Exposed Cairn Panels: Over 20 Dashboards and 1,100+ Projects in the Largest Observed Cluster

1. Basic Information

• Article Title: Inside Cairn: Open Windows into massive AI-Driven Cyber Operations
• Publisher: NorForge
• Publication Date: 2026-10-19
• Original Source: NorForge
• Related Source: Dark Reading / NorForge: Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
• Related Malware & Threat Groups: AIA0001, AIA0002, AIA0003
• Related CVE: CVE-2026-75650
• Related Products: Cairn, DeepSeek, Playwright, Magento, PHPGGC
• Severity: High
• Basis for Severity: NorForge confirmed an uploader-type web shell deployed on a single commercial site and observed instructions within attacker tasks requesting remote code execution (RCE) and information theft (this does not indicate successful compromise of all projects or arbitrary command execution via the uploader itself).
• Reason for Update: Updated to align the primary source, prerequisites, observation scope, confidence statements, and ATT&CK mappings with primary sources and official specifications. This editorial update is distinct from the original source's publication or update timestamp.

2. In Short

NorForge investigated more than 20 Cairn panels exposed without authentication on the internet, reporting that multiple financially motivated clusters used AI agents to conduct large-scale reconnaissance against e-commerce and payment sites. The largest observed cluster (AIA0001) accounted for over 1,100 projects across 14 panels.

3. Attack Flow

Cairn is a public tool also used for authorized penetration testing and other legitimate purposes. Human operators can intervene midway by adding hints to the shared workspace (blackboard) of each project, and this intervention is not treated as a uniform final step after compromise completion. Additionally, AIA0002 targets different objectives such as credit card and cryptocurrency theft, and AIA0003 has a low confidence rating regarding malicious intent.

Task Submission, Reconnaissance, and Human Intervention Observed in AIA0001

1. Target Prioritization and Automated Task Submission (AIA0001): According to NorForge's analysis, AIA0001's task-submission pipeline prioritized candidate sites by traffic volume, used Playwright to verify that orders could be placed, and then submitted the targets to Cairn (this procedure is not universal across all clusters).
2. Iterative RCE Exploration Tasks: Task instructions demanded searching for RCE through various vectors, including SQL injection (SQLi), file upload, deserialization, authentication bypass, SSTI, and SSRF (this does not imply that all instructed methods were executed or successful in every case).
3. Web Shell Deployment Confirmed (1 Commercial Site): At a commercial site URL noted in one of the completed tasks, NorForge confirmed the delivery of an uploader-type web shell (this confirmation is limited to that single URL and does not indicate success across all 1,100+ projects).

Cluster Classification	Observed Panels & Project Scale	Key Characteristics and Objectives	Confidence & Interpretive Notes
AIA0001	14 panels, 1,100+ projects	Chinese-speaking cluster. Selects e-commerce and payment sites in the US, Japan, Australia, and other regions based on traffic order and Playwright verification to search for RCE	Uploader-type web shell deployment confirmed on 1 commercial site. The 1,100+ figure represents the project count, not successful compromises
AIA0002	10 panels suspected to be related (some with low confidence in attribution)	Sets explicit goals for credit card and cryptocurrency theft, as well as financial transfers	Suggests the use of DeepSeek via Pi / OpenRouter
AIA0003	1 panel, 59 projects	Small-scale observed cluster	Evaluation of malicious activity remains low confidence

4. Attacker Position and Execution Environment

• Multiple financially motivated operators targeting internet-exposed web applications and APIs
• Externally exposed Cairn panels and AI worker containers
• Human operators managing target feeder pipelines and browser automation while providing hints to the blackboard

5. Perspective of Victims and Administrators

Victims

• On e-commerce and payment sites, web shell installation and credential theft may be taking place behind normal screen displays.
• Even organizations and customers utilizing Cairn for authorized penetration testing risk exposing target information and secrets externally if panels are published without authentication.

Administrators and SOCs

• Defenders may see rapidly changing, diverse probes, browser automation traffic, and prolonged RCE exploration, depending on their visibility.
• If a compromise occurs, suspicious file uploads, deserialization processing, shell launches, and unknown outbound communications may originate from web server processes.

