Hujumchilar kamida 17 ta internetga ochiq Cairn AI pentesting panelini buzib kirishdi va avtonom xavfsizlik agentlarini o'z infratuzilmasiga qarshi ishlatib, ma'lumotlarni o'g'irlash, ruxsatsiz kirish o'rnatish va zararli dastur o'rnatishdi.
Jabrlanuvchilar orasida gumon qilingan jinoiy operatsiyalar bilan bog'liq panellar, shuningdek, qonuniy red teaming, bug bounty tadqiqotlari va capture-the-flag musobaqalari uchun ishlatilgan holatlar ham bor edi.
Hujumlar yangi aniqlangan dasturiy zaiflik emas, balki autentifikatsiyasiz ma'muriy kirishdan foydalanadi.
Ochiq panel ichiga kirgach, buzg'unchilar loyihalar yaratishi va agentlarga ularni ishlatayotgan infratuzilmaga qarshi buyruqlar bajarishni buyurishi mumkin.
NorForge faoliyatni AIA0009 va AIA0010 deb vaqtinchalik kuzatadi. Ularning buyruqlari o'xshash so'zlashuvni o'z ichiga olsa-da, tadqiqotchilar ikkala klaster bir operatorga tegishli ekanligini isbotlovchi umumiy qattiq indikatorlar topmadi.
AIA0009 vazifa nomlariga tasodifiy o'n oltilik satrlar qo'shadi va doimiylik, masofaviy kirish va zararli dastur o'rnatishga ustuvorlik beradi.
Uning razvedka buyruqlari "cairnscan" belgisidan foydalanadi, so'ngra bajarilayotgan hisobning shaxsini va xost nomini to'playdi.
AIA0010 Cairnning mahalliy maqsad identifikatorlariga o'xshash vazifa yorliqlaridan foydalanadi, masalan "i014". Uning operatsiyalari muhitni aniqlash, ichki xizmatlar, infratuzilmani xaritalash, ma'lumotlarni olish va ochiq panellarni topish uchun qo'shimcha umumiy IP diapazonlarini skanerlashga qaratilgan.
Shubhali ko'rinadigan vazifalar bilan Cairn paneli (Manba: Norforge).
Hujumchilar agentlarga muhit o'zgaruvchilari, tinglayotgan portlar, konfiguratsiya fayllari va potentsial sirlarni, jumladan AI model API ma'lumotlarini sanab o'tishni buyurishdi.
Norforge GBhackers bilan bo'lishgan hisobotida aytishicha, kampaniyalar 2026-yil 20-oktabr atrofida kuchaygan, garchi bog'liq razvedka 10-oktabrdayoq boshlanishi mumkin.
Natijalar ommaviy kirish mumkin bo'lgan "faktlar"ga yozildi va panellarni qo'shimcha oshkor qilish kanaliga aylantirdi.
Topilmalar avvalgi ochiq Cairn infratuzilmasi haqidagi hisobotni kengaytiradi, unda jinoiy operatorlar tasodifan maqsadlar, loyiha tarixi va o'g'irlangan sirlarni himoyalanmagan boshqaruv panellari orqali oshkor qilgani tasvirlangan.
Bir nechta kiritilgan vazifalar agentlarga hujumchi nazoratidagi SSH ochiq kalitlarini kali hisobining authorized_keys fayliga o'rnatishni buyurdi.
Faoliyat naqshlari ikkala guruh o'rtasida (Manba: Norforge).
Tadqiqotchilar agent natijalarida o'rnatish, egalik o'zgarishi va cheklovchi fayl ruxsatlari tasdiqlanganini kuzatishdi, bu ruxsatsiz ma'muriy buyruqlarning muvaffaqiyatli bajarilishini ko'rsatadi.
Boshqa vazifalar Linux imkoniyatlari, o'rnatilgan fayl tizimlari, Docker soketlari va xavfsizlik cheklovlarini tekshirib, mumkin bo'lgan konteynerdan qochish yo'llarini aniqladi. NorForge hujumchilar bu izolyatsiya chegaralarini muvaffaqiyatli kesib o'tganini aniqlay olmadi.
21-oktabr 21:15 UTC da AIA0009 texnik xizmat ko'rinishidagi vazifa yubordi, unda Base64-kodlangan shell skripti bor edi.
Dekodlashdan so'ng, u 199.91.220[.]129:28471 dan worker-health nomli Linux bajariladigan faylni yuklab oldi, uning SHA-256 nazorat summasini tekshirdi va fonda ishga tushirdi.
Yuklama Poseidon deb aniqlandi, bu ochiq manbali Mythic buyruq va nazorat ekotizimi bilan bog'liq Go asosidagi implant. Uning rasmiy repozitoriyasi Linux va macOS maqsadlarini qo'llab-quvvatlashini tasvirlaydi.
Kuzatilgan namuna Bunny.net CDN infratuzilmasi orqali aloqa qilgani xabar qilindi.
Birga kelgan tsikl agent vazifasini belgilangan to'xtash fayli paydo bo'lguncha tirik saqladi, bu ish maydonini saqlab qolish va implantning ishlash oynasini uzaytirish maqsadida edi.
Bir-biriga bog'liq bo'lmagan panellarda sinxron vazifa yaratish kuchli skriptli muvofiqlashtirishni ko'rsatadi.
