Cairn Operations Against Asian Governments and Enterprises: Human and AI Roles Across 66 Project Records

VULONE recovered 66 project records from an attack infrastructure using the public penetration testing tool Cairn, describing an operation in which human operators define targets and behavioral constraints while AI agents repeatedly perform reconnaissance and exploitation. The 48 projects recorded as reaching session-level access or higher are counted from attacker-side records; victim organizations have not independently verified every case.

The report examines the operational process from attacker infrastructure databases and work records rather than fragmented alerts from victim organizations. Because the 66 recovered projects include 7 unstarted ones, it does not mean that all 66 attacks were executed or that 66 different organizations were compromised.

VULONE states that it collected, verified, and hashed a 16.4 GB archive of attacker /tmp directories publicly exposed without authentication between September 29 and October 15, 2026, along with data from authorized host and container access. This is targeted collection rather than a complete disk clone.

The project records themselves span from September 24 to October 14, 2026, and are treated separately from the directory exposure period. The aggregation is based on attacker-side databases, task logs, and shell histories, supplemented for some cases by exfiltration logs and listener captures. However, these remain attacker-side evidence and do not constitute independent verification of every case by victim organizations. Original Collection and Results Explanation

Human operators provided targets, hints, success conditions, and behavioral constraints while reviewing results. Operators specified completing either web shell deployment or OS command execution as the completion condition, while not treating administrative panel or application privilege acquisition alone as completion (this is an operational standard for the operators; the impact of unauthorized administrative privilege acquisition itself is assessed separately). The Cairn dispatcher assigned work to Kali-based ephemeral worker containers, using DeepSeek v4.1 Flash to repeatedly perform reconnaissance, exploitation, and credential collection.

A total of 116 unique workers were recorded across the entire period, with simultaneous active counts in the dozens (this does not mean 116 ran simultaneously).

Cairn itself is public software, and its use alone does not mean Cairn developers participated in the attack. VULONE analyzed the attack infrastructure built by this operator using Cairn.

Entry points and observed access outcomes varied by target; the following do not form a single continuous attack chain.

These are actions organized from records in the original source. They do not represent fully autonomous attacks, nor do records show all targets sharing the same entry point, privileges, or information retrieval.

The breakdown of the 66 projects organized by VULONE is as follows. Counts are project-based and should not be equated with the number of victim organizations or hosts.

Targets include government-related systems in Vietnam, Taiwan, Indonesia, and India, as well as aviation, payment, retail, and hosting companies. Mailbox access was also reported. Note that the record label root alone does not confirm control of the entire host beyond container (pod) boundaries.

Success Judgment in Public Information: Subsequent Compromise Confirmed. VULONE reports post-execution credential acquisition and the privilege levels reached based on attacker-side records and partial communication logs. However, evidence strength varies by case, and it does not mean all 48 cases were verified on the victim side. Original Source Results and Caveats

VULONE assesses the operator as a Chinese-speaking entity with a Chinese nexus based on Simplified Chinese instructions, script comments, and utilized technology stacks. While assessing with high confidence that the infrastructure belongs to a single operator or very small group, the operator's real name and physical location are not identified. Financial motivation is also a VULONE assessment.

The recovered materials reportedly contained no evidence supporting state support, such as state directives or shared infrastructure with known state-backed activity (though this does not prove the Chinese government is uninvolved). Furthermore, because instructions existed to limit strings left on target systems to English and ASCII, language artifacts left on victim systems alone cannot determine the operator's spoken language.

Although the previously reported Gambit "SOUL" campaign overlaps with Cairn and model families, no common infrastructure, targets, or data have been confirmed. The Hermes/Strix, skimmers, and destructive behaviors characterizing SOUL were not found in the recovered materials, and it is not substantiated as the same campaign. The possibility of the same operator remains unproven. Original Source Attribution Assessment

VULONE lists 202.61.139[.]15 and 202.61.139[.]137 as attack infrastructure. Tool retrieval from port 9000 and data transmission via PUT /ev/… to a receiver are recorded, with related receiving ports including 8896, 8899, 8997, 9099, 9201, and 9955 (port numbers alone are not treated as indicators specific to this incident).

Inference: Even if regular screens and services operate normally, command execution and information retrieval may be proceeding server-side. The following are candidate records to cross-check within your organization and do not represent a log checklist obtained across all victim organizations by VULONE.

Inference: Using suspicious files, execution, or related communications as a starting point, preserve records by aligning assets, accounts, and timestamps. Treat a single suspicious execution as an initial detection trigger, and correlate requests/reconnaissance → execution → access to files or credentials → outbound communications on the same asset. This correlation is a proposed investigation approach and not a universally observed sequence across all targets.

Inference: If information retrieval is confirmed, broaden investigations to subsequent use of obtained credentials and tokens, access to mail or internal systems, and external destinations. Judge contact, successful authentication, command execution, information retrieval, and transmission separately, and do not equate mere IOC matches with confirmed compromise. Check log collection settings, retention periods, and monitoring scope, and do not use the absence of records as proof of being uncompromised.

Inference: Isolate assets according to the confirmed scope of compromise, and revoke or update leaked credentials and tokens based on service impact and evidence preservation. Ongoing countermeasures should prioritize patching public assets, eliminating default or initial credentials, restricting public access to management features, and narrowing web, database, and container privileges, write destinations, and outbound communications to necessary scopes. These are mitigation and impact-reduction measures per path and do not suggest a single configuration can prevent this entire incident.

No additional hypotheses. Unverified items are listed under "Unknowns and Additional Investigations".

The key takeaway to re-evaluate in this incident is the assumption that attackers test only a single technique for a short time. When humans provide targets and constraints while AI continues reconnaissance using known weaknesses and credentials, closing individual single-shot alerts separately causes organizations to lose sight of continuous attempts against the same asset. SOC teams should correlate requests, execution, credential use, and outbound traffic per public asset and evaluate the extent to which evidence supports each stage. By clearly distinguishing between attacker record aggregations and internal evidence, organizations can assess mitigation priorities without being swayed by the scale implied by the term AI.