Autonomous attacks with Cairn hit 10 organizations
Autonomous attacks with Cairn hit 10 organizations out of 19 marked as targets. Unit 42, the threat intelligence team at Palo Alto Networks, published the report on November 12: between August and September 2026, Chinese-speaking attackers ran 25 operations with Cairn, an open-source penetration testing framework, and achieved access or data extraction in more than …
Unit 42, a threat intelligence team from Palo Alto Networks, reported on November 12 that a Chinese-speaking attacker used Cairn, an open-source penetration testing framework, to carry out 25 autonomous operations against 19 targets between August and September 2026. The attacker, believed to be a single person or a small group, successfully gained access or extracted data from over half of the targets, including organizations in the semiconductor, defense, and civil society sectors.
The attacks exploited common vulnerabilities such as weak credentials, exposed cloud interfaces, and public vulnerabilities, and did not require new techniques. The campaign, tracked as CL-STA-1238, is assessed with moderate confidence to be linked to Chinese intelligence gathering.
Written by urgent.news from Dev.to's report — not a translation of it. Machine-written — may contain errors; check the original before relying on it.
