Kaspersky Threat Research has uncovered attacks on educational organizations in Latin America and Africa in which attackers used artificial intelligence to help direct activity inside compromised networks. Researchers traced reconnaissance, credential theft, movement between computers and data collection, including activity that compromised highly privileged administrator accounts.
The attackers used CyberStrikeAI, an open-source penetration-testing framework that combines a command-and-control system with a large language model. In this architecture, a human operator sets objectives, while the model can select tools, generate commands and analyze execution results. An implant installed on the compromised machine executes those commands and returns the results to the attackers’ server. Kaspersky observed the attacks between September and October 2026.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- AI aids nation-state hackers but also helps US spies to find them, says NSA cyber director
January 9, 2024
Nation state-backed hackers and criminals are using generative AI in their cyberattacks, but U.S. intelligence is also using artificial intelligence technologies to find malicious activity, according to a senior U.S. National Security Agency official. “We already see criminal and nation state elements utilizing AI. They’re all subscribed to the big name companies that you would expect ...
- Kenya Airways suffers passenger data breach in cyber attack
January 9, 2024
Cybercriminals attacked Kenya Airways’ (KQ) information systems and obtained sensitive information, including contact details and identification documents, of passengers and staff of the airline, an authoritative source at KQ has confirmed. The cyber attack, which occurred late last month, led to unauthorised access to police investigation reports, phone numbers, email addresses, and passports of an unspecified ...
- Deceptive Cracked Software Spreads Lumma Variant on YouTube
January 8, 2024
FortiGuard Labs recently discovered a threat group using YouTube channels to distribute a Lumma Stealer variant. We found and reported on a similar attack method via YouTube in March 2023. These YouTube videos typically feature content related to cracked applications, presenting users with similar installation guides and incorporating malicious URLs often shortened using services like TinyURL ...
- Hundreds of museums hit by cyber attack
January 8, 2024
Hundreds of art institutions and museums have been affected by a cyber attack on the Gallery Systems software company, with those impacted having used the software to organise their online archives. Last month, Gallery Systems informed its clients that computers using its software had become encrypted and could no longer operate. They launched an investigation, enlisted ...
- Lebanon: Beirut airport screens come under cyberattack
January 8, 2024
Beirut airport on Sunday came under a cyberattack, Lebanon’s state news agency said, with footage shared by local media showing anti-Hezbollah messages had replaced screen displays at its terminal. Lebanon’s National News Agency said “the cyberattack on the departure and arrival screens at the airport disrupted the BHS baggage inspection system.” It added that authorities were ...
- Explained: SMTP smuggling
January 7, 2024
SMTP smuggling is a technique that allows an attacker to send an email from pretty much any address they like. The intended goal is email spoofing—sending emails with false sender addresses. Email spoofing allows criminals to make malicious emails more believable. Let’s take a closer look at what it is exactly, and how cybercriminals can use ...