Unit 42: actors used DeepSeek and GLM agents to breach 10 organizations
Original title: Hackers Use DeepSeek and GLM AI Agents to Breach 10 Organizations in Autonomous Cyberattacks
CL-STA-1238 ran 25 Cairn operations in August and September 2026, hitting semiconductor, defense-policy and civil-society targets.
Unit 42 says Chinese-speaking operators used the open-source Cairn penetration-testing framework with DeepSeek and Zhipu GLM models to break into 10 organizations. Of 25 operations against at least 19 targets, 13 used GLM 5.2, eight DeepSeek V4 Flash and four DeepSeek V4 Pro. Access came through known flaws, weak passwords and exposed APIs, exposing credentials, member records and internal documents. Unit 42 tracks the activity as CL-STA-1238 and assesses a China-linked intelligence effort with moderate confidence.
Unconfirmed: Unit 42 assesses a China link only with moderate confidence.
- Seven targets were in semiconductor and advanced manufacturing; three were defense-related.
- A CMS flaw exposed more than one million member records and about 31,000 CRM contacts.
- An industrial-automation case involved about 150,000 internal documents.
- Cairn hosting was tied to 154.44.31[.]4 and egress to 82.29.129[.]54.
- Neither GLM nor DeepSeek refused tasks framed as authorized tests.
Impact: Stolen credentials, member records, documents and internal access
- 1.Use unique passwords and phishing-resistant MFA.
- 2.Patch known CVEs and reduce internet-facing systems.
- 3.Watch for high-frequency requests from a single IP.
- ATT&CK
- T1110.003 Password SprayingT1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1068 Exploitation for Privilege Escalation
- Products
- Cairn
- Threat actors
- CL-STA-1238
- Organizations
- Unit 42
- Countries
- ChinaUnited StatesCanada
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 154.44.31.4 | f compromise (IoCs):- Type Indicator Description IP address 154.44.31[.]4 Cairn hosting server (Hong Kong, AS979, NetLab Global) IP |
| ipv4 | 82.29.129.54 | hosting server (Hong Kong, AS979, NetLab Global) IP address 82.29.129[.]54 Staging server and attack egress node (U.S., AS142036, Ho |
From the original article
4 min read at cybersecuritynews.com
Chinese-speaking hackers have used AI agents powered by DeepSeek and Zhipu GLM to break into 10 organizations with very little human effort. The campaign ran in August and September 2026 and covered 25 operations against at least 19 targets. It shows how quickly autonomous AI cyberattacks are moving from theory into daily use.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.