CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin America

Key facts for CyberStrikeAI attack framework

Detection coverage for CyberStrikeAI attack framework

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5039 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CyberStrikeAI Foothold - SQL Server Spawning Shell, Encoded PowerShell or Certutil Decode/Download

Detects sqlservr.exe spawning cmd, PowerShell, certutil, rundll32, schtasks, wmic or bitsadmin, scored for Base64-encoded PowerShell, certutil -decode/-urlcache and CyberStrikeAI artifact names (svchosts.exe, svcmon32.exe, wdiag2.exe, RogueWinRM, p1.ps1, dsn_line.txt). In TL-2026-5039 a compromised Microsoft SQL Server 16.0.1000 was the code-execution foothold before the CyberStrikeAI beacon was deployed; shell children of the SQL Server service are rare in normal operations.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.001, T1140, T1105
• Data sources: sysmon, microsoft_defender_for_endpoint_DeviceProcessEvents, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*sqlservr.exe" (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*certutil.exe" OR Image="*rundll32.exe" OR Image="*schtasks.exe" OR Image="*wmic.exe" OR Image="*bitsadmin.exe")
| eval encoded_ps=if(match(CommandLine,"(?i)-(e|enc|encodedcommand) +[A-Za-z0-9+/=]{20,}"),1,0)
| eval certutil_decode=if(match(CommandLine,"(?i)certutil.* -decode"),1,0)
| eval certutil_download=if(match(CommandLine,"(?i)certutil.* -(urlcache|verifyctl)"),1,0)
| eval cyberstrikeai_artifact=if(match(CommandLine,"(?i)(svchosts\.exe|svcmon32\.exe|wdiag2\.exe|roguewinrm|p1\.ps1|dsn_line\.txt)"),1,0)
| fillnull value="unknown" User
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as command_lines max(encoded_ps) as encoded_ps max(certutil_decode) as certutil_decode max(certutil_download) as certutil_download max(cyberstrikeai_artifact) as cyberstrikeai_artifact by host User ParentImage
| eval risk_score=1+(encoded_ps*2)+(certutil_decode*2)+(certutil_download*2)+(cyberstrikeai_artifact*3)
| convert ctime(first_seen) ctime(last_seen)
| sort - risk_score

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "rundll32.exe", "schtasks.exe", "wmic.exe", "bitsadmin.exe")
| extend EncodedPS = ProcessCommandLine matches regex @"(?i)-(e|enc|encodedcommand)\s+[A-Za-z0-9+/=]{20,}"
| extend CertutilDecode = ProcessCommandLine matches regex @"(?i)certutil.*\s-decode"
| extend CertutilDownload = ProcessCommandLine matches regex @"(?i)certutil.*\s-(urlcache|verifyctl)"
| extend CyberStrikeAIArtifact = ProcessCommandLine matches regex @"(?i)(svchosts\.exe|svcmon32\.exe|wdiag2\.exe|roguewinrm|p1\.ps1|dsn_line\.txt)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, EncodedPS, CertutilDecode, CertutilDownload, CyberStrikeAIArtifact
| order by Timestamp desc

Sigma

title: SQL Server Spawning Shell or Download/Decode Utility - CyberStrikeAI Foothold
id: 3f6c1a52-7d0e-4b39-9a41-5039a1c0d001
status: experimental
description: Detects sqlservr.exe spawning a command interpreter or living-off-the-land binary (cmd, PowerShell, certutil, rundll32, schtasks, wmic, bitsadmin). In the CyberStrikeAI intrusions against education-sector targets (TL-2026-5039) a compromised Microsoft SQL Server was the code-execution foothold used to stage the C2 beacon.
references:
    - https://securelist.com/cyberstrikeai-attacks/121715/
author: 'AII-Detector — ThreadLinqs Intelligence'
date: 2026-11-02
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1140
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\sqlservr.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\rundll32.exe'
            - '\schtasks.exe'
            - '\wmic.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Database administrators legitimately enabling xp_cmdshell for maintenance jobs
    - Vendor database agents that shell out from the SQL Server service process
level: high

Known false positives:

• DBA maintenance jobs that enable xp_cmdshell and run cmd.exe or PowerShell from sqlservr.exe
• Third-party backup or monitoring agents invoking shells through the SQL Server service

Tuning notes: Baseline sqlservr.exe child processes for 14 days and allowlist known maintenance command lines by exact match. Keep alerting on encoded_ps, certutil_decode, certutil_download and cyberstrikeai_artifact regardless of allowlist. Ensure Sysmon EventCode 1 is collected from SQL Server hosts. The Sigma flavor covers the parent/child relationship only; scoring lives in the SPL and KQL flavors.

