AI Agent Takes Schools’ Windows Domains in Under Four Days

An open-source “AI pentest” framework has graduated to real break-ins. Kaspersky says attackers used CyberStrikeAI, a Go tool that lets a language model drive a built-in command-and-control server, to take over Windows domains at education organizations in Africa and Latin America. Once the agent landed, it went from foothold to domain admin in three to four days, with the model choosing the commands. Kaspersky’s point is that nothing it did was new: it’s the speed and the lower skill bar that change.

185.186.245[.]144
104.234.26[.]163
fastcdn[.]bar
media.fastcdn[.]bar

c:\windows\temp\svchosts.exe (MD5 D726A8B4886C636F76CA6D30EF6A6FF4)
c:\programdata\svcmon32.exe (MD5 2770562d104391b92b42671c270079bb)
C:\Windows\Temp\wdiag2.exe (renamed mimikatz)
c:\ProgramData\p1.ps1
Scheduled task / Run value: SystemUpdate
HTTP header: X-Implant-Token

Source article: CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations
Publisher: Kaspersky Securelist (Kirill Antonov, Vladislav Vlasov, Dmitry Chizhmak)
Published: November 2, 2026
URL: https://securelist.com/tr/cyberstrikeai-attacks/121715/

Executive Summary

Kaspersky documents real intrusions using CyberStrikeAI, an open-source Go framework that pairs LLM-driven attack orchestration with a built-in C2 server whose functions are exposed to the model as MCP tools; the Windows and Linux beacons carry no AI and simply poll the listener over HTTP/S, TCP or WebSocket for shell commands. No named actor is tracked; Kaspersky notes the tool is public and could be used by many operators, and reads Chinese-language script comments, use of dnslog[.]cn and UTC+8 certificate restart times as suggestive, not conclusive, signs of a Chinese-speaking operator. Confirmed victims are education-sector organizations in several countries in Africa and Latin America. In the detailed case, commands first ran in the context of sqlservr.exe (SQL Server 16.0.1000), indicating a SQL Server-based initial vector; a day of manual collection and network recon was followed by a two-week pause, then the agent (dropped as svchosts.exe after checks of Windows\Temp, Windows, ProgramData and C:\Temp, with payloads split into Base64 fragments decoded by certutil) set persistence via a SYSTEM scheduled task and HKCU Run value named SystemUpdate within two minutes, enumerated the domain over LDAP for about five hours, identified Kerberoasting and AS-REP Roasting candidates, dumped registry hives and LSASS (comsvcs.dll MiniDump by PID), moved laterally with Impacket WMIExec, SMB admin shares, WMI and WinRM, and finished with DCSync and a Golden Ticket using mimikatz renamed wdiag2.exe, reaching domain admin three to four days after agent deployment; the model then generated database queries, scanned shares and took screenshots. The objective was credential and data collection; the impact is full domain compromise. Kaspersky published no YARA or Sigma rules; hunt leads, false positive expectations and indicators are detailed below.

ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Discovery → Credential Access → Lateral Movement → Collection → Command and Control

Hunt Lead Grid

CyberStrikeAI Infrastructure, File and Persistence Sweep

Kaspersky lists the Windows beacon at c:\windows\temp\svchosts.exe (one letter off svchost.exe), a second binary as c:\windows\temp\svcmon32.exe and c:\programdata\svcmon32.exe, mimikatz renamed to C:\Windows\Temp\wdiag2.exe, RogueWinRM at c:\rwx\RogueWinRM.exe and a PowerShell reverse shell at c:\ProgramData\p1.ps1. The agent persisted within two minutes of landing through a scheduled task and an HKCU\Software\Microsoft\Windows\CurrentVersion\Run value, both named SystemUpdate and pointing at the implant; on Linux, the model chose between an @reboot crontab line and a nohup line appended to ~/.bashrc. C2 ran at 185.186.245[.]144 and fastcdn[.]bar for Windows and media.fastcdn[.]bar and 104.234.26[.]163 for Linux, with a fixed X-Implant-Token HTTP header per C2 server and a self-signed TLS certificate naming the framework in its issuer and subject, regenerated each time the server restarts. The detection logic is a retrospective sweep of file-creation and process events for those paths and MD5s, scheduled-task and Run-key inventories for a SystemUpdate entry whose target sits in Temp or ProgramData, DNS and proxy logs for the domains, firewall and NetFlow for the IPs, and, where TLS or HTTP inspection exists, any request carrying an X-Implant-Token header.

