Chinese-Speaking Hackers Exploit Cairn Tool for Widespread Attacks on E-Commerce Sites

Chinese-speaking hackers have leveraged the AI-driven penetration testing tool Cairn to conduct extensive attacks on various e-commerce websites, compromising hundreds of sites worldwide. Researchers from NorForge found over 20 publicly exposed dashboards engaged in automated activities aimed at stealing payment information.

This investigation reveals the operational capabilities of AI-assisted cyber operations, highlighting workflows that transform vulnerability discovery into actionable access to victim infrastructures. The campaign illustrates how AI is expanding the target base for attackers, prompting organizations to enhance their defenses accordingly.

The attackers focused on 100 sites across regions including the US, Australia, Canada, and Japan, with a particular emphasis on e-commerce and payment systems, according to NorForge’s report published on October 20. The researchers identified the malicious activity while examining publicly exposed AI-driven penetration testing control panels.

Although NorForge did not disclose the names of the victim organizations in its initial report, a subsequent Reuters article identified several, including US-based John Deere, SharkNinja, and Cummins.

Extent of Cyber-Damage Remains Unclear

NorForge’s analysis revealed three activity clusters within the exposed infrastructure, with two deemed malicious. The activity appeared primarily financially motivated, lacking indications of state-sponsored intrusion, according to the report.

Snorre Fagerland, a founding researcher at NorForge, noted, “The operation is massive, with over 1,100 attack projects spread over the 14 dashboards likely associated with this group.” The exposed data included hundreds of sensitive records detailing how automated agents were programmed to identify vulnerabilities and maintain access to victim websites.

The reported impact varied among victims, with the full extent of the damage still unclear. NorForge confirmed that at least one attack resulted in a Web shell being installed on a commercial website, potentially allowing the attacker to execute commands on the server. Separate operations targeting credit card data and cryptocurrency were also observed.

Of the victims mentioned by Reuters, John Deere stated it had taken remedial actions but found no evidence that sensitive information was accessed. SharkNinja reported that the incident was contained and affected a standalone product-support website. Cummins is investigating a potential attack on a third-party vendor’s website.

Cairn Security did not respond to a request for comment regarding the activity.

Using AI for Attack Coordination

The attackers utilized AI agents to coordinate multiple stages of the attack as a connected workflow, allowing them to run several projects simultaneously and sustain operations over extended periods without constant human oversight. Tyler Oliver, CEO of threat-hunting platform Huntbase, emphasized that this is not merely a single attack but an exposure of attacker infrastructure, revealing tools used by various groups with differing motivations.

Experts have noted that attackers are advancing faster than defenders due to their ability to adopt AI technologies more rapidly. This trend is expected to widen the gap between offensive and defensive capabilities.

The attackers employed Cairn to direct AI agents in identifying exploitable weaknesses, including SQL injection and insecure file uploads. Some instructions explicitly directed agents to deploy Web shells for ongoing access.

The operation also automated target selection, with projects prioritizing targets based on traffic and using browser automation to verify whether e-commerce sites could process orders.

AI Shifts Cyberattack Economics, Puts More Orgs in Sights

Experts warn that AI is altering the economics of cyberattacks more than the techniques themselves. Rickard Carlsson, CEO of Detectify, noted that while attackers exploited familiar vulnerabilities, AI agents can now pursue these weaknesses for hours with minimal human involvement. This shift allows attackers to conduct numerous attempts at a low cost, making it feasible to target organizations that may have previously seemed unworthy of effort.

NorForge estimates that the average task costs around five dollars, which, while uncertain, indicates that the cost of attempting attacks has dramatically decreased. This reduction enables attackers to target a broader range of organizations.

Driving New Cyber Defense Strategies

In light of the threats posed by AI-driven attacks, organizations must equip themselves with technology to strengthen defenses. Experts recommend implementing security solutions that utilize AI to facilitate the deployment of security basics, such as automated network fixes and vulnerability scanning.

Carlsson advises organizations to maintain a comprehensive inventory of their internet-facing assets, conduct continuous testing, and prioritize addressing leaked credentials. This proactive approach is essential for closing the gap between identifying and resolving vulnerabilities.

As NorForge continues to notify victims and manage the aftermath of the attacks, the firm is also working to have the compromised Cairn panels taken down. However, Fagerland acknowledged that success depends on how well hosting providers respond to takedown requests, indicating that organizations remain at risk.

 

Source: Dark Reading