November 3, 2026
- Kaspersky documented the CyberStrikeAI framework in the wild against education-sector organizations in Africa and Latin America — an LLM orchestrator on the C2 plans actions and generates commands while a Go implant executes them, taking attackers from recon to full domain compromise in roughly three to four days (Securelist). The practical takeaway for defenders: the implant itself is not AI-driven, so classic behavioral detections and C2 indicators still work. Attribution is supported by Go build metadata — Windows and Linux samples share identical build info, splitting the set into two groups — and by per-C2 implant tokens embedded at build time that double as network indicators. · AI-Assisted Intrusions
in Agent-Driven Intrusions Get Named Operators, and a Kernel Bug Gets Mass-Scanned