Threat reportMalwareTL-2026-4532
Hijacked Cairn AI Pentesting Agent Panels Used to Install SSH Keys, Poseidon RAT and Steal API Keys (AIA0009 / AIA0010)
Hijacked Cairn AI Pentesting Agent Panels Used to Install (TL-2026-4532) is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects Cairn (open source, author le1xia0) Cairn AI agent orchestration panel, maps to 13 MITRE ATT&CK / ATLAS techniques (AML.T0053, T1005, T1027), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK / ATLAS
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4532
- Threat ID
- TL-2026-4532
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cybersecurity, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Hijacked Cairn AI Pentesting Agent Panels Used to Install
Malware and tooling: FindPOS, Mythic - S0699
How Hijacked Cairn AI Pentesting Agent Panels Used to Install works
NorForge research, as reported by Cybersecurity News on 2026-10-27, found at least 17 exposed Cairn AI agent orchestration panels (including red-team and CTF deployments) compromised through malicious task injection starting 2026-10-20. Two activity clusters, AIA0009 and AIA0010, had Cairn's own agents install unauthorized SSH keys, deploy the Go-based Poseidon RAT (Mythic framework agent) and harvest API keys, tokens and secrets from environment variables and config files.
Cairn is an open-source autonomous AI agent orchestration platform: operators define a goal, agents work toward it step by step, and findings are posted as 'facts' visible through a web panel. Many panels were exposed to the internet without authentication, so third parties could submit tasks that the operator's own agents then executed with the operator's privileges and without validation. The tool's author (le1xia0) has stated Cairn was not designed for attacking. NorForge (researcher Snorre Fagerland) had been scanning for exposed Cairn instances since about 2026-10-02 and published separate research ('Inside Cairn') on attacker-operated panels; this record covers the hijacking of panels that belong to other operators, as reported by Cybersecurity News.
Two clusters are tracked. AIA0009 uses random hexadecimal suffixes in task names and a 'cairnscan' tag, and focuses on persistence and malware delivery. Its first phase was 11 injected tasks, including 'Install kali SSH key', which instructed agents to append an attacker public key to authorized_keys. On 2026-10-21 at about 21:15 UTC a task titled 'Local worker maintenance' carried a base64-encoded script that downloaded a Linux binary, verified its SHA256, and ran it as a background process. The binary is the Go-based Poseidon agent, normally controlled through the open-source Mythic red-team framework. It persisted until an operator-created stop file appeared. Three C2 generations were observed (103.181.134.12, 199.91.220.129, 64.176.50.179), plus a Bunny CDN (b-cdn.net) hostname.
AIA0010 uses task names that mimic Cairn's own intent labels (for example 'i014') and targets internal services, credentials and other exposed panels. No malware deployment was observed for AIA0010, and NorForge treats it as separate pending further correlation. In both clusters, follow-on tasks searched system folders and configuration files for API_KEY and ANTHROPIC_AUTH_TOKEN variables and returned the secrets through public fact text visible on the panels. Exposed data included AI model API keys, SSH key material, environment variables, config-file secrets and internal service details. At least 17 panels were affected, including red-team and CTF platforms.
Caveats: the AIA0009/AIA0010 details come from a single secondary report (Cybersecurity News) of NorForge research. The original NorForge write-up on these two clusters could not be retrieved, and the NorForge 'Inside Cairn' post lists AIA0001-AIA0003 only. No CVE or CVSS applies; this is an exposure and abuse of unauthenticated agent task intake. The same report separately mentions an AstraRCE defacement on 2026-10-20 and unrelated retailer targeting (105 projects, September 2026). Those are not part of the AIA0009/AIA0010 activity.
MITRE ATT&CK / ATLAS techniques used in TL-2026-4532
Execution
AML.T0053 AI Agent Tool Invocation; T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Command and Control
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1552.001 Credentials In Files; T1552.004 Private Keys
Exfiltration
T1567 Exfiltration Over Web Service
Reconnaissance
Affected products and versions in Hijacked Cairn AI Pentesting Agent Panels Used to Install
- Cairn (open source, author le1xia0) — Cairn AI agent orchestration panel
Vulnerable versions: Internet-exposed deployments without authentication
Remediation for Hijacked Cairn AI Pentesting Agent Panels Used to Install
Immediate actions
- Put authentication in front of every Cairn panel and remove direct internet exposure
- Rotate all API keys and tokens (including ANTHROPIC_AUTH_TOKEN and any API_KEY values) reachable from Cairn hosts
- Audit authorized_keys on Cairn hosts for unauthorized keys such as the 'kali' key
- Block outbound connections to 103.181.134.12, 199.91.220.129, 64.176.50.179 and 74342459543956677599003426txhdpndwdwy.b-cdn.net
- Hunt for the Poseidon ELF with SHA256 1cfee868e5e488bb862140cf288fce46a167aa5982900102356dac552fa4fa43 and unexpected background processes started by agent workers
Workarounds
- Restrict panel access to a VPN or IP allow-list until authentication is in place
Longer-term hardening
- Run agent task execution in containers or sandboxes with strict boundaries
- Restrict agent outbound connectivity with network segmentation and egress allow-lists
- Keep secrets out of environment variables and files readable by agent workers
- Review task execution logs for injected tasks (hex-suffixed names, 'cairnscan' tag, intent-label lookalikes such as 'i014')
- Monitor for Poseidon/Mythic C2 communication patterns
Weaknesses (CWE) in Hijacked Cairn AI Pentesting Agent Panels Used to Install
Timeline of Hijacked Cairn AI Pentesting Agent Panels Used to Install
- NorForge (Snorre Fagerland), scanning for exposed Cairn panels, begins observing malicious Cairn instances (around this date per The Hacker News)
- The Hacker News reports NorForge's separate 'Inside Cairn' research on attacker-operated Cairn panels (AIA0001, Chinese-language operation, ~1,100 projects); context for, but distinct from, the AIA0009/AIA0010 hijacking of third-party panels
- Separate defacement by AstraRCE reported on the same date; not attributed to AIA0009/AIA0010
- Injection of malicious tasks into exposed Cairn panels begins, starting with SSH key persistence tasks (11 tasks including 'Install kali SSH key')
- Three successive Poseidon/Mythic C2 generations (103.181.134.12, 199.91.220.129, 64.176.50.179) plus a Bunny CDN hostname are later observed for the AIA0009 implant
- At about 21:15 UTC a 'Local worker maintenance' task delivers a base64 script that downloads and runs the Poseidon Linux implant (AIA0009)
- BeaconBeagle lookups of the three C2 IPs return no record (HTTP 404); no independent corroboration of the infrastructure found
- Cybersecurity News publishes the NorForge findings: at least 17 exposed Cairn panels compromised, activity ongoing
Sources cited for Hijacked Cairn AI Pentesting Agent Panels Used to Install
- Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys
- NorForge blog (Inside Cairn: Open Windows into massive AI-Driven Cyber Operations)
- NorForge blog index
- The Hacker News: Hackers Use Autonomous AI Agents to Breach Company Websites (Cairn / NorForge)
- NorForge Finds Exposed Cairn Panels; Reuters Links Campaign to 100+ Company Breaches
- Hackers Use AI Agents to Do Hacking for Them (PYMNTS)
- AI pentest Cairn attack activities
Detection coverage for TL-2026-4532
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4532 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.