Chinese-speaking operator uses Cairn-based autonomous AI agents to breach 100+ e-commerce websites in AIA0001 campaign
A Chinese-speaking operator used autonomous AI agents on the open-source Cairn platform to compromise the websites of more than 100 companies. NorForge tracks the most active campaign as AIA0001: over 1,100 attack projects across 14 dashboards, and more than 1,200 break-in attempts overall. Targets were e-commerce businesses in the United States, Canada, Japan and Australia, with the apparent aim of persistent access to shopping and payment infrastructure for later monetization. NorForge researcher Snorre Fagerland found the activity while investigating publicly exposed Cairn instances. Reuters named Deere, SharkNinja and Cummins among the affected organizations, but could not determine the extent of any data extraction.
Technical Details
- Cairn structures each assignment around an initial state and an objective. Agents generate "intents" (planned actions) and "facts" (discoveries) on a shared project blackboard, so they can reuse evidence and switch attack paths without operator input.
- Target selection used Playwright to confirm that candidate sites had working shopping functionality. Agents prioritized unauthenticated RCE, SQL injection, unsafe deserialization, authentication bypass and vulnerable upload functionality, and were asked to deploy uploader shells for persistence.
- In one confirmed compromise on a vendor site, the agent reported unauthorized write access to a memcached session store, unsafe PHP object deserialization and a gadget chain in legacy Zend Framework components, ending in an uploader shell. This account comes from the agent itself and was not independently validated at every step.
- Exposed worker directories held Nmap, OWASP Amass, dnsrecon, ffuf, PHPGGC, Python and Docker. A worker identifier hinted at Claude Code orchestration with a DeepSeek model, which NorForge presented with caution.
- Successful AIA0001 projects averaged just under 23 hours. NorForge estimated a success rate near 10%, with caveats about differing objectives. Reuters put the cost at about $5,000 in tokens (roughly $50 per successful intrusion), while NorForge estimated about $5 per task; both figures are uncertain.
- The operator's dashboards were unsecured and exposed victim credentials and operational details. NorForge found hundreds of exposed credentials, and TruffleHog verified 11% as valid.
- Victim statements: Deere said it remediated the issue and found no evidence of sensitive data access. SharkNinja said a standalone product support site was affected. Cummins said it was investigating a potentially affected third-party vendor site.
Remediation
The article gives no explicit remediation guidance. The attack paths it describes point to reviewing exposed session stores such as memcached, patching or retiring legacy Zend Framework and PHP components, hunting for uploader shells on e-commerce and vendor sites, and rotating any credentials that may have been exposed.
Linha do tempo
-
Chinese-speaking operator uses Cairn-based autonomous AI agents to breach 100+ e-commerce websites in AIA0001 campaign
ler a análise desta fonte ocultar
A Chinese-speaking operator used autonomous AI agents on the open-source Cairn platform to compromise the websites of more than 100 companies. NorForge tracks the most active campaign as AIA0001: over 1,100 attack projects across 14 dashboards, and more than 1,200 break-in attempts overall. Targets were e-commerce businesses in the United States, Canada, Japan and Australia, with the apparent aim of persistent access to shopping and payment infrastructure for later monetization. NorForge researcher Snorre Fagerland found the activity while investigating publicly exposed Cairn instances. Reuters named Deere, SharkNinja and Cummins among the affected organizations, but could not determine the extent of any data extraction.
Technical Details
- Cairn structures each assignment around an initial state and an objective. Agents generate "intents" (planned actions) and "facts" (discoveries) on a shared project blackboard, so they can reuse evidence and switch attack paths without operator input.
- Target selection used Playwright to confirm that candidate sites had working shopping functionality. Agents prioritized unauthenticated RCE, SQL injection, unsafe deserialization, authentication bypass and vulnerable upload functionality, and were asked to deploy uploader shells for persistence.
- In one confirmed compromise on a vendor site, the agent reported unauthorized write access to a memcached session store, unsafe PHP object deserialization and a gadget chain in legacy Zend Framework components, ending in an uploader shell. This account comes from the agent itself and was not independently validated at every step.
- Exposed worker directories held Nmap, OWASP Amass, dnsrecon, ffuf, PHPGGC, Python and Docker. A worker identifier hinted at Claude Code orchestration with a DeepSeek model, which NorForge presented with caution.
- Successful AIA0001 projects averaged just under 23 hours. NorForge estimated a success rate near 10%, with caveats about differing objectives. Reuters put the cost at about $5,000 in tokens (roughly $50 per successful intrusion), while NorForge estimated about $5 per task; both figures are uncertain.
- The operator's dashboards were unsecured and exposed victim credentials and operational details. NorForge found hundreds of exposed credentials, and TruffleHog verified 11% as valid.
- Victim statements: Deere said it remediated the issue and found no evidence of sensitive data access. SharkNinja said a standalone product support site was affected. Cummins said it was investigating a potentially affected third-party vendor site.
Remediation
The article gives no explicit remediation guidance. The attack paths it describes point to reviewing exposed session stores such as memcached, patching or retiring legacy Zend Framework and PHP components, hunting for uploader shells on e-commerce and vendor sites, and rotating any credentials that may have been exposed.