Cairn’s exposed dashboards became footholds for website attacks
Norforge identified three malicious Cairn clusters automating website attacks, with the largest running more than 1,100 projects across 14 dashboards. Norforge says the clusters pursued persistent access and financial theft; Reuters separately reports that the largest actor breached more than 100 companies.
Cairn lets operators set a target and goal, then coordinate AI agents that work through steps and post findings to a shared board. With panels left open, operators could use them as control surfaces. Norforge found hundreds of stored secrets in panel data, 11% verified as valid. The clusters pursued webshell, administrator-panel, database, and payment access, so valid credentials could open routes beyond Cairn—but the reporting does not establish which secrets were used or which footholds remain.
For Cairn deployments, the dashboard is only one boundary: closing an exposed panel would not establish whether its credentials were used or access persisted in a target system. For organizations among the reported victims, the scope of downstream exposure remains unsettled.
AI Pen-Test Tool Cairn Abused to Automate Massive Attack Spree
A Chinese-speaking actor compromised 100s of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.