Three criminal clusters have been driving Cairn, an open source engine that coordinates AI agents toward a goal, to run automated break-ins against websites around the world. AI security firm Norforge found them because some of the attackers never locked their dashboards.
Cairn treats each job as a project with a starting point and an objective. Agents step toward the goal and post their findings to a shared board.
Cluster one speaks Chinese
The biggest operation runs more than 1,100 attack projects across 14 exposed dashboards, aimed at e-commerce and payment infrastructure in the US, Japan and Australia. Its apparent aim is durable access to large platforms through webshells, likely for later sale. Targets were ranked by traffic and pre-tested with Playwright, Microsoft’s browser automation framework, before Cairn took over.
Norforge did not name victims. Reuters reported the crew breached more than 100 companies, including John Deere and SharkNinja.
Two more, and a number that matters
A second cluster, writing in English with what Norforge believes is an African base, chased card and crypto theft from merchant payment services and gray-market payment sites. A third exposed panel carried 59 projects against large US commerce platforms, hunting shell, admin panel and database access.
About one attempt in ten worked. The abandoned panel data also leaked hundreds of secrets, and 11% were still valid when checked.
The defensive read
Automation has collapsed the cost of trying. Rate limiting and per-request scanning no longer separate a scripted sweep from a determined operator, because the agent adapts between steps. Prioritise blocking webshell writes and monitoring for admin account creation. And audit any AI orchestration tool your red team runs: an unauthenticated panel is now an attack surface in its own right.
