Hackers Deploy CyberStrikeAI Agents to Automate Windows Domain Takeovers and Credential Theft

Attackers are using an AI-driven command framework called CyberStrikeAI to infiltrate Windows environments and take control of entire domains.

Confirmed victims include educational institutions in Africa and Latin America. The platform delegates command selection to a language model, so the operator no longer needs to type each step manually.

CyberStrikeAI is an open-source framework written in Go and designed for penetration testing. Criminal actors have adapted it for real-world attacks; earlier reporting showed the same framework used against Fortinet FortiGate devices.

This campaign demonstrates the tool being applied at scale: attackers moved from a single weak server to full domain compromise.

Researchers at Kaspersky’s Securelist discovered the intrusion during their routine monitoring and described it as one of the first publicly documented instances of a language model being used inside a live breach.

The attack workflow combined human operators and AI. An operator established initial access, gathered basic host information, deployed tools, and scanned the network. That initial phase lasted nearly a day, after which the intruders paused for about two weeks.

Hackers deploy CyberStrikeAI agents

When activity resumed, a CyberStrikeAI agent on the attacker’s control server took over. Within two minutes it created persistence by adding a scheduled task named SystemUpdate and completed local reconnaissance. Over the next five hours the agent enumerated the domain using PowerShell and LDAP queries.

It collected data useful for Kerberoasting and AS-REP roasting, techniques for cracking account passwords. Other reporting notes operators coordinating as many as 44 AI agents with this platform, indicating the approach may be spreading.

After a short pause of a few days, the final escalation ran in under an hour. The agent moved laterally via SMB and WMI, dumped credentials from numerous machines, and exfiltrated database contents.

Credentials were harvested from registry-stored files and from the LSASS process using the comsvcs.dll MiniDump routine. After obtaining the built-in domain administrator account, the attackers performed DCSync and Golden Ticket operations using a renamed Mimikatz binary.

From agent installation to domain administrator privileges, the compromise took roughly three to four days. The intruders attempted to evade detection by Base64-encoding commands, splitting scripts across files and reassembling them with certutil.

One beacon binary was named svchosts.exe to resemble a legitimate Windows process. Some scripts included comments written in Chinese, and the attackers used the Chinese DNS logging service dnslog.cn to discover victim IP addresses.

Server restarts primarily occurred during UTC+8 business hours. Together these indicators point to a Chinese-speaking operator, although Securelist could not attribute the activity to any known threat group.

Why defenders can still detect this activity

The tactics themselves are familiar. The agent relied on established tools and techniques; the AI mostly automated and sped up the operator’s work. Because the language model runs on the attacker’s server, defenders won’t see unusual AI network traffic or high local resource use—the observable behavior on the victim network looks like a human-driven intrusion.

That means existing detection rules remain effective. Security teams should alert on remote scheduled tasks created with schtasks.exe, LSASS memory access, and WMI or WinRM activity originating from unexpected hosts.

A DCSync attack requests password hashes by impersonating a domain controller. Event ID 4662 can help detect such requests when they originate from systems that are not legitimate domain controllers. After any confirmed domain admin compromise, rotate the krbtgt account twice to invalidate forged Golden Tickets.

Defenders should also monitor for commands launched from the sqlservr.exe process, since the initial access in this campaign likely involved a compromised SQL Server. Patch and restrict exposed SQL Servers and enable LAPS where possible.

Limit replication rights, retain logs for process launches, PowerShell execution, and logons. Microsoft has additionally warned about AI agents targeting Microsoft 365 tenants, so cloud accounts associated with the domain require similar protections.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally Q‑defanged (for example, [.]) to prevent accidental resolution or clickable links. Re-fang only inside controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.