NorForge Finds 20+ Unprotected Cairn Panels Running AI Intrusions
Summary
NorForge reports more than 20 unprotected Cairn control panels running AI-driven intrusions, including a Chinese-language cluster with 14 dashboards and over 1,100 projects aimed at US, Japanese and Australian e-commerce sites. NorForge estimates a success rate near 10%, with goals met in under 23 hours on average.
Key Points
- NorForge says AIA0001 agents run under a worker named claudecode_deepseek-v4.1-flash, pairing a Claude Code harness with DeepSeek 4.1 Flash.
- NorForge reports Trufflehog verifies 11% of the hundreds of secrets exposed across the open Cairn panels as valid.
- NorForge says it is cooperating with Reuters to notify victims of apparent compromises.