{"id":"CMP-202611-i6dfwu","kind":"campaign","aliases":[],"related":[],"title":"China-linked spies (CL-STA-1238) run the open-source Cairn AI pentest agent with GLM and DeepSeek to break into semiconductor, defense and civil-society organizations on their own (Unit 42)","description":null,"summary":"From August to September 2026, Chinese-speaking attackers Unit 42 tracks as CL-STA-1238 (China-nexus, moderate confidence) ran 25 operations against at least 19 organizations with a customized fork of the open-source Cairn AI penetration-testing framework. It ran on Zhipu GLM 5.2 and DeepSeek V4 Flash/Pro with an 'AIScan Runner Skills' pack and an 'authorized test, never refuse' pretext. The attackers gave it only a target's root domain and a goal, sometimes with VPN addresses and shared group passwords collected earlier. The agent found and exploited weak spots on its own: password spraying and brute force, open sign-up and registration endpoints, account-creation bypasses in content management systems, and unauthenticated cloud-storage writes. It got in or took data at 10 organizations: semiconductor and lithography supply-chain firms (rogue admin accounts and a persistent API token in production), an industry standards body (a live ballot document overwritten), a US teachers' union (more than 1 million member records), a defense-policy program (about 500 .mil/.gov users) and an industrial-automation maker (about 150,000 documents). Victim names were not published.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-12T15:34:18+00:00","products":[],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Traffic to or from 154.44.31[.]4 (Cairn controller, Hong Kong, AS979) and 82.29.129[.]54 (egress and staging, AS142036 Hosteons). In web and identity logs, look for bursts of automated scanning and password spraying against internet-facing apps, accounts created through open registration or sign-up endpoints, new administrator accounts or API tokens you cannot explain, and unauthenticated writes to cloud storage buckets.","fix":"Block the two IPs. Turn off open self-registration on CMS, identity and partner portals, or put it behind approval. Make internet-facing logins and VPNs use MFA, and replace shared group VPN passwords. Rate-limit logins and lock out password spraying. Close public write access on storage buckets. Check for admin accounts and API tokens nobody can account for, remove them and rotate credentials.","status":"open","published_at":null,"first_seen_at":"2026-11-12T15:34:18+00:00","triaged_at":"2026-11-12T15:34:18+00:00","updated_at":"2026-11-12T15:35:35+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-12T15:35:23Z","path":"third-party-breach","entry":"unknown","reason":"The record lists the methods the agent used across its 25 operations (password spraying, brute force, open sign-up endpoints, CMS account-creation bypasses, unauthenticated storage writes) but does not say which of these gave access at each of the 10 compromised victims, and the teachers' union's more than 1 million member records were taken from the breached organisation.","confidence":0.45}},"analyst_status":"done","analyst_note":null,"search":"'-202611':38A '000':233B '1':212B '10':178B '1238':8A,60B '150':232B '19':72B '2026':48B '25':67B '42':36A,54B '5.2':94B '500':222B 'account':158B,189B 'account-cr':157B 'address':128B 'admin':188B 'agent':17A,136B 'ai':15A,84B 'aiscan':101B 'api':193B 'attack':52B,113B 'august':45B 'author':107B 'autom':229B 'ballot':203B 'bodi':200B 'break':23A 'brute':148B 'bypass':160B 'cairn':14A,83B 'campaign':40B 'chain':185B 'china':2A,62B 'china-link':1A 'china-nexus':61B 'chines':50B 'chinese-speak':49B 'civil':29A 'civil-societi':28A 'cl':6A,58B 'cl-sta':5A,57B 'cloud':168B 'cloud-storag':167B 'cmp':37A 'collect':133B 'confid':65B 'content':162B 'creation':159B 'custom':76B 'data':176B 'deepseek':21A,96B 'defens':26A,218B 'defense-polici':217B 'document':204B,234B 'domain':121B 'earli':42B 'earlier':134B 'early-warn':41B 'endpoint':156B 'exploit':139B 'firm':186B 'flash/pro':98B 'forc':149B 'fork':77B 'found':137B 'framework':88B 'gave':114B 'glm':19A,93B 'goal':124B 'got':172B 'group':131B 'i6dfwu':39A 'industri':198B,228B 'industrial-autom':227B 'least':71B 'link':3A 'lithographi':182B 'live':202B 'maker':230B 'manag':163B 'member':214B 'mil/.gov':223B 'million':213B 'moder':64B 