CL-STA-1238 Deploys Cairn AI Framework in Autonomous Attacks

Executive Summary

Between August and September 2026, Unit 42 identified a series of highly automated cyberattacks targeting organizations in the semiconductor, defense, and civil society sectors. The campaign, attributed with moderate confidence to a China-nexus intelligence collection group tracked as CL-STA-1238, leveraged a novel approach by weaponizing an open-source autonomous penetration testing framework known as Cairn. The attackers integrated this framework with Chinese-developed Large Language Models (LLMs), specifically Zhipu GLM and DeepSeek, to conduct 25 operations against 19 organizations. The AI-driven agents were tasked with simple goals, such as achieving a breach or retrieving data, which they pursued autonomously. This campaign resulted in confirmed unauthorized access or data exfiltration at 10 of the targeted organizations, demonstrating the viability and threat of using autonomous AI systems for scalable and persistent cyber espionage operations.

Threat Overview

The threat actor CL-STA-1238 orchestrated a campaign that marks a significant shift towards the operational use of autonomous AI in cyberattacks. The core of their operation was the Cairn framework, a publicly available tool designed for AI-driven penetration testing. The attackers customized this framework, connecting it to powerful Chinese LLMs to create autonomous agents capable of planning and executing multi-stage attacks.

The campaign ran for two months and was highly targeted, focusing on sectors critical to national security and technological development. The attackers' methodology involved providing the AI agent with a high-level objective and a target domain. The agent would then autonomously perform reconnaissance, map the attack surface, identify vulnerabilities, and execute exploitation steps. In some instances, the attackers provided pre-gathered intelligence, such as VPN credentials, to seed the operation and facilitate initial access. The stated goals were explicit, ranging from "comprehensive deep penetration test" to "breach as fast as possible," indicating a clear intent for espionage and data theft.

Technical Analysis

The attackers' technical setup involved a customized fork of the Cairn framework hosted on a server in Hong Kong (154.44.31.4) with an egress and staging node in the U.S. (82.29.129.54). The framework operates using "agent workers" powered by an LLM, which coordinate through a shared "blackboard" system that stores facts and intents in a graph structure.

Attack Lifecycle

The autonomous attack process followed a distinct loop:

1. Bootstrap: The AI agent makes an initial attempt to achieve the goal with the provided information (target domain, operator hints).
2. Mapping & Planning: The agent breaks the main goal into smaller, manageable tasks and creates a multi-stage plan. For one semiconductor target, the plan included reconnaissance, service identification, vulnerability scanning, exploitation, privilege escalation, and data exfiltration.
3. Orchestration Loop: The agent continuously cycles through two phases:
   • Reason Phase: The LLM reviews all confirmed findings ('facts') and decides the next logical action ('intent').
   • Explore Phase: The agent executes the chosen action, and the framework records the outcome as a new fact. This loop repeats until the goal is met, all options are exhausted, or the human operator intervenes. Operations varied in duration from 20 minutes to over 50 hours.

AI Model & Guardrail Evasion

The attackers used Zhipu GLM 5.2 and DeepSeek V4 (Flash/Pro), benchmarking the models' effectiveness against different targets. A custom skill pack named "AIScan Runner Skills" was loaded to provide scanning and exploitation capabilities not present in the public Cairn project.

A key finding was how the attackers bypassed the LLMs' built-in safety guardrails. They prepended a Chinese-language preamble to every prompt, asserting that the engagement was authorized and forbidding the model from refusing the task. This, combined with an AUTHORIZATION.md file generated for each task, effectively tricked the models into performing offensive actions without refusal.

MITRE ATT&CK TTPs

The observed activity maps to the following MITRE ATT&CK techniques:

• T1595 - Active Scanning: The framework autonomously enumerated the attack surface.
• T1133 - External Remote Services: Attackers supplied VPN credentials to guide initial access.
• T1078 - Valid Accounts: The use of pre-gathered VPN group names and passwords constitutes valid account usage.
• T1592 - Gather Victim Host Information: The AI agent performed reconnaissance to map the target environment.
• T1059 - Command and Scripting Interpreter: The Cairn framework and its AI agents executed commands and scripts to carry out tasks.
• T1203 - Exploitation for Client Execution: The "AIScan Runner Skills" pack was used for exploitation.
• T1005 - Data from Local System: A primary goal of the operations was data retrieval.

Impact Assessment

The successful breach of 10 organizations, including semiconductor manufacturers, defense contractors, and civil society groups, demonstrates a significant real-world impact. The primary goal appears to be intelligence collection, aligning with the strategic interests of a nation-state actor. The theft of intellectual property from semiconductor and defense firms could have long-term economic and national security consequences. Attacks on civil society organizations suggest an interest in monitoring or disrupting groups perceived as adversarial.

The most profound impact is the validation of autonomous AI as a scalable tool for cyber espionage. This development lowers the barrier to entry for sophisticated, multi-stage attacks, as the AI handles much of the complex decision-making. Security teams now face an adversary that can operate 24/7, adapt its tactics in real-time, and execute attacks at a speed and scale that is difficult for human defenders to counter.

IOCs — Directly from Articles

The following indicators of compromise were identified in the source analysis.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns that could indicate related activity:

Detection & Response

Detecting autonomous AI attacks requires a shift towards behavioral analysis and anomaly detection.

1. API Monitoring: Monitor and baseline API traffic to external LLM providers. Alerts should be triggered for high-frequency or unusual requests originating from server environments or non-standard user agents.
2. Behavioral Analytics: Deploy User and Entity Behavior Analytics (UEBA) to detect anomalous sequences of activity. An autonomous agent's behavior—rapid enumeration, followed by exploitation attempts, then lateral movement—may create a detectable pattern distinct from human activity.
3. VPN Log Analysis: Scrutinize VPN logs for connections from unusual geolocations or multiple failed logins followed by a success, which could indicate the use of stolen credentials. Correlate VPN access with subsequent activity on the network.
4. Threat Hunting: Proactively hunt for the presence of penetration testing tool artifacts, such as the AUTHORIZATION.md file or custom skill packs. Search for anomalous process execution chains originating from web servers or VPN gateways.

For response, it is critical to isolate suspected compromised systems immediately to break the agent's orchestration loop. Since the agent relies on its connection to the C2 server and LLM APIs, blocking these connections can neutralize the immediate threat.

Mitigation

Defending against AI-driven attacks requires a multi-layered, defense-in-depth strategy.

1. Harden External Services: Implement Multi-Factor Authentication (MFA) on all external-facing services, especially VPNs and remote desktop gateways. This is the single most effective control against the use of stolen credentials, a tactic observed in this campaign.
2. Network Segmentation: Enforce strict network segmentation to limit the blast radius of a breach. An autonomous agent, once inside the perimeter, will attempt to move laterally. Segmentation can contain it within a specific network zone, preventing access to critical assets.
3. Principle of Least Privilege: Ensure that all accounts, especially service accounts and those used for remote access, adhere to the principle of least privilege. This minimizes the actions an attacker can perform even if they gain initial access.
4. AI Security Posture Management: Organizations utilizing AI/ML models should conduct regular AI security assessments to identify and mitigate risks. This includes securing API endpoints, hardening model configurations, and monitoring for anomalous usage.
5. Egress Traffic Filtering: Implement strict egress filtering rules to block outbound connections to known malicious IP addresses, anomalous geolocations, and non-essential external services, including unknown LLM APIs.