- Joined
- Jan 22, 2026
- Messages
- 101
- Reaction score
- 921
How Chinese intelligence agencies gave the world an automatic vulnerability scanner.
Team Cymru analyzes network traffic on a global level using aggregated NetFlow data and open port scans. Such data allows you to see which IP addresses are connecting to each other, which services are running on network nodes, and which devices are becoming targets for mass scanning or suspicious requests. Using these telemetry streams, analysts are trying to find the attackers' infrastructure, track new attack tools, and understand which systems are being targeted.
One such episode led researchers to the CyberStrikeAI tool, an open—source project using artificial intelligence mechanisms. Interest in it arose after the publication of the Amazon CTI team, which described the infrastructure of the attackers who used AI in the attacks, and indicated the associated IP address 212.11.64.250.
Team Cymru checked this address in its own Scout system and found a characteristic CyberStrikeAI network banner on the server in the port scan data. Such a banner usually returns the service when it is connected over the network, so you can use it to understand which software is running on the node.
The next step was to check whether this server was used for real operations. To do this, the analysts studied NetFlow connections, metadata of network traffic that shows which nodes are communicating with each other. This data indicated access to Fortinet FortiGate devices. Such systems often stand on the edge of corporate networks and act as firewalls and VPN gateways, so they regularly become the target of intelligence and exploitation attempts.
The CyberStrikeAI tool itself is distributed via GitHub. In the description of the project, the developer indicates that the platform is written in the Go language and combines more than a hundred security testing tools. The architecture includes an orchestration engine that manages the sequence of operations, a role-based testing model with predefined scenarios, and a skill system that allows you to connect specialized verification methods. The platform also contains a web dashboard where the operator sees the system status and can manage the launch of tasks.
In fact, CyberStrikeAI is trying to automate the process of offensive testing: combine many utilities, run them according to predefined scenarios and analyze the results. This approach is especially useful for mass operations, for example, to search for vulnerable network devices or to verify large ranges of addresses.
The researchers paid special attention to the project developer, who uses the alias Ed1s0nZ. His GitHub account revealed several other projects related to vulnerability detection and privilege escalation. Among them, PrivHunterAI is a tool that uses a passive proxy and API of popular AI models to identify privilege escalation vulnerabilities. Another project, InfiltrateX, is also related to the automated search for such vulnerabilities.
Analysts also noticed the developer's activity in the ecosystem of organizations that, according to various studies, collaborated with Chinese government agencies in the field of cyber operations. For example, in December 2025, Ed1s0nZ hosted CyberStrikeAI in the Starlink Project related to Knownsec 404. According to research companies, Knownsec collaborated with Chinese law enforcement agencies and structures associated with the Ministry of State Security.
Another detail appeared in January 2026. A reward entry has been added to the developer's GitHub profile for participating in the CNNVD vulnerability search program, the Chinese national vulnerability database. This system is managed by CNITSEC and is under the supervision of the Ministry of State Security. Previously, researchers noted that such programs can be used to collect vulnerabilities before they are publicly disclosed. Later, the mention of this award disappeared from the developer's profile.
An analysis of the activity around CyberStrikeAI also showed an increase in the number of platform installations. The first commit in the repository appeared on November 8, 2025, and in the first weeks the system was almost never seen online. However, from January 20 to February 26, 2026, analysts have already discovered 21 unique IP addresses on which this tool worked. This dynamic indicates a fairly rapid spread of the project after the initial publication.
Geographically, most of the servers where CyberStrikeAI was launched were located in regions with Chinese—speaking infrastructure - in China, Singapore and Hong Kong.
Team Cymru believes that interest in such platforms will grow. CyberStrikeAI combines many tools and tries to automate their work through AI and orchestration mechanisms. As such systems become more accessible, complex operations such as searching for vulnerable devices on the network perimeter, infrastructure exploration, or privilege escalation attempts can be performed faster and require less manual work.
The study notes that there are already signs of automated targeting of network devices like Fortinet FortiGate. If such platforms become widespread, attackers will be able to scale up the exploration and exploitation of vulnerabilities faster. Therefore, security teams are advised to monitor network anomalies more closely and take into account that AI tools are gradually becoming part of the arsenal of cybercriminals.
