Kaspersky: CyberStrikeAI used to automate domain admin takeover
The open-source penetration testing framework was planted in victim networks at educational institutions in Africa and Latin America, Kaspersky said.
Kaspersky published research on November 2 describing attacks in which the open-source penetration testing framework CyberStrikeAI was installed inside compromised networks and used to automate the path to domain administrator takeover, according to dailysecu.com.
The attacks targeted educational institutions in Africa and Latin America and were observed between September and October 2026. In the incident Kaspersky reconstructed, an implant of CyberStrikeAI was placed on the victim system, and domain administrator accounts were compromised within 3 to 4 days of the installation.
The final stage — lateral movement, credential collection and database export — took about one hour. The AI itself ran on the attacker's server, while the implant on the victim system executed commands and returned the results.
Kaspersky said it found Chinese-language comments in the attack scripts but did not attribute the campaign to a specific country or to a known threat group.
Preparatory phase
Before the AI implant was installed, the attacker manually gathered system information and prepared tools through an already compromised SQL server. Activity then paused for about two weeks before CyberStrikeAI was deployed on the victim system.
Quick answers
What is CyberStrikeAI?
It is an open-source penetration testing framework that, according to Kaspersky, was abused in these attacks as an implant inside victim networks.
Who was targeted in the attacks?
Educational institutions in Africa and Latin America, with activity observed between September and October 2026.
Did Kaspersky attribute the attacks to a country or group?
No. Kaspersky found Chinese-language comments in the attack scripts but did not link the campaign to a specific country or known threat group.