Actively exploited Security news
Cairn: CL-STA-1238 let autonomous AI agents attack chipmakers, defense firms and nonprofits
On 12 November 2026 Unit 42 (Palo Alto Networks) published an analysis of a campaign in which a China-nexus actor used a customized fork of the open-source Cairn framework. In August and September 2026 its AI agents ran 25 operations against at least 19 organizations largely on their own, from reconnaissance to persistence. Nothing about it was novel: weak passwords, open registration endpoints and old bugs. Here is what is confirmed, the indicators, and what it means for defenders.
Key points
- Unit 42 tracks the cluster as CL-STA-1238 and assesses with moderate confidence that it serves Chinese intelligence collection, based on Chinese-language tasking, exclusive use of Chinese AI models, and target selection.
- The attackers ran a customized fork of the open-source Cairn framework: AI agents pick their own next step, record results on a shared blackboard, and an operator only drops in occasional hints. Operations lasted from 20 minutes to more than 50 hours.
- Targets were 7 semiconductor supply-chain organizations, 3 in defense and 4 in human rights and civil society. Unit 42 confirmed outcomes at 10, ranging from harvested credentials to more than a million union member records.
- Access came from weak and default passwords, authentication bypasses, open registration endpoints, publicly writable cloud storage and dated public CVEs. Unit 42 released only two IP addresses.
What happened
Palo Alto Networks' Unit 42 on 12 November 2026 described a campaign by a cluster it tracks as CL-STA-1238. In August and September 2026 the group ran 25 operations against at least 19 organizations, and much of the hands-on work was done by AI agents. Unit 42 assesses with moderate confidence that the activity serves Chinese intelligence collection: the tasking and "authorization" text is in Chinese, the attackers used Chinese models exclusively, and the targets match Chinese state intelligence priorities. The report suggests a single operator or a small team.
The tool was Cairn, a publicly available open-source penetration testing framework. The attackers ran their own customized fork on a server in Hong Kong, with an added skill pack called "AIScan Runner Skills" that does not exist upstream.
How the attacks worked
Cairn runs several agent workers, each driven by an AI model. In a loop, each agent reviews what is known, picks the next step, executes one action and records the result on a shared blackboard. Confirmed findings become immutable facts; planned actions wait in a queue. The operator seeds an operation with root domains, sometimes adds hints or target intelligence (such as a VPN gateway address and a shared group password) and lets the agents run - according to Unit 42, anywhere from 20 minutes to more than 50 hours with no time limit.
The entry points Unit 42 describes: password spraying against an application server, brute-forcing a production credential that worked across several accounts on a partner-integration app, an unauthenticated write to cloud storage (used to overwrite a live standards-ballot document), an account-creation bypass in a CMS, and an open registration endpoint on an identity platform. Unit 42 does not name CVE IDs, only "dated public CVEs".
Models: Zhipu GLM 5.2 in 13 operations, DeepSeek V4 Flash in 8 and DeepSeek V4 Pro in 4. The attackers bypassed refusals with a Chinese-language preamble and a generated AUTHORIZATION.md file claiming the testing was authorized.
Who is affected
- Semiconductor and advanced-manufacturing supply chain (7 organizations) - lithography, chip design, materials, photomasks and standards bodies.
- Defense and defense policy (3) - a space technology company, a defense-analytics vendor and a policy think tank.
- Human rights and civil society (4) - a Canadian human-rights body, a US teachers' union, a science-policy advocacy group and an education nonprofit.
Unit 42 confirmed outcomes at 10 organizations: dozens of valid credentials, non-public directory databases, rogue admin accounts and a persistent production API token at a chipmaker, more than a million member records plus staff password hashes at the teachers' union, about 500 user records including .mil and .gov accounts at a defense-policy organization, and roughly 150,000 internal documents at an industrial-automation manufacturer.
How to spot compromise
Unit 42 published only two network indicators (defanged); there are no hashes or domains:
154[.]44[.]31[.]4 Cairn hosting server (Hong Kong, AS979)
82[.]29[.]129[.]54 staging server and attack egress (US, AS142036)Our suggestions:
- Search web server, VPN, WAF and authentication logs from August to November 2026 for both addresses. Paste log exports into our IOC extractor - it pulls out the IPs right in your browser.
- Look for runs of failed logins followed by a success, accounts created through self-registration, new administrators and API tokens nobody remembers creating.
- An AI agent is persistent and methodical: a long stream of varied API and login requests from one address over hours or days is a signal even when each request looks harmless.
What to do
- Passwords and identity: ban weak, default and shared passwords, enforce MFA on everything internet-facing, and cut standing privileged access. You can test passphrases with our password strength checker.
- Shrink the attack surface: review public registration endpoints, unauthenticated APIs and cloud storage with public write access - those flaws alone were enough in the cases described.
- Patch the old stuff: Unit 42 explicitly notes the attackers used dated public CVEs.
- Plan for volume: autonomous attacks are not cleverer, Unit 42 says, just faster and broader. Rate limiting and alerts on unusual logins are worth it even for low-profile apps.
For an earlier case of AI agents in real attacks, see our report on ARTEX and Storm-3358.
Timeline
Updates
- 12 Nov 2026 - first version of this article.
FAQ
Is this the first attack run by autonomous AI?
No. In early November 2026 Microsoft and Check Point described attacks using the ARTEX framework. The Unit 42 report is one of the most detailed so far, though: it covers full AI-driven operations, outcomes for specific victim types, and which models the attackers used.
Which AI models were used?
According to Unit 42, only Chinese ones: Zhipu GLM 5.2 in 13 operations, DeepSeek V4 Flash in 8 and DeepSeek V4 Pro in 4, mostly against targets that resisted Flash. The attackers got around refusals by claiming the work was an authorized penetration test, and neither provider's model refused.
Do I need a new defense strategy for AI attacks?
Mostly you need the basics done properly. Unit 42 stresses that autonomous AI raises the volume and coverage of attacks, not their sophistication. Strong passwords with MFA, closed registration, private storage and timely patching would have stopped every intrusion described.
Which countries were hit?
Unit 42 does not publish a full country list. It explicitly mentions only targets in Canada and the United States, plus infrastructure in Hong Kong and the US.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
FBI disrupts North Korea's FaceStealer fake video call campaign as the US moves to seize $1.2 billion from the Binance theft
On 12 November 2026 the US Department of Justice announced two actions against North Korean cryptocurrency theft. The FBI disrupted cloud infrastructure behind FaceStealer, a campaign that lures crypto workers and open-source developers into fake video calls and installs malware disguised as a fix for an audio problem. Separately, a court authorised the seizure or restraint of more than $1.2 billion from the theft of over $6 billion from Binance on 29 October. Here is how the trick works and what to do if you joined one of these calls.