Attackers hijack 17 exposed Cairn AI pentest panels, deploy Poseidon
Original title: Hackers Compromise 17 Exposed AI Pentesting Panels to Deploy Malware and Steal Credentials
NorForge tracks clusters AIA0009 and AIA0010 using open admin access, not a newly disclosed vulnerability.
Attackers compromised at least 17 internet-exposed Cairn AI penetration-testing panels, including panels tied to suspected criminal use and to red teaming, bug bounty work, and CTF challenges. Intruders used unauthenticated administrative access to create projects and order agents to run commands, steal credentials, add SSH keys, and deploy malware. NorForge provisionally tracks the activity as AIA0009 and AIA0010. Campaigns intensified around October 20, 2026, with related reconnaissance possibly from October 10. On October 21, AIA0009 launched a Base64 shell script that fetched a Linux binary identified as Poseidon, a Go implant from the Mythic ecosystem.
Unconfirmed: NorForge found no shared hard indicators linking AIA0009 and AIA0010 and could not confirm container escape or autonomous AI orchestration.
- AIA0009 favors persistence, remote access, and malware; AIA0010 emphasizes discovery and credential extraction.
- Several tasks installed attacker SSH public keys for the kali account; agent output confirmed installation.
- The Poseidon sample was downloaded from 199.91.220[.]129:28471 and reportedly used Bunny.net CDN.
- NorForge could not confirm container escapes or that both clusters share an operator.
- Results were written into publicly accessible panel “facts.”
Impact: Credential theft, unauthorized access, and malware on agent hosts
| Product | Affected |
|---|---|
| Cairn AI penetration-testing panels | — |
- 1.Keep Cairn administrative panels off the public internet.
- 2.Check the kali account authorized_keys file for attacker-added SSH keys.
- 3.Hunt for the Poseidon sample and the listed Gen1–Gen3 and Bunny.net indicators.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | b-cdn.net | .176.50[.]179 Gen3 C2 74342459543956677599003426txhdpndwdwy.b-cdn[.]net Poseidon Bunnynet C2 Note: IP addresses and domains are i |
| domain | bunny.net | argets. The observed sample reportedly communicated through Bunny.net CDN infrastructure. An accompanying loop kept the agent tas |
| ipv4 | 103.181.134.12 | , transforming the tester into the compromised target. IOCs 103.181.134[.]12 Gen1 C2 199.91.220[.]129 Gen2 C2 64.176.50[.]179 Gen3 C2 |
| ipv4 | 199.91.220.129 | , it downloaded a Linux executable named worker-health from 199.91.220[.]129:28471, verified its SHA-256 checksum, and launched it in |
| ipv4 | 64.176.50.179 | get. IOCs 103.181.134[.]12 Gen1 C2 199.91.220[.]129 Gen2 C2 64.176.50[.]179 Gen3 C2 74342459543956677599003426txhdpndwdwy.b-cdn[.]net |
From the original article
3 min read at gbhackers.com
Attackers have compromised at least 17 internet-exposed Cairn AI penetration-testing panels, turning autonomous security agents against their own infrastructure to steal credentials, establish unauthorized access, and deploy malware.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.