# CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations

Attackers used a compromised SQL Server as initial access, then an LLM-orchestrated CyberStrikeAI C2 agent to reach full domain compromise at education-sector victims.

- Payout: Real-world hack
- Severity: critical
- Program: Education sector
- Analysis by: Kirill Antonov, Vladislav Vlasov, Dmitry Chizhmak
- Disclosed: 2026-11-02
- Write-up quality: 7/10
- Original: https://securelist.com/tr/cyberstrikeai-attacks/121715/
- Library page: https://bugbountylibrary.com/r/blog%3Asecurelist-com-tr-cyberstrikeai-attacks-121715
- Tags: area:cloud domain:infra impact:data-leak impact:privesc impact:rce kind:incident platform:threat-intel sev:critical tech:llm tech:windows technique:source-review vuln:misconfiguration vuln:privilege-escalation vuln:rce

**Target:** SQL Server host and Active Directory domain
**Root cause:** Initial code execution originated from the sqlservr.exe process on a compromised SQL Server 16.0.1000, giving the operator a foothold to deploy the CyberStrikeAI agent and escalate.
**Steps:**
1. Gain access via compromised SQL Server (16.0.1000); commands execute in `sqlservr.exe` context
2. Manually collect host info, check internet via `dnslog[.]cn` resolution, run `net.exe` recon of remote hosts
3. Check for existing agent in `C:\Windows\Temp\`, `C:\Windows\`, `C:\ProgramData\`, `C:\Temp\` via PowerShell
4. Deliver agent disguised as `svchosts.exe`; execute via Base64-encoded PowerShell
5. Establish persistence: scheduled task `SystemUpdate` or `HKCU\...\Run` value; Linux via `@reboot` crontab or `~/.bashrc`
6. Local/domain discovery: PowerShell host sweep, LDAP queries for Kerberoasting/AS-REP, LAPS and Azure checks
7. Credential access: `reg.exe` hive dumps, `comsvcs.dll` MiniDump of lsass by PID, renamed mimikatz for DCSync/Golden Ticket
8. Lateral movement via Impacket WMIExec, SMB shares, and WMI protocol including `Invoke-CimMethod`, distributing `p1.ps1` reverse shell to `185.186.245[.]144:5501`
9. Collection/exfiltration: PowerShell SQL queries, recursive file scan, Base64 file transfer over C2 channel, screenshots
**How found:** Kaspersky proactive threat monitoring; analysts reconstructed the chain from process ancestry (commands originating from sqlservr.exe), implant build metadata (Go VCS info, vcs.modified=true), self-signed TLS cert not_before restart times, and the fixed `X-Implant-Token` header.
**Exploitation:** Operator used SQL Server access for initial code execution, then deployed the CyberStrikeAI implant which polled the C2 server; a server-side LLM orchestrator selected tools and generated commands (MCP tools) executed by the implant, driving persistence, discovery, credential dumping, lateral movement and DB export to full domain admin compromise within 3-4 days.
**Escalation:** Chained domain recon (Kerberoasting/AS-REP) into LSASS dumps, DCSync and Golden Ticket with renamed mimikatz to obtain domain administrator and mass-dump hosts.
**Insight:** Go implant build metadata (go version -m VCS hash/commit time/vcs.modified) and per-server fixed auth headers like `X-Implant-Token` are strong fingerprints for clustering C2 samples and reconstructing operator infrastructure even when the LLM varies commands.