Threat Actors Abuse Cairn AI Platform in Attacks on More Than 100 Organizations
Summary
Norforge reports three malicious activity clusters using Cairn to target e-commerce and payment services. Reuters reports that one actor breached more than 100 companies; Norforge says the actors succeeded in roughly 10% of attempts.
Key points
- Norforge identified three apparently malicious clusters after finding exposed Cairn dashboards.
- The largest cluster had more than 1,100 projects across 14 dashboards and targeted e-commerce and payment infrastructure in the US, Japan, and Australia.
- Norforge says the largest cluster sought persistent access, including through webshells, and ranked and tested targets with Playwright.
- Reuters reported that the actor behind the largest cluster breached more than 100 companies, including John Deere and SharkNinja; Norforge did not name victims.
- A second cluster focused on credit-card and cryptocurrency theft, while a third sought shell, admin-panel, and database access.
- Norforge estimates the actors succeeded in roughly 10% of attempts and found hundreds of secrets in exposed panel data, 11% of which it verified as valid.
Article Details
- Event Type
- Abuse of an open-source AI platform to automate malicious cyber operations
- Impact
- Norforge reported three apparently malicious activity clusters using Cairn to target e-commerce, payment, and pharmaceutical platforms. Reported objectives included persistent access through webshells, credit card and cryptocurrency theft, and access to admin panels and databases. The actors reportedly succeeded in roughly 10% of attempts; hundreds of exposed secrets were found, with 11% verified as valid. Reuters reported that one actor breached more than 100 companies, including John Deere and SharkNinja.
MITRE ATT&CK
Products
Tools
Countries
AustraliaThe largest of the clusters uses Chinese language and comprises over 1,100 attack projects across 14 dashboards. It has targeted e-commerce/payment infrastructure in the US, Japan, and Australia.JapanThe largest of the clusters uses Chinese language and comprises over 1,100 attack projects across 14 dashboards. It has targeted e-commerce/payment infrastructure in the US, Japan, and Australia.
Industries
E-commerceThe largest of the clusters uses Chinese language and comprises over 1,100 attack projects across 14 dashboards. It has targeted e-commerce/payment infrastructure in the US, Japan, and Australia.Payment servicesThe group uses English and focuses on credit card and cryptocurrency theft, mainly from merchant payment services, gray-market payment sites, and pharmaceutical platforms.pharmaceuticalThe group uses English and focuses on credit card and cryptocurrency theft, mainly from merchant payment services, gray-market payment sites, and pharmaceutical platforms.