Use EDR file and process telemetry, Windows Event 4698 or the Task Scheduler operational log, registry auditing of Run keys, and DNS, proxy and firewall logs, and sweep at least 90 days because the operator paused for two weeks after initial access. Scope to every host, but look first at SQL Server machines and anything they can reach. Hash blocking alone is the wrong control here: the beacon is built by a public generator, so each operator’s hashes differ; the paths, the one-letter svchosts.exe name, the header and the certificate subject are more durable, and Kaspersky notes the Go build metadata (go version -m output, vcs fields with vcs.modified=true) helps cluster new builds. Any hit on the C2, the header or the SystemUpdate task pointing at Temp should go straight to incident response with domain-wide credential reset planning, since Kaspersky saw domain admin within days.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task), T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder); Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location) (our mapping; the source gives no ATT&CK IDs)

Sources: “CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations”, Kaspersky Securelist, Nov. 2, 2026, https://securelist.com/tr/cyberstrikeai-attacks/121715/ (source article)

LSASS MiniDump Through comsvcs.dll

During the agent-driven phase, after domain recon, the model dumped credentials from the registry with reg.exe and dumped LSASS memory through the MiniDump export of comsvcs.dll, passing the LSASS process ID rather than the name, which sidesteps simple rules that look for the string lsass on the command line. The detection logic is a process-creation rule for rundll32.exe whose command line references comsvcs.dll together with MiniDump (or its ordinal #24) and a numeric PID and an output path, plus a process-access rule for any non-allowlisted process opening lsass.exe with memory-read rights, and a companion rule for reg.exe save of the SAM, SYSTEM or SECURITY hives.

Use EDR process creation and process-access telemetry, or Sysmon Event IDs 1 and 10, together with Windows 4688 command-line auditing and 4656 or 4663 object-access events, which Kaspersky lists among the needed log sources. Sweep 90 days. Allowlist by the signed image path of known crash-dump, backup and EDR tools rather than by process name. Blocking or deleting comsvcs.dll is the wrong control because Windows components rely on it; LSA protection (RunAsPPL) and Credential Guard are the right preventive controls. This lead generalizes far beyond CyberStrikeAI because the comsvcs.dll technique is common across ransomware and espionage intrusions. A hit means credentials in memory on that host are compromised; escalate, isolate and reset every account that was logged on there.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1003.001 (OS Credential Dumping: LSASS Memory) (our mapping; the source gives no ATT&CK IDs)

Sources: “CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations”, Kaspersky Securelist, Nov. 2, 2026, https://securelist.com/tr/cyberstrikeai-attacks/121715/ (source article)

SQL Server Spawning a Shell

Kaspersky saw the first commands of the intrusion run in the context of sqlservr.exe, so the database engine was the operator’s way in, followed by manual host collection, tool deployment and network recon before the agent arrived. Agent delivery then used Base64-encoded PowerShell, payloads split into fragments such as d3.b64 and reassembled with certutil, pre-deployment checks of Windows\Temp, Windows, ProgramData and C:\Temp, and an external IP lookup against a random subdomain of the public dnslog[.]cn service. The detection logic is a parent-child rule for cmd.exe or powershell.exe launched by sqlservr.exe, raised to high priority when the child uses -EncodedCommand, runs certutil -decode, writes executables to Temp or ProgramData, or resolves a dnslog[.]cn subdomain.

Use EDR process creation with parent and command line, Windows 4688 and PowerShell 4104 script-block logs (both named by Kaspersky as required sources), and DNS logs. Scope to database servers, and inventory which SQL Agent jobs or xp_cmdshell scripts legitimately start shells so you can allowlist them by exact command line rather than by parent alone. Disabling xp_cmdshell and keeping SQL Server off the internet are the preventive controls; blocking certutil outright tends to break certificate administration, so alert on its decode use instead. Kaspersky’s SIEM rule for a Windows shell started by a web application reflects the same idea for internet-facing services. Treat a hit as initial access in progress: there was a two-week gap before the agent arrived in this case, which is a window to evict the operator before domain compromise.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1059.001 (Command and Scripting Interpreter: PowerShell); Defense Evasion → T1140 (Deobfuscate/Decode Files or Information) (our mapping; the source gives no ATT&CK IDs)

