# CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin America

> Securelist (Kaspersky) reports in-the-wild abuse of CyberStrikeAI, an open-source Go framework that combines LLM-based attack orchestration with a built-in C2 server and Windows/Linux beacons. Intrusions began with a compromised SQL Server and progressed to persistence, domain reconnaissance, credential dumping, lateral movement and database export against educational institutions.

- **Published:** 2026-11-02T08:24:25Z
- **Last reviewed:** 2026-11-02T08:24:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5039
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5039.png
- **ID:** TL-2026-5039
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

CyberStrikeAI is an open-source (Apache-2.0), modular Go platform published on GitHub by the developer alias Ed1s0nZ. It automates penetration testing through LLM-based orchestration (OpenAI-compatible providers such as GPT-4o, DeepSeek and Qwen), ships 100+ curated security tool recipes (nmap, sqlmap, nuclei, Metasploit and others) and includes a lightweight built-in C2 with TCP reverse, HTTP/HTTPS beacon and WebSocket listeners, encrypted beacons, and session/task queues. The project documentation restricts use to systems the operator owns or is authorized to test, but the framework is now being used by real attackers.

Securelist describes two phases of an intrusion against educational institutions in multiple countries in Africa and Latin America. In phase 1 an operator worked manually for about one day through a compromised Microsoft SQL Server (version 16.0.1000), where the SQL Server was the code-execution foothold, then paused for roughly two weeks. In phase 2 CyberStrikeAI was deployed: persistence and local reconnaissance completed within about 2 minutes, domain reconnaissance ran for about 5 hours, and lateral movement plus credential dumping finished in under one hour. The report does not state the initial exploitation method for the SQL Server or the calendar dates of the intrusions.

The AI logic runs server-side; the implant has no autonomous logic and behaves as a classic C2 agent polling over HTTP/S, TCP or WebSocket. Observed Windows activity includes Base64-encoded PowerShell, certutil Base64 decoding, scheduled tasks (including remote creation via schtasks /s and COM Schedule.Service abuse for SYSTEM execution), a SystemUpdate scheduled task and an HKCU Run key for persistence, systeminfo/ipconfig and SCCM vulnerability checks, PowerShell ping sweeps and WMI host enumeration, LDAP queries supporting Kerberoasting/AS-REP roasting reconnaissance, LAPS detection, Azure IMDS checks and AzCopy searches, registry hive dumps with reg.exe, LSASS dumping via comsvcs.dll MiniDump with obfuscated PID, DCSync, Golden Ticket creation with a renamed Mimikatz (wdiag2.exe), DSN extraction from the SSRS rsreportserver.config, Impacket WMIExec and Invoke-CimMethod lateral movement, payload distribution over network shares, RogueWinRM, SQL database querying/export, screenshots and Base64 file transfer over the C2 channel. On Linux the beacon persists through a crontab @reboot entry and ~/.bashrc modification.

Network tradecraft: the C2 sets a fixed per-server HTTP header X-Implant-Token (embedded at build time, useful to pivot between samples), and the server generates a self-signed TLS certificate at every start containing the framework name in issuer/subject; the not_before field reveals process launch time and restart chronology. The operators used the Chinese service dnslog.cn for external IP reconnaissance. Attribution: no definitive link to a known APT; Chinese-language comments in scripts, UTC+8 restart patterns and use of Chinese services suggest Chinese-speaking operators, but open-source availability and LLM-generated command variability preclude firm attribution. Separately, Team Cymru reported (via The Hacker News, 2026-03-03) that between 2026-01-20 and 2026-02-26 21 unique attacker IPs ran CyberStrikeAI in a campaign that compromised 600+ FortiGate appliances in 55 countries, indicating broader criminal adoption.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1053.003 Cron
- T1140 Deobfuscate/Decode Files or Information
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.006 DCSync
- T1558.001 Golden Ticket
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1087.002 Domain Account
- T1021.002 SMB/Windows Admin Shares
- T1113 Screen Capture
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CyberStrikeAI Foothold - SQL Server Spawning Shell, Encoded PowerShell or Certutil Decode/Download** (`TL-2026-5039-SPL-001`)

