Using AI, attackers automated hacking, credential theft, and lateral movement across a corporate network

Kaspersky investigated cyberattacks on educational organizations in Latin America and Africa in which attackers used artificial intelligence to automate virtually all stages of the intrusion. According to the company, the attackers utilized the open-source CyberStrikeAI framework, which enabled a full attack cycle—from intelligence gathering to gaining control over the organization’s domain.

CyberStrikeAI combines a command-and-control server, software agents, and a large language model. The operator sets the tasks, after which the AI independently selects tools, generates commands, and analyzes the results.

In one of the investigated incidents, the attackers initially gained access to an SQL server and manually gathered information about the system. A two-week pause followed, after which the CyberStrikeAI implant was installed on the devices. In just three to four days, the attackers were able to compromise domain administrator accounts. The final stage, which included lateral movement, password harvesting, and database exfiltration, took less than an hour.

Meanwhile, the artificial intelligence ran on the attackers’ servers rather than on the compromised computers. The installed implant merely executed commands and relayed the results back to the command server.

Experts discovered comments in Chinese within the scripts, though this is not enough to attribute the attacks to a specific threat group. Kaspersky EDR Expert and the company’s network monitoring tools were used to detect the threat.

According to experts, using AI makes it possible to accelerate and coordinate complex cyberattacks, although the intrusion methods themselves remain familiar: reconnaissance, credential theft, and lateral movement between systems. Kaspersky recommends that organizations tighten control over endpoints and network traffic, regularly update cyber threat intelligence, and ensure 24/7 monitoring of infrastructure.