CL-STA-1238 (China-nexus) uses customized open-source Cairn AI pentest framework to breach 10 organizations

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5867 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CL-STA-1238 Password Spraying Against Entra ID Sign-In (Cairn Credential Acquisition)

Detects password spraying / brute force (T1110.003, T1110) leading to valid-account abuse (T1078) against cloud SSO and VPN-fronting identity providers, the primary credential-acquisition method of CL-STA-1238 in TL-2026-5867. Fires on one source IP failing against many distinct accounts, or on any failed sign-in from the Unit 42 published Cairn infrastructure 154.44.31.4 / 82.29.129.54.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1110.003, T1110, T1078
• Data sources: azure:monitor:aad (SignInLogs), SigninLogs
• Severity: high
• Confidence: high

Splunk SPL

```TL-2026-5867 CL-STA-1238 Cairn autonomous AI spraying: many accounts, one source, low-and-slow```
index=azure sourcetype="azure:monitor:aad" category=SignInLogs earliest=-1h
| eval src='properties.ipAddress', user='properties.userPrincipalName', err=tostring('properties.status.errorCode'), app='properties.appDisplayName'
| where match(err,"^(50126|50034|50053)$")
| stats count as attempts dc(user) as distinct_users values(app) as apps min(_time) as first_seen max(_time) as last_seen by src
| where (distinct_users>=10 AND attempts>=20) OR src IN ("154.44.31.4","82.29.129.54")
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table src attempts distinct_users apps first_seen last_seen

Microsoft KQL

let ioc_ips = dynamic(["154.44.31.4","82.29.129.54"]);
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType in ("50126","50034","50053")
| summarize Attempts=count(), DistinctUsers=dcount(UserPrincipalName), Apps=make_set(AppDisplayName, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by IPAddress
| where (DistinctUsers >= 10 and Attempts >= 20) or IPAddress in (ioc_ips)
| project IPAddress, Attempts, DistinctUsers, Apps, FirstSeen, LastSeen

Sigma

title: Entra ID Failed Sign-In - Spray Candidate (TL-2026-5867)
id: 5b1e7c52-3a4d-4f0e-9c1a-6d2f8e4b7a01
name: tl_5867_entra_failed_signin
status: experimental
description: Failed Entra ID sign-in with invalid password, unknown user or locked account result codes; base rule for spray correlation
references:
    - https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.credential-access
    - attack.t1110
    - attack.t1110.003
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType:
            - '50126'
            - '50034'
            - '50053'
    condition: selection
falsepositives:
    - Users mistyping passwords
level: low
---
title: Password Spraying Against Entra ID by CL-STA-1238 Cairn Operations
id: 8c3d9a14-72b6-4e58-a0f3-1b5e6c7d8e02
status: experimental
description: One source IP generating failed sign-ins against 10 or more distinct accounts within an hour (T1110.003)
references:
    - https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.credential-access
    - attack.t1110.003
    - attack.t1078
correlation:
    type: value_count
    rules:
        - tl_5867_entra_failed_signin
    group-by:
        - IPAddress
    timespan: 1h
    condition:
        gte: 10
        field: UserPrincipalName
falsepositives:
    - Shared NAT egress with many users after an SSO outage or password policy change
level: high

Known false positives:

• Corporate NAT or VPN egress where many users fail sign-in at once (SSO outage, forced password reset)
• Authorized red-team or password-audit tooling against the tenant

Tuning notes: Raise or lower the distinct_users/attempts thresholds to your tenant size; allowlist corporate egress ranges and approved scanner IPs; add 50055/50057 if your tenant sees expired-credential spraying; pivot any hit on a later successful sign-in (ResultType 0) from the same IP as T1078.

• 🔒 CL-STA-1238 Autonomous IDOR / Object-ID Enumeration Against Web APIs · unlock with TL Creds
• 🔒 CL-STA-1238 Persistence - Entra ID New Admin Role, User or App Credential Added · unlock with TL Creds
• 🔒 CL-STA-1238 AI Agent Egress - Zhipu GLM / DeepSeek API Calls From Unexpected Hosts · unlock with TL Creds
• 🔒 CL-STA-1238 Mass-Assignment Privilege Escalation Parameters on Registration/Profile Endpoints · unlock with TL Creds
• 🔒 CL-STA-1238 Cairn Guardrail-Bypass Artifact - [indicator] File Creation · unlock with TL Creds
• 🔒 CL-STA-1238 Cairn / AIScan Runner Skills Framework Execution or Retrieval · unlock with TL Creds
• 🔒 CL-STA-1238 Persistence - New Local/Domain Account Creation and Privileged Group Add · unlock with TL Creds
• 🔒 CL-STA-1238 Cairn Infrastructure - Traffic To/From Published IPs [indicator] and [indicator] · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5867.

