Cyberwarfare / Nation-State Attacks,
Fraud Management & Cybercrime
Attackers Used Cairn With DeepSeek and GLM Models to Compromise 10 Organizations
Recent findings have revealed that a Chinese-speaking threat actor leveraged an open-source artificial intelligence penetration testing framework to launch a series of automated cyberattacks targeting key industries in the United States, specifically semiconductor manufacturing, defense, and human rights organizations. This alarming revelation was uncovered by cybersecurity researchers from Palo Alto Networks’ Unit 42, who delved deep into the methods employed in these attacks.
These sophisticated attackers utilized the Cairn framework, configuring it with advanced Chinese AI models, notably Zhipu GLM and DeepSeek. Over a span of two weeks in August and September, the offensive was directed towards at least 19 organizations, succeeding in unauthorized access or data exfiltration from 10 of those targets. Unit 42 presented their analysis, emphasizing the simplicity of the attackers’ toolkit, which consisted of readily available open-source components, commodity model APIs, and a basic pretext for administrative privilege escalation.
Unit 42 drew attention to the implications of such campaigns, stating that the combination of autonomous and model-driven intrusion efforts was likely to proliferate. This sentiment is underscored by the fact that accessible open models today often lack robust security measures against malicious cyber actions, making them fertile ground for cybercriminal activity.
The marriage of penetration testing tools designed for the advent of agentic AI with easily accessible open-weight models has paved the way for a new generation of cyberattacks, characterized by their speed, cost-effectiveness, and accessibility. This particular method mirrors tactics employed in recent breaches of various South Korean financial institutions and Japanese companies.
The Cairn framework has roots in China’s offensive security landscape, having emerged from a red team competition. Notably, it secured third place in the AI Penetration Testing Challenge organized by Tencent Cloud Hackathon in April. According to the developers at Bytex, the framework had never been tested prior to the competition, with the complete system designed to operate without any pre-training or domain-specific tools.
Cairn operates as a “general-purpose problem-solving engine,” with AI penetration testing being its primary successful application. The framework’s unique design allows it to employ AI agents to autonomously navigate various pathways toward task completion, independent of predetermined instructions. Such flexibility in operation further enhances its potential as a tool for malicious actors.
To further their agendas, the attackers utilized multiple open-weight models, examining each model’s performance to allocate tasks efficiently. Out of a total of 25 operations, 13 were allocated to the GLM 5.2 model, while eight were designated for DeepSeek V4 Flash, and four for the more advanced DeepSeek V4 Pro. The attackers consistently employed the higher-tier model for repeated attempts against particularly resilient targets.
Each attack was equipped with a specialized skill pack, providing the model with crucial capabilities for scanning and exploitation. Notably, this skill pack is not part of the upstream Cairn project and is tailored specifically for the attacks in question. Instructions issued to the AI models were crafted in Chinese, explicitly directing the Cairn agents to obtain high-value access, focusing on elements such as webshells, SSH, source code, and sensitive user credentials, indicating a clear intent to infiltrate internal networks.
The coordinated efforts of the Cairn agents allowed them to share information and document findings, with human operators capable of guiding the agents as needed. Remarkably, the attackers established a framework where Cairn agents were informed that they were operating in scenarios resembling authorized security testing or vulnerability assessments, cleverly circumventing the limited guardrails present in open-weight models.
The attackers adeptly customized attack strategies for each target. For instance, in operations targeting a semiconductor manufacturer, the sequence of activities transitioned smoothly from reconnaissance to exploitation of web applications and middleware, followed by credential collection, privilege escalation, and securing a foothold within the internal network. These engagements varied significantly in duration, with some operations lasting from 20 minutes to well over 50 hours, demonstrating the level of commitment and sophistication behind the attacks.
The assets stolen during this malicious campaign were substantial and included sensitive credentials belonging to an industry standards body, a significant database of member records from a teachers’ union, user data from a defense-policy think tank, and approximately 150,000 confidential documents from an industrial-automation manufacturer. The scale and precision of these cyber intrusions underscore the evolving capabilities and ambitions of state-sponsored actors in the realm of cyber warfare.