Detects sqlservr.exe spawning cmd, PowerShell, certutil, rundll32, schtasks, wmic or bitsadmin, scored for Base64-encoded PowerShell, certutil -decode/-urlcache and CyberStrikeAI artifact names (svchosts.exe, svcmon32.exe, wdiag2.exe, RogueWinRM, p1.ps1, dsn_line.txt). In TL-2026-5039 a compromised Microsoft SQL Server 16.0.1000 was the code-execution foothold before the CyberStrikeAI beacon was deployed; shell children of the SQL Server service are rare in normal operations.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.001, T1140, T1105
- **Data sources:** sysmon, microsoft_defender_for_endpoint_DeviceProcessEvents, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*sqlservr.exe" (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*certutil.exe" OR Image="*rundll32.exe" OR Image="*schtasks.exe" OR Image="*wmic.exe" OR Image="*bitsadmin.exe")
| eval encoded_ps=if(match(CommandLine,"(?i)-(e|enc|encodedcommand) +[A-Za-z0-9+/=]{20,}"),1,0)
| eval certutil_decode=if(match(CommandLine,"(?i)certutil.* -decode"),1,0)
| eval certutil_download=if(match(CommandLine,"(?i)certutil.* -(urlcache|verifyctl)"),1,0)
| eval cyberstrikeai_artifact=if(match(CommandLine,"(?i)(svchosts\.exe|svcmon32\.exe|wdiag2\.exe|roguewinrm|p1\.ps1|dsn_line\.txt)"),1,0)
| fillnull value="unknown" User
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as command_lines max(encoded_ps) as encoded_ps max(certutil_decode) as certutil_decode max(certutil_download) as certutil_download max(cyberstrikeai_artifact) as cyberstrikeai_artifact by host User ParentImage
| eval risk_score=1+(encoded_ps*2)+(certutil_decode*2)+(certutil_download*2)+(cyberstrikeai_artifact*3)
| convert ctime(first_seen) ctime(last_seen)
| sort - risk_score
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "rundll32.exe", "schtasks.exe", "wmic.exe", "bitsadmin.exe")
| extend EncodedPS = ProcessCommandLine matches regex @"(?i)-(e|enc|encodedcommand)\s+[A-Za-z0-9+/=]{20,}"
| extend CertutilDecode = ProcessCommandLine matches regex @"(?i)certutil.*\s-decode"
| extend CertutilDownload = ProcessCommandLine matches regex @"(?i)certutil.*\s-(urlcache|verifyctl)"
| extend CyberStrikeAIArtifact = ProcessCommandLine matches regex @"(?i)(svchosts\.exe|svcmon32\.exe|wdiag2\.exe|roguewinrm|p1\.ps1|dsn_line\.txt)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, EncodedPS, CertutilDecode, CertutilDownload, CyberStrikeAIArtifact
| order by Timestamp desc
```

### Sigma

```yaml
title: SQL Server Spawning Shell or Download/Decode Utility - CyberStrikeAI Foothold
id: 3f6c1a52-7d0e-4b39-9a41-5039a1c0d001
status: experimental
description: Detects sqlservr.exe spawning a command interpreter or living-off-the-land binary (cmd, PowerShell, certutil, rundll32, schtasks, wmic, bitsadmin). In the CyberStrikeAI intrusions against education-sector targets (TL-2026-5039) a compromised Microsoft SQL Server was the code-execution foothold used to stage the C2 beacon.
references:
    - https://securelist.com/cyberstrikeai-attacks/121715/
author: 'AII-Detector — ThreadLinqs Intelligence'
date: 2026-11-02
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1140
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\sqlservr.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\rundll32.exe'
            - '\schtasks.exe'
            - '\wmic.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Database administrators legitimately enabling xp_cmdshell for maintenance jobs
    - Vendor database agents that shell out from the SQL Server service process
level: high

```

**Known false positives:**

- DBA maintenance jobs that enable xp_cmdshell and run cmd.exe or PowerShell from sqlservr.exe
- Third-party backup or monitoring agents invoking shells through the SQL Server service

**Tuning notes:** Baseline sqlservr.exe child processes for 14 days and allowlist known maintenance command lines by exact match. Keep alerting on encoded_ps, certutil_decode, certutil_download and cyberstrikeai_artifact regardless of allowlist. Ensure Sysmon EventCode 1 is collected from SQL Server hosts. The Sigma flavor covers the parent/child relationship only; scoring lives in the SPL and KQL flavors.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CyberStrikeAI Staged Beacon, Renamed Mimikatz and DSN Credential Artifacts (locked: unlock with TL Creds)
- CyberStrikeAI Credential Access - comsvcs LSASS Dump, Registry Hive Export, Renamed Mimikatz DCSync and Golden Ticket (locked: unlock with TL Creds)
- CyberStrikeAI Lateral Movement - Impacket WMIExec, Remote schtasks, Invoke-CimMethod and Admin Share Payload Drop (locked: unlock with TL Creds)
- CyberStrikeAI Payload Decoding - Encoded PowerShell from Server Parents and Certutil Decode (locked: unlock with TL Creds)
- CyberStrikeAI Linux Beacon Persistence - Crontab @reboot and .bashrc Modification (locked: unlock with TL Creds)
- CyberStrikeAI Domain Reconnaissance - Kerberoast/AS-REP LDAP Queries, LAPS Probing and Ping Sweep (locked: unlock with TL Creds)
- CyberStrikeAI Windows Persistence - SystemUpdate Task, Remote schtasks and HKCU Run Key (locked: unlock with TL Creds)
- CyberStrikeAI C2 - Beacon Infrastructure, X-Implant-Token Header and Framework TLS Certificate (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `185.186.245[.]144`
- Domain: `fastcdn[.]bar`
- File hash: `D726A8B4886C636F76CA6D30EF6A6FF4`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations (Securelist)](https://securelist.com/cyberstrikeai-attacks/121715/)
- [CyberStrikeAI in the wild (Securelist, Turkish edition)](https://securelist.com/tr/cyberstrikeai-attacks/121715/)
- [Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries (The Hacker News)](https://thehackernews.com/2026/03/open-source-cyberstrikeai-deployed-in.html)
- [CyberStrikeAI tool adopted by hackers for AI-powered attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/cyberstrikeai-tool-adopted-by-hackers-for-ai-powered-attacks/)
- [CyberStrikeAI project repository (Ed1s0nZ)](https://github.com/Ed1s0nZ/CyberStrikeAI)
- [CyberStrikeAI uses artificial intelligence to launch automated attacks against Fortinet systems (INCIBE-CERT)](https://www.incibe.es/index.php/en/incibe-cert/publications/cybersecurity-highlights/cyberstrikeai-uses-artificial-intelligence-launch-automated-attacks-against)
- [Novel CyberStrikeAI tool exploited in attacks (SC Media)](https://www.scworld.com/brief/novel-cyberstrikeai-tool-exploited-in-attacks)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5039