Kaspersky Threat Research has uncovered attacks on educational organizations in Latin America and Africa in which attackers used artificial intelligence to help direct activity inside compromised networks. Researchers traced reconnaissance, credential theft, movement between computers and data collection, including activity that compromised highly privileged administrator accounts.
The attackers used CyberStrikeAI, an open-source penetration-testing framework that combines a command-and-control system with a large language model. In this architecture, a human operator sets objectives, while the model can select tools, generate commands and analyze execution results. An implant installed on the compromised machine executes those commands and returns the results to the attackers’ server. Kaspersky observed the attacks between September and October 2026.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Malicious meeting invite fix targets Mac users
March 1, 2024
Cybercriminals are targeting Mac users interested in cryptocurrency opportunities with fake calendar invites. During the attacks the criminals will send a link supposedly to add a meeting to the target’s calendar. In reality the link runs a script to install Mac malware on the target’s machine. Cybersecurity expert Brian Krebs investigated and flagged the issue. Scammers, impersonating ...
- Hackers stole ‘sensitive’ data from Taiwan telecom giant
March 1, 2024
Hackers stole “sensitive information” including military and government documents from Taiwan’s largest telecom company and sold it on the dark web, the island’s ministry of national defence has said. The confirmation of the democratic island’s latest major data leak followed a report by local news channel TVBS on the hack of telecom giant Chunghwa Telecom. Read more… Source: ...
- #StopRansomware: Phobos Ransomware
February 29, 2024
The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint CSA, to disseminate known TTPs and IOCs associated with the Phobos ransomware variants observed as recently as February 2024, according to open source reporting. Phobos is structured as a ransomware-as-a-service ...
- Golden Corral Corporation Provides Notice of Data Privacy Event
February 29, 2024
Golden Corral Corporation is notifying certain individuals of a recent incident that may impact the privacy of past and present employees, dependents, and beneficiary personal information. Golden Corral is unaware of any misuse of the information and is providing notice to potentially affected individuals out of an abundance of caution. On or about August 15, 2023, ...
- Ireland: Dept of Foreign Affairs investigating potential cybersecurity incident
February 29, 2024
The Department of Foreign Affairs (DFA) has said that it is investigating a potential cybersecurity incident involving its systems. The DFA said that it was notified by Ireland’s National Cyber Security Centre (NCSC) yesterday about the possible security breach and is working closely with the NCSC to establish whether this allegation is authentic. It follows reports ...
- Cyber attack affects numerous services at most Nebraska state hospital
February 29, 2024
The Nebraska Hospital Association said most state hospitals were affected by a cyber attack. The NHA said Change Health Care was hit with the attack on Feb. 21. The technology company assists with things like prior authorizations, insurance verification and patient billing. All of those services are affected. Read more… Source: MSN News