/
← Voltar ao feed
high retail manufacturing e-commerce

Chinese-speaking actor uses autonomous Cairn AI agents to attack 1,200+ websites and breach 100+ companies, incl. Deere and SharkNinja

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 11:07 · coletado há 1 dia

A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn control panels, which let him watch the attackers' work in real time. Reuters identified the victims from the attacker's own records. The scale of data theft is unknown, and the named companies told Reuters the damage was limited. The busiest cluster, AIA0001, appears to seek persistent access to shop and payment systems for later use, targeting the United States, Japan and Australia.

Detalhes técnicos

  • Cairn gives agents a start point and a goal, and agents post findings to a shared board while the operator can add hints. It was built for authorized penetration testing, and its author ("le1xia0") says it was not designed for attacks.
  • AIA0001 is Chinese-language and links 14 panels to more than 1,100 attack projects. Typical tasks told agents to gain code execution on a shop and plant a web shell uploader (a file-upload form that can be swapped for a more capable shell).
  • NorForge confirmed a live web shell at a large hardware-parts vendor and independently confirmed the compromise of a very large US retailer, where agents found the single cookie setting that selected a vulnerable backend server.
  • One documented chain used unauthorized write access to a memcached session store, unsafe PHP object deserialization and a weakness in old Zend Framework code. Paths differ per victim.
  • Operator instructions were under 100 Chinese characters. Successful intrusions averaged just under 23 hours, with a roughly 10% success rate and about $5 per task (about $5,000 in tokens overall, roughly $50 per successful hack).
  • All AIA0001 tasks ran under the worker name claudecode_deepseek-v4.1-flash, which may indicate a DeepSeek V4.1 Flash model driven by Claude Code. This is not confirmed.
  • The open panels also leak victim data: Trufflehog found hundreds of secrets, 11% verified as valid. Panels appear to expose full controls (start/stop projects, feed data, redirect agents), though NorForge did not test whether these work without a login. A second English-language cluster exposed operators' SSH logins to staging servers. Some legitimate pentest firms also left client tests on open panels.
  • A worker directory held a proof-of-concept and test lab for the critical Magento flaw StyleSmuggler (CVE-2026-75650). There is no evidence it was used in these intrusions.
  • A September Gambit Security report described a separate campaign using Cairn for credit card theft. No source links the two.

Remediação

  • Hunt for exposed agent control panels without authentication, often on port 8000.
  • Look for unexpected file-upload forms in hidden directories, the foothold these agents aimed for.
  • Apply Adobe's hotfix for CVE-2026-75650 on Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9.
  • NorForge is working with Reuters to notify victims and is asking hosting providers to take the panels down.

Linha do tempo

  1. thehackernews.com ↗ · pub. 20/10/2026 11:07 · coletado 20/10 14:00 primeiro registro

    Chinese-speaking actor uses autonomous Cairn AI agents to attack 1,200+ websites and breach 100+ companies, incl. Deere and SharkNinja

    ler a análise desta fonte

    A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn control panels, which let him watch the attackers' work in real time. Reuters identified the victims from the attacker's own records. The scale of data theft is unknown, and the named companies told Reuters the damage was limited. The busiest cluster, AIA0001, appears to seek persistent access to shop and payment systems for later use, targeting the United States, Japan and Australia.

    Technical Details

    • Cairn gives agents a start point and a goal, and agents post findings to a shared board while the operator can add hints. It was built for authorized penetration testing, and its author ("le1xia0") says it was not designed for attacks.
    • AIA0001 is Chinese-language and links 14 panels to more than 1,100 attack projects. Typical tasks told agents to gain code execution on a shop and plant a web shell uploader (a file-upload form that can be swapped for a more capable shell).
    • NorForge confirmed a live web shell at a large hardware-parts vendor and independently confirmed the compromise of a very large US retailer, where agents found the single cookie setting that selected a vulnerable backend server.
    • One documented chain used unauthorized write access to a memcached session store, unsafe PHP object deserialization and a weakness in old Zend Framework code. Paths differ per victim.
    • Operator instructions were under 100 Chinese characters. Successful intrusions averaged just under 23 hours, with a roughly 10% success rate and about $5 per task (about $5,000 in tokens overall, roughly $50 per successful hack).
    • All AIA0001 tasks ran under the worker name claudecode_deepseek-v4.1-flash, which may indicate a DeepSeek V4.1 Flash model driven by Claude Code. This is not confirmed.
    • The open panels also leak victim data: Trufflehog found hundreds of secrets, 11% verified as valid. Panels appear to expose full controls (start/stop projects, feed data, redirect agents), though NorForge did not test whether these work without a login. A second English-language cluster exposed operators' SSH logins to staging servers. Some legitimate pentest firms also left client tests on open panels.
    • A worker directory held a proof-of-concept and test lab for the critical Magento flaw StyleSmuggler (CVE-2026-75650). There is no evidence it was used in these intrusions.
    • A September Gambit Security report described a separate campaign using Cairn for credit card theft. No source links the two.

    Remediation

    • Hunt for exposed agent control panels without authentication, often on port 8000.
    • Look for unexpected file-upload forms in hidden directories, the foothold these agents aimed for.
    • Apply Adobe's hotfix for CVE-2026-75650 on Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9.
    • NorForge is working with Reuters to notify victims and is asking hosting providers to take the panels down.