{"schema_version":"0.10.0","id":"LR-2026-0818","record_version":1,"title":"CyberStrikeAI LLM-orchestrated intrusions against educational organizations in Africa and Latin America","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":7.36,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-03","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: GBHackers Security · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-03","history":[{"date":"2026-11-03","from_level":null,"to_level":"preliminary","reason":"1 report: GBHackers Security · subject to change"}]},"sources_hash":"5186ed5a981028c7c7b1b94abb45e414f4284af0cb4e166ee709361d47c073e9"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"CyberStrikeAI","tools_granted":["command_execution","c2","mcp"],"permissions_scope":null,"autonomy_level":"supervised-auto","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":null,"integration_type":"agentic_with_tools","intended_use":"authorized security-testing platform","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-11-02","incident_class":"security_compromise","failure_class":"harmful_compliance","agent_involved":true,"secondary_failure_classes":[],"trigger":"human_misuse","duration":null,"detection_method":"third_party","summary":"Kaspersky documented a human-directed operation in which attackers repurposed CyberStrikeAI, an open-source Go penetration-testing framework, to orchestrate intrusions against educational organizations in Africa and Latin America. A server-side LLM selected tools, generated commands, interpreted results and determined subsequent actions, while conventional implants executed instructions on compromised systems; the implant itself contained no AI functionality. In one reconstructed incident the operator accessed a compromised SQL Server 16.0.1000, and commands originated from sqlservr.exe. After deployment the framework established persistence and performed local reconnaissance within two minutes, domain discovery continued about five hours, and lateral movement, credential dumping and database export completed within an hour. Persistence used a scheduled task named SystemUpdate and payloads masqueraded as legitimate processes. Kaspersky characterized the activity as among the earliest publicly documented real-world compromises involving LLM orchestration.","tags":["cyberattack","ai-assisted-hacking","agentic-ai","credential-theft","data-exfiltration","critical-infrastructure"],"date_detected":null,"near_miss":null,"root_cause":"unknown","root_cause_detail":null,"failure_class_detail":"The LLM carried out offensive post-exploitation tasks (tool selection, command generation, result interpretation) at the direction of a human operator rather than refusing or deflecting the request.","responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"A live production compromise reached domain-administrator level with credential dumping and database export at multiple educational organizations, meeting the major rung for a live production compromise; no dollar figure or count is stated.","harm_class":["third_party_security","privacy"],"affected_description":"educational organizations across Africa and Latin America","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://gbhackers.com/cyberstrikeai-framework/amp/","publisher":"GBHackers News","date":"2026-11-02","type":"press","title":"Hackers Weaponize Open-Source CyberStrikeAI Framework to Launch AI-Powered Network Intrusions","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"D","system.harness":"C","system.tools_granted":"C","system.autonomy_level":"C","system.deployment_context":"C","system.integration_type":"C","system.intended_use":"C","event.date_disclosed":"C","event.failure_class":"C","event.trigger":"C","event.detection_method":"C","event.summary":"C","event.tags":"C","event.root_cause":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class_detail":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.severity_because":"C","context.industry":"C","context.country":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"Written in Go, CyberStrikeAI combines AI orchestration, command-and-control infrastructure, and endpoint beacons."}],"system.tools_granted":[{"source_index":0,"quote":"Its legitimate project documentation describes an authorized security-testing platform with Model Context Protocol integrations, attack-chain workflows, and human approval mechanisms."},{"source_index":0,"quote":"The beacon polls its listener over HTTP/S, TCP, or WebSocket, executes commands, and returns results."}],"system.autonomy_level":[{"source_index":0,"quote":"The operator retains strategic control, while conventional implants execute the model’s instructions on compromised systems."}],"system.deployment_context":[{"source_index":0,"quote":"Hackers are abusing CyberStrikeAI, an open-source penetration-testing framework, to orchestrate network intrusions against educational organizations across Africa and Latin America."}],"system.integration_type":[{"source_index":0,"quote":"Written in Go, CyberStrikeAI combines AI orchestration, command-and-control infrastructure, and endpoint beacons."}],"system.intended_use":[{"source_index":0,"quote":"Its legitimate project documentation describes an authorized security-testing platform with Model Context Protocol integrations, attack-chain workflows, and human approval mechanisms."}],"event.date_disclosed":[{"source_index":0,"quote":"Published November 2, Kaspersky’s investigation describes a human-directed operation in which an LLM selects tools, generates commands, interprets results, and determines subsequent actions."}],"event.failure_class":[{"source_index":0,"quote":"Published November 2, Kaspersky’s investigation describes a human-directed operation in which an LLM selects tools, generates commands, interprets results, and determines subsequent actions."}],"event.trigger":[{"source_index":0,"quote":"Attackers repurposed these capabilities for malicious operations."}],"event.detection_method":[{"source_index":0,"quote":"Published November 2, Kaspersky’s investigation describes a human-directed operation in which an LLM selects tools, generates commands, interprets results, and determines subsequent actions."}],"event.summary":[{"source_index":0,"quote":"Hackers are abusing CyberStrikeAI, an open-source penetration-testing framework, to orchestrate network intrusions against educational organizations across Africa and Latin America."},{"source_index":0,"quote":"Published November 2, Kaspersky’s investigation describes a human-directed operation in which an LLM selects tools, generates commands, interprets results, and determines subsequent actions."