AIA0001

AIA0001 is a financially motivated, Chinese-language cybercriminal activity cluster that uses the Cairn AI-agent coordination platform to automate attacks against e-commerce websites and payment infrastructure. Its operations encompass 14 associated dashboards containing more than 1,100 attack projects, primarily targeting organizations in the United States, Japan, Australia, and Canada. Chinese-language tasking does not establish the operators’ nationality, and no state affiliation has been established. The cluster uses Microsoft Playwright to validate that prospective shopping-site targets can accept orders before directing AI agents to identify and exploit weaknesses. Its tasking prioritizes unauthenticated remote code execution, SQL injection, unsafe file uploads, deserialization, authentication bypass, and account takeover. Agents share discoveries through a common project board and adapt their attack paths with limited ongoing human guidance. Associated tooling includes PHPGGC, OWASP Amass, dnsrecon, ffuf, and Nmap. AIA0001 seeks persistent access that can subsequently be monetized, including deploying uploader webshells as footholds on compromised websites. A functioning uploader webshell was independently confirmed on a hardware vendor’s website. Successful projects averaged slightly less than 23 hours, with some running for several days. The extent of data theft has not been established. Unsecured operational dashboards exposed targeting information, discovered vulnerabilities, compromise status, and sensitive credentials.