Attackers used open-source Cairn against over 100 organizations
Original title: AI Platform Cairn Abused to Hack Over 100 Organizations
Norforge found three exposed-panel clusters; Reuters names John Deere and SharkNinja, and about 10% of attempts succeeded.
Norforge says attackers left Cairn panels open and used the open-source agent platform to automate intrusions against websites. The largest, Chinese-language cluster ran more than 1,100 projects from 14 dashboards against e-commerce and payment sites in the US, Japan, and Australia, seeking webshells. An English-language cluster focused on card and cryptocurrency theft, and a third ran 59 projects for shells, admin panels, and databases. Norforge did not name victims; Reuters reports breaches of more than 100 companies, including John Deere and SharkNinja.
Unconfirmed: Reuters, not Norforge, names John Deere, SharkNinja, and a breach count above 100 companies.
- Targets were ranked by traffic and tested with Playwright before Cairn runs.
- Norforge says roughly 10% of attempts succeeded.
- Hundreds of secrets were exposed; 11% were verified as valid.
- The second cluster exposed 10 panels, including African commerce sites.
- The largest cluster covered more than 1,100 attack projects.
Impact: Persistent site access and payment or card theft
- ATT&CK
- T1505.003 Web Shell
- Vendors
- Microsoft
- Products
- CairnPlaywright
- Victims
- John DeereSharkNinja
- Organizations
- Norforge
- Countries
- United StatesJapanAustraliaChina
From the original article
2 min read at securityweek.com
At least three threat actors have been abusing Cairn for persistent access and financial theft. The post AI Platform Cairn Abused to Hack Over 100 Organizations appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.