Date: 11/03/2026
Severity: High
Summary
Researchers identified CyberStrikeAI, an open-source LLM-orchestrated Command-and-Control (C2) framework, being abused in attacks against educational organizations across Africa and Latin America. The framework uses a server-side AI model to automate post-exploitation, reconnaissance, persistence, credential dumping, and lateral movement, while implants execute generated commands on compromised systems. The campaign leveraged compromised SQL Server infrastructure and techniques such as PowerShell execution, SMB/WMI lateral movement, Kerberoasting, LSASS credential dumping, and database exfiltration. The findings highlight the growing use of AI-driven attack orchestration to accelerate enterprise network compromise and domain takeover.
Indicators of Compromise (IOC) List
Domains/URLs | fastcdn.bar media.fastcdn.bar |
IP Address | 104.234.26.163 185.186.245.144 |
Hash | 09e1da2afa1216ecc55648ec8e122d2a
0BBD08AF95F877F1D568B03DE2EB76B4
2770562d104391b92b42671c270079bb
29EFD64DD3C7FE1E2B022B7AD73A1BA5
74F57B3E897A4960DCDD5B7E8A54F9DF
805B9E4AE74C903787416800999B8418
D726A8B4886C636F76CA6D30EF6A6FF4
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "media.fastcdn.bar" or url like "media.fastcdn.bar" or siteurl like "media.fastcdn.bar" or domainname like "fastcdn.bar" or url like "fastcdn.bar" or siteurl like "fastcdn.bar" |
Detection Query 2 : | dstipaddress IN ("104.234.26.163","185.186.245.144") or srcipaddress IN ("104.234.26.163","185.186.245.144") |
Detection Query 3 : | md5hash IN ("D726A8B4886C636F76CA6D30EF6A6FF4","0BBD08AF95F877F1D568B03DE2EB76B4","09e1da2afa1216ecc55648ec8e122d2a","74F57B3E897A4960DCDD5B7E8A54F9DF","29EFD64DD3C7FE1E2B022B7AD73A1BA5","805B9E4AE74C903787416800999B8418","2770562d104391b92b42671c270079bb")
|
Reference:
AI-Driven CyberStrikeAI C2 Attacks