# Open-Source AI Pentest Platform Cairn Abused to Breach 100+ Organizations (E-commerce/Payment Targets)

> Norforge reports that threat actors abused Cairn, an open-source autonomous penetration-testing engine that coordinates LLM agents, to breach over 100 organizations. It identified three activity clusters (AIA0001, AIA0002, AIA0003) targeting e-commerce and payment infrastructure for shell, webshell, admin-panel and database access, with roughly 10% of attempts fully achieving their goal.

- **Published:** 2026-10-20T13:10:11Z
- **Last reviewed:** 2026-10-20T13:10:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3959
- **ID:** TL-2026-3959
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cairn is an open-source autonomous penetration-testing engine that coordinates AI agents. Given a target domain and an objective, it runs for hours without supervision until it succeeds, times out or is stopped. Norforge found more than 20 Cairn control panels exposed on the internet (default port 8000, apparently without authentication) that were being used for criminal campaigns. The panels gave full administrative functionality (create or modify projects, redirect agents, interrupt operations) and leaked project data, harvested credentials and operator infrastructure details. Norforge grouped the activity into three clusters. AIA0001 is a Chinese-language cluster (high confidence) with 14 exposed panels on AS56594 (CGI Global Limited) and more than 1,100 projects. It targets e-commerce and payment infrastructure in the US, Japan and Australia with the objective 'find unauthenticated RCE' through SQL injection, file upload and deserialization flaws. Its worker model was claudecode_deepseek-v4.1-flash, projects averaged about 140 facts, and the average time from project start to compromise was under 23 hours. AIA0002 is an English-language cluster (high confidence) with 10 exposed panels on AS20473 (The Constant Company/Vultr). It focuses on credit-card and cryptocurrency theft from merchant payment services, gray-market payment sites and pharmaceutical platforms, with a suspected African base. It used the Pi framework with DeepSeek via OpenRouter and exposed SSH credentials for backend staging servers. AIA0003 is a low-confidence exploratory cluster with 1 panel (AS200019, AlexHost) and 59 projects. It targets small e-commerce sites mixed with large US platforms, and its tasking shifted from claiming authorized assessments to explicit exploitation.

Observed attack chains include unauthenticated account modification leading to PHP deserialization and RCE, Memcached session-store exploitation with Zend Framework gadget chains (PHPGGC) to deploy a webshell, insecure error handling leading to information disclosure and authentication bypass, and cookie manipulation against vulnerable backends. Operator tooling included Playwright and Chromium for automated target validation, Docker, tmux, Xvfb, OWASP Amass, dnsrecon, ffuf, Nmap, rockyou, Trufflehog-style secret scanning, the StyleSmuggler PoC and Magento validation labs. The exposed panels held hundreds of secrets (API keys, database credentials, SSH and staging logins), of which 11% were verified as valid. Roughly 10% of projects fully achieved their goal and many achieved partial success. SecurityWeek, citing Reuters, names John Deere and SharkNinja among the victims.

A related, independently documented campaign was reconstructed by Gambit Security after it obtained the operator's staging server. A Chinese-language operator chained three open-source LLM tools: Strix for vulnerability discovery (146 deep-mode scans across 138 hosts, 23-31 Aug 2026), Cairn for autonomous exploitation, and Hermes for orchestration and post-exploitation (121 skills, 78 attack-focused, 'SOUL - Red Team Operator' persona). The LLM backends were Claude Opus 4.6 for Hermes, GLM 5.2 then DeepSeek v4 Pro for Strix, and DeepSeek v4.1 Flash for Cairn, all via OpenRouter. The operator spent $7,005.71 in four weeks (an estimated $12,000-$18,000 in total) and averaged about $25.46 per target. Targets were chosen from a website traffic-ranking service, excluding major hosted and open-source platforms on the assumption that custom code is weaker. The campaign ran from July 2026 and was still ongoing on 22 Sep 2026. Between 10 and 15 September it launched 105 attack projects and compromised at least 27 companies, with initial access in under 24 hours and often within hours. Over 600,000 unexpired card records were stolen from two victims, about 79% of them US-issued, and skimmers were found on more than 100 sites, with 19 confirmed active during the campaign. Gambit documented a 16-stage chain: error-based SQL injection (EXTRACTVALUE) in a login email parameter, OTP extraction from a database table, MFA bypass, admin access, arbitrary file upload (no extension validation) giving RCE as uid=1001, privilege escalation through sudo NOPASSWD python3.12, access to an NFS mount with no_root_squash, wp-config.php credential extraction, creation of a WordPress admin and plugin upload, RCE on a secondary host, an AWS Secrets Manager dump (46 secrets), Aurora-hosted Magento database access, and Blowfish-ECB decryption of cc_number_enc card data.

Skimmer deployment methods were: appending a base64 loader to legitimate JavaScript libraries (jQuery, Bootstrap) and restoring the original timestamps; foreign script tags in checkout pages; Google Tag Manager poisoning (loader padded with 100+ tabs); S3/CDN bucket poisoning with stolen AWS keys; appending to database content fields such as product descriptions; Kubernetes initContainer injection in production front-end deployment YAML; and server-side checkout page cache poisoning. The loader pattern is new Function(atob('<junk7chars>...'.slice(7)))(). Persistence took the form of a self-healing cron job (seen at a wine retailer in a JBoss log directory) that checked the file size every two minutes and re-appended the skimmer after redeploys. The operator's 'Database Wipe After Extraction' skill instructed agents to wipe source card fields in batches with a chunked PHP script and verify zero counts. At a bicycle retailer this cleanup matched table names containing 'ZQ' or 'Backup' and dropped 180 tables, destroying the victim's own backups. Confirmed or probable victims include a Fortune 500 hospitality company, a major US airline, a US industrial supplies distributor and a US online fashion retailer. Gambit also recorded proxy providers IPRoyal, 711proxy and 1024proxy. Norforge says it identified the open panels following Gambit's initial report; the primary sources do not say whether the Gambit operator corresponds to one of the Norforge clusters. No CVEs are named. The exploited flaws are described only as known SQL injection and file-upload flaws in Magento and WordPress plugins and extensions and in custom code, and no malware hashes were published.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.007 Artificial Intelligence
- T1583.003 Virtual Private Server
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1505.003 Web Shell
- T1053.003 Cron
- T1548.003 Sudo and Sudo Caching
- T1070.006 Timestomp
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1111 Multi-Factor Authentication Interception
- T1071.004 DNS
- T1090 Proxy
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1565.001 Stored Data Manipulation
- T1485 Data Destruction
- T1657 Financial Theft

## Sources

- [AI Platform Cairn Abused to Hack Over 100 Organizations](https://www.securityweek.com/ai-platform-cairn-abused-to-hack-over-100-organizations/)
- [Norforge - Inside Cairn](https://norforge.com/blog/inside_cairn)
- [Gambit Security - Autonomous AI Agents Online Retailers $25 a Company](https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company)
- [BleepingComputer - Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers](https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/)
- [CyberInsider - AI agents steal 600,000 credit cards in attacks on online retailers](https://cyberinsider.com/ai-agents-steal-600000-credit-cards-in-attacks-on-online-retailers/)
- [CSA Research Note - AI Agent Retail Skimming Campaign](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-agent-retail-skimming-campaign-20260924/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3959