Threat actors have been abusing open source AI platform Cairn to automate malicious operations against hundreds of websites worldwide, AI security firm Norforge reports.
Cairn is a general-purpose problem-solving engine that can coordinate AI agents towards a set goal and can be used as an autonomous penetration testing engine.
Each task in Cairn is considered a project, with an origin and a predefined goal, and agents work step by step from origin to goal, posting their intents and findings to a shared blackboard.
Following a recent Gambit Security report on hackers using three AI harnesses to automate attacks against hundreds of online retailers, Norforge decided to investigate further and discovered that some threat actors left their panels open.
On Cairn, the cybersecurity firm identified three clusters of activity that appear to be malicious, focused on persistent access and financial theft.
The largest of the clusters uses Chinese language and comprises over 1,100 attack projects across 14 dashboards. It has targeted e-commerce/payment infrastructure in the US, Japan, and Australia.
According to Norforge, the threat actor’s goal appears to be persistent access to large platforms via webshells, likely to be monetized later. Automated validation was also included, and targets were ranked by traffic and tested using Microsoft’s browser automation framework Playwright before being fed to Cairn.
While Norforge has not named any of the victims, Reuters reports that this threat actor breached over 100 companies, including US-based equipment maker John Deere and home appliance firm SharkNinja.
The second cluster of activity exposed 10 panels. The group uses English and focuses on credit card and cryptocurrency theft, mainly from merchant payment services, gray-market payment sites, and pharmaceutical platforms.
Some of the cluster’s targets are African commerce sites, and Norforge believes the threat actor has a base on that continent.
The third cluster exposed a panel with 59 projects targeting all types of e-commerce sites, including very large US-based commercial platforms. The group is focused on shell access, as well as admin panel and database access.
According to the cybersecurity firm, the threat actors were successful in roughly 10% of their attempts. Hundreds of secrets were found in the exposed panel data, 11% of which were verified as valid.
Related: AI Agents Aimed SQL Injection at US and Canadian Government Sites
Related: Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
Related: OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks
Related: AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds
