Loading malware…
Cairn is an open-source autonomous penetration-testing agent platform that has been abused by threat actors to conduct intrusions. It is a dual-use offensive security framework rather than a dedicated malware family. In October 2026, Cairn was linked to an unnamed actor targeting the websites of more than 100 companies. Associated activity included infiltration of retail e-commerce sites, point-of-sale infrastructure, and web applications worldwide. Google Threat Intelligence Group and Mandiant also identified CAIRN among agentic penetration-testing frameworks used by threat actors in real-world intrusions. Specific operating-system requirements and a named threat-actor attribution have not been established.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
« Reconnaissance automatisée d’infrastructure associée à des cibles »
Automated fingerprinting of backend frameworks (Node.js, Express, Nginx).
« Reconnaissance automatisée d’infrastructure associée à des cibles » ; « Découverte de panneaux de contrôle exposés publiquement »
AI agents autonomously crawled endpoints and identified input vectors.
The AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel.
« Exploitation de vulnérabilités de traitement de données (injection de commandes) »
« Exécution de commandes malveillantes côté serveur après des heures d’essais-erreurs autonomes »
Execution of web shell evaluation commands (whoami, id) to verify access.
« Escalade sudo NOPASSWD python3.12 → root ».
The AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel.
WP admin write (new user via DB) -> WP plugin upload.
Deployment of persistent backdoor shells in web-accessible directories.
The AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel.
WP admin write (new user via DB) -> WP plugin upload.
[The agent] escalated privileges through a misconfigured sudo rule.
Synthesis of PNG/JavaScript polyglot files to evade file-type filters.
Staging web shells under names like logo_thumb.png.js in public asset paths.
The AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel.
Dynamic payload re-encoding to bypass Cloudflare and AWS WAF signatures.
OTP plaintext read from the OTP table (MFA bypass) -> admin panel access.
[The agent] accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB.
« Montage NFS (no_root_squash) → credentials WP » ; accès à des secrets AWS et clés de chiffrement.
AWS Secrets Manager full dump (46 secrets, 102KB) -> Main Magento DB access (Aurora) -> Magento encryption key extraction.
Automatic execution of system profiling commands upon shell verification.
The operator “pivoted across an NFS mount.”
« Montage NFS (no_root_squash) → credentials WP ».
Scraping of database configuration files (config.json, .env) on compromised hosts.
The actor “reached the main Magento database, and finally extracted the encryption key to decrypt stored card numbers.”
155.254.22.215 Staging and command server, AI console... 213.21.239.62 C2.
They then pasted 301 results into the console with a message that ended with 跑这些 用代理 只扫高危 (“run these, use the proxy, high severity only”).
La liste des TTPs identifie T1102 ; les opérateurs utilisent OpenRouter pour accéder aux modèles IA utilisés dans la campagne.
The campaign stole “over 600,000 credit card records” and a Hermes skill was titled “Database Wipe After Extraction.”
In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.