6. Success and Failure Conditions

Success Conditions

• The presence of web application vulnerabilities, usable credentials, or similar flaws on each target site (pre-authentication RCE was listed as a task objective and is not a confirmed, universal entry vector across all projects).
• The AI agent remaining capable of continuously issuing trial attempts until the goal is achieved.
• The success of outbound communications where required for objectives such as data exfiltration (note that separate outbound C2 connections are not strictly mandatory for all web shell installations or operations conducted via HTTP requests).

Failure Conditions and Mitigations

• Legitimate Cairn operators must apply authentication and network restrictions to their panels to prevent exposing customer data externally. Meanwhile, targeted web operating organizations must patch application vulnerabilities and restrict permissions (it is essential not to confuse attacker-operated panels with an organization's own assets requiring remediation).
• Maintain inventory management for public web assets, timely patch deployment, appropriate WAF operations, and secure file upload restrictions.
• Continuously monitor file integrity (File Integrity Monitoring) for payment pages and critical server files.

7. What Happens Upon Success

• The 14 panels evaluated as associated with AIA0001 contained over 1,100 projects (this represents the project count within the largest observed cluster, not unique victim organizations or successful compromises).
• An uploader-type web shell was confirmed delivered on one commercial site, and other tasks contained instructions to steal credit card data and cryptocurrency (these are not treated as a sequence of successful thefts on the same compromised site).
• E-commerce sites in various countries, including Japan, were automatically prioritized and selected as targets based on traffic volume.

8. Observable Logs

Inference: The following items are candidates for internal organizational investigation. Availability depends on products, permissions, log configurations, and retention periods; individual suspicious operations or missing logs alone do not conclusively attribute activity or prove compromise.

Email

• No email-initiated entry vectors common to all clusters have been reported.

Proxy / SWG / DNS

• Check for probing traffic rapidly shifting across numerous endpoints, or outbound communications toward Cairn workers and C2 servers.

Endpoint / EDR

• Check for shell execution originating from web server processes, execution of PHP payloads, unexpected file creation, and web shell placement.

Identity / IdP

• Check for unexpected administrator logins, unauthorized API key usage, and credential replay attempts.

SaaS / Cloud

• Organizations utilizing Cairn internally should check public Cairn panel exposure status, customer data, project secrets, and worker container authentication settings.

Network

• Verify the chronological timeline of probe traffic such as SQLi, file uploads, SSTI, SSRF, and deserialization attempts.

9. Attack Success Assessment

• Subsequent Compromise Confirmed
• Basis: Publicly available information indicates NorForge confirmed uploader-type web shell delivery at a completed task URL (one commercial site). Although credentials and API keys were exposed separately on panels, records also show human entry of credentials obtained elsewhere, meaning not all acquisitions represent successful AI-driven theft.
• Scope: The figure of 1,100+ represents the number of projects and does not imply complete compromise success across all or attribution to a single operator.

10. Investigation Playbook

• Trigger: Check for shell execution from web processes, PHP payloads, unexpected file writing, and web shell artifacts.
• Initial Verification: Normalize target assets, accounts, and event times to UTC/JST, and preserve relevant logs.
• Endpoint & Server Investigation: Investigate server-side file and process modifications following high-volume diverse probes, browser automation traffic, and prolonged RCE exploration.
• Identity & Cloud Investigation: Check for unexpected admin logins, API key usage, and credential replays.
• Subsequent Actions: Investigate subsequent file uploads or searches for credentials and payment data following web shell installation (the 1,100+ projects in AIA0001 represent project volume, not unique victim organizations or successful compromises).
• Containment: Legitimate Cairn operators should apply authentication and network restrictions to protect customer data, while targeted web organizations should patch application vulnerabilities, restrict permissions, and remove suspicious files (do not confuse attacker panels with internal remediation targets).
• Assessment Categories: Clearly distinguish between contact (probes), execution, successful authentication, data acquisition, and subsequent compromise without presuming unverified successes.

11. Defense and Detection Ideas

• Single Event: Detect shell execution from web processes, PHP payload execution, unexpected file writing, and web shell installation.
• Chronological Correlation: Inference: Correlate diverse web probing traffic, file writing/uploader deployment, credential usage, and outbound communications chronologically per asset. Organizations operating Cairn legitimately must separately audit panel exposure scopes and hint/task modification histories.
• Threat Hunting: Hunt for chronological patterns of SQLi, file upload, SSTI, SSRF, deserialization attempts, and traces of automated order verification such as Playwright.
• Log Limitations: The success rate and actual impact range independently verified by victim organizations across all projects cannot be definitively determined from public data alone (the approximate "10%" figure mentioned in the source is an estimate for clusters with differing objectives and does not represent a comparable measured compromise rate).
• Priority Mitigations: Legitimate Cairn operators must apply authentication and network restrictions to their panels, and targeted web organizations must patch and restrict application permissions (do not confuse attacker panels with internal remediation targets). Maintain public web asset inventory management, patching, WAF operations, and secure upload restrictions while monitoring payment page and server file integrity.

