Executive Summary
Executive Summary In early 2025, Kaspersky's Cyber Threat Intelligence team uncovered an active campaign leveraging CyberStrikeAI, an open-source Go-based C2 framework that embeds a large language model orchestrator server-side to automate post-exploitation decisions. Threat actors—assessed with moderate confidence as Chinese-speaking based on script comments, timezone patterns, and tool provenance—compromised SQL Server 16.0.1000 instances at education-sector organizations across Africa and Latin America. Within hours of deploying the AI-driven implant, attackers achieved domain compromise via automated Kerberoasting, LSASS dumping, DCSync, Golden Ticket attacks, and SMB/WMI lateral movement, culminating in database exfiltration. The entire operation from agent deployment to domain administrator compromise completed in three to four days.
This campaign marks one of the first publicly documented in-the-wild uses of an LLM embedded directly into attack orchestration rather than used for preparatory tasks. The AI layer did not introduce novel techniques but dramatically lowered operator skill requirements and compressed the post-exploitation timeline from weeks to hours, signaling a structural shift in how advanced persistent threats will operate at scale going forward.
Why This Matters Now
Why This Matters NowAI-orchestrated post-exploitation is no longer theoretical. CyberStrikeAI is publicly available, actively deployed, and reduces the expertise barrier for executing full domain compromise in hours rather than weeks. As LLM capabilities improve and similar frameworks proliferate, security teams face an accelerating attack tempo that outpaces traditional human-speed detection and response cycles, making automated network segmentation, east-west traffic controls, and egress enforcement operationally critical today.
Attack Path Analysis
Attack Path AnalysisAttackers exploited a vulnerable SQL Server (v16.0.1000) to gain initial code execution, then manually collected host information before deploying the CyberStrikeAI LLM-orchestrated C2 agent. The agent autonomously escalated privileges using scheduled tasks, DPAPI extraction, and LSASS dumping, then moved laterally across the domain via SMB, WMI, and Impacket tooling using harvested credentials. The C2 channel operated over encrypted HTTP/S or TCP to attacker-controlled infrastructure, with the LLM orchestrator dynamically generating and queuing shell commands. Data was exfiltrated via the agent's built-in Base64-encoded JSON channel, including database exports and screenshots, resulting in full domain compromise and sensitive data theft from educational organizations.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAttackers exploited a publicly exposed or misconfigured Microsoft SQL Server (version 16.0.1000) to achieve remote code execution under the sqlservr.exe process context. This served as the initial foothold, enabling manual operator commands prior to agent deployment. The server likely had weak credentials or an unpatched vulnerability enabling xp_cmdshell or similar abuse.
Related CVEs
Related CVEsCVE-2024-0056
CVSS 8.7A SQL Server vulnerability in Microsoft SQL Server allows an attacker to perform a man-in-the-middle attack to force a client-server connection to be unencrypted, potentially enabling code execution and lateral movement from a compromised SQL Server process context.
Affected Products:
Microsoft SQL Server – 2019, 2022 (16.0.1000 and prior cumulative updates)
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesExploit Public-Facing Application
Command and Scripting Interpreter: PowerShell
Scheduled Task/Job: Scheduled Task
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
OS Credential Dumping: LSASS Memory
Steal or Forge Kerberos Tickets: Kerberoasting
OS Credential Dumping: Security Account Manager
OS Credential Dumping: DCSync
Use Alternate Authentication Material: Pass the Ticket
Remote Services: SMB/Windows Admin Shares
Windows Management Instrumentation
Exfiltration Over C2 Channel
Application Layer Protocol: Web Protocols
Obfuscated Files or Information
Masquerading: Match Legitimate Name or Location
Account Discovery: Domain Account
Remote System Discovery
Domain Trust Discovery
Data from Local System
Screen Capture
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Malicious Code Protection, System Monitoring, Remote Access, Authenticator Management
Control ID: SI-3, SI-4, AC-17, IA-5
CISA Zero Trust Maturity Model 2.0 – Device Trust, Workload Segmentation, Data Access Controls
Control ID: Identity Pillar – Pillar 2 (Device), Pillar 4 (Application Workload), Pillar 5 (Data)
NIS2 Directive (EU) 2022/2555 – Incident Handling, Supply Chain Security, Network Security, Access Control
Control ID: Article 21 – Cybersecurity Risk Management Measures
ISO/IEC 27001:2022 – Malware Protection, Security Logging and Monitoring, Privileged Tool Controls
Control ID: A.8.7 (Protection against malware), A.8.15 (Logging), A.8.16 (Monitoring), A.8.18 (Use of privileged utility programs), A.5.30 (ICT readiness for business continuity)
DORA (EU) 2022/2554 – ICT Risk Management, Threat Detection Capability, Incident Classification and Response
Control ID: Article 9 – ICT Security Policies; Article 10 – Detection; Article 17 – ICT-related Incident Management
GDPR (EU) 2016/679 – Technical Security Measures, Breach Notification Obligations
Control ID: Article 32 – Security of Processing; Article 33 – Notification of Personal Data Breach
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Education Management
Confirmed CyberStrikeAI campaign victims; AI-orchestrated post-exploitation via compromised SQL Servers enabled full domain compromise, credential dumping, and database exfiltration against education organizations across Africa and Latin America.
Information Technology/IT
AI-driven LLM orchestration automates lateral movement, privilege escalation, and C2 operations; IT infrastructure faces accelerated domain compromise cycles reduced to hours, bypassing traditional behavioral detection thresholds.
Government Administration
AI-orchestrated post-exploitation targeting Active Directory, LAPS, DCSync, and Golden Ticket attacks threatens government identity infrastructure; NIST.800-53 and Zero Trust compliance gaps amplify exfiltration and lateral movement risk.
