NorForge exposes Cairn operation panels showing separate AI-assisted attack campaigns

NorForge examined openly reachable Cairn agent control planes and recovered task and project material from multiple exposed dashboards. Some panels contained evidence of attempted credential theft, payment or wallet targeting and shell deployment. Its AIA0001 and AIA0002 groupings have different infrastructure and objectives; similarity of orchestration software is not evidence that every operation belongs to one actor. Reported intrusions and broad target counts require victim-by-victim confirmation.

This is related to, but not identical to, the single ReliaQuest-investigated server compromise. ReliaQuest associated one real intrusion with a Cairn panel on the source host. NorForge's wider exposed-panel survey adds possible operator infrastructure and project-level evidence. A visible dashboard control does not itself prove unauthenticated modification rights, nor do strings that resemble passwords establish successful login without validation. Unknown attribution and incomplete incident linkage remain central to any numerical campaign summary.

The source contains multiple investigative populations: exposed control panels, project entries, vulnerable targets and reported compromised websites. They cannot share one denominator. A panel may belong to a legitimate test operator, and a project name may not correspond to a victim. ReliaQuest's documented compromise remains a narrower incident; the NorForge survey provides campaign context only where host, timeline and artifact evidence actually match.

NorForge later investigated unauthorized task submissions to exposed Cairn agent panels and selected downstream payload effects. This was a new attack direction, documented in a separate October 26 study, rather than stronger evidence that all earlier dashboard projects had already compromised their advertised targets. The distinct finding is retained as exposed-agent task subversion. Linking the two cases explains the common panel surface without merging their populations or success counts.