INSIDE CAIRN: OPEN WINDOWS INTO MASSIVE AI-DRIVEN CYBER OPERATIONS

Summary from the TLDR InfoSec newsletter

NorForge found more than 20 publicly exposed Cairn panels used for malicious intrusion work. One Chinese-language cluster ran over 1,100 attack projects against e-commerce and payment systems in the US, Japan, Australia, and Canada, seeking unauthenticated RCE, file-upload webshells, SQL injection, and authentication bypasses. Another cluster targeted merchant payment, crypto, and pharmaceutical sites for card and cryptocurrency theft. The panels exposed targets, credentials, API keys, agent instructions, and successful compromises. Trufflehog found hundreds of secrets, with 11% verified valid. NorForge is notifying victims and seeking panel takedowns.