How Hackers Are Using AI Frameworks to Accelerate Cyberattacks

Cybercriminals are increasingly adopting artificial intelligence to coordinate complex cyberattacks, according to new research from cybersecurity firm Kaspersky. The findings reveal that attackers are using AI-powered penetration testing frameworks to automate multiple stages of network intrusion, drastically shortening the time required to compromise high-level administrative accounts.

For Kenyan businesses operating custom web applications, client portals, and internal enterprise systems, this development highlights the growing need for proactive security measures. As threat actors leverage machine learning to move faster through compromised networks, traditional, manual approaches to monitoring IT infrastructure are no longer sufficient.

• Attackers are utilising open-source AI frameworks known as CyberStrikeAI to automate network reconnaissance, credential theft, and lateral movement.
• In documented cases, the use of AI tools allowed intruders to escalate access and control domain administrator accounts in just three to four days.
• The AI models operate on the attackers' own servers while lightweight implants execute commands on compromised machines, making detection more challenging.
• Experts recommend implementing endpoint detection and response (EDR) solutions and continuous monitoring to catch suspicious activity before damage occurs.

What Happened

Between September and October 2026, Kaspersky Threat Research identified cyberattacks targeting educational institutions in Africa and Latin America that relied on automated artificial intelligence tools. The attacks centred on an open-source framework called CyberStrikeAI, which combines a command-and-control infrastructure with a large language model.

Rather than writing individual scripts for every phase of a breach, human operators set high-level objectives. The AI model then selects appropriate tools, generates specific commands, and analyses the results to determine the next steps in the intrusion chain. In one reconstructed case, after initial manual access to an SQL server, the deployment of the CyberStrikeAI implant allowed intruders to escalate privileges rapidly and complete data collection and exfiltration tasks in less than an hour.

What Is Confirmed and What Is Not Yet Known

Kaspersky confirmed that the AI models do not run directly on victim machines, but rather execute from the attackers' servers via specific implants classified as HEUR:HackTool.Win64.CyberStrike.gen and HEUR:HackTool.Linux.CyberStrike.gen. Security tools successfully detected credential dumping, malicious scheduled tasks, and abnormal network queries used for domain mapping.

However, several details remain unconfirmed. Although researchers discovered Chinese-language comments within some of the scripts utilised during the operations, Kaspersky cautioned that this evidence is insufficient to determine the definitive geographical location, identity, or sponsorship of the threat actors involved.

Why It Matters for Custom Business Systems

As organisations digitise their operations by deploying custom web applications, customer relationship management databases, and automated payment workflows, they expand their digital footprint. When attackers use automated AI frameworks to accelerate discovery and credential theft, any vulnerability in a company's software stack can be exploited much faster than human defenders can typically respond.

Custom software systems often hold sensitive data, from customer records to financial transaction logs. If an unauthorised user gains privileged access, automated tools can map the internal network and extract database information within minutes. This shifts the priority from simple perimeter defence to rapid detection and containment inside the network.

Aspect	Traditional Attack Method	AI-Assisted Attack (CyberStrikeAI)
Coordination	Manual execution of commands at each stage.	Automated decision-making based on AI analysis.
Speed	Gradual progression over weeks or months.	Privileged access escalation achieved in 3 to 4 days.
Infrastructure	Operators manually script tools for each target environment.	LLM selects and deploys tools dynamically based on output results.

What It Means for Kenyan Businesses

Businesses in Kenya are increasingly moving away from off-the-shelf software towards bespoke digital systems that integrate local payment channels like M-Pesa alongside internal operations. While these custom platforms improve operational efficiency, they also represent high-value targets for attackers seeking customer databases or financial records.

Local organisations often operate with leaner IT teams, sometimes lacking round-the-clock security monitoring. Because AI-driven attacks can execute critical phases of an intrusion outside normal working hours or in a matter of hours once inside, relying solely on daytime observation leaves systems exposed during evenings and weekends.

Our Analysis

The emergence of frameworks like CyberStrikeAI demonstrates that the barrier to executing sophisticated cyberattacks is lowering. Attackers no longer need large, highly specialised teams to coordinate multi-stage intrusions; generative technology can handle the tactical adjustments between network reconnaissance and lateral movement.

A common mistake among growing companies is assuming that security stops at a basic firewall or an SSL certificate on a public-facing website. The Kaspersky findings show that breaches often begin through a compromised server or database, after which automated tools move inward. Security must therefore be treated as an architectural requirement across all custom web applications and databases, rather than an afterthought added once the system is live.

Practical Next Steps for Business Owners

1. Audit your current digital architecture to ensure all custom web applications, client portals, and databases have restricted access permissions based strictly on user roles.
2. Deploy endpoint detection and response (EDR) solutions rather than relying only on traditional antivirus software, ensuring suspicious network queries and credential dumping attempts are flagged immediately.
3. Establish monitoring protocols that cover periods outside normal working hours, or partner with managed security providers to ensure 24/7 oversight of internal system logs.
4. Review patch management schedules for all underlying servers and SQL databases to eliminate known entry points that automated tools scan for during the initial reconnaissance phase.

Securing digital infrastructure against sophisticated threats requires robust technical architecture and continuous oversight. At Nimus, our Custom All-In-One Systems service includes building secure web applications, client portals, and CRM platforms with rigorous attention to data protection, complemented by three months of free support after launch to help maintain system integrity.

Frequently Asked Questions

What is CyberStrikeAI?

CyberStrikeAI is an open-source framework combining a command-and-control infrastructure with a large language model, allowing attackers to automate network reconnaissance, credential theft, and lateral movement.

Are AI-powered attacks running directly on victim computers?

No. According to Kaspersky, the AI model runs on the attackers' server while a lightweight implant on the compromised machine executes commands and transmits results back.

How can organisations protect themselves against these automated threats?

Experts recommend implementing endpoint detection and response solutions, integrating threat intelligence, and maintaining continuous monitoring of network communications, particularly outside normal working hours.

Sources

• Cybercriminals use AI to accelerate network intrusions targeting educational institutions in Africa, TechTrends Kenya, 3 Nov 2026

Written by the Nimus Newsroom with AI assistance from the sources above, and checked against them before publishing. Spotted an error? Tell us through the contact page and we will correct it.