Suspected Chinese Spies Let an AI Pentest Tool Hack 19 Targets Solo
Unit 42 says CL-STA-1238 pointed the open-source Cairn framework, running on Zhipu GLM and DeepSeek, at 19 organizations and let it work alone; it got in at 10 using known weaknesses.
A suspected Chinese spying operation handed an open-source AI penetration testing tool a target and a one-line goal, then let it work through 19 organizations on its own. Unit 42 says the operators, which it tracks as CL-STA-1238, ran a customized copy of the Cairn framework on Chinese AI models Zhipu GLM and DeepSeek in August and September 2026. It got in or pulled data at 10 of them, including more than a million member records at a US teachers’ union, admin accounts in a semiconductor company’s production system and a tampered industry standards-ballot document.
For defenders
How it ran: 25 operations, each lasting 20 minutes to more than 50 hours. Cairn’s AI workers planned three to seven stages per target (recon, web app exploitation, middleware, credential collection, privilege escalation, internal access) and logged confirmed findings to a shared “blackboard”. A Chinese-language preamble told the models every task was an authorized test and never to refuse; neither model pushed back, per Unit 42.
What actually worked: nothing new. Password spraying against an internet-facing app server (T1110.003 (Brute Force: Password Spraying)), a brute-forced partner-integration credential reused across accounts, an account-creation bypass in a CMS, an open registration endpoint on an identity platform that exposed about 500 users with .mil and .gov addresses, an unauthenticated cloud-storage write, and then new admin accounts plus a persistent API token (T1136 (Create Account)). Unit 42 sums up the bugs as auth bypasses, insecure direct object references, mass assignment, weak or default passwords, exposed cloud APIs and old public CVEs (T1190 (Exploit Public-Facing Application)). For one chip-equipment supplier the operators also fed in VPN gateway addresses and shared group passwords gathered earlier.
Attribution: moderate confidence China-nexus, based on Chinese-language tasking, exclusive use of Chinese models and targets (seven semiconductor supply-chain firms, three defense and policy organizations, four civil-society groups including a Canadian human-rights body). No CVE IDs or hashes were published. Related: https://threatroundup.com/news/unit42-ai-espionage-government-linux/.
154[.]44[.]31[.]4 (Cairn controller, Hong Kong, AS979)
82[.]29[.]129[.]54 (staging and attack egress, US, AS142036)What it means for you
The AI here didn’t invent clever new hacks. It just kept trying the boring ones, weak passwords, sign-up pages that hand out too much, forgotten admin panels, faster and longer than a person would bother to. That’s good news for defenders, because the fixes are the basics. If you run a website or member portal, the risk is that whatever you’ve left half-locked will now be found.
Do this now
- Turn on multi-factor sign-in for every internet-facing login, including partner and API portals, and kill shared or default passwords.
- Close or rate-limit open self-registration and account-creation endpoints you don’t need.
- Review recently created admin accounts and API tokens in production apps.
- Block or alert on the two IP addresses above and patch old CVEs on public-facing apps.
Source article: Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors
Publisher: Unit 42, Palo Alto Networks
Published: Nov. 12, 2026
URL: https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/
Executive Summary
Unit 42 tracks CL-STA-1238, an activity cluster it assesses with moderate confidence to be China-nexus intelligence collection; no other vendor names or aliases are reported. Between August and September 2026 the operators, likely one person or a small team, used a customized fork of Cairn, an open-source AI penetration testing framework, driven by Zhipu GLM 5.2 and DeepSeek V4 Flash and Pro, to run 25 autonomous operations against at least 19 organizations: seven across the semiconductor and advanced-manufacturing supply chain, three in defense and defense policy, and four in human rights and civil society. The controller ran in Hong Kong (154[.]44[.]31[.]4) with a US staging and egress node (82[.]29[.]129[.]54). For each task the operators supplied a root domain, a one-line goal and sometimes prior intelligence such as VPN gateways and shared group passwords; a Chinese-language preamble and a generated AUTHORIZATION.md framed every task as an authorized test, and a custom “AIScan Runner Skills” pack provided scanning and exploitation. Cairn then enumerated the attack surface and looped through reason-and-explore steps for 20 minutes to more than 50 hours per operation, exploiting known weaknesses: password spraying, brute-forced and reused credentials, account-creation and authentication bypasses, open registration endpoints, insecure direct object references, mass-assignment privilege escalation, exposed cloud storage APIs and dated public CVEs. Unit 42 confirmed access or data retrieval at 10 organizations, including over one million member records, about 31,000 CRM contacts and staff password hashes at a US teachers’ union, roughly 500 user records with .mil and .gov accounts at a defense-policy program, about 150,000 internal documents at an industrial-automation manufacturer, unauthorized administrator accounts and a persistent API token in a semiconductor company’s production system, and an overwritten standards-ballot document. Hunt leads, false positive expectations and indicators are detailed below; Unit 42 published no file hashes or detection rules.