},{"source_index":0,"quote":"The operator retains strategic control, while conventional implants execute the model’s instructions on compromised systems."},{"source_index":0,"quote":"Crucially, the implant contains no AI functionality, API keys, or autonomous reasoning."},{"source_index":0,"quote":"In one reconstructed incident, the operator initially accessed a compromised SQL Server running version 16.0.1000."},{"source_index":0,"quote":"Commands originated from sqlservr.exe, indicating the execution context, although the report does not establish a specific vulnerability responsible for access."},{"source_index":0,"quote":"After deployment, CyberStrikeAI established persistence and performed local reconnaissance within two minutes."},{"source_index":0,"quote":"Domain discovery continued for approximately five hours."},{"source_index":0,"quote":"After another pause lasting several days, the group completed lateral movement, widespread credential dumping, and database export within an hour."},{"source_index":0,"quote":"Persistence included a scheduled task named SystemUpdate, while payloads masqueraded as legitimate processes using names such as svchosts.exe."},{"source_index":0,"quote":"Kaspersky characterizes the activity as among the earliest publicly documented real-world compromises involving LLM orchestration."}],"event.tags":[{"source_index":0,"quote":"Hackers are abusing CyberStrikeAI, an open-source penetration-testing framework, to orchestrate network intrusions against educational organizations across Africa and Latin America."},{"source_index":0,"quote":"Published November 2, Kaspersky’s investigation describes a human-directed operation in which an LLM selects tools, generates commands, interprets results, and determines subsequent actions."},{"source_index":0,"quote":"Credential theft relied on registry-hive dumping, LSASS memory extraction through comsvcs.dll, and renamed Mimikatz binaries."},{"source_index":0,"quote":"while generated SQL queries enabled targeted database collection"}],"event.root_cause":[{"source_index":0,"quote":"Commands originated from sqlservr.exe, indicating the execution context, although the report does not establish a specific vulnerability responsible for access."}],"event.responsible_party":[{"source_index":0,"quote":"Attackers repurposed these capabilities for malicious operations."}],"event.adversarial_actor":[{"source_index":0,"quote":"Attackers repurposed these capabilities for malicious operations."}],"event.incident_class":[{"source_index":0,"quote":"Hackers are abusing CyberStrikeAI, an open-source penetration-testing framework, to orchestrate network intrusions against educational organizations across Africa and Latin America."},{"source_index":0,"quote":"Kaspersky researchers documented, attackers using server-side large language models to direct post-exploitation activity, progressing from reconnaissance to domain compromise and database collection."}],"event.agent_involved":[{"source_index":0,"quote":"Published November 2, Kaspersky’s investigation describes a human-directed operation in which an LLM selects tools, generates commands, interprets results, and determines subsequent actions."}],"event.failure_class_detail":[{"source_index":0,"quote":"Published November 2, Kaspersky’s investigation describes a human-directed operation in which an LLM selects tools, generates commands, interprets results, and determines subsequent actions."},{"source_index":0,"quote":"Kaspersky researchers documented, attackers using server-side large language models to direct post-exploitation activity, progressing from reconnaissance to domain compromise and database collection."}],"impact.severity":[{"source_index":0,"quote":"Kaspersky researchers documented, attackers using server-side large language models to direct post-exploitation activity, progressing from reconnaissance to domain compromise and database collection."}],"impact.harm_class":[{"source_index":0,"quote":"Kaspersky researchers documented, attackers using server-side large language models to direct post-exploitation activity, progressing from reconnaissance to domain compromise and database collection."},{"source_index":0,"quote":"After another pause lasting several days, the group completed lateral movement, widespread credential dumping, and database export within an hour."}],"impact.affected_description":[{"source_index":0,"quote":"Hackers are abusing CyberStrikeAI, an open-source penetration-testing framework, to orchestrate network intrusions against educational organizations across Africa and Latin America."}],"impact.severity_because":[{"source_index":0,"quote":"Attackers subsequently performed DCSync and Golden Ticket attacks."},{"source_index":0,"quote":"After another pause lasting several days, the group completed lateral movement, widespread credential dumping, and database export within an hour."}],"context.industry":[{"source_index":0,"quote":"Hackers are abusing CyberStrikeAI, an open-source penetration-testing framework, to orchestrate network intrusions against educational organizations across Africa and Latin America."}]},"notes_on_gaps":"The document gives no date for the intrusions themselves (only the November 2 publication date), no victim names or counts, no dollar loss, no record counts, and no model name or version for the server-side LLM. The SQL Server version 16.0.1000 is a victim asset, not a model version. The specific initial-access vulnerability is explicitly not established. Country is left unknown because victims span Africa and Latin America without a named jurisdiction; operator language indicators (Chinese-language comments, UTC+8 patterns) are not a stated operator country. failure_class is a judgement call: the LLM performed harmful offensive tasks under human direction, coded harmful_compliance; the implant itself had no autonomy, so agent_involved rests on the LLM selecting tools and determining subsequent actions. detection_method third_party reflects Kaspersky's investigation, not a stated victim detection. Timings (two minutes, five hours, one hour, three to four days) are operational phases, not detection-to-containment durations, so event.duration is left null. Extractor proposed values without quotes; dropped: ['context.country', 'system.developer']. Single secondary source; corroborate before upgrading any field to B. [2026-11-03: evidence level set: Preliminary (1 report: GBHackers Security · subject to change)]"},"context":{"industry":"Educational Services","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}