Kaspersky has documented CyberStrikeAI in attacks against educational organizations in Africa and Latin America. Its November 2 research describes AI helping direct activity after attackers had already established access, rather than independently breaking into networks from scratch.
A planner on the attacker’s server
A human sets the objective. A language model on the control server chooses tools and commands, then assesses the results. The victim-side implant remains a conventional remote-control program: it executes instructions and returns output without contacting AI services itself.
In one reconstructed incident, manual activity through a compromised SQL Server preceded a two-week pause and implant deployment. Domain-administrator compromise followed within three to four days. A final sequence involving lateral movement, credential collection and database export took at most an hour; that was not the duration of the entire intrusion.
Kaspersky’s conclusion is that familiar intrusion behaviors still offer detection opportunities. Its evidence does not establish an attack that operated without human direction.
Keep the evidence in view
For Windows teams, Microsoft’s process-auditing documentation provides useful context. Event 4688 records process creation, including executable and creator information, with fields varying by event version. Command-line arguments require an additional auditing policy and are empty by default. An investigation needs to confirm what was actually collected before drawing conclusions from missing detail.
PowerShell documentation similarly describes script-block logging and event 4104. When enabled, it records processed script content, including automated activity. Microsoft recommends protected event logging because scripts can expose sensitive information in logs. These records support investigation of what executed; they do not, by themselves, prove that a model wrote the commands.
Sources: Kaspersky CyberStrikeAI research; Microsoft event 4688 reference; Microsoft PowerShell logging guide.
Image: AI-generated editorial illustration created for DaySec, not a photograph of the incident.
