{"id":10410,"date":"2026-11-12T15:15:00","date_gmt":"2026-11-12T15:15:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10410"},"modified":"2026-11-12T15:15:00","modified_gmt":"2026-11-12T15:15:00","slug":"palo-alto-tracks-a-massive-chinese-ai-attack-that-sadly-lives-up-to-industry-fears","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10410","title":{"rendered":"Palo Alto tracks a massive Chinese AI attack that sadly lives up to industry fears"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Palo Alto Networks Unit 42 is reporting today that it has tracked a massive China-based attack leveraging the open-source AI penetration testing framework Cairn to autonomously conduct 25 operations against at least 19 organizations. The attackers weaponized Cairn by pairing it with Chinese AI models Zhipu GLM and DeepSeek, Unit 42 said.<\/p>\n

The report said<\/a> it monitored the attacks in August and September 2026 in which the Chinese-speaking attackers were able to successfully achieve unauthorized access at 10 of the targeted businesses, accessing dozens of valid credentials. It captured more than one million records at one business, grabbed military and government identities at others, created persistent admin accounts in multiple product systems.<\/p>\n

It even gained unauthenticated access to cloud storage and overwrote a live ballot for a vote on an industry standard. Through separate flaws, the attackers logged in as arbitrary customers and gained read, write and delete access to meeting, voting and back-office functions.<\/p>\n

\u201cWhat a nightmare,\u201d said Frank Dickson<\/a>, principal analyst at Dickson Research. \u201cThis campaign is impressive, in the worst way.\u201d<\/p>\n

He viewed the detailed approach Unit 42\u2019s threat researchers used in tracking the attacks with approval.<\/p>\n

Unit 42 \u201ctook the machine apart and showed how it thinks: the shared blackboard, the facts, the intents, the human hints, and even the exact prompts the attackers used,\u201d he said. \u201cThe expensive part of an intrusion was always the labor: the reconnaissance, the trial and error, and the patience. That labor is now a line item on an API bill. Unit 42 believes one person or a handful of people ran all of it, hitting 19 organizations in two weeks. Some operations ran for more than 50 hours.\u201d<\/p>\n

Andy Piazza<\/a>, senior director of threat research at Unit 42, said the monitored campaign showed that the massive scope of a global AI-fueled assault is every bit as frightening as predicted.<\/p>\n

\u201cWe are now starting to see the evidence\u201d because the monitored campaign \u201ccan now interact with 1,000 organizations at the same time,\u201d Piazza said. \u201cI think we need to throw out the risk model for the perimeter. This also completely breaks our attribution models. The fingerprinting of attack uniqueness is going to be a hell of a lot harder now.\u201d<\/p>\n

Justin Greis<\/a>, CEO of consulting firm Acceligence, added that he was concerned about this campaign because of the scope of activities that AI is now able to handle.<\/p>\n

\u201cThis is significant because AI is taking on the coordination of an intrusion, using each result to decide what to try next and reducing the hands-on effort required to pursue multiple targets,\u201d he said. \u201cThat changes the economics of targeting. An attacker can sustain pressure across more organizations without personally directing every step. An organization\u2019s risk can rise even when its vulnerabilities haven\u2019t changed.\u201d<\/p>\n

Greis noted that the altered ballot deserves attention because it shows how an intrusion can undermine the information people rely on to make decisions. \u201cAlongside detecting data theft, CISOs should monitor unauthorized changes to critical records and privileged access and test their ability to verify and restore trusted information after an incident,\u201d he said. \u201cResilience includes knowing that the information you are using to run the business can still be trusted.\u201d<\/p>\n

The model\u2019s process<\/h2>\n

The report included a detailed description of the campaign\u2019s methodology. \u201cCairn coordinated its activities through a shared blackboard,\u201d it said. \u201cAgents read the blackboard and wrote their \ufb01ndings back as a fact-intent graph, while human operators can inject hints at any time to help guide the operations if needed. Con\ufb01rmed\u00a0\ufb01ndings accumulate as immutable facts and the agent queues its next actions as intents. Attackers ran a customized fork of Cairn from a server hosted in Hong Kong, and hosted an attack egress and staging node in the US.\u201d<\/p>\n

The model produced a different plan for each target, each running between three and seven stages, the researchers explained. Individual operations ran from 20 minutes to more than 50 hours, with no attacker-imposed time limit. Chinese AI Models Cairn is model-agnostic, they noted, and the attackers ran their operations on the Chinese models Zhipu GLM 5.2 and DeepSeek V4 Flash\/Pro.<\/p>\n

The report also described attackers\u2019 efforts to negate systems attempting to prohibit the unauthorized activities.<\/p>\n

\u201cCairn\u2019s stock worker prompts already instruct the model to never refuse a task,\u201d it said. \u201cThe attackers reinforced this with an authorization pretext of their own. Each operation also generated an authorization.md file. This file declared the operation authorized, treating the attackers\u2019 act of creating the task as a client-approved engagement. The attackers seeded each task with an organization\u2019s root domain, allowing the framework to autonomously enumerate the attack surface.\u201d<\/p>\n

\u201cWe knew attackers would get here. We hoped it was not now,\u201d Dickson said. \u201cAI attack agents have graduated from failed experiments to real breaches, and they did it in about three months.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Palo Alto Networks Unit 42 is reporting today that it has tracked a massive China-based attack leveraging the open-source AI penetration testing framework Cairn to autonomously conduct 25 operations against at least 19 organizations. The attackers weaponized Cairn by pairing it with Chinese AI models Zhipu GLM and DeepSeek, Unit 42 said. The report said […]<\/p>\n","protected":false},"author":0,"featured_media":10411,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10410","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10410"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10410"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10410\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10411"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}