# AI-Assisted Attackers Chain Web App Flaws (SQLi to xp_cmdshell, File-Upload Web Shells) for Rapid Intrusions Using Cairn, CyberStrikeAI and CupcakeC2

> Sophos DFIR reports two real-world intrusions in which operators using open-source AI-driven offensive tooling (Cairn, CyberStrikeAI, CupcakeC2) chained web application weaknesses, credential theft and lateral movement into near-autonomous workflows. In one case SQL injection reached SQL Server xp_cmdshell command execution 1h45m after enumeration began; in the other, abuse of an upload endpoint led to multiple IIS web shells in just over 3 hours, followed by configuration and cloud-metadata credential harvesting, database enumeration and cleanup.

- **Published:** 2026-10-21T19:47:07Z
- **Last reviewed:** 2026-10-21T19:47:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4058
- **ID:** TL-2026-4058
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Sophos DFIR & Readiness lead Chris Ahearn ('The Frontlines' series) describes two incident patterns handled by Sophos incident response in which attackers combined commodity web application weaknesses with open-source AI-driven offensive frameworks to compress the time from first probe to hands-on-keyboard activity. Artifacts associated with three tools were identified: Cairn, an open-source AI-driven state-space search engine built for autonomous penetration testing; CyberStrikeAI, an open-source AI-powered autonomous security testing framework that couples LLMs with automated decision-making workflows; and CupcakeC2, an open-source command-and-control framework with a Rust agent, a Go server and Model Context Protocol (MCP) integration. Sophos names no CVEs, threat actor or network IOCs for the two incidents.

Incident pattern one (database access): the attackers enumerated several web applications in parallel, then ran SQL injection attempts that enabled and invoked SQL Server xp_cmdshell. About 1 hour 45 minutes after web enumeration began they had operating-system command execution through SQL Server processes and PowerShell. In roughly 30 minutes on target before isolation they ran whoami and network enumeration, attempted privilege escalation through token impersonation and service-account abuse, looked for credentials in configuration and script files, Windows registry hives and LSASS, and attempted lateral movement over administrative shares, WMI and scheduled tasks.

Incident pattern two (file upload): the attackers abused account-management and password-reset functionality, reached customer data through an upload endpoint that accepted executable content, and deployed multiple web shells across web servers about 3 hours after enumeration began. Over about 1 hour 45 minutes on target, the IIS worker process ran command shells. The attackers harvested web.config files, private keys, certificates and credentials, and recovered temporary cloud credentials from the instance metadata service. They also enumerated production and staging SQL databases, found credentials for an internal file-transfer service, tried RDP without success, retrieved privilege-escalation tooling, compiled small executables in temporary directories, and ran cleanup commands that deleted temporary directories and other artifacts.

Tool context from primary sources: Cairn (github.com/oritera/Cairn, Python 3.12+, AGPL-3.0) uses a blackboard architecture of Facts, Intents and Hints, with OODA-loop workers driven by Claude Code, Codex or Pi backends. It solved 54/54 challenges in the Tencent Cloud Hackathon AI penetration-testing contest. CyberStrikeAI (github.com/Ed1s0nZ/CyberStrikeAI) is a Go platform that bundles more than 100 tools (nmap, subfinder, nuclei, sqlmap, metasploit, mimikatz, bloodhound) behind Eino multi-agent orchestration and MCP. Its web UI listens on HTTPS port 8080 with a self-signed certificate by default. Team Cymru saw 21 CyberStrikeAI server IPs between 2026-01-20 and 2026-02-26, including 212.11.64.250:8080, which talked to FortiGate devices during a campaign that compromised more than 600 appliances in 55 countries. CupcakeC2 (github.com/yellatiamo/CupcakeC2, MIT) has a Rust agent, Go server, Vue 3 UI and MCP client. Its documentation advertises dynamic patching of amsi.dll and ntdll.dll (AMSI/ETW), memory ballooning against memory scanners, and AI-generated WASM plugins.

The same tooling appears in a separate campaign reported by Gambit Security. A single financially motivated operator writing Chinese-language prompts used Strix for scanning, Cairn for exploitation and Hermes for orchestration, through OpenRouter. The operator ran 105 attack projects between 2026-09-10 and 2026-09-15, compromised at least 27 organizations (mostly online retailers) and stole more than 600,000 payment card records, at an average of $25.46 per completed scan. Gambit's infrastructure IOCs belong to that campaign. They are included here as related-tooling pivots only and are not attributed to the Sophos incidents. Sophos recommends treating application behavior as security telemetry, storing uploads outside executable web roots, removing secrets from configuration files, restricting application-server egress, alerting on abnormal parent-child processes (w3wp.exe or sqlservr.exe spawning cmd.exe or powershell.exe), correlating behavioral sequences, and containing at machine speed.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1588.002 Obtain Capabilities: Tool
- T1190 Exploit Public-Facing Application
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1505.003 Server Software Component: Web Shell
- T1505.001 Server Software Component: SQL Stored Procedures
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1070.004 Indicator Removal: File Deletion
- T1027.004 Obfuscated Files or Information: Compile After Delivery
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.002 Unsecured Credentials: Credentials in Registry
- T1552.004 Unsecured Credentials: Private Keys
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1003.001 OS Credential Dumping: LSASS Memory
- T1033 System Owner/User Discovery
- T1046 Network Service Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021.001 Remote Services: Remote Desktop Protocol
- T1213.006 Data from Information Repositories: Databases

## Sources

- [Web App Owners: AI-Powered Attackers Are Targeting Your Lowest-Hanging Fruit Faster Than Ever (Sophos, Chris Ahearn)](https://www.sophos.com/en-us/blog/web-app-owners-your-low-hanging-fruit-just-got-lower)
- [Autonomous AI agents attacking online retailers at $25 a company (Gambit Security)](https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company)
- [AI agents stole 600,000 credit cards for about $25 a target, Gambit says](https://thenextweb.com/news/ai-agents-600000-credit-card-records-gambit)
- [Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries](https://thehackernews.com/2026/03/open-source-cyberstrikeai-deployed-in.html)
- [CyberStrikeAI tool adopted by hackers for AI-powered attacks](https://www.bleepingcomputer.com/news/security/cyberstrikeai-tool-adopted-by-hackers-for-ai-powered-attacks/)
- [Cairn - AI state-space search engine (GitHub)](https://github.com/oritera/Cairn)
- [CyberStrikeAI (GitHub, Ed1s0nZ)](https://github.com/Ed1s0nZ/CyberStrikeAI)
- [CupcakeC2 - Rust agent / Go server C2 with MCP (GitHub)](https://github.com/yellatiamo/CupcakeC2)
- [AI tools help hacker break in for $25 per target (Computerworld)](https://www.computerworld.com/article/4226868/ai-tools-help-hacker-break-in-for-25-per-target-2.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4058