ATT&CK chain: Reconnaissance → Initial Access → Credential Access → Persistence → Privilege Escalation → Collection → Impact
Hunt Lead Grid
| Hunt Lead Level | Hunt Lead Name | ATT&CK | Risk of False Positives |
|---|---|---|---|
| 1 (Junior) | CL-STA-1238 Cairn Infrastructure Sweep | T1595.002 (Active Scanning: Vulnerability Scanning) | Low. The two addresses are the operators’ controller and egress node per Unit 42; hosting neighbours could share the ranges, so the lead anchors on the exact IPs only. |
| 2 (Pro) | Password Spraying Against Internet-Facing Apps and VPNs | T1110.003 (Brute Force: Password Spraying), T1078 (Valid Accounts) | Medium. Users mistype passwords and scanners hit login pages; the lead anchors on many distinct accounts failing from one source, followed by a success, and on one credential succeeding for several accounts. |
| 2 (Pro) | Self-Registration Abuse and Bulk Record Reads | T1190 (Exploit Public-Facing Application), T1136 (Create Account) | Medium. Real users sign up and some apps export data in bulk; the lead anchors on accounts created through an API or bypass path and then reading far more records than any normal member. |
| 3 (Elite) | Machine-Speed Autonomous Exploitation Sessions | T1190 (Exploit Public-Facing Application), T1098 (Account Manipulation), T1565.001 (Data Manipulation: Stored Data Manipulation) | High. Authorized scanners and pentests look similar; the lead needs baselining of per-source request breadth and duration, correlation with a privileged change afterwards, and an allowlist of approved testers. |
CL-STA-1238 Cairn Infrastructure Sweep
Unit 42 says the operators ran their customized Cairn controller from 154[.]44[.]31[.]4 in Hong Kong (AS979, NetLab Global) and used 82[.]29[.]129[.]54 in the US (AS142036, Hosteons) as the staging server and attack egress, which is the address target organizations would see. The operations ran in August and September 2026, seeded with each organization’s root domain, so the first traffic would be enumeration of subdomains and web applications followed by exploitation attempts against the same hosts. The detection logic is a retrospective search of web server, WAF, load balancer, VPN, SSO and cloud-storage access logs for either address, and of DNS and proxy logs for any internal host connecting to them.
Use edge logs (WAF, reverse proxy, CDN), VPN concentrator logs, identity provider sign-in logs and cloud storage access logs, and sweep back to at least July 2026 to cover the campaign window. Scope internet-facing applications first, especially member portals, partner integrations, CMS instances and identity platforms. Blocking the two IPs is reasonable but not sufficient, because a framework like this can be pointed out of any egress; treat the search as a way to learn which of your applications were probed. Any hit, and especially any successful authentication from these addresses, should be escalated and paired with the account and record-access leads below.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Reconnaissance → T1595.002 (Active Scanning: Vulnerability Scanning)
Sources: “Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors”, Unit 42, Nov. 12, 2026, https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/ (source article)
Password Spraying Against Internet-Facing Apps and VPNs
Against an industry standards organization, Cairn sprayed weak passwords at an internet-facing application server and came away with dozens of valid credentials and access to non-public directory databases. Against a semiconductor company it brute-forced a production credential on a partner-integration application that turned out to be valid across multiple accounts, and for a semiconductor equipment supplier the operators pre-loaded VPN gateway addresses, group names and shared group passwords for several sites. The detection logic is to count, per source IP and per time window, distinct usernames with failed logins against each web application, SSO tenant and VPN gateway, and alert when the count passes a threshold and is followed by a success from the same source; separately, alert when one password hash or one credential successfully authenticates more than one account, and on VPN logins using group credentials from sources outside your usual geography or ASN set.
Use application authentication logs, identity provider sign-in logs, VPN logs and WAF logs. Sweep 90 days, since the activity predates publication and credentials taken then may still be valid. Scope partner and integration portals that often sit outside SSO and MFA. Expect noise from users and from routine internet scanning; reduce it by keying on many accounts per source rather than many failures per account, and by suppressing your own vulnerability scanners by source address. Account lockout alone is the wrong control against spraying, which deliberately stays under per-account thresholds; MFA and removal of shared group passwords fix the root cause. Treat a spray followed by a success as a compromise: reset the account, review what it accessed, and check for new admin accounts or tokens.
