CL-STA-1238 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/cl-sta-1238/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 22:16:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCL-STA-1238 Autonomous AI-Driven Cyber Operationshttps://feed.craftedsignal.io/briefs/2026-11-cairn-ai-attacks/Thu, 12 Nov 2026 22:16:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cairn-ai-attacks/The threat actor CL-STA-1238, assessed to be China-nexus, used an open-source AI penetration testing framework called Cairn to autonomously conduct operations against semiconductor, defense, and civil society organizations.Between August and September 2026, the actor CL-STA-1238 conducted approximately 25 autonomous cyber operations against at least 19 organizations using the open-source Cairn penetration testing framework. Attackers integrated Cairn with Chinese AI models Zhipu GLM 5.2 and DeepSeek V4 and deployed a custom 'AIScan Runner Skills' pack. The AI agents operated autonomously through a reasoning and exploration loop, guided by attacker-supplied task goals and authorization preambles intended to bypass model guardrails.

Attack Chain

  1. Target and goal setting via a custom-forked Cairn controller.
  2. Initial bootstrap task execution for target mapping and planning.
  3. Iterative autonomous orchestration consisting of 'Reason' and 'Explore' phases.
  4. Exploitation of identified targets including identity and configuration weaknesses.

Impact

Confirmed impacts across 10 organizations include the unauthorized access to valid credentials, exfiltration of over one million personal records, retrieval of military and government identities, creation of persistent administrator accounts, and modification of live industry standards documents.

Recommendation

Organizations are advised to prioritize identity hygiene, attack-surface reduction, and software patching to mitigate the known vulnerabilities (such as weak credentials and exposed APIs) exploited by these automated agents.

]]>highthreataiespionagecairn