AI agents tied to breaches of more than 100 company websites
Original title: One Hacker Uses AI Agents to Breach Over 100 Company Websites for Just $5,000
NorForge estimates about $5,000 in tokens for a campaign that tried more than 1,200 sites, mostly online stores.
Reuters and NorForge report that a Chinese-speaking operator used the open-source Cairn agent platform to compromise more than 100 company websites. After September 25, agents tried more than 1,200 sites, mainly stores in the United States, Canada, Australia and Japan, seeking unauthenticated code execution and payment-system access. NorForge tracked cluster AIA0001 across 14 dashboards and more than 1,100 projects and confirmed one webshell. Deere, SharkNinja and Cummins gave differing accounts; how much data was taken is unknown.
Unconfirmed: Token costs are estimates; operator nationality is unconfirmed, and Reuters could not determine how much data was taken.
- NorForge estimated about a 10% success rate and roughly $50 per successful intrusion.
- Successful AIA0001 projects averaged just under 23 hours; one ran more than five days.
- One confirmed chain used memcached writes, PHP object deserialization and older Zend Framework components.
- Deere said it found no access to sensitive information; SharkNinja said a support site was contained.
- NorForge found hundreds of exposed secrets in open panels and is notifying victims with Reuters.
Impact: Webshell footholds and possible access to shopping and payment systems
- 1.Patch public-facing applications and restrict access to admin panels.
- 2.Watch web directories for unexpected files and isolate servers where webshells are found.
- 3.Review suspicious web requests and check for stolen data before restoring service.
- Products
- Cairn
- Threat actors
- AIA0001
- Victims
- DeereSharkNinjaCummins
- Organizations
- NorForge
- Countries
- United StatesCanadaAustraliaJapan
From the original article
4 min read at cybersecuritynews.com
A Chinese-speaking hacker used AI agents to break into more than 100 company websites while spending an estimated $5,000 on AI tokens, according to a Reuters investigation in October. The operation shows how one person can direct software to carry out complex attacks with little ongoing human input. The targets included sites linked to Deere, […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.