• 🔒 CyberStrikeAI Staged Beacon, Renamed Mimikatz and DSN Credential Artifacts · unlock with TL Creds
• 🔒 CyberStrikeAI Credential Access - comsvcs LSASS Dump, Registry Hive Export, Renamed Mimikatz DCSync and Golden Ticket · unlock with TL Creds
• 🔒 CyberStrikeAI Lateral Movement - Impacket WMIExec, Remote schtasks, Invoke-CimMethod and Admin Share Payload Drop · unlock with TL Creds
• 🔒 CyberStrikeAI Payload Decoding - Encoded PowerShell from Server Parents and Certutil Decode · unlock with TL Creds
• 🔒 CyberStrikeAI Linux Beacon Persistence - Crontab @reboot and .bashrc Modification · unlock with TL Creds
• 🔒 CyberStrikeAI Domain Reconnaissance - Kerberoast/AS-REP LDAP Queries, LAPS Probing and Ping Sweep · unlock with TL Creds
• 🔒 CyberStrikeAI Windows Persistence - SystemUpdate Task, Remote schtasks and HKCU Run Key · unlock with TL Creds
• 🔒 CyberStrikeAI C2 - Beacon Infrastructure, X-Implant-Token Header and Framework TLS Certificate · unlock with TL Creds

Indicators of compromise for CyberStrikeAI attack framework

As of 2026-11-02, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5039.

Sample indicators (3 of 26)

• IP address: 185.186.245[.]144
• Domain: fastcdn[.]bar
• File hash: D726A8B4886C636F76CA6D30EF6A6FF4

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

How CyberStrikeAI attack framework works

CyberStrikeAI is an open-source (Apache-2.0), modular Go platform published on GitHub by the developer alias Ed1s0nZ. It automates penetration testing through LLM-based orchestration (OpenAI-compatible providers such as GPT-4o, DeepSeek and Qwen), ships 100+ curated security tool recipes (nmap, sqlmap, nuclei, Metasploit and others) and includes a lightweight built-in C2 with TCP reverse, HTTP/HTTPS beacon and WebSocket listeners, encrypted beacons, and session/task queues. The project documentation restricts use to systems the operator owns or is authorized to test, but the framework is now being used by real attackers.

Securelist describes two phases of an intrusion against educational institutions in multiple countries in Africa and Latin America. In phase 1 an operator worked manually for about one day through a compromised Microsoft SQL Server (version 16.0.1000), where the SQL Server was the code-execution foothold, then paused for roughly two weeks. In phase 2 CyberStrikeAI was deployed: persistence and local reconnaissance completed within about 2 minutes, domain reconnaissance ran for about 5 hours, and lateral movement plus credential dumping finished in under one hour. The report does not state the initial exploitation method for the SQL Server or the calendar dates of the intrusions.

The AI logic runs server-side; the implant has no autonomous logic and behaves as a classic C2 agent polling over HTTP/S, TCP or WebSocket. Observed Windows activity includes Base64-encoded PowerShell, certutil Base64 decoding, scheduled tasks (including remote creation via schtasks /s and COM Schedule.Service abuse for SYSTEM execution), a SystemUpdate scheduled task and an HKCU Run key for persistence, systeminfo/ipconfig and SCCM vulnerability checks, PowerShell ping sweeps and WMI host enumeration, LDAP queries supporting Kerberoasting/AS-REP roasting reconnaissance, LAPS detection, Azure IMDS checks and AzCopy searches, registry hive dumps with reg.exe, LSASS dumping via comsvcs.dll MiniDump with obfuscated PID, DCSync, Golden Ticket creation with a renamed Mimikatz (wdiag2.exe), DSN extraction from the SSRS rsreportserver.config, Impacket WMIExec and Invoke-CimMethod lateral movement, payload distribution over network shares, RogueWinRM, SQL database querying/export, screenshots and Base64 file transfer over the C2 channel. On Linux the beacon persists through a crontab @reboot entry and ~/.bashrc modification.

Network tradecraft: the C2 sets a fixed per-server HTTP header X-Implant-Token (embedded at build time, useful to pivot between samples), and the server generates a self-signed TLS certificate at every start containing the framework name in issuer/subject; the not_before field reveals process launch time and restart chronology. The operators used the Chinese service dnslog.cn for external IP reconnaissance. Attribution: no definitive link to a known APT; Chinese-language comments in scripts, UTC+8 restart patterns and use of Chinese services suggest Chinese-speaking operators, but open-source availability and LLM-generated command variability preclude firm attribution. Separately, Team Cymru reported (via The Hacker News, 2026-03-03) that between 2026-01-20 and 2026-02-26 21 unique attacker IPs ran CyberStrikeAI in a campaign that compromised 600+ FortiGate appliances in 55 countries, indicating broader criminal adoption.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1003.002 Security Account Manager; T1003.006 DCSync; T1552.001 Credentials In Files; T1558.001 Golden Ticket

Discovery

T1018 Remote System Discovery; T1082 System Information Discovery; T1087.002 Domain Account

