Chinese-speaking attackers used Cairn AI against chip and defense groups
Original title: Chinese-Speaking Hackers Weaponize Cairn AI Framework to Breach Semiconductor and Defense Organizations
Ten of at least 19 targeted organizations had confirmed access or data theft, including more than one million union records.
Unit 42 says Chinese-speaking operators used the open-source Cairn penetration-testing framework in 25 operations against at least 19 organizations in August and September 2026. Ten had confirmed unauthorized access or data retrieval, spanning semiconductor, defense-policy, and civil-society targets. Operators paired Cairn with Zhipu GLM 5.2 and DeepSeek V4 models and supplied a domain and an objective. Unit 42 tracks the activity as CL-STA-1238 with moderate confidence of China-nexus collection, without naming a government sponsor.
Unconfirmed: Unit 42’s China-nexus assessment is moderate confidence and does not identify a government sponsor.
- Operations lasted from 20 minutes to more than 50 hours.
- A U.S. teachers’ union exposure included more than one million member records.
- A defense-program endpoint revealed roughly 500 user records with government emails.
- Thirteen operations used GLM 5.2, eight DeepSeek V4 Flash, and four V4 Pro.
- Infrastructure included 154.44.31[.]4 in Hong Kong and 82.29.129[.]54 in the United States.
Impact: Unauthorized access and retrieval of member, employee, and industrial data
- 1.Block 154.44.31[.]4 and 82.29.129[.]54 in threat-intelligence tooling.
- 2.Hunt for customized Cairn deployments loading AIScan Runner Skills.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110.003 Password SprayingT1136 Create AccountT1078 Valid Accounts
- Products
- Cairn
- Threat actors
- CL-STA-1238
- Organizations
- Unit 42
- Countries
- ChinaHong KongUnited States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 154.44.31.4 | Unit42). Infrastructure included a Hong Kong controller at 154.44.31[.]4 and a U.S. staging and egress server at 82.29.129[.]54. T |
| ipv4 | 82.29.129.54 | .]4 Cairn hosting server Hong Kong (HK) AS979 NetLab Global 82.29.129[.]54 Staging server and attack egress United States (US) AS142 |
From the original article
3 min read at gbhackers.com
Chinese-speaking attackers weaponized the open-source Cairn penetration-testing framework to conduct 25 autonomous operations against at least 19 organizations during August–September 2026. Ten organizations experienced confirmed unauthorized access or data retrieval, exposing how agentic AI can translate brief operator instructions into sustained intrusion attempts.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.