Sample indicators (3 of 11)

• IP address: 154.44.31[.]4
• Domain: open[.]bigmodel[.]cn
• IP address: 82.29.129[.]54

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

Technical analysis

Unit 42 (Palo Alto Networks) published on 2026-11-12 an analysis of an intrusion campaign it tracks as CL-STA-1238. Between August and September 2026 the actor ran 25 operations against at least 19 organizations and Unit 42 confirmed unauthorized access or data retrieval at 10. Attribution to China-nexus intelligence collection is moderate confidence and rests on Chinese-language artifacts, exclusive use of Chinese AI models and target selection that aligns with Chinese state priorities. The activity is assessed as a single operator or small team running many intrusions in parallel; individual operations lasted from about 20 minutes to more than 50 hours with no attacker-imposed limit.

The actor ran a customized fork of Cairn (github.com/oritera/Cairn), an open-source AI penetration-testing framework in which AI-driven agent workers share a 'blackboard' fact-intent graph, operators can inject hints, and each operation runs a bootstrap task followed by a Reason/Explore loop (the model reviews confirmed facts, picks one next action, runs it and logs the result). The fork was hosted on a Hong Kong server (154.44.31.4) with a U.S. staging and egress node (82.29.129.54). Each operation loaded an 'AIScan Runner Skills' pack that provides scanning and exploitation capabilities and does not appear in upstream Cairn. Operators supplied little more than a root domain and a one-line Chinese-language goal (for example obtaining a webshell, SSH, source code, keys, credentials and ideally internal network access), plus optional intel such as VPN gateway addresses, group names and shared passwords. The model then built a 3-7 stage plan: recon and asset mapping, web-app exploitation, services/middleware exploitation, credential and secret collection, privilege escalation and lateral movement, and internal access and persistence.

Model use: Zhipu GLM 5.2 drove 13 operations, DeepSeek V4 Flash 8 and DeepSeek V4 Pro 4; the actor appears to have switched to Pro for repeat attempts on targets that resisted Flash. A Chinese-language preamble was prepended to every Reason and Explore call stating the work is an authorized security test or CTF, that all tasks are authorized and that the model must never refuse, and an AUTHORIZATION.md file was generated per operation declaring the engagement client-approved. Neither GLM nor DeepSeek refused this framing.

Targets: 7 semiconductor / advanced-manufacturing supply-chain organizations (lithography, chip design, materials, photomask, standards layers), 3 defense or defense-policy organizations (space technology company, defense-analytics vendor, policy think tank) and 4 human-rights / civil-society organizations (including a Canadian human-rights body, a U.S. teachers' union, a science-policy advocacy group and an education nonprofit). Observed techniques were conventional: password spraying and brute-forced credentials, authentication bypasses (including a CMS account-creation bypass), IDOR, mass-assignment privilege escalation, default or weak credentials, exposed cloud APIs, an unauthenticated cloud storage write, and dated public CVEs (none named). Impact: an industry standards body lost dozens of valid credentials and non-public directory data and had a live ballot document overwritten, with read/write/delete access to meeting, voting and back-office functions; a semiconductor company's production partner-integration credential was brute-forced, leading to application data and user/email list retrieval, new unauthorized admin accounts and a persistent API token; a U.S. teachers' union exposed over one million member records, about 31,000 CRM contacts and staff password hashes; a defense-policy program exposed about 500 user records including .mil and .gov accounts through an open registration endpoint; other cases included employee data at a lithography manufacturer, about 150,000 internal documents at an industrial-automation manufacturer and student data at an education nonprofit. Unit 42 concludes autonomous AI increased the volume and coverage of exploitation, not its complexity, so identity hygiene, attack-surface reduction and patching remain the primary defenses. The Unit 42 report publishes only two IP addresses as indicators; no domains, hashes or user agents were provided.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation; T1136 Create Account

Credential Access

T1110 Brute Force; T1110.003 Brute Force: Password Spraying; T1552 Unsecured Credentials

Collection

T1213 Data from Information Repositories

