Blog

Cybercriminals are increasingly using artificial intelligence to coordinate cyberattacks, with educational institutions in Africa and Latin America being among the targets, according to the new findings by cybersecurity firm Kaspersky.

The attacks involve the use of AI powered penetration testing frameworks known as CyberStrikeAI, which enabled attackers to automate and coordinate several stages of their operations, including network reconnaissance, credential theft, movement across compromised systems and data collection.

Kaspersky Threat Research identified the activity between September and October 2026, documenting incidents in which attackers gained access to highly privileged administrator accounts within affected organisations.

CyberStrikeAI is an open-source framework that combines a command-and-control infrastructure with a large language model (LLM). It allows human operators to set attack objectives while the AI model selects appropriate tools, generates commands and analyses the results to determine subsequent actions.

In one reconstructed case, the attackers first broke into a compromised SQL server and collected information manually before installing the tools they needed for their operation. They sat idle for two weeks, and then used the CyberStrikeAI implant to resume the intrusion.

Following deployment, the attack escalated quickly, with attackers gaining control of domain administrator accounts in three to four days. The final stage, which involved moving between computers, collecting credentials and exporting database information, was completed in less than an hour.

Despite the use of artificial intelligence, the technology did not operate directly on the victims’ computers. Instead, the AI model ran on the attackers’ server, while the implant installed on compromised machines executed commands and transmitted the results back to the command-and-control infrastructure.

Kaspersky said its security solutions detected several malicious activities during the investigations, including credential dumping, the creation of malicious scheduled tasks and suspicious network queries used to map compromised domains.

Its Endpoint Detection and Response Expert solution identified malicious behaviour on affected devices, while its network detection capabilities helped uncover CyberStrikeAI command-and-control communications.

The identified implants were classified as HEUR:HackTool.Win64.CyberStrike.gen and HEUR:HackTool.Linux.CyberStrike.gen.

“The attackers used an AI agent based on CyberStrikeAI to carry out a full attack chain and adapt their next steps within compromised networks. However, the framework still relied on familiar techniques and procedures, including discovery, credential dumping, lateral movement, and collection and exfiltration. AI changes how attackers coordinate intrusions and the speed at which they operate, but well-configured security tools such as Kaspersky EDR can still detect and help stop the techniques they use,” said Nikita Nazarov, head of Threat Exploration at Kaspersky.

Researchers also discovered Chinese-language comments within some of the scripts used during the attacks. However, Kaspersky cautioned that these findings were insufficient to establish the attackers’ identities, geographical location or affiliation with a known cybercriminal group.

The incidents highlight the growing role of artificial intelligence in cybercrime, particularly its potential to help attackers coordinate complex operations and reduce the time needed to move through compromised networks.

Kaspersky recommends that educational institutions and other organizations implement endpoint detection and response solutions to improve defenses, detect suspicious activity, monitor network communications and attempts to access sensitive credentials.

The company also recommends organizations integrate threat intelligence into security investigations, and continue to monitor, especially outside normal working hours. Where internal security teams are not able to provide 24/7 coverage, managed detection and response services can help to detect and respond to threats before they become a problem.

Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.

Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to info@techtrendsmedia.co.ke