CyberStrikeAI used in education org attacks by AI C2

Kaspersky's Cyber Threat Intelligence team identified a malicious campaign targeting educational organizations in Africa and Latin America using CyberStrikeAI, an open-source framework that integrates an LLM orchestrator on a command-and-control server with classic implants. The framework automates post-exploitation tasks including persistence, discovery, credential access, and lateral movement while maintaining human strategic control. Researchers noted that the AI orchestration significantly accelerates attack execution speed without relying on novel exploitation techniques, making the activity detectable via standard EDR, NDR, and SIEM correlation rules. Open article →