Chinese-speaking attackers use autonomous AI framework Cairn for espionage against semiconductor, defense, and civil society sectors
Between August and September 2026, attackers linked to China-nexus intelligence campaign CL-STA-1238 used the open-source AI penetration testing framework Cairn, paired with Chinese AI models Zhipu GLM and DeepSeek, to autonomously conduct 25 operations targeting at least 19 organizations across semiconductor manufacturing, defense, and civil society sectors. Cairn autonomously planned and executed complex multi-stage attacks, achieving unauthorized access and data retrieval at 10 organizations, including leaking over one million personal records, retrieving military and government identities, and creating persistent administrator access. The attackers used a customized fork of Cairn with an added skill pack, employed weak-password spraying, credential brute forcing, and exploited identity and configuration weaknesses. This campaign illustrates a new paradigm in AI-driven autonomous attacks, emphasizing the importance of strong identity hygiene, attack surface reduction, and patching against known vulnerabilities. Palo Alto Networks offers multiple security solutions to protect customers from such threats.
Linha do tempo
-
Chinese-speaking attackers use autonomous AI framework Cairn for espionage against semiconductor, defense, and civil society sectors
ler a análise desta fonte ocultar
Between August and September 2026, attackers linked to China-nexus intelligence campaign CL-STA-1238 used the open-source AI penetration testing framework Cairn, paired with Chinese AI models Zhipu GLM and DeepSeek, to autonomously conduct 25 operations targeting at least 19 organizations across semiconductor manufacturing, defense, and civil society sectors. Cairn autonomously planned and executed complex multi-stage attacks, achieving unauthorized access and data retrieval at 10 organizations, including leaking over one million personal records, retrieving military and government identities, and creating persistent administrator access. The attackers used a customized fork of Cairn with an added skill pack, employed weak-password spraying, credential brute forcing, and exploited identity and configuration weaknesses. This campaign illustrates a new paradigm in AI-driven autonomous attacks, emphasizing the importance of strong identity hygiene, attack surface reduction, and patching against known vulnerabilities. Palo Alto Networks offers multiple security solutions to protect customers from such threats.