Kaspersky: AI agent took a school network from implant to domain admin in 3 to 4 days

Kaspersky's Threat Research team says attackers have used an open-source tool called CyberStrikeAI, which puts a large language model in charge of a hacking toolkit, against education organizations in several countries in Africa and Latin America. In a report on Securelist dated November 2, 2026, the company reconstructs one intrusion in which the agent went from first deployment to domain-administrator accounts in three to four days.

The headline is easy to over-read, so here is what the report does and does not say.

What the tool is

Kaspersky describes CyberStrikeAI as a modular, open-source penetration-testing platform written in Go. It combines LLM-driven orchestration with a built-in command-and-control (C2) server and agents in one server process. A human operator sets the objective. The model picks tools, writes commands and reads the results.

The key design point: the AI runs on the attacker's server, not on the victim's machines. Per Kaspersky, the implant on a compromised host is a conventional remote-control tool. It contains no AI model or API keys and makes no direct calls to AI services. The framework also has a human-in-the-loop mode in which the operator can approve or correct commands. Kaspersky's press release says its team observed the activity between September and October 2026.

The intrusion, step by step

Kaspersky walks through one incident in detail. The first malicious commands ran from the sqlservr.exe process on a compromised SQL Server (version 16.0.1000), which the researchers read as the likely way in. The report does not say how the server was compromised.

• Manual phase: nearly a day of hands-on activity by the operator, covering host information, tool deployment and network reconnaissance. Then a pause of about two weeks.
• Agent phase: persistence and local reconnaissance within 2 minutes of the implant starting, then domain reconnaissance over the next 5 hours.
• Pause: several days.
• Final sweep: lateral movement, mass credential dumping and database export, all within no more than an hour.

From agent deployment to compromised domain administrator accounts: three to four days. The techniques Kaspersky lists are standard Windows tradecraft: scheduled tasks running as SYSTEM, Base64-encoded PowerShell, dumping the LSASS process through comsvcs.dll, copying registry hives, Kerberoasting preparation, and a renamed Mimikatz used for DCSync and Golden Ticket attacks. Movement between machines used WMI, SMB and Impacket's WMIExec.

What is new, and what is not

Kaspersky's own conclusion is modest. Nikita Nazarov, head of Threat Exploration at the company, said that well-configured security tools "can still detect and help stop the techniques they use," and that AI changes how attackers coordinate intrusions and how fast they work, while the framework still relies on familiar steps: discovery, credential dumping, lateral movement and exfiltration. Help Net Security quotes Kaspersky as saying the AI "does not yet present fundamentally new challenges for detection," because the compromised host still sees known techniques.

That matters for how you read the three-to-four-day figure. It is a measure of one incident, and the report says the agent paused for days between bursts. It is not proof that AI makes intrusions instant, and Kaspersky does not give a count of victims or a comparison with how long human operators typically take.

A secondary write-up by Cyber Press uses far more dramatic framing than Kaspersky's stated conclusion; we relied on Kaspersky's own report and press release for every claim here.

Who is behind it

Kaspersky does not tie the activity to a known group. It points to Chinese-language comments in scripts, use of the Chinese service dnslog[.]cn, and C2 server restarts mostly during UTC+8 business hours, which suggest a Chinese-speaking operator. The company stresses that this is not conclusive. It also found the implant samples fall into two build groups that share no infrastructure, and says it could not confirm that a single operator controlled everything.

The same week, Help Net Security reported separately on CrowdStrike research into a China-nexus group it tracks as Vapor Panda, which began using a different agentic framework, ARTEX, on October 17. Per that coverage, one controller was used against organizations in at least 14 countries within 11 days. We have not independently reviewed CrowdStrike's primary report, and Kaspersky's work does not appear to be connected to it. For more on how security vendors are responding to AI agents, see our earlier story on CrowdStrike's AI kill switch.

What owners and IT leads can take from it

Schools and universities hold student records and payment data on aging, often under-staffed networks, and a small business running its own SQL Server shares the same exposure. Kaspersky's guidance is plain, and none of it requires new products:

• Treat a database server that spawns a shell as an alarm. Kaspersky calls this the key sign of the initial access it saw.
• Watch for the known steps: schtasks.exe run against remote machines, comsvcs.dll MiniDump calls, suspicious LSASS access, and remote execution over WinRM and WMI.
• Collect the logs that show them, including Windows event IDs 4688, 4104, 4624, 4768, 4769, 4662, 4663, 4656 and 5145.
• Cover nights and weekends. The company's press release recommends round-the-clock monitoring, for example through a managed detection service, if a team cannot staff it. A pause of days followed by a one-hour sweep is exactly the pattern a nine-to-five team can miss.

The report includes indicators of compromise, among them two C2 addresses and several domains, plus hashes and file names. Kaspersky's detections are named HEUR:HackTool.Win64.CyberStrike.gen and HEUR:HackTool.Linux.CyberStrike.gen, and its network product flags the C2 traffic as Backdoor.CyberStrikeAI.HTTP.C&C. Because the AI sits outside the victim network, defenders may see none of the model traffic, so detection has to rest on what the hosts themselves do.

Sources: Kaspersky Securelist report (Nov. 2, 2026); Kaspersky press release (Nov. 2, 2026); Help Net Security (Nov. 3, 2026); Cyber Press. All timings are Kaspersky's. This is information, not investment advice.