Attackers are deploying a tool called CyberStrikeAI—an open-source, Go-based AI-driven command framework—to infiltrate Windows domains and steal credentials at speed and scale. What sets this campaign apart is that it’s one of the first observed instances of a live intrusion where a language model was given goal-level control, while malware inside the target system more passively carries out instructions.
From Quiet Entry to Full Domain Control
The intrusion kicked off with attackers gaining access to an SQL Server. Over roughly a day, they harvested basic system intelligence and laid groundwork by deploying tools to scan the broader network. After a roughly two-week lull in activity, the AI agent took over. Within minutes, it established persistence via a scheduled task, then spent hours mapping the domain using PowerShell and LDAP queries.
The AI turned to credential theft methods like Kerberoasting and AS-REP Roasting, techniques designed to extract account passwords. Later, the attackers used lateral movement tools like SMB and WMI, extracted credentials via the LSASS process using the MiniDump capability in comsvcs.dll, and ultimately took control of the domain with DCSync and Golden Ticket attacks—facilitated by a customized version of Mimikatz. From agent installation to domain admin access, the full takeover was completed in under four days.
How Detection Still Works & Key Indicators
Though the use of AI speeds up the operation and automates many decisions, the underlying tactics aren’t new. Because the language model runs on the attacker’s remote control server—not inside the compromised network—defenders won’t pick up unusual AI model usage or abnormal resource spikes. The log of actions, however, look like a well-executed manual attack.
This means existing defense strategies still apply. Monitoring for scheduled tasks created via schtasks.exe, unexpected LSASS memory access, or unusual WMI and WinRM commands remains essential. Administrators should also enable security tools like Microsoft’s LAPS, lock down SQL Servers, limit replication rights across domains, and retain verbose logging of process launches and PowerShell usage. When domain admin accounts are compromised, rotating the krbtgt account twice is critical to invalidate forged Golden Tickets.
Geography, Attribution & IoCs
Some victims are located in the education sector across Africa and Latin America. Suspicious activity—including server restarts during UTC+8 business hours, scripts with Chinese-language comments, and use of a Chinese DNS logging service called dnslog.cn—suggest a possible Chinese-speaking actor, though no firm attribution has been made.
Indicators of Compromise (IoCs) for this campaign include Windows beacons disguised as processes like svchosts.exe or svcmon32.exe, Linux beacons, a renamed Mimikatz binary, PowerShell reverse shells, and command-and-control (C2) servers with domains like fastcdn[.]bar and specific IP addresses. These hashes and domains provide concrete leads for defenders.
This new attack wave underscores the evolving threat posed by AI enabling more autonomous intrusions. It’s not about new tools—it’s about accelerating every stage of the attack lifecycle. For defenders, understanding the interplay between AI orchestration and conventional attack techniques is now essential. You’ll want to watch closely for further campaigns that replicate this model, and whether threat actors build in even more automation, evasions, or cross-platform capabilities.