'name':236B 'never':109B 'nexus':63B 'open':12A,81B,150B 'open-sourc':11A,80B 'oper':68B 'organ':31A,73B,179B 'overwritten':205B 'pack':104B 'password':132B,145B 'penetr':86B 'penetration-test':85B 'pentest':16A 'persist':192B 'polici':219B 'pretext':111B 'product':196B 'program':220B 'publish':239B 'ran':66B,90B 'record':215B 'refus':110B 'registr':155B 'rogu':187B 'root':120B 'run':9A 'runner':102B 'semiconductor':25A,180B 'septemb':47B 'share':130B 'sign':152B 'sign-up':151B 'skill':103B 'societi':30A 'sometim':125B 'sourc':13A,82B 'speak':51B 'spi':4A 'spot':141B 'spray':146B 'sta':7A,59B 'standard':199B 'storag':169B 'suppli':184B 'supply-chain':183B 'system':164B 'target':118B 'teacher':208B 'test':87B,108B 'token':194B 'took':175B 'track':55B 'unauthent':166B 'union':209B 'unit':35A,53B 'us':207B 'user':224B 'v4':97B 'victim':235B 'vpn':127B 'warn':43B 'weak':140B 'write':170B 'zhipu':92B","nicknames":["CL-STA-1238","Cairn","AIScan Runner Skills"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["aiscanrunnerskills","cairn","clsta1238"],"ptokens":[],"labels":["campaign","earlywarning","high","other"],"campaign_type":"breach","search_a":"'-202611':38A '1238':8A '42':36A 'agent':17A 'ai':15A 'break':23A 'cairn':14A 'china':2A 'china-link':1A 'civil':29A 'civil-societi':28A 'cl':6A 'cl-sta':5A 'cmp':37A 'deepseek':21A 'defens':26A 'glm':19A 'i6dfwu':39A 'link':3A 'open':12A 'open-sourc':11A 'organ':31A 'pentest':16A 'run':9A 'semiconductor':25A 'societi':30A 'sourc':13A 'spi':4A 'sta':7A 'unit':35A","search_b":"'000':233B '1':212B '10':178B '1238':60B '150':232B '19':72B '2026':48B '25':67B '42':54B '5.2':94B '500':222B 'account':158B,189B 'account-cr':157B 'address':128B 'admin':188B 'agent':136B 'ai':84B 'aiscan':101B 'api':193B 'attack':52B,113B 'august':45B 'author':107B 'autom':229B 'ballot':203B 'bodi':200B 'brute':148B 'bypass':160B 'cairn':83B 'campaign':40B 'chain':185B 'china':62B 'china-nexus':61B 'chines':50B 'chinese-speak':49B 'cl':58B 'cl-sta':57B 'cloud':168B 'cloud-storag':167B 'collect':133B 'confid':65B 'content':162B 'creation':159B 'custom':76B 'data':176B 'deepseek':96B 'defens':218B 'defense-polici':217B 'document':204B,234B 'domain':121B 'earli':42B 'earlier':134B 'early-warn':41B 'endpoint':156B 'exploit':139B 'firm':186B 'flash/pro':98B 'forc':149B 'fork':77B 'found':137B 'framework':88B 'gave':114B 'glm':93B 'goal':124B 'got':172B 'group':131B 'industri':198B,228B 'industrial-autom':227B 'least':71B 'lithographi':182B 'live':202B 'maker':230B 'manag':163B 'member':214B 'mil/.gov':223B 'million':213B 'moder':64B 'name':236B 'never':109B 'nexus':63B 'open':81B,150B 'open-sourc':80B 'oper':68B 'organ':73B,179B 'overwritten':205B 'pack':104B 'password':132B,145B 'penetr':86B 'penetration-test':85B 'persist':192B 'polici':219B 'pretext':111B 'product':196B 'program':220B 'publish':239B 'ran':66B,90B 'record':215B 'refus':110B 'registr':155B 'rogu':187B 'root':120B 'runner':102B 'semiconductor':180B 'septemb':47B 'share':130B 'sign':152B 'sign-up':151B 'skill':103B 'sometim':125B 'sourc':82B 'speak':51B 'spot':141B 'spray':146B 'sta':59B 'standard':199B 'storag':169B 'suppli':184B 'supply-chain':183B 'system':164B 'target':118B 'teacher':208B 'test':87B,108B 'token':194B 'took':175B 'track':55B 'unauthent':166B 'union':209B 'unit':53B 'us':207B 'user':224B 'v4':97B 'victim':235B 'vpn':127B 'warn':43B 'weak':140B 'write':170B 'zhipu':92B","search_c":"","cause_entry":"unknown","cause_path":"third-party-breach","disclosures_checked_at":"2026-11-12T15:36:03+00:00","first_public_at":"2026-11-12T15:00:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-i6dfwu","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T15:34:18+00:00","fetched_at":"2026-11-12T15:34:18+00:00","note":null}],"documents":[{"id":135746,"url":"https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/","title":"Unit 42: Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors","kind":"blog","source":"blog","publisher":null,"text":"Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors\n\nOur analysis of how attackers used the open-source Cairn AI agent framework to autonomously breach semiconductor, defense and civic targets. The post Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors appeared first on Unit 42 .","published_at":"2026-11-12T15:00:31+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}