and data collection; 3. The final sequence of lateral movement, credential collection, and database export took under an hour, and the whole post-implant phase reached domain administrator rights within 3 to 4 days. Kaspersky's endpoint detection spotted credential dumping, malicious scheduled tasks, and similar behavior, while network detection identified the framework's command-and-control traffic and unusual queries used to map victim domains; the implants have been named HEUR:HackTool.Win64.CyberStrike.gen and the Linux variant.
The model did not break in on its own, and attribution remains open
The division of labor in CyberStrikeAI needs to be stated plainly: a human operator on the attacker's side sets the objectives, and the model only coordinates follow-up actions inside networks that are already compromised. The model does not run on victim machines, and the implant does not call AI services directly. Kaspersky found Chinese-language comments in scripts, but says clearly that they do not establish the attackers' identity or location, that the activity cannot be attributed to a known group, and that it cannot be confirmed that all infrastructure belonged to the same operator. In other words, this was a human-in-the-loop agent intrusion, not a model independently finding vulnerabilities and launching attacks; calling it an "AI hacker acting alone" would distort it.
Against this kind of attack, watching behavior beats watching the model
Kaspersky's judgment is that AI changes how intrusions are coordinated and how fast they move, while the techniques themselves remain familiar: reconnaissance, credential dumping, lateral movement, collection, and exfiltration, which well-configured security tools can still detect and stop. The advice for organizations stays at the behavioral level: use endpoint detection to watch suspicious commands, credential access, and persistence mechanisms; use network detection to spot anomalous cross-system traffic; keep threat intelligence current; and maintain monitoring outside working hours. The risk is not an isolated case: the UK NCSC's warning about AI ransomware points the same way — AI is amplifying attack methods that already exist, so defense starts with doing behavioral monitoring properly, not waiting for a dedicated "anti-AI" tool.
