The report
Kaspersky's November 2 investigation places CyberStrikeAI inside real intrusions against educational organizations in Africa and Latin America. In one reconstructed sequence, the attacker initially worked manually through a compromised Microsoft SQL Server, left the operation dormant for roughly two weeks, and then introduced a CyberStrikeAI implant. The report documents credential access, lateral movement and database export after that deployment. It does not publish every model instruction or prove that each command was independently chosen by the model.
The change after the implant arrived
The researchers distinguish two periods. Before the implant, commands issued from sqlservr.exe were associated with an operator collecting host and network information over almost a day. After the pause, the attacker deployed a remotely controlled agent. Kaspersky reports establishment of persistence and local discovery within approximately two minutes, further Active Directory reconnaissance over about five hours, and, after another delay, an operation involving SMB or WMI movement, bulk credential dumping and database export within roughly one hour. Those are durations from one incident timeline, not performance guarantees for the framework. Primary report.
The CyberStrikeAI framework places its language-model orchestration on a remote command-and-control server. The implant on the affected machine is a conventional Go-based beacon, which polls for commands and executes them. Reconnaissance and other capabilities appear to the remote orchestrator as MCP tools. A responder looking only for calls to a public model API on the victim host could miss this design entirely.
What can be attributed
Kaspersky observed two infrastructure clusters but said their tooling alone did not establish a common operator. Chinese-language material and server timing are investigative clues, not sufficient evidence of nationality or state direction. The published telemetry documents the host commands and intrusion progression more directly than the model's private decision process. No total victim count, quantified losses or complete prompt trace was established in the report.
The key distinction for incident responders is between identifying CyberStrikeAI components and identifying which party selected an action. Endpoint processes, scheduled tasks, lateral-movement traffic, credential access and export remain observable even when the planning model runs elsewhere. Investigating their ordering can show what occurred without claiming access to the attacker's model reasoning. The underlying Case dossier tracks that evidential boundary.