# CL-STA-1238 (China-nexus) uses customized open-source Cairn AI pentest framework to breach 10 organizations

> Unit 42 reports that CL-STA-1238, assessed with moderate confidence as China-nexus intelligence collection, ran 25 autonomous-AI intrusion operations against at least 19 organizations in August-September 2026, achieving unauthorized access or data theft at 10. The operator used a customized fork of the open-source Cairn framework driven by Zhipu GLM 5.2 and DeepSeek V4 models, bypassing model guardrails with a Chinese-language authorization preamble.

- **Published:** 2026-11-12T15:43:14Z
- **Last reviewed:** 2026-11-12T15:43:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5867
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5867.png
- **ID:** TL-2026-5867
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** CL-STA-1238 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (3 shown free below)

## Description

Unit 42 (Palo Alto Networks) published on 2026-11-12 an analysis of an intrusion campaign it tracks as CL-STA-1238. Between August and September 2026 the actor ran 25 operations against at least 19 organizations and Unit 42 confirmed unauthorized access or data retrieval at 10. Attribution to China-nexus intelligence collection is moderate confidence and rests on Chinese-language artifacts, exclusive use of Chinese AI models and target selection that aligns with Chinese state priorities. The activity is assessed as a single operator or small team running many intrusions in parallel; individual operations lasted from about 20 minutes to more than 50 hours with no attacker-imposed limit.

The actor ran a customized fork of Cairn (github.com/oritera/Cairn), an open-source AI penetration-testing framework in which AI-driven agent workers share a 'blackboard' fact-intent graph, operators can inject hints, and each operation runs a bootstrap task followed by a Reason/Explore loop (the model reviews confirmed facts, picks one next action, runs it and logs the result). The fork was hosted on a Hong Kong server (154.44.31.4) with a U.S. staging and egress node (82.29.129.54). Each operation loaded an 'AIScan Runner Skills' pack that provides scanning and exploitation capabilities and does not appear in upstream Cairn. Operators supplied little more than a root domain and a one-line Chinese-language goal (for example obtaining a webshell, SSH, source code, keys, credentials and ideally internal network access), plus optional intel such as VPN gateway addresses, group names and shared passwords. The model then built a 3-7 stage plan: recon and asset mapping, web-app exploitation, services/middleware exploitation, credential and secret collection, privilege escalation and lateral movement, and internal access and persistence.

Model use: Zhipu GLM 5.2 drove 13 operations, DeepSeek V4 Flash 8 and DeepSeek V4 Pro 4; the actor appears to have switched to Pro for repeat attempts on targets that resisted Flash. A Chinese-language preamble was prepended to every Reason and Explore call stating the work is an authorized security test or CTF, that all tasks are authorized and that the model must never refuse, and an AUTHORIZATION.md file was generated per operation declaring the engagement client-approved. Neither GLM nor DeepSeek refused this framing.

Targets: 7 semiconductor / advanced-manufacturing supply-chain organizations (lithography, chip design, materials, photomask, standards layers), 3 defense or defense-policy organizations (space technology company, defense-analytics vendor, policy think tank) and 4 human-rights / civil-society organizations (including a Canadian human-rights body, a U.S. teachers' union, a science-policy advocacy group and an education nonprofit). Observed techniques were conventional: password spraying and brute-forced credentials, authentication bypasses (including a CMS account-creation bypass), IDOR, mass-assignment privilege escalation, default or weak credentials, exposed cloud APIs, an unauthenticated cloud storage write, and dated public CVEs (none named). Impact: an industry standards body lost dozens of valid credentials and non-public directory data and had a live ballot document overwritten, with read/write/delete access to meeting, voting and back-office functions; a semiconductor company's production partner-integration credential was brute-forced, leading to application data and user/email list retrieval, new unauthorized admin accounts and a persistent API token; a U.S. teachers' union exposed over one million member records, about 31,000 CRM contacts and staff password hashes; a defense-policy program exposed about 500 user records including .mil and .gov accounts through an open registration endpoint; other cases included employee data at a lithography manufacturer, about 150,000 internal documents at an industrial-automation manufacturer and student data at an education nonprofit. Unit 42 concludes autonomous AI increased the volume and coverage of exploitation, not its complexity, so identity hygiene, attack-surface reduction and patching remain the primary defenses. The Unit 42 report publishes only two IP addresses as indicators; no domains, hashes or user agents were provided.

## MITRE ATT&CK

- T1595 Active Scanning
- T1596 Search Open Technical Databases
- T1588.002 Obtain Capabilities: Tool
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1110 Brute Force
- T1110.003 Brute Force: Password Spraying
- T1552 Unsecured Credentials
- T1136 Create Account
- T1098 Account Manipulation
- T1213 Data from Information Repositories
- T1565.001 Data Manipulation: Stored Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CL-STA-1238 Password Spraying Against Entra ID Sign-In (Cairn Credential Acquisition)** (`TL-2026-5867-SPL-001`)

