NorForge found over 20 exposed Cairn AI pentesting panels used in malicious cyber operations. Cairn is an AI-powered system that coordinates agents to probe targets and exploit weaknesses. More than 20 panels were linked to likely malicious activity. One cluster, AIA0001, ran over 1,100 attack projects targeting US, Japan, and Australia. AIA0001 uses automated pipelines to validate and rank e-commerce targets before exploitation. AIA0002 focuses on financial theft, exposing backend staging host credentials in taskings. AIA0003 shows exploratory behavior, starting as authorized assessments before shifting to exploitation. The average cost per task is estimated at $5, with long-running projects exceeding $100. Some panels also exposed legitimate red team operations, risking client data. Panels reveal sensitive target details, including vulnerabilities, account secrets, and compromise status.
What changed
Cairn panels were previously assumed to be used only for legitimate penetration testing.
What it unlocks
Visibility into how threat actors use AI-driven tools to automate cyber attacks at scale.
- 20+ exposed Cairn panels
- 1,100+ attack projects in AIA0001
- $5 average task cost
- $100+ for long-running projects
Sources