AI Platform Cairn Abused to Hack Over 100 Organizations - SecurityWeek

The AI security firm Norforge has identified threat actors abusing Cairn, an open-source AI platform, to automate malicious operations against hundreds of websites worldwide, SecurityWeek reported. Norforge said it identified three clusters of activity that appear to be malicious, and that the campaigns were focused on persistent access and financial theft. The activity targeted more than 100 organisations, according to the report.

The three clusters were characterised as seeking both persistent access and financial theft — maintaining a foothold in compromised systems and extracting money from them. The operations are described as automated, with Cairn used to run malicious activity at scale across hundreds of websites rather than against a single target. Cairn is described as open source, meaning its underlying code is publicly available.

SecurityWeek frames the finding as an open-source AI platform being repurposed by threat actors, with a security vendor rather than the platform's developers making the attribution. The article does not describe which capabilities of Cairn were used, name the targeted organisations, or specify the countries in which the affected websites are based. It also does not say whether Norforge has published indicators of compromise, notified affected parties, or reported the activity to law enforcement. Norforge's three-cluster breakdown is the only structural detail given about the campaign. Cairn's developers are not named in the report, and no timeline is given for when the activity was detected.