Kaspersky

Kaspersky documents live intrusions where an LLM on the C2 server chose the commands, reaching domain admin in 3-4 days harmfulCompany claim

• Securelist, published 2 November by Kirill Antonov, Vladislav Vlasov and Dmitry Chizhmak, calls the campaign "one of the first public descriptions of a compromise involving an LLM in the wild." It uses the open-source CyberStrikeAI framework, in which an LLM orchestrator on the command-and-control server plans actions, selects tools and generates commands, while the on-host implant has "no API keys, no calls to AI service APIs, and no autonomous logic." A human-in-the-loop mechanism means "the operator retains full control over the process".
• Confirmed victims were in the education sector in several countries across Africa and Latin America; Kaspersky does not name them or give a total count. In the incident it details, the operator entered through a compromised SQL Server 16.0.1000, worked manually for nearly a day and paused for two weeks; the agent then established persistence and ran local reconnaissance "within 2 minutes", did domain reconnaissance over the next 5 hours, and after a pause of several days performed lateral movement over SMB and WMI, mass credential dumping and a database export within no more than one hour. Kaspersky puts the whole run from agent deployment to domain-administrator compromise at 3-4 days.
• Techniques Kaspersky lists include a scheduled task named SystemUpdate and an HKCU Run value for persistence (crontab @reboot or ~/.bashrc on Linux), LSASS dumping via comsvcs.dll MiniDump, a renamed mimikatz for DCSync and Golden Ticket attacks, Impacket WMIExec for lateral movement, and LLM-generated SQL and LDAP queries for collection. Its conclusion: "AI orchestration has lowered the skill requirements for the operator" but "has not taken the attack beyond what defenders already know and are capable of detecting."
• Kaspersky says the available data does not link the activity to any known group and that it cannot confirm the same operator ran both sample sets it found. It points to Chinese-language comments in scripts, use of the dnslog[.]cn service and control-server restarts mostly in UTC+8 business hours, while stating these indicators are not an attribution. No LLM or model vendor is named in the report.