Detects password spraying / brute force (T1110.003, T1110) leading to valid-account abuse (T1078) against cloud SSO and VPN-fronting identity providers, the primary credential-acquisition method of CL-STA-1238 in TL-2026-5867. Fires on one source IP failing against many distinct accounts, or on any failed sign-in from the Unit 42 published Cairn infrastructure 154.44.31.4 / 82.29.129.54.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1110.003, T1110, T1078
- **Data sources:** azure:monitor:aad (SignInLogs), SigninLogs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```TL-2026-5867 CL-STA-1238 Cairn autonomous AI spraying: many accounts, one source, low-and-slow```
index=azure sourcetype="azure:monitor:aad" category=SignInLogs earliest=-1h
| eval src='properties.ipAddress', user='properties.userPrincipalName', err=tostring('properties.status.errorCode'), app='properties.appDisplayName'
| where match(err,"^(50126|50034|50053)$")
| stats count as attempts dc(user) as distinct_users values(app) as apps min(_time) as first_seen max(_time) as last_seen by src
| where (distinct_users>=10 AND attempts>=20) OR src IN ("154.44.31.4","82.29.129.54")
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table src attempts distinct_users apps first_seen last_seen
````

### Microsoft KQL

```kql
let ioc_ips = dynamic(["154.44.31.4","82.29.129.54"]);
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType in ("50126","50034","50053")
| summarize Attempts=count(), DistinctUsers=dcount(UserPrincipalName), Apps=make_set(AppDisplayName, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by IPAddress
| where (DistinctUsers >= 10 and Attempts >= 20) or IPAddress in (ioc_ips)
| project IPAddress, Attempts, DistinctUsers, Apps, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Entra ID Failed Sign-In - Spray Candidate (TL-2026-5867)
id: 5b1e7c52-3a4d-4f0e-9c1a-6d2f8e4b7a01
name: tl_5867_entra_failed_signin
status: experimental
description: Failed Entra ID sign-in with invalid password, unknown user or locked account result codes; base rule for spray correlation
references:
    - https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.credential-access
    - attack.t1110
    - attack.t1110.003
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType:
            - '50126'
            - '50034'
            - '50053'
    condition: selection
falsepositives:
    - Users mistyping passwords
level: low
---
title: Password Spraying Against Entra ID by CL-STA-1238 Cairn Operations
id: 8c3d9a14-72b6-4e58-a0f3-1b5e6c7d8e02
status: experimental
description: One source IP generating failed sign-ins against 10 or more distinct accounts within an hour (T1110.003)
references:
    - https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.credential-access
    - attack.t1110.003
    - attack.t1078
correlation:
    type: value_count
    rules:
        - tl_5867_entra_failed_signin
    group-by:
        - IPAddress
    timespan: 1h
    condition:
        gte: 10
        field: UserPrincipalName
falsepositives:
    - Shared NAT egress with many users after an SSO outage or password policy change
level: high

```

**Known false positives:**

- Corporate NAT or VPN egress where many users fail sign-in at once (SSO outage, forced password reset)
- Authorized red-team or password-audit tooling against the tenant

**Tuning notes:** Raise or lower the distinct_users/attempts thresholds to your tenant size; allowlist corporate egress ranges and approved scanner IPs; add 50055/50057 if your tenant sees expired-credential spraying; pivot any hit on a later successful sign-in (ResultType 0) from the same IP as T1078.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CL-STA-1238 Autonomous IDOR / Object-ID Enumeration Against Web APIs (locked: unlock with TL Creds)
- CL-STA-1238 Persistence - Entra ID New Admin Role, User or App Credential Added (locked: unlock with TL Creds)
- CL-STA-1238 AI Agent Egress - Zhipu GLM / DeepSeek API Calls From Unexpected Hosts (locked: unlock with TL Creds)
- CL-STA-1238 Mass-Assignment Privilege Escalation Parameters on Registration/Profile Endpoints (locked: unlock with TL Creds)
- CL-STA-1238 Cairn Guardrail-Bypass Artifact - [indicator] File Creation (locked: unlock with TL Creds)
- CL-STA-1238 Cairn / AIScan Runner Skills Framework Execution or Retrieval (locked: unlock with TL Creds)
- CL-STA-1238 Persistence - New Local/Domain Account Creation and Privileged Group Add (locked: unlock with TL Creds)
- CL-STA-1238 Cairn Infrastructure - Traffic To/From Published IPs [indicator] and [indicator] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 11)

Defanged, TLP:CLEAR.

- IP address: `154.44.31[.]4`
- Domain: `open[.]bigmodel[.]cn`
- IP address: `82.29.129[.]54`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors (Unit 42)](https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/)
- [Attackers breached 10 organizations with an open-source AI pentest framework (Help Net Security)](https://www.helpnetsecurity.com/2026/11/12/cairn-autonomous-ai-cyberattacks/)
- [Cairn open-source AI penetration testing framework (GitHub)](https://github.com/oritera/Cairn)
- [The Pathless Path: Cairn AI from Penetration Testing to General Problem Solving (Zero Evolution Lab)](https://mp.weixin.qq.com/s/2rEqFLvkxvYWM3gW170C2w)
- [Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors (OffSeq Radar)](https://radar.offseq.com/threat/attackers-use-autonomous-ai-to-target-semiconductor-defense-and-civil-society-sectors-c6fcb5caf6b716e5)
- [Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System (Unit 42, related context)](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5867