An open-source AI platform called Cairn has been co-opted by at least three financially motivated threat clusters to automate intrusions against organizations worldwide, researchers at NorForge reported. The activity included more than 1,100 attack projects, attempts against more than 1,200 websites and successful or claimed compromises of more than 100 organizations, according to research reviewed by Reuters.
NorForge identified more than 20 publicly exposed Cairn control panels associated with malicious activity. The largest cluster, tracked as AIA0001, used Chinese-language infrastructure and targeted e-commerce and payment systems, particularly in the United States, Japan and Australia. A second cluster focused in English on credit-card and cryptocurrency theft, targeting payment services, gray-market sites, pharmaceutical platforms and online retailers. NorForge assessed the first two clusters as high-confidence malicious activity, while assigning lower confidence to a third.
Cairn acted as an autonomous exploitation engine rather than a vulnerability itself. Operators supplied targets and objectives, after which agents performed reconnaissance, searched for weaknesses and attempted to gain access. Observed techniques included authentication bypasses, SQL injection, unsafe PHP deserialization, server-side template injection, server-side request forgery, command execution and vulnerable file-upload functionality. NorForge said one confirmed task resulted in an uploader webshell being placed on a vendor website, giving the attacker a way to return later.
The findings build on a Gambit Security investigation into a related campaign that combined Strix for vulnerability discovery, Cairn for end-to-end exploitation and Hermes for orchestration. Gambit said attackers launched 105 projects between Sept. 10 and Sept. 15 and compromised at least 27 companies; researchers also reported the theft of more than 600,000 still-valid payment-card records from two organizations. The available research does not tie the activity to a named threat group or establish that a specific CVE drove the compromises.
NorForge found no clear evidence of state-sponsored operations and described the observed activity as financially motivated, while cautioning that this does not rule out other uses of Cairn. The exposed panels also contained hundreds of secrets, 11% of which were verified as valid by the researchers. Organizations using Cairn or comparable AI-agent systems should remove internet exposure from control panels, enforce authentication and access controls, rotate exposed credentials and API keys, and investigate for webshells, unauthorized administrator access, database theft and cryptocurrency transactions. The incident also highlights the need to treat exposed agent telemetry as a potential breach record rather than merely a configuration error.
