"According to our data, this is one of the first public descriptions of a compromise involving an LLM in the wild," Kaspersky’s Cyber Threat Intelligence team reported, describing an intrusion in which an LLM-driven orchestrator directed post‑exploitation activity while a classic C2 implant executed commands on infected hosts.
Timeline: from a compromised SQL Server to domain compromise
Kaspersky reconstructed a multi‑phase campaign that began with manual access through a compromised SQL Server (version 16.0.1000). The operator collected host information, deployed tools and performed network reconnaissance over nearly a day, then paused for about two weeks. In the second phase the attackers deployed a CyberStrikeAI C2 agent controlled by a server‑side LLM orchestrator. Kaspersky observed the agent establish persistence and carry out local reconnaissance in roughly two minutes, conduct domain reconnaissance over about five hours, then—after a brief pause of several days—perform lateral movement, mass credential dumping and database export in under an hour. From agent deployment to compromise of domain administrator privileges, the campaign completed within three to four days in the observed cases.
How CyberStrikeAI operates: server-side LLM plus traditional implant
CyberStrikeAI is an open‑source platform written in Go that combines an LLM orchestrator and a built‑in C2 server. Kaspersky emphasizes a two‑level decision model: a human operator sets high‑level goals; the server‑side LLM generates the specific sequence of commands and selects tools; an implant executes those commands on compromised hosts.
Crucially, the implant itself contains no AI: it does not hold API keys, does not call external AI services, and offers no autonomous model behavior. The implant periodically polls the listener via HTTP/S, TCP or WebSocket, executes shell commands, interacts with the file system and returns results—appearing to the victim as a standard remote‑control session while the LLM queues tasks on the server.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTechniques, tools and artifacts observed
Kaspersky documented familiar post‑exploitation techniques executed under LLM orchestration rather than novel exploits. Observed activity included:
- Delivery and execution via PowerShell with Base64‑encoded commands to evade keyword detection; reverse shell payloads (example connecting to 185.186.245[.]144:5501).
- Persistence via scheduled tasks (task named SystemUpdate) and HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries; Linux persistence via crontab @reboot or ~/.bashrc nohup entries.
- Credential access and lateral movement using reg.exe, comsvcs.dll MiniDump of lsass.exe, renamed mimikatz to perform DCSync and Golden Ticket attacks, and Impacket tools (WMIExec) for remote execution and distribution.
- Discovery via PowerShell, net.exe and LDAP queries for Kerberoasting and AS‑REP Roasting; checks for LAPS, Azure indicators (including .azcopy directories) and SCCM or msiexec privilege escalation paths.
- Collection via generated SQL and LDAP queries, recursive file scanning, direct upload/download through the implant’s JSON responses (Base64‑encoded), and screenshots captured at the LLM’s command.
Attribution signals and limits
Kaspersky found build metadata that grouped samples into two independent sets; within each group Windows and Linux implants shared identical Go build metadata, indicating a shared build environment. Nevertheless, the groups did not share C2 infrastructure or versions, and Kaspersky could not conclusively tie both groups to a single operator.
Analysts noted Chinese‑language comments in delivered scripts, use of the Chinese dnslog[.]cn service for external IP checks, and control‑server restarts that aligned with business hours in UTC+8. Kaspersky also observed that CyberStrikeAI originated inside the Chinese cybersecurity community and is well known there—but the report stops short of definitive attribution to a named actor.
Detection, indicators and defensive signals Kaspersky published
Kaspersky’s defensive guidance stresses that the novelty lies in orchestration speed and lowered operator skill requirements, not in fundamentally new host behavior. Detection methods and signatures they published include:
- Network and file indicators: C2 addresses 185.186.245[.]144, fastcdn[.]bar, media.fastcdn[.]bar and 104.234.26[.]163; example file paths and hashes for Windows and Linux beacons and tools (see list below).
- Telemetry‑based detections in Kaspersky Next EDR Expert (rules for scheduled task creation, MiniDump via comsvcs.dll, WinRM/WMI remote execution), KATA network detection (Backdoor.CyberStrikeAI.HTTP.C&C), and NDR/NAD rules for LDAP scanning.
- SIEM rules and IDs for the full attack chain (process launches, PowerShell 4104, Windows security logs 4688/4624/4662/etc.) that Kaspersky maps to reconnaissance, credential theft and lateral movement techniques.
File and network indicators published by Kaspersky:
- Windows Beacon hashes: D726A8B4886C636F76CA6D30EF6A6FF4 — example path c:\windows\temp\svchosts.exe; 2770562d104391b92b42671c270079bb — c:\windows\temp\svcmon32.exe / c:\programdata\svcmon32.exe
- Linux Beacon hashes: 09e1da2afa1216ecc55648ec8e122d2a; 805B9E4AE74C903787416800999B8418
- Tool hashes: 29EFD64DD3C7FE1E2B022B7AD73A1BA5 — C:\Windows\Temp\wdiag2.exe (mimikatz); 74F57B3E897A4960DCDD5B7E8A54F9DF — c:\rwx\RogueWinRM.exe; 0BBD08AF95F877F1D568B03DE2EB76B4 — c:\ProgramData\p1.ps1
- Network: 185.186.245[.]144 (C2 for Windows Beacon), fastcdn[.]bar and media.fastcdn[.]bar (Windows C2), 104.234.26[.]163 (C2 for payload delivery + Linux Beacon).
Kaspersky’s central finding: the LLM’s addition accelerates and automates post‑exploit decision‑making, but defenders can apply classic telemetry, correlation and behavioral rules—carefully tuned—to detect the same chains of reconnaissance, credential theft and lateral movement that the LLM simply executes faster.
