AI agent as burglar: CyberStrikeAI takes over a Windows domain in three to four days

What's going on

On November 2, 2026, Securelist, the research team at security vendor Kaspersky, published a report on attacks in which a language model largely played the role of the intruder. The attackers used CyberStrikeAI, a freely available open-source framework. The targets were educational institutions in several countries in Africa and Latin America. The attacks ran between September and October 2026.

What makes this case stand out: a large language model (LLM) ran on the attackers' server. It decided which tools to use, crafted the right commands and analyzed the output to plan its next move. The blog aicybr.com analyzed the Kaspersky report and derived recommendations for defenders. This article is based on that summary.

How CyberStrikeAI works

CyberStrikeAI is written in Go. It combines three components: an AI orchestrator – essentially a language model acting as operations lead – a command-and-control server (C2, the attackers' remote control hub) and so-called implants, small remote-control programs on the hijacked machines. Kaspersky describes four roles:

• Operator: A human sets the high-level goal and stays in control.
• Server-side orchestrator: The language model picks tools, builds commands, checks results and plans next steps.
• C2 service: Relays tasks and results back and forth between the model and the infected machines.
• Implant: Executes commands on the victim machine and handles file and system operations.

The model accesses the remote-control functions through tool interfaces, including the Model Context Protocol (MCP) – an open standard that lets AI models operate external programs. The implant itself is unremarkable. It behaves like a classic remote administration tool and communicates over HTTP/S, TCP or WebSocket. It contains no language model of its own and doesn't call any AI services. Kaspersky also observed a "human in the loop" mechanism: actions proposed by the model could only run after the human operator approved or corrected them.

So the real shift isn't new attack techniques – it's less coordination overhead. An attacker describes a goal, and the model handles the grunt work: mapping the network, harvesting credentials, hopping from machine to machine. What's achievable still depends on the tools and permissions at hand.

The reconstructed attack, step by step

In one case, Kaspersky was able to trace the sequence in detail:

Three to four days passed between launching the agent and taking over a domain admin account. That kind of account is effectively the master key to a Windows corporate network. These timings apply only to this one incident and can't be generalized to other attacks. The first malicious commands ran in the context of the SQL Server process. That makes the database server, its service account and its connections to other systems the most important traces.

The report lists familiar techniques. For persistence on Windows, the attackers used scheduled tasks and Registry autostart entries, including a task named "SystemUpdate". On Linux, they relied on crontabs and shell startup files. They obtained credentials by accessing LSASS, the Windows process that holds login data in memory. Later came DCSync, in which an attacker impersonates a domain controller to pull password hashes (MITRE ATT&CK T1003.006), and Golden Tickets, forged Kerberos tickets that grant virtually unlimited access.

What defenders should do

aicybr.com distills six priorities from the report. The key takeaway: post-compromise behavior is well known and can be detected with existing tools.

1. Watch for suspicious database services: If sqlservr.exe spawns command shells, script interpreters or unknown programs, that's a red flag. SQL Server should run under a dedicated least-privilege account and sit in an isolated network segment.
2. Correlate persistence across system boundaries: Look at new scheduled tasks or autostart entries together with the creating process, the account and any subsequent network traffic. The name "SystemUpdate" is a useful hunting lead, but it's trivial to change.
3. Detect credential theft as a sequence: Access to LSASS, followed by dump files or Registry changes. Microsoft recommends LSA protection and Credential Guard. Where that's not possible, a Defender rule that blocks credential stealing from LSASS is an option – after testing.
4. Link SMB and WMI activity to privileged logons: Remote administration originating from a database server is suspicious if that server has no admin role. Recommended measures include separate admin accounts, tiered administration and dedicated admin workstations.
5. Monitor outbound traffic: Check unexpected HTTP/S, TCP and WebSocket connections from servers. Important: if you only look for calls to commercial AI APIs, you'll miss this attack entirely, because the model runs on the attacker's side.
6. Audit database access and exports: Compare bulk queries and exports against the server's normal workload profile.

Since the attackers paused for two weeks, you should also retain logs for several weeks. If you suspect a domain compromise, the source recommends these steps: isolate affected systems, preserve evidence, determine the extent of compromised privileges, rotate credentials in stages from a clean admin system, and rebuild compromised machines from trusted images. It also points to guidance from the US agency CISA on Active Directory compromises.

Who's behind it?

Kaspersky doesn't attribute the attacks to any known group. Scripts contained Chinese-language comments, but Kaspersky explicitly treats them as an artifact, not as proof of the perpetrators' identity. The framework is freely available, so in principle anyone can use it.

Analysis

This case shows what experts have long expected: AI agents turn well-known intrusion techniques into a faster, largely automated workflow. The techniques aren't new – the speed and minimal staffing are. One hour for lateral movement, password theft and data export leaves defenders little time to respond. For security teams, the architecture matters: the model runs on the attackers' infrastructure, and the victim machines only host an ordinary remote-control program. That's why classic detection based on processes, accounts, remote administration and data exfiltration remains the most effective lever.

What remains unclear is how much the AI actually contributed to the attack's success. A human prepared the intrusion manually and could approve or correct actions. It's also unclear how many organizations were affected in total. The fact that a publicly available framework is being used in real attacks is likely to further fuel the debate over offensive AI tools.