The original text is in EN, taken from the source site. Source ↗

Attackers have compromised at least 17 internet-exposed Cairn AI penetration-testing panels, turning autonomous security agents against their own infrastructure to steal credentials, establish unauthorized access, and deploy malware.

Victims included panels associated with suspected criminal operations, alongside instances apparently used for legitimate red teaming, bug bounty research, and capture-the-flag challenges.

The attacks exploit unauthenticated administrative access rather than a newly disclosed software vulnerability.

Once inside an exposed panel, intruders can create projects and instruct agents to execute commands against the infrastructure running them.

NorForge provisionally tracks the activity as AIA0009 and AIA0010. Although their instructions contain similar wording, researchers found no shared hard indicators establishing that both clusters belong to the same operator.

AIA0009 appends random hexadecimal strings to task names and prioritizes persistence, remote access, and malware deployment.

Its reconnaissance commands use the marker “cairnscan” before collecting the executing account’s identity and hostname.

AIA0010 uses task labels resembling Cairn’s native intent identifiers, such as “i014.” Its operations emphasize environment discovery, internal services, infrastructure mapping, credential extraction, and scanning additional public IP ranges for exposed panels.

Cairn panel with suspicious looking tasks (Source : Norforge).

Attackers directed agents to enumerate environment variables, listening ports, configuration files, and potential secrets, including AI model API credentials.

Norforge said in a report shared with GBhackers, the campaigns intensified around October 20, 2026, though related reconnaissance may have begun as early as October 10.

Results were written into publicly accessible “facts,” turning the panels into an additional disclosure channel.

The findings extend earlier reporting on exposed Cairn infrastructure, which described criminal operators inadvertently revealing targets, project histories, and stolen secrets through unsecured dashboards.

Several injected tasks instructed agents to install attacker-controlled SSH public keys into the kali account’s authorized_keys file.

Activity patterns between the two groups (Source : Norforge).

Researchers observed agent output confirming installation, ownership changes, and restrictive file permissions, demonstrating successful execution of unauthorized administrative instructions.

Other tasks inspected Linux capabilities, mounted filesystems, Docker sockets, and security restrictions to identify possible container escape paths. NorForge could not determine whether attackers successfully crossed those isolation boundaries.

On October 21 at 21:15 UTC, AIA0009 submitted a maintenance-themed task containing a Base64-encoded shell script.

After decoding, it downloaded a Linux executable named worker-health from 199.91.220[.]129:28471, verified its SHA-256 checksum, and launched it in the background.

The payload was identified as Poseidon, a Go-based implant associated with the open-source Mythic command-and-control ecosystem. Its official repository describes support for Linux and macOS targets.

The observed sample reportedly communicated through Bunny.net CDN infrastructure.

An accompanying loop kept the agent task alive until a designated stop file appeared, apparently preserving the workspace and extending the implant’s operating window.

Synchronized task creation across unrelated panels strongly indicates scripted coordination.

In one sequence, five panels received tightly clustered probes, followed exactly two hours and forty minutes later by additional projects targeting access and malware execution.

However, automation does not establish autonomous AI orchestration. Cairn-like intent labels and operational patterns suggest that possibility, but researchers lacked visibility into the systems issuing instructions.

The central exposure is architectural: an accessible agent dashboard can become a privileged command interface.

Containerization may limit immediate reach, but it does not protect secrets already available inside an agent workspace.

The observed campaigns show how insecure control planes can reverse an AI security tool’s role, transforming the tester into the compromised target.

IOCs

103.181.134[.]12 Gen1 C2 199.91.220[.]129 Gen2 C2 64.176.50[.]179 Gen3 C2 74342459543956677599003426txhdpndwdwy.b-cdn[.]net Poseidon Bunnynet C2

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.