Cairn AI Framework Hits Semiconductor and Defense Orgs
Chinese-speaking threat actors weaponized the open-source Cairn penetration testing framework, pairing it with DeepSeek and Zhipu GLM models to autonomously execute 25 intrusion operations against 19 organizations across semiconductor manufacturing, U.S. defense policy, and civil society sectors. The campaign, tracked as CL-STA-1238, achieved unauthorized access or data retrieval at 10 targets, including credential theft, mass personal data exposure exceeding one million records, and persistent administrator account creation. This represents one of the most operationally significant documented uses of autonomous AI agents for state-linked offensive cyber operations.