CyberStrikeAI in the Wild: Kaspersky Describes an LLM-Orchestrated C2 Campaign

Kaspersky’s Cyber Threat Intelligence team has described a campaign in which a large language model, running on the attacker’s server, planned and issued post-exploitation commands to implants on victim machines. In a report dated 2 November 2026, the researchers say confirmed victims included education-sector organizations in several countries across Africa and Latin America. Kaspersky claims, “according to our data”, that this is one of the first public descriptions of a compromise involving an LLM in the wild. Earlier AI-agent intrusions have been reported, including in our ARTEX coverage, so read that as Kaspersky’s framing.

All details below are Kaspersky’s, a single vendor report that also promotes its own detection products. We have not analyzed the samples ourselves.

How the framework works

CyberStrikeAI is an open-source, modular penetration-testing platform written in Go. It combines LLM-based orchestration and a built-in C2 server in a single server process. C2 functions, including calling recon and exploitation utilities, managing webshell connections and assigning tasks to agents, are exposed to the model as MCP tools.

Kaspersky stresses that the “intelligent” layer stays on the server. The implant polls the listener over HTTP/S, TCP or WebSocket, runs shell commands and handles files. From the victim’s side it looks like a normal remote-control session in which an LLM queues tasks instead of a live operator. The framework also has a human-in-the-loop option, so model-generated commands can require approval before they run.

What the attackers did

In the incident Kaspersky walks through, a human operator first got in through a compromised SQL Server (version 16.0.1000, the likely initial access vector in Kaspersky’s words), collected host information, deployed tools and scanned the network. That took nearly a day and was followed by a two-week pause, before the agent was deployed. The second phase used the CyberStrikeAI agent:

• Persistence and local recon within 2 minutes of deployment.
• Domain recon over the following 5 hours.
• After a pause of several days, lateral movement over SMB and WMI, mass credential dumping and a database export in no more than one hour.

Kaspersky says the attack from agent deployment to domain administrator compromise was completed within 3-4 days, a span that excludes the earlier two-week pause. The techniques it lists are standard: Kerberoasting and AS-REP Roasting queries, LSASS dumps through comsvcs.dll, DCSync and Golden Ticket attacks with a renamed mimikatz, and Impacket WMIExec. It says some scripts bore marks of LLM generation and contained Chinese-language comments.

Where the LLM showed up, and what was generic

Kaspersky says data collection “deserves special attention” as a demonstration of LLM orchestration. The model generated SQL and LDAP queries tailored to the task: on an education organization’s SQL server the agent checked the connecting account’s privileges before querying, and on network shares it ran a recursive directory scan before collecting files of interest. Kaspersky says the choice of persistence method is left to the connected model, and that scripts delivered before the agent was installed bore the hallmarks of LLM generation. Separately, the generic stealth measures were Base64-encoded commands and payload scripts split across several files. The framework’s own source offers alternatives such as a registry Run key on Windows and crontab or .bashrc entries on Linux.

Attribution and detection

Kaspersky found two groups of samples whose build metadata match within each group but not across groups, with no shared C2 infrastructure and different framework versions on the servers. It says the evidence does not support linking the activity to a known actor or confirming that one operator is behind both groups.

Framework artifacts it lists for hunting: a self-signed TLS certificate on the control panel carrying the framework name, identical build-path metadata in the Go implant, and an X-Implant-Token header with a fixed value per C2 server. It also reports a scheduled task named SystemUpdate used for persistence.

What this means

Kaspersky’s own conclusion is measured: in its assessment AI orchestration lowered the skill needed to run these intrusions and the main difference from an experienced human operator lies largely in speed, but it did not add techniques defenders cannot already detect. Kaspersky gives no human baseline for that comparison. Our advice, which is not from the report: hardening against the classic techniques named above, such as tiered admin accounts, LSASS protection, WMI and scheduled-task monitoring and SQL Server hardening, still applies, and speed leaves less time to respond.

References

• Kaspersky Securelist: CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations