Attackers use AI pen-test tool Cairn against e-commerce sites
Original title: Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
NorForge says a Chinese-speaking operator ran over 1,100 projects across dashboards aimed at stealing payments.
Dark Reading reports that a Chinese-speaking attacker used the AI penetration-testing tool Cairn against e-commerce and payment sites, with researchers finding more than 20 publicly exposed dashboards. NorForge says the activity hit 100 sites in the US, Australia, Canada, and Japan and looked financially motivated, with no obvious state-sponsored signs. Reuters, coordinating disclosure with NorForge, later named John Deere, SharkNinja, and Cummins. NorForge found three activity clusters, two assessed as malicious, and wrote that the group likely used 14 dashboards holding over 1,100 attack projects. The extent of damage is unclear.
Unconfirmed: The extent of damage is unclear, and victim names come from a Reuters report coordinating with NorForge rather than NorForge's original report.
- NorForge found the activity via publicly exposed AI pen-test control panels.
- Two of three activity clusters were assessed as malicious.
- Named organizations are John Deere, SharkNinja, and Cummins.
- Workflows aimed to turn vulnerability discovery into access to victim infrastructure.
Impact: theft of payments from compromised websites
- Products
- Cairn
- Victims
- John DeereSharkNinjaCummins
- Organizations
- NorForge
- Countries
- United StatesAustraliaCanadaJapan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=similar-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 4056475ddaadba32176031a32b0b2af4 | omers-hacked-gainsight#recipe=similar-items&sourcecontentid=4056475ddaadba32176031a32b0b2af4) Deja Vu: Salesforce Customers Hacked Again, Via Gainsight |
| md5 | 772e2b458963b1a9ec224771cac5b591 | -orgs-high-end-malware#recipe=similar-items&sourcecontentid=772e2b458963b1a9ec224771cac5b591) Chinese APTs Hacking Asian Orgs With High-End Malware by |
From the original article
8 min read at darkreading.com
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.
By Elizabeth Montalbano · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.