Cummins

Summary

Autonomous AI agents operated by a Chinese-speaking criminal targeted more than 1,200 company websites and reached over 100 organizations, including engine maker Cummins, which said it was investigating a possible attack on a vendor-run website. The campaign used an open-source tool called Cairn to direct agents toward goals such as running code on shops and planting web shell uploaders, with successful intrusions averaging under 23 hours and an overall success rate near 10 percent. Exposed attacker control panels revealed hundreds of secrets, 11 percent of which remained valid, though the amount of data taken from any specific victim is unknown.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A Chinese-speaking criminal operator directed autonomous AI agents at company websites with minimal human intervention, and the activity was observed by security researcher Snorre Fagerland of NorForge after he scanned the internet for exposed copies of Cairn, an open-source AI tool. Beginning around October 2, Fagerland identified approximately two dozen Cairn instances being used maliciously, allowing him to read the attackers' work in real time. The agents attempted more than 1,200 websites and reached sites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company SharkNinja, and engine maker Cummins. Reuters reviewed the attacker's own records to identify the victims, though the amount of data taken, if any, remains unknown. Cairn provides AI agents with a starting point and a goal, then permits them to work toward it step by step while posting findings to a shared board that a human operator can supplement with hints. The tool was created by an author posting as le1xia0 for authorized penetration testing and other legitimate jobs, but in this case it was aimed at online shops without permission. NorForge grouped the exposed panels into three clusters and assessed more than 20 as likely malicious. The busiest cluster, designated AIA0001, operates in Chinese and connects 14 panels to more than 1,100 attack projects, with an apparent aim of obtaining lasting access to shop and payment systems across targets in the United States, Japan, and Australia.

Cummins specifically stated that it was investigating a report of a possible attack on a website operated by one of its vendors. The three named companies, including Cummins, Deere, and SharkNinja, told Reuters that the damage was limited. Deere reported that it took steps to fix the problem and had no indication that sensitive information was accessed. SharkNinja said the attack struck a standalone product-support site and that it had contained the threat. Two smaller businesses also informed Reuters that they were compromised. A typical task assigned to the agents instructed them to find a way to execute code on a shop and then plant a web shell uploader, which is a form that saves uploaded files rather than one that runs commands, though attackers could replace it with something more harmful at any time. One documented intrusion, according to the agent's own account, proceeded through unauthorized write access to a memcached session store, unsafe handling of saved PHP objects, and a weakness in old Zend Framework code. The operators provided instructions in fewer than 100 Chinese characters, after which the agents proceeded autonomously. Successful break-ins required a little under 23 hours on average, and NorForge estimated the overall success rate across the tools it observed at around 10 percent. The campaign cost roughly $5 per task on average, counting failed or early-ended attempts, with total token usage of about $5,000, or approximately $50 per successful hack. All tasks in the AIA0001 cluster ran under a worker named claudecode_deepseek-v4.1-flash, though neither the researcher nor Reuters confirmed the underlying models.

The exposed Cairn panels displayed who was being attacked, which weaknesses were discovered, and which credentials and keys had been taken, meaning that having a site tested on an open instance could expose secrets regardless of the test's outcome. NorForge ran the secrets scanner Trufflehog over the panel data and located hundreds of secrets, 11 percent of which were verified as still valid. The panels also appeared to expose the complete set of the tool's controls, including functions to start and stop projects, input new data, and redirect agents toward different targets. NorForge stated that it did not test whether those controls function without a login. A second, English-language cluster went further by exposing the operators' own SSH logins to their staging servers, and NorForge said it did not log in. The exposure extended beyond criminal activity, as NorForge also found apparently legitimate penetration-testing firms that had left real client tests on unsecured panels, placing their customers' data at equivalent risk.

Sources

Sources available to members: 1 source.