An alarming report from AI security firm Norforge reveals that cybercriminals are exploiting the open-source AI platform Cairn to conduct widespread malicious activities against numerous websites globally. The misuse of this platform highlights significant vulnerabilities in online security systems.
Understanding the Misuse of Cairn
Cairn serves as a versatile problem-solving engine capable of orchestrating AI agents to achieve specified objectives, functioning effectively as an autonomous penetration testing tool. Each task within Cairn is treated as a project, involving a starting point and a predefined aim, with agents collaboratively moving towards these goals while sharing their progress on a communal blackboard.
Following an examination prompted by Gambit Security’s recent findings on AI-enhanced attacks on online retailers, Norforge’s investigation uncovered several threats. These actors left their operational panels exposed, leading to the identification of three malicious activity clusters on the Cairn platform, all centered on maintaining unauthorized access and financial exploitation.
Details of Malicious Activity Clusters
The most substantial cluster primarily utilizes Chinese and encompasses over 1,100 attack projects distributed across 14 dashboards. Its targets include e-commerce and payment systems in countries such as the United States, Japan, and Australia. The attackers aim to secure persistent access to major platforms using webshells, potentially for future monetization. Automated validation processes are employed, and targets are evaluated based on traffic and tested through Microsoft’s Playwright before being integrated into Cairn.
Norforge has not disclosed specific victims, but reports indicate that over 100 companies, including prominent US firms like John Deere and SharkNinja, have suffered breaches.
Additional Clusters and Their Implications
The second cluster, involving 10 exposed panels, operates in English and focuses on stealing credit card information and cryptocurrency from various merchant services and gray-market payment sites, as well as pharmaceutical platforms. Some of these activities are directed at African e-commerce sites, suggesting the attackers may be based on the continent.
The third identified cluster comprises 59 projects targeting diverse e-commerce platforms, including large US commercial entities. This group prioritizes gaining shell access, along with access to administrative panels and databases.
According to Norforge, the success rate of these threat actors stands at approximately 10%, with hundreds of confidential details uncovered, 11% of which were verified as genuine.
Looking Ahead in Cybersecurity
The exploitation of the Cairn platform underscores the growing sophistication of cyber threats leveraging AI technology. As these attacks continue to evolve, there is an urgent need for enhanced cybersecurity measures to protect vulnerable systems and data. Organizations must remain vigilant and proactive in their security strategies to mitigate potential risks posed by such malicious activities.
