CyberStrikeAI used in Windows domain takeovers, Cyber Security News reports

What happened

Cyber Security News reports that Securelist analysts identified a campaign in which attackers used CyberStrikeAI to take over Windows domains and steal credentials. The outlet describes CyberStrikeAI as an open-source, Go-based penetration testing platform. It says that education organizations in Africa and Latin America were among the victims, but it does not name them. No other outlet in our sources has independently verified the report. The original Securelist publication was not among the sources we reviewed.

According to Cyber Security News, the intrusion unfolded in three phases:

• Manual initial access: a human operator got into a compromised SQL Server, collected host details, dropped tools and scanned the network. The outlet says the attackers then went quiet for about two weeks.
• Automated phase: the CyberStrikeAI agent created persistence through a scheduled task named SystemUpdate. It then spent about five hours mapping the domain with PowerShell and LDAP queries. It also collected data for Kerberoasting and AS-REP Roasting.
• Final phase, in under an hour: the agent moved laterally over SMB and WMI. It dumped credentials from the registry and from LSASS using the comsvcs.dll MiniDump function, and exported database content. After compromising the built-in domain administrator, it ran DCSync and Golden Ticket techniques with a renamed Mimikatz.

The outlet says the whole process, from agent install to domain admin, took three to four days. It also says the language model runs on the attacker’s control server, and the implant on victim machines contains no AI.

The report says the attackers took these steps to avoid detection:

• They encoded commands in Base64.
• They split scripts across several files and rebuilt them with certutil.
• They named a beacon svchosts.exe.

According to the report, several clues suggest a Chinese-speaking operator:

• Some scripts contained Chinese comments.
• The attackers used the Chinese service dnslog.cn to find victim IP addresses.
• Server restarts mostly fell within UTC+8 business hours.

The outlet says Securelist could not link the activity to any known group.

Am I affected?

The sources do not confirm the full list of victims, the specific SQL Server weakness used for entry, or the volume of data taken. According to Cyber Security News, the likely entry point was an exposed SQL Server.

The outlet published these indicators of compromise:

What to do now

Steps 1 and 3 to 7 are the defensive measures listed by Cyber Security News. Step 2 uses the indicators and task name the outlet reported.

1. Look for commands running from the sqlservr.exe process. Patch and lock down exposed SQL Servers.
2. Search your environment for the hashes, IPs and domains above, and for a scheduled task named SystemUpdate.
3. Alert on the following activity:
   • remote scheduled tasks created with schtasks.exe
   • LSASS memory access
   • WMI or WinRM commands from unusual hosts
4. Watch Event ID 4662 for replication requests from systems that are not domain controllers, which can indicate DCSync.
5. If a domain admin account was compromised, rotate the krbtgt account twice to invalidate forged Golden Tickets.
6. Turn on LAPS and limit replication rights.
7. Keep logs for process launches, PowerShell activity and logons. Apply the same care to cloud accounts linked to the domain.

Sources

• Cyber Security News: Hackers Use CyberStrikeAI Agents to Automate Windows Domain Takeovers and Credential Theft