{"id":382847,"date":"2026-11-02T01:52:00","date_gmt":"2026-11-02T09:52:00","guid":{"rendered":"https:\/\/cms-articles.softonic.io\/en\/?p=382847"},"modified":"2026-11-02T01:52:10","modified_gmt":"2026-11-02T09:52:10","slug":"cyberstrikeai-hits-schools-kaspersky-details-llm-led-intrusions","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/cyberstrikeai-hits-schools-kaspersky-details-llm-led-intrusions\/","title":{"rendered":"CyberStrikeAI hits schools: Kaspersky details LLM-led intrusions"},"content":{"rendered":"

Kaspersky has a new report out on intrusions aimed at education organizations in Africa and Latin America, and it includes confirmed victims from what looks like one of the first public, in-the-wild cases where a large language model had a central operational role<\/strong>.<\/p>\n

\r\n
\r\n
\r\n
\r\n \"Kaspersky\r\n <\/div>\r\n
\r\n Kaspersky Anti-Virus<\/span>\r\n Download<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n\n\n

The attackers, Kaspersky says, used the open-source CyberStrikeAI framework. It splits the work between a server-side orchestrator and an implant. The model plans actions, chooses tools, and generates commands; the implant carries them out. That setup lets operators set broad goals<\/strong> instead of typing every step by hand, and it helps move an attack from reconnaissance to full domain compromise.<\/p>\n\n

In one case described in the report, the initial access point was a compromised Microsoft SQL Server 16.0.1000<\/strong> host. The intruders spent nearly a full day collecting host data, deploying tools, and mapping the network. Then they went quiet for roughly two weeks. When activity picked back up, CyberStrikeAI was used for discovery, persistence, lateral movement, and data exfiltration.<\/p>\n\n

If you follow AI-driven threats<\/a> or security in education, this is a report worth reading. Schools remain attractive targets because they hold student records, financial data, credentials, and research. Kaspersky cites figures showing that 51%<\/strong> of U.S. K-12 districts reported an incident, 34% experienced disruption, 66% have one or two security staff, and 70% point to underfunding. At the college level, ransomware cases rose 8%, with a median demand of $420,620 and an average recovery cost of $2.26 million.<\/p>\n\n

The full report is available from Kaspersky. Its recommendations are familiar, but still practical: phishing-resistant MFA, tighter identity controls, and network limits that make lateral movement harder.<\/p>\n

\r\n
\r\n
\r\n
\r\n \"Malwarebytes\r\n <\/div>\r\n
\r\n Malwarebytes Anti-Malware<\/span>\r\n Download<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"

Kaspersky has a new report out on intrusions aimed at education organizations in Africa and Latin America, and it includes confirmed victims from what looks like one of the first public, in-the-wild cases where a large language model had a central operational role. The attackers, Kaspersky says, used the open-source CyberStrikeAI framework. It splits the … Continue reading “CyberStrikeAI hits schools: Kaspersky details LLM-led intrusions”<\/span><\/a><\/p>\n","protected":false},"author":9349,"featured_media":382846,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[6771],"class_list":["post-382847","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","content-category-ai"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t