12. Facts / Inference / Hypothesis

Facts

• Internet scans by NorForge identified over 20 unauthenticated Cairn panels and categorized them into multiple clusters suspected of malicious activity.
• The Chinese-speaking cluster AIA0001 maintained 14 panels containing over 1,100 attack projects, primarily targeting e-commerce and payment infrastructure in the US, Japan, Australia, and other regions.
• Although 10 panels suspected to be associated with AIA0002 explicitly targeted credit card and cryptocurrency theft, attribution confidence for some panels is considered low. AIA0003 has 1 panel and 59 projects and is assessed as malicious with low confidence.
• AIA0001's target-submission pipeline reportedly used traffic volume prioritization and Playwright order feasibility verification (this behavior is not treated as universal across all clusters, including AIA0002 and AIA0003).
• NorForge confirmed uploader-type web shell delivery on a single commercial site. Mentioned entry vectors like memcached writes and PHP deserialization represent agent-side explanations and do not imply independent replication of every stage. Furthermore, 1,100+ refers to the project count for AIA0001.
• No evidence indicates that legitimate Cairn maintainers or Tencent were involved in these malicious activities; this is an abuse case of publicly available tools.
• Human operators could add hints to project blackboards mid-stream, serving as input for Cairn's next intent determination. Worker names in AIA0001 suggest DeepSeek (implying v4.1 Flash), while AIA0002 indicates DeepSeek via Pi / OpenRouter, meaning identical models were not definitively used across all clusters.

Inference

• Rather than relying on novel, sophisticated vulnerabilities, AI agents widen the range of potential targets by repeatedly testing known web weaknesses and misconfigurations at low cost over extended periods.
• While exposing panels without authentication represents an operational security (OPSEC) failure by attackers, similar configuration errors by legitimate red teams could directly lead to customer data leaks.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Unknowns and Further Investigation".

13. MITRE ATT&CK Mappings

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	The records contain exploitation instructions and completed tasks against public web applications; NorForge independently confirmed an uploader-type web shell at one commercial-site URL. This does not represent successful compromise of all projects. Definition
T1505.003	Server Software Component: Web Shell	high	NorForge confirmed uploader-type web shell delivery at a completed task URL. Definition
T1552.001	Unsecured Credentials: Credentials In Files	medium	Panel records include credential discovery and collection, though records also show human entry of secrets obtained elsewhere, leaving individual acquisition vectors unverified. Definition
T1078	Valid Accounts	medium	Panel records show valid credentials and account usage. This does not indicate successful authentication across all projects and credentials. Definition

14. Unknowns and Further Investigation

• Success rates and actual impact scopes independently verified by victim organizations across all projects (the approximate "10%" figure in the source is an estimate for clusters with differing objectives and is not a comparable measured compromise rate)
• Overlaps in operators between individual clusters and previously reported Gambit "SOUL" or VULONE incidents
• Current shutdown status of the publicly exposed Cairn panels
• Actual counts and financial damages associated with stolen credit cards and cryptocurrency

15. Impact on SOCs and Organizations

Japanese e-commerce sites are explicitly included in targeted regions. Prioritize public web asset inventory management, continuous security testing, payment page integrity monitoring, and monitoring of web process child process creation and outbound communications. Base detection and blocking on actual web application behavior, regardless of whether AI is involved.

16. Summary by Target Audience

• For SOCs: Review chronological probe data for SQLi, file upload, SSTI, SSRF, and deserialization attempts, and monitor for shell execution from web processes, PHP payloads, unexpected file writing, and web shell deployment.
• For Administrators: Legitimate Cairn operators must apply authentication and network restrictions to their panels and avoid exposing customer data. Targeted web operating organizations must thoroughly patch application vulnerabilities and restrict permissions (do not confuse attacker panels with internal remediation targets).
• For Users: If you encounter suspicious notifications, operational failures, or authentication prompts, do not act independently or re-execute actions; contact administrators promptly.