Financial Services
LLM-automated Kerberoasting, credential dumping, and database exfiltration mapped against PCI.4.0 and NIST controls expose financial sector to accelerated, low-operator-skill attacks targeting privileged account compromise and sensitive data theft.
Sources
Sources- CyberStrikeAI in the wild: the use of AI in real-world attacks on organizationshttps://securelist.com/tr/cyberstrikeai-attacks/121715/Verified
- CVE-2024-0056 Detail - NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-0056Verified
- Microsoft Security Response Center - CVE-2024-0056https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- MITRE ATT&CK - Command and Scripting Interpreter: PowerShell (T1059.001)https://attack.mitre.org/techniques/T1059/001/Verified
- MITRE ATT&CK - OS Credential Dumping: LSASS Memory (T1003.001)https://attack.mitre.org/techniques/T1003/001/Verified
- CyberStrikeAI Open Source Framework - GitHubhttps://github.com/search?q=CyberStrikeAI&type=repositories
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker relied on unrestricted network reachability to exploit a publicly exposed SQL Server, move laterally across domain infrastructure, and exfiltrate data over the same outbound channel used for C2. By enforcing workload-level segmentation and identity-aware access controls across the cloud fabric, Aviatrix would likely have reduced the attacker's ability to pivot freely, communicate with external infrastructure, and exfiltrate at scale.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network-level access to the SQL Server workload could likely be constrained so that only explicitly authorized sources — such as application tiers or jump hosts — would reach the database port, reducing the reachability of opportunistic external exploitation attempts against misconfigured or vulnerable instances.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation could likely reduce the scope of privilege escalation impact by constraining what resources the compromised SQL Server workload is permitted to communicate with, limiting the agent's ability to reach domain controllers directly and reducing the blast radius of credential harvesting and DCSync activity.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to move freely between workloads using SMB, WMI, and WinRM, as unplanned lateral connections between hosts would not match defined segmentation policies, potentially reducing the number of systems the agent could successfully reach and compromise.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control could likely surface unexpected outbound communication patterns from the SQL Server and compromised workloads to unknown external destinations, and policy enforcement may constrain unapproved outbound connections, reducing the reliability of the C2 channel and the attacker's ability to receive dynamically generated commands.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely reduce the attacker's ability to exfiltrate large volumes of encoded data by constraining which workloads are permitted to initiate outbound data flows, limiting access to unapproved destinations, and potentially flagging high-volume or anomalous outbound sessions over HTTP/TCP that do not align with expected egress patterns.
Had earlier segmentation and egress controls been applied, the residual impact would likely have been narrower in scope — potentially limited to the initially compromised SQL Server workload rather than extending to domain-wide credential access, multi-host propagation, and bulk database exfiltration across geographically distributed educational organizations.
Impact at a Glance
Affected Business Functions
- Student and Staff Records Management (SIS/LMS Database Integrity)
- Domain Authentication and Identity Services (Active Directory)
- Academic Research Data Repositories
- Network Administration and IT Operations
Estimated downtime: 4 days
Estimated loss: N/A
Confirmed exfiltration of database contents from educational organization SQL servers, likely containing student PII (names, enrollment records, academic results), staff personnel data, and institutional administrative records. LDAP and Active Directory enumeration exposed full domain user and group structures. Credential dumps via LSASS, DCSync, and registry hive extraction yielded domain administrator credentials and potentially service account secrets. DPAPI secret decryption from SQL Server Reporting Services configuration files may have exposed database connection strings and credentials. Screenshots of infected hosts were captured. The scope spanned multiple countries across Africa and Latin America, amplifying the breadth of institutional data at risk.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy East-West Traffic Security and Zero Trust Segmentation to enforce identity-based microsegmentation policies between SQL servers, domain controllers, and workstations — preventing the WMI/SMB lateral movement that enabled rapid domain compromise once initial access was established (ZTMM.Network, NIST.800-53.SC-7, NIST.800-53.AC-6).
- • Enable Egress Security and Policy Enforcement with FQDN filtering to block unauthorized outbound connections from internal servers to attacker-controlled C2 domains (fastcdn[.]bar, 185.186.245[.]144) and GitHub-hosted tool downloads — directly disrupting the C2 beaconing and payload staging pipeline (ZTMM.Data, NIST.800-53.SC-18, NIST.CSF.PR.DS-5).
- • Activate Multicloud Visibility and Control with anomaly detection to baseline normal SQL Server process behavior and alert on sqlservr.exe spawning PowerShell, certutil, or schtasks — the LLM-orchestrated command sequences deviated from legitimate server workloads and would have triggered behavioral anomaly rules (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6, NIST.CSF.DE.CM-7).
- • Enforce Inline IPS (Suricata) signatures targeting known Impacket WMIExec command patterns, comsvcs.dll LSASS dump invocations, DCSync DRSUAPI traffic, and CyberStrikeAI HTTP beacon headers (X-Implant-Token) to block or alert on exploit and post-exploitation traffic at the network layer before exfiltration occurs (ZTMM.Network, NIST.800-53.SI-4, PCI.4.0.6.4.1).
- • Apply Encrypted Traffic controls (HPE) and Cloud Firewall (ACF) egress inspection to detect and block Base64-encoded data exfiltration over the C2 channel, enforce outbound traffic policies preventing unauthorized data transfers from SQL and application servers to unknown external destinations, and ensure all internal traffic traversing hybrid connectivity paths is encrypted and inspectable (ZTMM.Data, NIST.CSF.PR.DS-2, NIST.800-53.SC-7).
