Kaspersky calls this one of the first public cases of an LLM running an intrusion in the wild. The framework, CyberStrik...

Kaspersky calls this one of the first public cases of an LLM running an intrusion in the wild. The framework, CyberStrikeAI, is an open-source Go toolkit. The model sits on the attacker's server and picks the commands. The implant on the victim's machine just executes them.Victims were education networks in Africa and Latin America, taken to domain admin in 3 to 4 days. On the host, everything was familiar. Kerberoasting, LSASS dumps, DCSync, Golden Ticket. Ordinary EDR rules catch all of it. AI has changed the tempo of intrusion. The techniques are ones defenders already know.https://securelist.com/tr/cyberstrikeai-attacks/121715/#InfoSec #CyberSecurity #AI #ThreatDetection