Attackers hijack 17 exposed Cairn AI pentesting panels to steal credentials, plant SSH keys and deploy Poseidon implant
Attackers compromised at least 17 internet-exposed Cairn AI penetration-testing panels, abusing unauthenticated administrative access to instruct the autonomous agents to run commands on their own host infrastructure. Victims included suspected criminal operations as well as apparently legitimate red team, bug bounty and CTF instances. NorForge provisionally tracks the activity as two clusters, AIA0009 and AIA0010, but found no shared hard indicators proving a common operator. Activity intensified around October 20, 2026, with related reconnaissance possibly starting as early as October 10. No new software vulnerability was exploited; the root cause is an exposed agent dashboard acting as a privileged command interface.
Detalhes técnicos
- Intruders create projects and issue tasks to agents, which execute commands on the infrastructure running them.
- AIA0009 appends random hex strings to task names, uses the "cairnscan" marker for reconnaissance (account identity and hostname), and prioritizes persistence, remote access and malware deployment.
- AIA0010 uses task labels mimicking Cairn native intent IDs (e.g. "i014"), and focuses on environment discovery, internal services, infrastructure mapping, credential extraction (including AI model API keys) and scanning further public IP ranges for exposed panels.
- Agents were told to enumerate environment variables, listening ports, config files and secrets. Results were written to publicly accessible "facts", creating an additional disclosure channel.
- Several tasks installed attacker-controlled SSH public keys in the kali account's authorized_keys, with agent output confirming installation and permissions.
- Other tasks inspected Linux capabilities, mounts, Docker sockets and security restrictions to look for container escape paths; NorForge could not determine whether any escape succeeded.
- On October 21 at 21:15 UTC, AIA0009 submitted a maintenance-themed task with a Base64-encoded script that downloaded a Linux executable, worker-health, from 199.91.220[.]129:28471, verified its SHA-256 and ran it in the background. The payload was identified as Poseidon, a Go-based implant of the Mythic C2 framework, reportedly communicating via Bunny.net CDN infrastructure. A loop kept the agent task alive until a stop file appeared.
- Synchronized task creation across unrelated panels (e.g. five panels probed, then follow-up projects exactly 2h40m later) indicates scripted coordination, but not proof of autonomous AI orchestration.
Remediação
- Do not expose AI agent dashboards to the internet; enforce authentication and network restrictions on control planes.
- Treat secrets available in agent workspaces (API keys, environment variables) as exposed if a panel was reachable, and rotate them.
- Review authorized_keys files, Docker socket exposure and outbound connections for the indicators above.
Linha do tempo
-
Attackers hijack 17 exposed Cairn AI pentesting panels to steal credentials, plant SSH keys and deploy Poseidon implant
ler a análise desta fonte ocultar
Attackers compromised at least 17 internet-exposed Cairn AI penetration-testing panels, abusing unauthenticated administrative access to instruct the autonomous agents to run commands on their own host infrastructure. Victims included suspected criminal operations as well as apparently legitimate red team, bug bounty and CTF instances. NorForge provisionally tracks the activity as two clusters, AIA0009 and AIA0010, but found no shared hard indicators proving a common operator. Activity intensified around October 20, 2026, with related reconnaissance possibly starting as early as October 10. No new software vulnerability was exploited; the root cause is an exposed agent dashboard acting as a privileged command interface.
Technical Details
- Intruders create projects and issue tasks to agents, which execute commands on the infrastructure running them.
- AIA0009 appends random hex strings to task names, uses the "cairnscan" marker for reconnaissance (account identity and hostname), and prioritizes persistence, remote access and malware deployment.
- AIA0010 uses task labels mimicking Cairn native intent IDs (e.g. "i014"), and focuses on environment discovery, internal services, infrastructure mapping, credential extraction (including AI model API keys) and scanning further public IP ranges for exposed panels.
- Agents were told to enumerate environment variables, listening ports, config files and secrets. Results were written to publicly accessible "facts", creating an additional disclosure channel.
- Several tasks installed attacker-controlled SSH public keys in the kali account's authorized_keys, with agent output confirming installation and permissions.
- Other tasks inspected Linux capabilities, mounts, Docker sockets and security restrictions to look for container escape paths; NorForge could not determine whether any escape succeeded.
- On October 21 at 21:15 UTC, AIA0009 submitted a maintenance-themed task with a Base64-encoded script that downloaded a Linux executable, worker-health, from 199.91.220[.]129:28471, verified its SHA-256 and ran it in the background. The payload was identified as Poseidon, a Go-based implant of the Mythic C2 framework, reportedly communicating via Bunny.net CDN infrastructure. A loop kept the agent task alive until a stop file appeared.
- Synchronized task creation across unrelated panels (e.g. five panels probed, then follow-up projects exactly 2h40m later) indicates scripted coordination, but not proof of autonomous AI orchestration.
Remediation
- Do not expose AI agent dashboards to the internet; enforce authentication and network restrictions on control planes.
- Treat secrets available in agent workspaces (API keys, environment variables) as exposed if a panel was reachable, and rotate them.
- Review authorized_keys files, Docker socket exposure and outbound connections for the indicators above.