Hackers Use CyberStrikeAI Agents to Automate Windows Domain Takeovers and Credential Theft

Hackers are now using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains.

Education organizations in Africa and Latin America were among the confirmed victims. The tool lets a language model decide which commands to run, so the operator no longer types each step by hand.

CyberStrikeAI is an open-source, Go-based platform built for penetration testing. Criminals have already turned it toward real targets, and earlier reports showed how attackers targeted Fortinet FortiGate devices with the same framework.

This new campaign shows the tool being used for something bigger: moving from a single weak server to full control of a network.

Analysts at Securelist identified the campaign during routine threat monitoring. They described it as one of the first public cases of a language model being used inside a live intrusion.

The human operator sets a broad goal, and the AI model on the control server picks the tools, writes the commands, and reads the results. The malware on the victim machine is a plain implant with no AI inside it.

Hackers Use CyberStrikeAI Agents

The intrusion began with a person. The operator got into a compromised SQL Server, collected basic host details, dropped tools, and scanned the network. That took almost a day, and then the attackers went quiet for about two weeks.

When they came back, the CyberStrikeAI agent took over. Within two minutes it set up persistence through a scheduled task named SystemUpdate and finished local checks. Over the next five hours it mapped the domain using PowerShell and LDAP queries.

It also collected data needed for Kerberoasting and AS-REP Roasting, two methods for cracking account passwords. Other reports show how attackers coordinate 44 AI agents with this same platform, which suggests the approach is spreading.

After a short pause of a few days, the final phase ran in under an hour. The agent moved sideways through SMB and WMI, dumped credentials from many machines, and exported database content.

It pulled passwords from registry files and from the LSASS process using the comsvcs.dll MiniDump function. After it compromised the built-in domain administrator, it ran DCSync and Golden Ticket techniques with a renamed Mimikatz tool.

The whole job, from agent install to domain admin, took only three to four days. The attackers tried to stay hidden. They encoded commands in Base64, split scripts into several files, and rebuilt them with certutil.

They also named one beacon svchosts.exe so it looked like a normal Windows process. Some scripts contained Chinese comments, and the attackers used the Chinese service dnslog.cn to find victim IP addresses.

Server restarts mostly fell within UTC+8 business hours. Together these clues suggest a Chinese-speaking operator, but Securelist could not link the activity to any known group.

Why Defenders Can Still Catch It

The methods themselves are not new. The agent used well-known tools, and the AI mainly made the work faster and easier. Because the model runs on the attacker’s server, defenders will not see AI traffic or odd resource use inside their network. They will see the same actions a human intruder would take.

That means ordinary detection rules still work. Teams should watch for remote scheduled tasks created with schtasks.exe, LSASS memory access, and WMI or WinRM commands from unusual hosts.

A DCSync attack steals password hashes by posing as a domain controller. Event ID 4662 helps catch it when the request comes from a system that is not a real domain controller. Rotating the krbtgt account twice after any domain admin compromise cancels forged Golden Tickets.

Defenders should also check for commands running from the sqlservr.exe process, since that was the likely way in. They should patch and lock down exposed SQL Servers and turn on LAPS.

They should also limit replication rights and keep logs for process launches, PowerShell activity, and logons. Microsoft recently described AI agents targeting Microsoft 365 tenants, so cloud accounts linked to the domain need the same care.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.