Kaspersky researchers have discovered cyberattacks utilizing CyberStrikeAI to compromise Active Directory environments, steal credentials, and gather databases This article explores compromised systems cyberstrikeai. . These findings reveal how attackers are advancing artificial intelligence beyond mere preparation, integrating it into direct control of compromised systems.
CyberStrikeAI Enables Credential Theft In a recently investigated incident, attackers first exploited a compromised SQL Server running version 16.0.1000. The operator meticulously gathered system details, deployed tools, and probed the network for nearly a day before taking a two-week break.
Generated PowerShell scripts and LDAP queries mapped Active Directory, identified privileged accounts, and collected information for Kerberoasting and AS-REP Roasting. CyberStrikeAI Facilitates Credential Theft (Source: securelist) After compromising privileged domain accounts, attackers employed renamed Mimikatz tools for DCSync and Golden Ticket attacks. Files were moved via the implant's encrypted control channel, containing Base64-encoded content encapsulated within JSON responses.
Since AI operated outside the victim's network, defenders might not detect AI service connections or unusual local model activity, as securelist suggested.
Indicators of Compromise Category Indicator Description C2 IP address 185.186.245[. ]144 Command-and-control server for the Windows beacon Reverse-shell endpoint 185.186.245[. ]144:5501 Connection destination used by the PowerShell reverse shell Join 16,000+ SOC teams using ANY.RUN to enhance threat investigations and streamline your team's workload.
