Ataques autónomos con Cairn entran en 10 organizaciones

Autonomous attacks using Cairn targeting 10 out of 19 marked organizations were documented by Palo Alto Networks' Unit 42 in a report published on November 12, 2026. Over a period spanning from August to September of the same year, Chinese-speaking attackers carried out 25 operations using Cairn, an open-source penetration testing framework, and succeeded in gaining access or extracting data from over half of the targets.

The report highlights the efficiency of a small team or even a single operator in orchestrating these operations, conducting simultaneous intrusions against 19 organizations within two weeks.

Each operation began with a minimal setup, involving a root domain and a target, and was automated to proceed without human intervention. Cairn coordinated its agents through a shared board, where each confirmed finding was recorded as a fixed fact, and each subsequent step was treated as an intention to be tested. The loop continued until the objective was achieved, all options were exhausted, or the operator intervened.

Operation durations ranged from 20 minutes to over 50 hours, with no set limit imposed by the attackers.

The attackers exclusively used Chinese models, with 13 operations involving GLM 5.2 from Zhipu, 8 utilizing DeepSeek V4 Flash, and 4 employing DeepSeek V4 Pro. For targets resistant to Flash, DeepSeek Pro was used as an alternative. Cairn had been modified for this campaign, hosted from Hong Kong, and included an AIScan Runner Skills package not found in the public version.

The model defenses were bypassed using a known trick: each order contained Chinese text presenting the task as an authorized test, prohibiting refusal, and each operation generated an AUTHORIZATION.md file declaring the order approved by a client. Neither GLM 5.2 nor DeepSeek objected to this framework, according to Unit 42's report, which was also noted by Help Net Security.

This campaign differs from a previous one reported in October, where the focus was on sealed Cairn panels and financially motivated groups targeting online retail stores. The new message emphasizes Unit 42's assessment of this activity, crediting it with moderate confidence as intelligence gathering linked to China, based on the artifacts' language and target selection.

The targets include semiconductor supply chain and defense entities, as well as civil rights organizations and civil society groups, such as a Canadian body and a U.S. teachers' union. The latter group experienced a breach due to an authentication bypass in their content manager, exposing over a million employee records, including contact information and hashed passwords.

The semiconductor manufacturer was breached through forced credential escalation in multiple application accounts, granting the attacker access to sensitive data, user lists, email addresses, and an unauthorized administrator account with persistent access to the programming interface. A technical standards organization was compromised due to weak passwords, granting the attackers access to internal bases.

Another attack involved writing unauthorized data to a cloud-based voting platform, granting the attackers arbitrary client privileges with read, write, and delete access to meetings and votes. Lastly, an open registry in an industrial automation program allowed the attackers to expose approximately 150,000 internal documents.

Unit 42's analysis suggests that these autonomous attacks have increased the volume and coverage of exploitation, rather than their complexity, and that the key to mitigation remains strong identity hygiene, reduced attack surface, and timely patching. The report concludes with a forecast from Unit 42's analysts: such campaigns will become more common as powerful autonomous models with weak safeguards gain prominence.