Search — “Cairn”
3 stories · 0 IoCs
Stories
CERT-In flags AI-assisted Crafty Falcon targeting Indian BFSI; backdoored ARTEX Docker image exposes 62 consoles
CERT-In reports an active AI-assisted actor, Crafty Falcon, using offensive AI tools (ARTEX, PentAGI, Cairn, CyberStrikeAI) against Indian BFSI, fintech and crypto firms, stealing payment gateway/partner-bank API credentials and invoking fund-transfer APIs from victims' allow-listed infrastructure, with theft of keys and funds reported. Tactics include web shells via file-upload/deserialization chains in PHP and Node.js apps, stolen static API tokens, plaintext creds in configs, micro-value test transactions, log deletion and endpoint security tampering. Separately, a copycat ARTEX GitHub repo pulls the backdoored Docker image tomicdd/artex, whose login handler runs a CAPTCHA field beginning with a secret marker through sh -c as root; 62 internet consoles served it. Hunt for web shells, anomalous fund-transfer/settlement API calls and Rs.1 test transactions, log clearing, and any deployment of artex images.
Threat actors use agentic AI tooling (ARTEX) to find exposed secrets and compromise Azure and Entra ID tenants
GTIG and Mandiant report PRC-nexus UNC7228 (overlaps STORM-0940) and financially motivated groups operating open-source agentic pentest frameworks (ARTEX, PentAGI, CAIRN, Hexstrike) in real intrusions since late August 2026, with confirmed compromise and data theft. ARTEX used supplied valid credentials to probe Azure/AWS permissions, poison MySQL general_log into JSP webshells, abuse Kudu APIs, Kerberoast/DCSync, and post output to rotating webhook.site URLs via curl. Hunt for 2–25 second bursts of API calls, artex-probe-*/ArtexProbe artifacts, MySQL SET GLOBAL general_log_file changes, and server egress to webhook.site.
Autonomous AI agents using open-source Cairn pentest tool breach 100+ company websites
A Chinese-speaking operator pointed autonomous AI agents running the open-source Cairn tool at over 1,200 e-commerce and company websites, reaching more than 100 companies, per Reuters and NorForge reporting. Agents aimed to run code on shops and plant web shell upload forms, with one documented chain via unauthorized memcached session store write access, unsafe PHP object deserialization, and old Zend Framework code. Hunters should look for exposed Cairn control panels (often port 8000 without login) and unexpected file-upload forms in hidden directories on web servers.