Hunt Lead Level: 2 (Pro)
ATT&CK: Credential Access → T1110.003 (Brute Force: Password Spraying), T1110.001 (Brute Force: Password Guessing); Initial Access → T1078 (Valid Accounts), T1133 (External Remote Services)
Sources: Unit 42 (above), source article
Self-Registration Abuse and Bulk Record Reads
At a US teachers’ union, an unauthenticated account-creation bypass in the content management system let Cairn mint valid sessions and then harvest member data at scale: Unit 42 says the framework logged access to more than one million member records, about 31,000 CRM contacts and staff password hashes. At a defense-policy program it used an open backend registration endpoint on the supporting identity platform to expose roughly 500 user records, including .mil and .gov accounts, and five more cases followed the same identity and configuration pattern across CMS platforms. The detection logic is to alert on accounts created through a direct API call or registration endpoint that the normal sign-up flow doesn’t use (no email verification, no CAPTCHA step, unusual user agent), and to baseline records read per session so that a new account paging through thousands of member, contact or user objects, or requesting sequential object IDs, triggers an alert.
Use application and API gateway logs that record the endpoint, account and object identifiers, plus CMS audit logs and database query logs where available. Sweep back to July 2026. Scope member portals, CRMs, CMS instances and identity platforms that allow self-service accounts. Normal members do sign up and some roles export data, so baseline per role and allowlist known integrations by service account rather than by IP. Simply disabling registration everywhere may break legitimate services; enforce server-side authorization on every object request and verification on every account creation instead. A new account with bulk reads is a likely breach: preserve logs, identify the records accessed and start notification planning.
Hunt Lead Level: 2 (Pro)
ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application); Persistence → T1136 (Create Account); Collection → T1213.004 (Data from Information Repositories: Customer Relationship Management Software), T1213.006 (Data from Information Repositories: Databases)
Sources: Unit 42 (above), source article
Machine-Speed Autonomous Exploitation Sessions
Cairn breaks each goal into many small tasks and repeats a reason-then-act loop until it decides it is done, so a single operation produced a long, broad sequence of requests from one egress: asset mapping, web application and middleware probing, credential collection, privilege escalation and attempts to reach internal networks, for anywhere from 20 minutes to more than 50 hours with no operator time limit. The successful runs ended in privileged changes: unauthorized administrator accounts and a persistent API token in a semiconductor company’s production system, read, write and delete access to meeting, voting and back-office functions at a standards body, and an overwritten live standards-ballot document through an unauthenticated cloud-storage write. The detection logic correlates a per-source session profile (distinct paths and parameters touched, distinct applications hit under one root domain, and continuous activity over hours with consistent, non-human request timing) with a subsequent high-impact event from the same source or from an account that source used: creation of an admin user, issuance of an API token, a role change, or a write to a document or storage object by an unauthenticated principal.
This needs WAF or reverse-proxy logs with full request paths, application audit logs for account, role and token changes, and cloud storage data-plane logs, joined by source IP, session and account over sliding windows of up to several days. Baseline normal breadth per source for two to four weeks and maintain an allowlist of authorized scanners and pentesters, including any AI-assisted testing you commission. Rate limiting alone is the wrong answer because the framework is patient and will run for days below the limit; the anchor is breadth plus a privileged outcome. A match should be escalated immediately: disable the new admin accounts and tokens, check object versions for tampered documents, and look for the same source across your other public applications. The pattern generalizes to any autonomous or scripted exploitation tool, whoever operates it.
Hunt Lead Level: 3 (Elite)
ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application); Persistence → T1098 (Account Manipulation), T1136 (Create Account); Impact → T1565.001 (Data Manipulation: Stored Data Manipulation); Collection → T1530 (Data from Cloud Storage)
Sources: Unit 42 (above), source article
Hash Appendix
CL-STA-1238 / Cairn
Unit 42 published no file hashes for this campaign; Cairn is a public open-source project and the operators’ customized fork and skill pack were not released. No hashes were sourced from OTX AlienVault or VirusTotal.
MD5s / SHA1s / SHA256s: (not available) # no files published
References Appendix
- “Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors”, Unit 42, Palo Alto Networks, Nov. 12, 2026, https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/ (source article; campaign, targeting, outcomes, infrastructure, attribution)
- MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/