Skip to content
AI-Driven Cyber Attacks Target Major Companies via Exposed Cairn Panels

AI-Driven Cyber Attacks Target Major Companies via Exposed Cairn Panels

First seen 19 Oct 2026, 14:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 19, 2026 at 15:19 UTC
  • •Over 20 Cairn control panels were found exposed, linked to malicious activities.
  • •AI agents executed attacks on over 100 websites, including major companies like John Deere.
  • •NorForge is actively working to remove the exposed Cairn instances to prevent further exploitation.

On October 19, 2026, NorForge reported over 20 exposed Cairn control panels linked to malicious cyber activities. These panels were exploited by a hacker using AI agents to breach more than 100 websites, including John Deere, SharkNinja, and Cummins. The attacks utilized Cairn's capabilities to autonomously investigate targets and exploit vulnerabilities, with successful breaches taking approximately 23 hours. Gambit Security had previously identified a criminal campaign using AI tools like Cairn, Hermes, and Strix, which led to significant data theft, including over 600,000 credit card records. Companies affected have stated that there is no indication of sensitive data being accessed, although investigations are ongoing. NorForge is working to take down the exposed Cairn instances to mitigate further risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-07
CVE-2026-75650 published
A critical vulnerability was disclosed, affecting systems that may be exploited in conjunction with Cairn.
Unite.Ai
2026-09-08
CVE-2026-75650 added to CISA KEV
CISA listed CVE-2026-75650 for active exploitation, highlighting its critical nature.
Unite.Ai
2026-10-19
NorForge reports on Cairn exploitation
NorForge disclosed findings on over 20 exposed Cairn panels linked to AI-driven cyber attacks.
Unite.Ai

More articles in this cluster (4)

Following this threat?

Track Hermes and Cummins in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 2

Common questions

What companies were affected by the Cairn attacks?
The attacks impacted over 100 websites, including John Deere, SharkNinja, and Cummins.
Is there evidence of sensitive data being accessed?
Companies like John Deere and Cummins reported no indication that sensitive information was accessed.
What actions are being taken to mitigate the threat?
NorForge is working to take down the exposed Cairn instances to prevent further exploitation.