Team Cymru analyzes network traffic on a global level using aggregated NetFlow data and open port scans. Such data allows you to see which IP addresses are connecting to each other, which services are running on network nodes, and which devices are becoming targets for mass scanning or suspicious requests. Using these telemetry streams, analysts are trying to find the attackers' infrastructure, track new attack tools, and understand which systems are being targeted.
One such episode led researchers to the CyberStrikeAI tool, an open—source project using artificial intelligence mechanisms. Interest in it arose after the publication of the Amazon CTI team, which described the infrastructure of the attackers who used AI in the attacks, and indicated the associated IP address 212.11.64.250.
Team Cymru checked this address in its own Scout system and found a characteristic CyberStrikeAI network banner on the server in the port scan data. Such a banner usually returns the service when it is connected over the network, so you can use it to understand which software is running on the node.
The next step was to check whether this server was used for real operations. To do this, the analysts studied NetFlow connections, metadata of network traffic that shows which nodes are communicating with each other. This data indicated access to Fortinet FortiGate devices. Such systems often stand on the edge of corporate networks and act as firewalls and VPN gateways, so they regularly become the target of intelligence and exploitation attempts.
The CyberStrikeAI tool itself is distributed via GitHub. In the description of the project, the developer indicates that the platform is written in the Go language and combines more than a hundred security testing tools. The architecture includes an orchestration engine that manages the sequence of operations, a role-based testing model with predefined scenarios, and a skill system that allows you to connect specialized verification methods. The platform also contains a web dashboard where the operator sees the system status and can manage the launch of tasks.
In fact, CyberStrikeAI is trying to automate the process of offensive testing: combine many utilities, run them according to predefined scenarios and analyze the results. This approach is especially useful for mass operations, for example, to search for vulnerable network devices or to verify large ranges of addresses.
The researchers paid special attention to the project developer, who uses the alias Ed1s0nZ. His GitHub account revealed several other projects related to vulnerability detection and privilege escalation. Among them, PrivHunterAI is a tool that uses a passive proxy and API of popular AI models to identify privilege escalation vulnerabilities. Another project, InfiltrateX, is also related to the automated search for such vulnerabilities.
Analysts also noticed the developer's activity in the ecosystem of organizations that, according to various studies, collaborated with Chinese government agencies in the field of cyber operations. For example, in December 2025, Ed1s0nZ hosted CyberStrikeAI in the Starlink Project related to Knownsec 404. According to research companies, Knownsec collaborated with Chinese law enforcement agencies and structures associated with the Ministry of State Security.
Another detail appeared in January 2026. A reward entry has been added to the developer's GitHub profile for participating in the CNNVD vulnerability search program, the Chinese national vulnerability database. This system is managed by CNITSEC and is under the supervision of the Ministry of State Security. Previously, researchers noted that such programs can be used to collect vulnerabilities before they are publicly disclosed. Later, the mention of this award disappeared from the developer's profile.
An analysis of the activity around CyberStrikeAI also showed an increase in the number of platform installations. The first commit in the repository appeared on November 8, 2025, and in the first weeks the system was almost never seen online. However, from January 20 to February 26, 2026, analysts have already discovered 21 unique IP addresses on which this tool worked. This dynamic indicates a fairly rapid spread of the project after the initial publication.
Geographically, most of the servers where CyberStrikeAI was launched were located in regions with Chinese—speaking infrastructure - in China, Singapore and Hong Kong.
Team Cymru believes that interest in such platforms will grow. CyberStrikeAI combines many tools and tries to automate their work through AI and orchestration mechanisms. As such systems become more accessible, complex operations such as searching for vulnerable devices on the network perimeter, infrastructure exploration, or privilege escalation attempts can be performed faster and require less manual work.
The study notes that there are already signs of automated targeting of network devices like Fortinet FortiGate. If such platforms become widespread, attackers will be able to scale up the exploration and exploitation of vulnerabilities faster. Therefore, security teams are advised to monitor network anomalies more closely and take into account that AI tools are gradually becoming part of the arsenal of cybercriminals.