Bir ketma-ketlikda beshta panelga tez klasterlangan tekshiruvlar yuborildi, so'ngra aynan ikki soat qirq daqiqadan keyin kirish va zararli dastur bajarishga qaratilgan qo'shimcha loyihalar yuborildi.
Biroq, avtomatlashtirish avtonom AI orkestratsiyasini isbotlamaydi. Cairn-ga o'xshash maqsad yorliqlari va operatsion naqshlar bu imkoniyatni ko'rsatadi, lekin tadqiqotchilar buyruqlarni berayotgan tizimlarga ko'rinishga ega emas edi.
Asosiy ochiqlik arxitektura bilan bog'liq: kirish mumkin bo'lgan agent boshqaruv paneli imtiyozli buyruq interfeysiga aylanishi mumkin.
Konteynerlash darhol ta'sirni cheklashi mumkin, lekin u agent ish maydonida allaqachon mavjud bo'lgan sirlarni himoya qilmaydi.
Kuzatilgan kampaniyalar himoyalanmagan nazorat tekisliklari AI xavfsizlik vositasining rolini qanday teskari aylantirishi, tekshiruvchini buzilgan maqsadga aylantirishini ko'rsatadi.
IOC lar
103.181.134[.]12 Gen1 C2 199.91.220[.]129 Gen2 C2 64.176.50[.]179 Gen3 C2 74342459543956677599003426txhdpndwdwy.b-cdn[.]net Poseidon Bunnynet C2
Eslatma: IP manzillar va domenlar tasodifan hal qilinishi yoki giperhavola bo'lishining oldini olish uchun ataylab defanged (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.
Attackers have compromised at least 17 internet-exposed Cairn AI penetration-testing panels, turning autonomous security agents against their own infrastructure to steal credentials, establish unauthorized access, and deploy malware.
Victims included panels associated with suspected criminal operations, alongside instances apparently used for legitimate red teaming, bug bounty research, and capture-the-flag challenges.
The attacks exploit unauthenticated administrative access rather than a newly disclosed software vulnerability.
Once inside an exposed panel, intruders can create projects and instruct agents to execute commands against the infrastructure running them.
NorForge provisionally tracks the activity as AIA0009 and AIA0010. Although their instructions contain similar wording, researchers found no shared hard indicators establishing that both clusters belong to the same operator.
AIA0009 appends random hexadecimal strings to task names and prioritizes persistence, remote access, and malware deployment.
Its reconnaissance commands use the marker “cairnscan” before collecting the executing account’s identity and hostname.
AIA0010 uses task labels resembling Cairn’s native intent identifiers, such as “i014.” Its operations emphasize environment discovery, internal services, infrastructure mapping, credential extraction, and scanning additional public IP ranges for exposed panels.
Cairn panel with suspicious looking tasks (Source : Norforge).
Attackers directed agents to enumerate environment variables, listening ports, configuration files, and potential secrets, including AI model API credentials.
Norforge said in a report shared with GBhackers, the campaigns intensified around October 20, 2026, though related reconnaissance may have begun as early as October 10.
Results were written into publicly accessible “facts,” turning the panels into an additional disclosure channel.
The findings extend earlier reporting on exposed Cairn infrastructure, which described criminal operators inadvertently revealing targets, project histories, and stolen secrets through unsecured dashboards.
Several injected tasks instructed agents to install attacker-controlled SSH public keys into the kali account’s authorized_keys file.
Activity patterns between the two groups (Source : Norforge).
Researchers observed agent output confirming installation, ownership changes, and restrictive file permissions, demonstrating successful execution of unauthorized administrative instructions.
Other tasks inspected Linux capabilities, mounted filesystems, Docker sockets, and security restrictions to identify possible container escape paths. NorForge could not determine whether attackers successfully crossed those isolation boundaries.
On October 21 at 21:15 UTC, AIA0009 submitted a maintenance-themed task containing a Base64-encoded shell script.
After decoding, it downloaded a Linux executable named worker-health from 199.91.220[.]129:28471, verified its SHA-256 checksum, and launched it in the background.
The payload was identified as Poseidon, a Go-based implant associated with the open-source Mythic command-and-control ecosystem. Its official repository describes support for Linux and macOS targets.
The observed sample reportedly communicated through Bunny.net CDN infrastructure.
An accompanying loop kept the agent task alive until a designated stop file appeared, apparently preserving the workspace and extending the implant’s operating window.
Synchronized task creation across unrelated panels strongly indicates scripted coordination.
In one sequence, five panels received tightly clustered probes, followed exactly two hours and forty minutes later by additional projects targeting access and malware execution.
However, automation does not establish autonomous AI orchestration. Cairn-like intent labels and operational patterns suggest that possibility, but researchers lacked visibility into the systems issuing instructions.
The central exposure is architectural: an accessible agent dashboard can become a privileged command interface.
Containerization may limit immediate reach, but it does not protect secrets already available inside an agent workspace.
The observed campaigns show how insecure control planes can reverse an AI security tool’s role, transforming the tester into the compromised target.
IOCs
103.181.134[.]12 Gen1 C2 199.91.220[.]129 Gen2 C2 64.176.50[.]179 Gen3 C2 74342459543956677599003426txhdpndwdwy.b-cdn[.]net Poseidon Bunnynet C2
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.