Cases › security breach › LR-2026-0818

CyberStrikeAI LLM-orchestrated intrusions against educational organizations in Africa and Latin America

Preliminary Why: 1 report: GBHackers Security · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

No source states: loss or records, developer and model, deployer.

Severity major: A live production compromise reached domain-administrator level with credential dumping and database export at multiple educational organizations for a live production compromise; no dollar figure or count is stated.

Kaspersky documented a human-directed operation in which attackers repurposed CyberStrikeAI, an open-source Go penetration-testing framework, to orchestrate intrusions against educational organizations in Africa and Latin America. A server-side LLM selected tools, generated commands, interpreted results and determined subsequent actions, while conventional implants executed instructions on compromised systems; the implant itself contained no AI functionality. In one reconstructed incident the operator accessed a compromised SQL Server 16.0.1000, and commands originated from sqlservr.exe. After deployment the framework established persistence and performed local reconnaissance within two minutes, domain discovery continued about five hours, and lateral movement, credential dumping and database export completed within an hour. Persistence used a scheduled task named SystemUpdate and payloads masqueraded as legitimate processes. Kaspersky characterized the activity as among the earliest publicly documented real-world compromises involving LLM orchestration.source

LR-2026-0818 · version 1 · published 2026-11-03 after automatic checks; not yet checked field by field by a person · JSON