Kaspersky has documented what it describes as one of the first public, in-the-wild cases in which a large language model played a central operational role in real attacks: intrusions against education organizations in Africa and Latin America, observed in September and October 2026 and detailed in a November 2 investigation on the company's Securelist blog.
The attackers used CyberStrikeAI, an open-source penetration-testing framework. Its design splits the work in two: an LLM orchestrator sitting on the attacker's command-and-control server plans actions, selects tools and generates commands, while a conventional implant carries those commands out on compromised machines. Kaspersky stresses the operation was human-directed, with the model working under operator oversight — not an autonomous AI running loose on a network.
From a database server to domain admin
In the reconstructed incident, the first malicious commands came from sqlservr.exe, and Kaspersky assesses a compromised SQL Server as the likely entry point; in one case the host ran SQL Server 16.0.1000. The intruders spent nearly a full day collecting host information, preparing tools and mapping the network, then went quiet for roughly two weeks.
When activity resumed, CyberStrikeAI took over the post-exploitation phase. Persistence via scheduled tasks and local reconnaissance followed within two minutes, with domain reconnaissance continuing over roughly five hours. After another pause of several days came the final burst: movement between machines using WMI and SMB, credential theft through LSASS memory dumping, registry hive dumping, DCSync and Golden Ticket attacks, and database export — all compressed into about an hour. Kaspersky puts the progression from implant deployment to domain-administrator compromise at three to four days.
Familiar techniques, faster hands
The techniques themselves are not new, and Kaspersky is careful to say so. The novelty is the orchestration: a model choosing the next tool, reading the result and deciding the following step, at a pace and consistency a human operator would struggle to match across a whole intrusion. The firm's detection advice follows from that — behavioral and correlation rules for remote scheduled tasks, LSASS dumping, WMI activity and LDAP reconnaissance, rather than hunting for a single exotic signature.
The report also states its limits plainly. It gives no victim count and does not quantify the records taken, and investigators observed no further activity after the data-collection stage. Build metadata linked samples into two groups, but researchers could not establish that the groups shared an operator or connect them to any known threat group.
Why schools are in the crosshairs
Education is a soft target for exactly this kind of attack. Figures cited in coverage of the report underline the strain: 51 percent of US K-12 districts reported an incident, 34 percent experienced disruption, 66 percent have one or two security staff, and 70 percent point to underfunding. Thinly staffed networks facing an orchestrated intruder have little margin for slow detection.
The case also marks a shift from the AI-assisted attacks documented just days earlier. The NIK C2 malware reported on October 29 used a victim's own OpenAI key to fund AI analysis of stolen data, and the VOLTA infostealer used a model to rank which victims were most valuable. CyberStrikeAI goes a step further: the model does the breaking in, not just the sorting afterward. For defenders, Kaspersky's message is that AI-orchestrated intrusion is no longer a laboratory demonstration — it is a technique already working in the wild.
