Between August and September 2026, Chinese-speaking attackers conducted 25 operations targeting at least 19 organizations using the open-source AI penetration testing framework, Cairn. The operations led to unauthorized access or data retrieval in 10 of these organizations.
The attackers' activities resulted in the mass exposure of personal data, exceeding one million records at one organization. Additionally, they retrieved military and government identities and created persistent administrator accounts within a production system.
The operations targeted sectors including the semiconductor and advanced-manufacturing supply chain, defense and defense policy, and human rights and civil society. The attackers modified a live industry standards-ballot document during their operations.
The attackers utilized Chinese AI models Zhipu GLM and DeepSeek to enhance their operations. They benchmarked these models against each other, using the higher-tier DeepSeek V4 Pro for repeated attempts against resistant targets. Each operation varied in duration, ranging from 20 minutes to over 50 hours.
The attack infrastructure included a customized fork of Cairn running from a server in Hong Kong, with an attack egress and staging node hosted in the U.S.