AWS to Africa: One AI Attack Tool in 4 Reports in 17 Days

CyberStrikeAI, an open-source platform that Elastic Security Labs says “pairs LLM agents with offensive security tools”, has been named in at least four attack reports in 17 days, by our count: Trend Micro’s TrendAI team on 27 October, Kaspersky on 2 November, India’s CERT-In on 4 November and Elastic on 13 November.

The reports cover four settings: organisations in Japan, education organisations in Africa and Latin America, Indian financial firms and four AWS accounts. The tool’s public repository showed 8,636 stars and 1,932 forks when we read it at 19:58 UTC on 14 November, up from “more than 7,000 stars” that ThreatBook cited when it said it had acquired CyberStrikeAI on 30 September.

Business Pill · Multi-agent systems

An evergreen Business Engineer explainer on multi-agent systems: how several AI agents split one job between them. It explains the general idea only and does not discuss any attack, tool or company in this story.

Report One: Japan, 27 October

As we reported on 28 October, TrendAI said one attack infrastructure it examined used CyberStrikeAI in a configuration in which 44 agents shared the work. At least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity in a short period in October, and the report says evidence of deep compromise was limited to a small proportion of them.

The report’s summary: “AI has increased the scale and speed of these attacks, but the attackers are still looking for an unlocked door.”

Report Two: Schools in Africa and Latin America, 2 November

Kaspersky says its threat intelligence team found a campaign in which “Confirmed victims of the campaign included organizations in the education sector in several countries across Africa and Latin America”, with CyberStrikeAI playing “a key role in the post-exploitation phase”.

Kaspersky says a human operator first got in through a compromised SQL Server, then paused for two weeks. In the second phase, it says, the agent established persistence and local reconnaissance within 2 minutes, ran domain reconnaissance over the next 5 hours and, after a pause of several days, finished lateral movement, credential dumping and database export in no more than one hour. Kaspersky calls it “one of the first public descriptions of a compromise involving an LLM in the wild”.

Report Three: India’s Financial Sector, 4 November

India’s CERT-In rated a campaign against lenders, fintechs and payment firms Critical in advisory CIAD-2026-0058. As we reported, its financial-sector team named the actor “CRAFTY FALCON” and listed four tools, CyberStrikeAI among them, saying the tools “execute complete attack chains autonomously at machine speed”. The advisory names no victim, gives no number of incidents and gives no amount lost.

Report Four: Four AWS Accounts, 13 November

Elastic says that between 30 September and 16 October one CyberStrikeAI server used credentials from eight AWS identities, five IAM users and three EC2 instance roles, across four accounts, and generated 78 alerts, all medium or low severity. One role sent 56 user data requests in 141 milliseconds, about 2.5 ms per call, or roughly 400 calls a second by our arithmetic.

Elastic says “This is the first case we have seen of the same tooling turned on AWS”. We added its figures to our piece on stolen keys and agent-written AWS code earlier today; this piece follows the tool across all four reports.

Who Owns the Tool

ThreatBook, which describes itself as an agentic security company, said on 30 September that it had acquired CyberStrikeAI, that the tool had “more than 7,000 stars on GitHub” and that internet-scanning data pointed to more than 3,000 instances in use. It said it would keep the open-source edition available and “add further safeguards to the open-source edition to prevent the technology from being misused”.

By our arithmetic, that is a gain of up to 1,635 stars in the 45 days to 14 November.

What the Reports Say They Cannot Prove

Elastic is explicit: “We cannot prove an LLM agent was making the decisions, and we do not know how the attacker obtained the credentials.” Kaspersky’s account of its campaign says the operator set the task while the model chose the technical steps.

The Structural Read

As we read the four reports, the common thread is reach rather than sophistication: TrendAI’s summary says the attackers are still looking for an unlocked door, and Elastic says it does not know how the AWS credentials were obtained.

As we read Elastic’s figures, the defensive problem is pattern, not volume: Elastic says all 78 alerts were medium or low severity and only made sense once correlated by source IP.

Three Implications

FOR SECURITY TEAMS Elastic says all 78 alerts were medium or low severity and only made sense once correlated by source IP.

FOR FINANCIAL FIRMS IN INDIA CERT-In rated the campaign naming CyberStrikeAI Critical in advisory CIAD-2026-0058 on 4 November.

FOR THE TOOL’S OWNER ThreatBook, which says it acquired CyberStrikeAI on 30 September, says it will add further safeguards to the open-source edition; the repository showed 8,636 stars on 14 November.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Agentic Harness War.

The framework argues that “The surface, not the model, governs autonomy”, meaning the harness around a model decides what an agent can do.

As we read it, CyberStrikeAI fits that view from the attacker’s side: Elastic describes a platform that pairs LLM agents with offensive security tools; the framework does not discuss CyberStrikeAI or these attacks.

What Is Not Established

None of the four reports names the people behind the activity, and none says the attacks were run by ThreatBook or the project’s maintainers. The reports cover different victims and periods, and none links the campaigns to one another. Star counts measure public interest in the code, not use in attacks. CERT-In names no victims and no losses, and Elastic does not say how the AWS credentials were obtained. We have not contacted ThreatBook, Trend Micro, Kaspersky, CERT-In or Elastic for this piece.

The Bottom Line

At least four reports in 17 days, from TrendAI, Kaspersky, CERT-In and Elastic, describe CyberStrikeAI in use against organisations in Japan, schools in Africa and Latin America, Indian financial firms and four AWS accounts, while its GitHub repository shows 8,636 stars. ThreatBook, which says it acquired the tool on 30 September, says it will add safeguards against misuse.