Loading threat actor…
AIA0002 is a financially motivated cybercriminal activity cluster that uses Cairn AI-agent infrastructure to conduct automated attacks and financial theft. Its operations use English-language tasking and target merchant payment services, gray-market payment websites, pharmaceutical websites, commerce websites, and a criminal carding site. Its geographic origin has not been established. AIA0002 directs agents to steal payment-card data and cryptocurrency, upload stolen information to attacker-controlled infrastructure, and transfer funds between cryptocurrency wallets. Its operational infrastructure includes publicly exposed Cairn control panels and backend staging hosts, with staging-host SSH credentials embedded in project instructions. The exposed panels reveal targeting and financial-theft objectives. AIA0002 is distinct from the activity clusters that subsequently compromised exposed Cairn installations; malware deployment and persistence observed in those separate campaigns are not established AIA0002 capabilities.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
2 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.