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server; T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1595 Active Scanning; T1596 Search Open Technical Databases

Remediation

Patches

• Keep internet-facing systems patched; the actor leveraged dated public CVEs (none named by Unit 42)

Immediate actions

• Block 154.44.31.4 and 82.29.129.54 at the perimeter and hunt historical logs for connections to or from them
• Audit for password spraying and brute-force patterns against VPN gateways, partner-integration endpoints, CMS and SSO portals; rotate credentials that may have been exposed
• Review recently created administrator accounts and API tokens and revoke any that are unauthorized
• Restrict anonymous write access to cloud storage and review open registration or account-creation endpoints

Workarounds

• Rate-limit and alert on authentication failures and on rapid automated enumeration of object identifiers
• Disable or authenticate exposed cloud APIs and unauthenticated registration endpoints

Longer-term hardening

• Enforce phishing-resistant MFA and SSO, least privilege, just-in-time access and zero standing privileges
• Adopt secrets management with regular credential rotation and eliminate default and shared passwords
• Reduce internet-facing attack surface and fix authorization flaws (IDOR, mass assignment, auth bypass) in web applications and APIs
• Monitor and control AI-agent activity on endpoints

Affected and fixed versions

• Various — Internet-facing web applications, CMS platforms, VPN gateways, partner-integration APIs and cloud storage at semiconductor, defense and civil-society organizations
  Vulnerable versions: Instances with weak or default credentials, authentication/authorization flaws or unpatched public CVEs

Timeline

• 2026-04-23 Unit 42 publishes related research on building an autonomous cloud-offensive multi-agent system, providing context for AI-agent-driven attack capability (context only; not part of CL-STA-1238 activity).
• 2026-08-01 CL-STA-1238 begins running autonomous-AI intrusion operations using a customized Cairn fork (Unit 42 gives the window only as 'August 2026'; day is a month-level placeholder).
• 2026-09-01 During the August-September window the actor runs 25 operations against at least 19 organizations (about 19 intrusion attempts within two weeks) and appears to switch from DeepSeek V4 Flash to V4 Pro for targets that resisted Flash (month-level date).
• 2026-09-15 Unit 42 observes roughly 19 organizations targeted with simultaneous intrusion attempts within a two-week span by a single operator or small team; individual operations ran from about 20 minutes to more than 50 hours with no attacker-imposed limit (exact dates not published; mid-window placeholder).
• 2026-09-30 End of the August-September 2026 activity window; Unit 42 confirms unauthorized access or data retrieval at 10 organizations across semiconductor, defense and civil-society sectors (month-level date).
• 2026-11-12 Help Net Security reports the campaign and lists the two published IP indicators (locked-ioc-6 and locked-ioc-4).
• 2026-11-12 Unit 42 states its findings, including the two IP indicators, were shared with Cyber Threat Alliance members and publishes the report.
• 2026-11-12 Unit 42 publishes its analysis of CL-STA-1238 and the Cairn-based autonomous-AI campaign, assessing China-nexus intelligence collection with moderate confidence.

Sources cited

• Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors (Unit 42) Unit 42 · Research · 2026-11-12
• The Pathless Path: Cairn AI from Penetration Testing to General Problem Solving (Zero Evolution Lab) mp.weixin.qq.com · Research
• Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System (Unit 42, related context) Unit 42 · Research · 2026-04-23
• Cairn open-source AI penetration testing framework (GitHub) GitHub · Code repository
• Attackers breached 10 organizations with an open-source AI pentest framework (Help Net Security) Help Net Security · News · 2026-11-12
• Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors (OffSeq Radar) radar.offseq.com · News · 2026-11-12

More in apt

• FaceStealer: DPRK (APT38-attributed) deepfake meeting social-engineering campaign disrupted by FBI/DOJ; $1.2B of stolen Binance crypto seized (TraderTraitor)
• Iran-Backed Network (IRGC / Kataib Hezbollah / HAYI) Directed London and European Attacks over FaceTime
• North Korean Contagious Interview (WaterPlum) Campaign Compromises 30,000+ Devices, Steals $10.71M in Crypto
• Silent Lynx (UAT-6275 / TAG-193) exposed server: Laplas/Chvost implants and AI-agent-driven intrusions against Tajikistan railway and EDO, Uzbekistan Smart Forestry, and Turkmenistan-themed lures
• Imperial Kitten (Tortoiseshell / UNC1549 / Nimbus Manticore) Iranian IRGC-linked APT: TWOSTROKE, MINIBIKE/MiniJunk, LIGHTRAIL, TRUSTTRAP Targeting Aerospace, Defense and IT