Hackers abuse AI penetration testing tool Cairn to automate large-scale attacks

Security company NorForge found that Chinese-speaking hackers used the AI penetration testing tool Cairn to automate attacks on about 100 e-commerce and payment-related websites, and that at least one attack had already implanted a Web shell in a commercial website. Researchers identified three activity clusters in publicly exposed AI penetration testing control panels, two of which were judged malicious; the 14 panels possibly related to this group of attackers contained more than 1100 attack projects in total, and the activity was mainly economically motivated with no obvious signs of state support. According to Reuters, the victims include John Deere, SharkNinja and Cummins; John Deere said it had taken remediation measures and found no sensitive information accessed, and SharkNinja said the incident was contained and affected only one standalone product support website. The attackers had AI agents look for weaknesses such as SQL injection, insecure file uploads, insecure deserialization, authentication bypass and server-side template injection; some instructions also required deploying a Web shell, and browser automation was used to determine whether a website could process orders in order to screen targets.