NorForge found more than 20 Cairn control panels exposed on the public internet; a Chinese-speaking group used Claude Code plus DeepSeek V4.1 Flash to run more than 1,100 intrusion projects

An investigation by the security research organization NorForge found more than 20 Cairn control panels exposed on the public internet, most of which were judged to be related to malicious intrusion activity. Cairn is a system that can dispatch AI agents to reconnaissance targets, search for weaknesses and attempt intrusion; these panels also exposed target information, account credentials and API keys. The most active Chinese-speaking cluster, AIA0001, used 14 panels and more than 1,100 attack projects, mainly targeting e-commerce and payment infrastructure in the United States, Japan and Australia; the English-speaking cluster AIA0002 focused on stealing credit cards and cryptocurrency. NorForge said the task worker was named claudecode_deepseek-v4.1-flash, presumed to be the Claude Code harness paired with the DeepSeek 4.1 Flash model. According to NorForge's estimate, the overall success rate of such tasks was about 10%; projects in which AIA0001 achieved its goal took an average of slightly less than 23 hours and produced about 140 facts each.