Case cyberstrikeai-attacks-edu-institutionsAI-assisted malwareWorldwide
CyberStrikeAI framework automates post-exploitation in attacks on educational institutions
Kaspersky analysed intrusions between September and October against educational institutions in several African and Latin American countries. The attackers broke in through a compromised SQL Server and then used the open-source CyberStrikeAI framework, whose server-side LLM plans and generates the commands that the implant executes. In one case, domain admin was reached within three to four days of agent deployment. Kaspersky did not link the activity to a known group but points to a Chinese-speaking operator.
MediumAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Nov 2, 2026
- Location
- Worldwide
- Target
- Educational institutions in Africa and Latin America
- Severity
- Medium
- Verification
- Reported by credible press or researchers
- Triggered by
- Unattributed; Chinese-speaking operator per Kaspersky indicators
- Actor type
- Unknown
- Sector
- Education & research
- Reported loss
- None reported
- CVE
- None
What happened
Kaspersky analysed intrusions between September and October against educational institutions in several African and Latin American countries. The attackers broke in through a compromised SQL Server and then used the open-source CyberStrikeAI framework, whose server-side LLM plans and generates the commands that the implant executes. In one case, domain admin was reached within three to four days of agent deployment. Kaspersky did not link the activity to a known group but points to a Chinese-speaking operator.
Impact: Several educational institutions were attacked; the number of victims and data affected are Unknown.
Who triggered it
Actor: Unattributed; Chinese-speaking operator per Kaspersky indicators
Attribution: Kaspersky Securelist analysis; the attacker is not named in the summary.
Motive: Unknown
How it happened
Attack vector: CyberStrikeAI penetration testing framework automating the post-exploitation phase.
Root cause: A legitimate AI-driven pentesting framework was used in real attacks; how initial access was gained is Unknown.
Timeline
- Reported by Kaspersky Securelist
Response
Kaspersky published its analysis; no victim response is reported.
Current status: Under investigation
Research warnings this case matches
- Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS
- Seen in real incidents Criminals and state hackers use AI in cyberattacks · International AI Safety Report
- Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- Kaspersky Securelist securelist.com
- Help Net Security helpnetsecurity.com
- Kaspersky Securelist securelist.com
Cite this case
CyberStrikeAI framework automates post-exploitation in attacks on educational institutions. AI Threat Watch, case cyberstrikeai-attacks-edu-institutions, Nov 2, 2026. https://aithreat.io/cases/cyberstrikeai-attacks-edu-institutions/
Permanent link: https://aithreat.io/cases/cyberstrikeai-attacks-edu-institutions/
Related cases
The same type of incident, most recent first.