Sources: “CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations”, Kaspersky Securelist, Nov. 2, 2026, https://securelist.com/tr/cyberstrikeai-attacks/121715/ (source article)

Roasting Burst Followed by DCSync

After about five hours of LDAP-driven domain discovery, including queries for accounts with service principal names and accounts without Kerberos pre-authentication, the agent ran Kerberoasting and AS-REP Roasting, moved laterally with WMIExec and WinRM, and once it held domain admin used the renamed mimikatz for DCSync and a Golden Ticket; lateral movement, mass credential dumping and database export took about an hour. The detection logic correlates, per source host, an unusual number of Kerberos service-ticket requests (Event 4769), especially with RC4 encryption, or AS requests for accounts without pre-authentication (Event 4768), with a following directory-replication request (Event 4662 with the replication GUIDs) from a machine that is not a domain controller, inside a window of a few hours.

Use domain controller security logs (4768, 4769, 4662, 4624) forwarded to the SIEM, plus LDAP query telemetry where your EDR or directory monitoring records it. Baseline normal ticket volume per host first; vulnerability scanners and some application servers request many tickets, so allowlist them by host. Kaspersky’s own rules cover each step (R034_01 Kerberoasting, R452_18 AS-REP Roasting, R073 DC Sync, R450_41 Golden Ticket), which shows the steps are individually detectable; the sequence is what separates an agent-driven takeover from noise. Resetting a single password after a hit is the wrong response, since a Golden Ticket survives it; a DCSync from a non-DC means the krbtgt account must be reset twice and all privileged credentials rotated. Escalate any confirmed sequence as a domain compromise.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting), T1558.004 (Steal or Forge Kerberos Tickets: AS-REP Roasting), T1003.006 (OS Credential Dumping: DCSync) (our mapping; the source gives no ATT&CK IDs)

Sources: “CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations”, Kaspersky Securelist, Nov. 2, 2026, https://securelist.com/tr/cyberstrikeai-attacks/121715/ (source article)

Hash Appendix

CyberStrikeAI beacons

MD5s come from the source article. The OTX AlienVault pulses for this report carry MD5s only for these files, and VirusTotal was not checked, so SHA-1 and SHA-256 are not available.

MD5s
D726A8B4886C636F76CA6D30EF6A6FF4  # svchosts.exe -> c:\windows\temp\, CyberStrikeAI Windows beacon
2770562d104391b92b42671c270079bb  # svcmon32.exe -> c:\windows\temp\ and c:\programdata\
09e1da2afa1216ecc55648ec8e122d2a  # Linux beacon (file name not given)
805B9E4AE74C903787416800999B8418  # Linux beacon (file name not given)

SHA1s
(not available)  # svchosts.exe
(not available)  # svcmon32.exe
(not available)  # Linux beacon
(not available)  # Linux beacon

SHA256s
(not available)  # svchosts.exe
(not available)  # svcmon32.exe
(not available)  # Linux beacon
(not available)  # Linux beacon

Attacker tools

MD5s come from the source article; SHA-1 and SHA-256 are not available. wdiag2.exe is mimikatz under a deceptive name; detect the path and behavior rather than relying on the hash.

MD5s
29EFD64DD3C7FE1E2B022B7AD73A1BA5  # wdiag2.exe -> C:\Windows\Temp\, renamed mimikatz
74F57B3E897A4960DCDD5B7E8A54F9DF  # RogueWinRM.exe -> c:\rwx\
0BBD08AF95F877F1D568B03DE2EB76B4  # p1.ps1 -> c:\ProgramData\, PowerShell reverse shell

SHA1s
(not available)  # wdiag2.exe
(not available)  # RogueWinRM.exe
(not available)  # p1.ps1

SHA256s
(not available)  # wdiag2.exe
(not available)  # RogueWinRM.exe
(not available)  # p1.ps1

References Appendix

• “CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations”, Kaspersky Securelist (Kirill Antonov, Vladislav Vlasov, Dmitry Chizhmak), Nov. 2, 2026, https://securelist.com/tr/cyberstrikeai-attacks/121715/ (source article; attack chain, artifacts, indicators, detection rules and log sources)
• OTX AlienVault pulse “CyberStrikeAI attacks educational institutions”, AlienVault, Nov. 2, 2026, https://otx.alienvault.com/ (checked for SHA-1/SHA-256; none mapped to these files)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/