Lateral Movement

T1021.002 SMB/Windows Admin Shares

Execution

T1047 Windows Management Instrumentation; T1059.001 PowerShell

Persistence

T1053.003 Cron; T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Command and Control

T1071.001 Web Protocols

Collection

T1113 Screen Capture

Defense Evasion

T1140 Deobfuscate/Decode Files or Information

Remediation for CyberStrikeAI attack framework

Immediate actions

• Block 185.186.245.144, 104.234.26.163, fastcdn.bar and media.fastcdn.bar at the perimeter and search proxy/DNS/firewall logs for historical contact
• Hunt for svchosts.exe, svcmon32.exe, wdiag2.exe, RogueWinRM.exe and p1.ps1 in C:\Windows\Temp, C:\ProgramData and C:\Temp, and for the SystemUpdate scheduled task
• Hunt Linux hosts for crontab @reboot entries and ~/.bashrc additions launching unknown binaries
• Reset credentials of exposed accounts, including SQL Server service/DSN credentials found in rsreportserver.config, and reset KRBTGT twice if DCSync or Golden Ticket activity is suspected
• Isolate internet-exposed SQL Server instances showing xp_cmdshell or unexpected child processes

Workarounds

• Restrict outbound traffic from servers to approved destinations to break beacon callbacks
• Segment domain controllers and database servers; restrict WMI/SMB between servers

Longer-term hardening

• Do not expose SQL Server to the internet; enforce strong authentication and least-privilege service accounts
• Enable LSASS protection (RunAsPPL/Credential Guard) and alert on comsvcs.dll MiniDump usage
• Monitor for DCSync (directory replication) from non-DC hosts and anomalous Kerberos ticket use
• Deploy EDR with behavioral detection for schtasks /s remote creation, WMI remote execution and Impacket WMIExec patterns
• Inspect TLS certificates and HTTP headers (X-Implant-Token, CyberStrikeAI in certificate issuer/subject) in network telemetry

Affected and fixed versions

• Microsoft — SQL Server (compromised initial foothold; version 16.0.1000 observed)
  Vulnerable versions: 16.0.1000 (as observed in compromised host; no vulnerability identified)
• Microsoft — Windows (Active Directory domain environments)
• Linux — Linux hosts targeted by the CyberStrikeAI Linux beacon

Timeline of CyberStrikeAI attack framework

• 2026-01-20 Team Cymru begins observing attacker-controlled servers running locked-ioc-23 (21 unique IPs) in a separate campaign against Fortinet FortiGate appliances.
• 2026-02-26 End of the Team Cymru observation window; the FortiGate campaign compromised 600+ appliances across 55 countries.
• 2026-03-03 The Hacker News publishes Team Cymru findings on in-the-wild locked-ioc-23 use and the Ed1s0nZ developer's alleged ties to Chinese government-linked entities.
• 2026-11-02 Securelist (Kaspersky) publishes IOCs and analysis of locked-ioc-23 attacks on educational institutions in Africa and Latin America.
• 2026-11-02 Securelist report published: phase 2 deployed locked-ioc-23, with persistence and local recon in about 2 minutes, domain recon over about 5 hours, and lateral movement plus credential dumping within an hour (calendar dates not disclosed).
• 2026-11-02 Securelist report published: phase 1 of the education-sector intrusion involved about one day of manual operator activity via a compromised SQL Server 16.0.1000, then a two-week pause (calendar dates not disclosed).

Sources cited for CyberStrikeAI attack framework

• CyberStrikeAI uses artificial intelligence to launch automated attacks against Fortinet systems (INCIBE-CERT) incibe.es · Advisory
• CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations (Securelist) Kaspersky Securelist · Research · 2026-11-02
• CyberStrikeAI in the wild (Securelist, Turkish edition) Kaspersky Securelist · Research · 2026-11-02
• CyberStrikeAI project repository (Ed1s0nZ) GitHub · Code repository
• Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries (The Hacker News) The Hacker News · News · 2026-03-03
• CyberStrikeAI tool adopted by hackers for AI-powered attacks (BleepingComputer) BleepingComputer · News
• Novel CyberStrikeAI tool exploited in attacks (SC Media) scworld.com · News

More in malware

• Cryptomining Campaign Targeting Linux SSH Servers (XMRig, ShellBot, XHide, Go-based downloaders)
• SloppyRAT: New ClickFix-Delivered Remote Access Trojan Supporting Ransomware Operations
• QuimaRAT: Java-based cross-platform Remote Access Trojan offered as Malware-as-a-Service
• APT37 NarwhalRAT: MS-Themed Phishing and pCloud Dead-drop C2 Targeting Korean Users
• The Mac Malware of 2025: Objective-See review of macOS infostealers (DigitStealer, Phexia, Paradox, Koi, MacSync, RN Stealer, AMOS variants), ChillyHell/NightPaw backdoors and DPRK-linked campaigns