Evidence · DiggingBeagle record
Unit 42: Cairn framework AI-assisted operations by CL-STA-1238
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. Chinese-speaking operator customized Cairn offensive agent, AIScan Runner skills, factual blackboard, 3-7-stage plans; human target objective and credentials; repeated Reason/Explore. Models GLM5.2 13 ops, DeepSeek V4 Flash 8, Pro 4. Operators planted AUTHORIZATION.md claiming permission and prompts to ignore refusals. At 10 organizations unauthorized access/data retrieval validated; targets include semiconductor, defense-policy, union, industrial manufacturer.
- Source role
- primary disclosure
Evidence record
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. Chinese-speaking operator customized Cairn offensive agent, AIScan Runner skills, factual blackboard, 3-7-stage plans; human target objective and credentials; repeated Reason/Explore. Models GLM5.2 13 ops, DeepSeek V4 Flash 8, Pro 4. Operators planted AUTHORIZATION.md claiming permission and prompts to ignore refusals. At 10 organizations unauthorized access/data retrieval validated; targets include semiconductor, defense-policy, union, industrial manufacturer.
Claim-level citations (3)
- supportsCairn-based offensive agents participated in ten confirmed unauthorized organizational accesses: Unit 42 reports 25 Cairn-assisted operations against at least 19 organizations, with unauthorized access or data retrieval confirmed at ten; the observed campaign included forged authorization material that did not grant legitimate target consent.
Unit 42 report, Executive Summary and attack framework authorization/operation sections
- supportsCairn-based offensive agents participated in ten confirmed unauthorized organizational accesses: Unit 42 assessed a China nexus with moderate confidence, not a proven government sponsor. Existing ReliaQuest and other Cairn records describe different victims or operations, so a common framework is not a canonical identity match.
Executive summary, 25 operations, 19 organizations, ten confirmed and framework architecture
- supportsCairn-based offensive agents participated in ten confirmed unauthorized organizational accesses: Palo Alto Networks Unit 42 attributed a campaign to CL-STA-1238 in which a Chinese-speaking operator adapted the Cairn agent framework, provided target objectives and sometimes credentials, and delegated reconnaissance and exploitation steps to AI-assisted agents.
Executive summary, 25 operations, 19 organizations, ten confirmed and framework architecture