Unit 42 tracks China-nexus attackers using autonomous Cairn AI agents

Between Aug. 1 and Sept. 30, 2026, Chinese-speaking attackers used the open-source Cairn AI penetration-testing framework to run 25 operations against at least 19 organizations across the semiconductor, defense and civil society sectors, Unit 42 said.

Attackers gained unauthorized access or retrieved data at 10 of the targeted organizations. The victims included seven semiconductor and advanced-manufacturing supply chain organizations, three defense or defense-policy organizations, and four human rights and civil society groups. Unit 42 treated the confirmed impact count as part of its investigation into the campaign.

Unit 42 expressed moderate confidence that the activity constitutes China-nexus intelligence collection under tracking designation CL-STA-1238. “We assess with moderate confidence that this activity represents China-nexus intelligence collection, which we currently track as CL-STA-1238,” the researchers said.

Unit 42 cited Chinese artifact language, exclusive reliance on Chinese AI models, and target selection matching Chinese state intelligence priorities as evidence for the China-nexus assessment. The researchers assessed the group as likely one operator or a small team that ran simultaneous intrusion attempts against 19 organizations within two weeks.

Autonomous orchestration removes the historical limit on simultaneous targets imposed by operator hours. Operators paired Cairn with Chinese AI models Zhipu GLM 5.2 and DeepSeek V4 Flash and V4 Pro. They ran 13 operations on Zhipu GLM 5.2, eight on DeepSeek V4 Flash, and four on DeepSeek V4 Pro.

The operators seem to have compared the models, choosing DeepSeek V4 Pro for new attempts against targets that blocked DeepSeek V4 Flash. Cairn is model-agnostic, Unit 42 said, and the operators built the campaign from an off-the-shelf open-source framework, commodity model APIs, and a trivial jailbreak pretext. Each operation loaded a custom skill pack called AIScan Runner Skills that does not exist in the upstream Cairn project.

Operators typically supplied only a domain name and a one-line goal to start an operation. A bootstrap task first tries to solve the goal directly using the target and attacker-supplied hints. Following the bootstrap task, the framework maps the target and decomposes the goal into many small tasks.

The model created a unique plan for each target, with plans running from three to seven stages. Unit 42 states that a single AI worker carries out all three task types within each Cairn operation. Unit 42 gives one semiconductor manufacturer as an example where stages progressed through reconnaissance, web exploitation, services exploitation, credential collection, privilege escalation and lateral movement, and internal-network access and persistence.

Cairn assigns one AI model to each agent worker and coordinates activity through a shared blackboard where confirmed findings become immutable facts. Unit 42 describes the blackboard as a fact-intent graph that stores confirmed findings as immutable facts while the agent queues its next actions as intents.

The framework’s loop alternates between a Reason phase, in which the model selects the next step, and an Explore phase, in which it executes one step and logs the outcome. Operators can inject hints at any time to steer the AI worker during an operation. The loop repeats until the model decides it has met the goal, options run out, or the attacker halts it. Individual operations ran for between 20 minutes and over 50 hours without an attacker-set time limit.

Cairn’s default prompts instruct the model never to decline a task, and the attackers added a Chinese-language preamble declaring the engagement authorized and prohibiting refusal. Unit 42 states the framework prepended the preamble to the worker system prompt on every Reason and Explore phase. Every operation produced an AUTHORIZATION.md file claiming client approval, and neither Zhipu GLM nor DeepSeek rejected that framing.

Attackers assigned Chinese names to each task and stated the intent plainly, including a comprehensive deep penetration test against a target and breaching a target as fast as possible. In some tasks, attackers added target-environment-specific information to help guide initial access. A task aimed at a semiconductor equipment supplier contained VPN gateway addresses and group names, along with shared passwords for several sites, indicating pre-gathered intelligence.

At a U.S. teachers’ union, an account-creation bypass let the intruders create valid sessions, exposing more than one million member records, about 31,000 CRM contacts, and staff password hashes. Password spraying against an industry standards organization produced dozens of valid credentials and entry to non-public internal directory databases. The intruders modified a live standards-ballot document using an unauthenticated cloud-storage write, and separate flaws let them sign in as arbitrary customers to manage meeting and voting functions.

A brute-forced production credential at a semiconductor company enabled the creation of unauthorized administrator accounts and a lasting API token inside the production system. An open registration endpoint on a defense-policy identity platform exposed roughly 500 user records, including accounts with .mil and .gov domains.

Five confirmed breaches exposed tens of thousands of content-management records. A semiconductor-lithography manufacturer saw employee data among the records reached, an industrial-automation manufacturer’s records included roughly 150,000 internal documents, and an education nonprofit saw student data accessed. Unit 42 lists retrieving military and government identities among the confirmed achievements of the operations.

The intrusion relied on documented weaknesses. Authentication bypasses and insecure direct object references appeared alongside mass-assignment privilege escalation. Exposed cloud APIs were also exploited, as were weak or default credentials and dated public CVEs. Unit 42 assessed that autonomous AI increased exploitation volume and coverage without adding complexity, and that identity hygiene, attack-surface reduction and patching remain effective.

Unit 42 assessed that model-driven intrusion campaigns powered by autonomous AI will keep spreading as accessible open models with weak offensive-use guardrails grow stronger. Unit 42 states Palo Alto Networks shared these findings with fellow Cyber Threat Alliance members.

The operators hosted a customized Cairn fork on a Hong Kong server at 154.44.31[.]4, AS979, NetLab Global. They also used a U.S. staging and attack egress node at 82.29.129[.]54, AS142036, Hosteons Pte. Ltd.