analyst@unixshadow:~$ explain cairn storm-0940 # two campaigns, one inflection: the human gives a goal, the agents do the hours
Cairn & Storm-0940
Two Campaigns That Let AI Agents Do the Hacking
In October 2026, two unrelated reports landed days apart and described the same shift. A criminal hacker used an open-source agent platform to breach more than 100 company websites. A nation-state actor used an agentic AI framework to hammer 2,250 Microsoft 365 tenants at machine speed. Different actors, different tools, different targets — and in both cases the human mostly got out of the way.
# case one: cairn — the $50 break-in, criminal division
tool: Cairn, an open-source “general-purpose problem-solving engine” — built for authorized work, repurposed for break-ins
operator: a single Chinese-speaking hacker, financially motivated, per Reuters and NorForge
start: Sept 25, 2026 — e-commerce sites in the US, Canada, Australia, and Japan
instructions: under 100 Chinese characters. One captured task told the agents to find unauthenticated code execution on a site, then plant an uploader web shell
agents did: probing targets, adapting methods, executing commands, continuing across sessions — alone, for hours
scale: 1,200+ sites attempted; websites at 100+ companies reached, including Deere, SharkNinja, and Cummins
time: about 23 hours per successful intrusion, on average
cost: roughly $5,000 in tokens total, about $50 per successful hack (NorForge estimate — rests on assumptions, not metered usage)
models: logs suggested DeepSeek and Anthropic’s Claude Code — suggested, not confirmed
operator: a single Chinese-speaking hacker, financially motivated, per Reuters and NorForge
start: Sept 25, 2026 — e-commerce sites in the US, Canada, Australia, and Japan
instructions: under 100 Chinese characters. One captured task told the agents to find unauthenticated code execution on a site, then plant an uploader web shell
agents did: probing targets, adapting methods, executing commands, continuing across sessions — alone, for hours
scale: 1,200+ sites attempted; websites at 100+ companies reached, including Deere, SharkNinja, and Cummins
time: about 23 hours per successful intrusion, on average
cost: roughly $5,000 in tokens total, about $50 per successful hack (NorForge estimate — rests on assumptions, not metered usage)
models: logs suggested DeepSeek and Anthropic’s Claude Code — suggested, not confirmed
The number that matters is not $50. It is 23 hours. A human attacker does not patiently probe one site for 23 hours. An agent does — it does not get bored, tired, or distracted, and it costs less than lunch. That patience, multiplied across 1,200 targets, is the whole campaign.
how it surfaced: the operator left his own Cairn control panels exposed on the internet, without a password. NorForge researcher Snorre Fagerland found more than 20 exposed panels tied to malicious activity and reconstructed the campaign from them
fallout: Deere said it took remediation actions with “no indication that sensitive information was accessed”; SharkNinja said a standalone product-support site was hit and contained; Cummins said it was investigating a third-party vendor site
unknown: Reuters could not establish whether any data was taken. No confirmed theft of sensitive data from the three named companies
fallout: Deere said it took remediation actions with “no indication that sensitive information was accessed”; SharkNinja said a standalone product-support site was hit and contained; Cummins said it was investigating a third-party vendor site
unknown: Reuters could not establish whether any data was taken. No confirmed theft of sensitive data from the three named companies
The campaign was discovered through the attacker’s own opsec failure, not through a victim’s defenses. The panels also leaked hundreds of secrets, 11% of them still valid. The lesson cuts both ways: exposed dashboards betray whoever leaves them open — attacker or defender.
Note on scope: this post describes what was reported about the campaigns and the fix. It deliberately contains no exploit code, payloads, or reproduction steps. The tools discussed are public; nobody needs another how-to.
# case two: storm-0940 — the 2,900-a-minute campaign, nation-state division
actor: Storm-0940, China-state-aligned per Microsoft Threat Intelligence, tracked since 2021, no known industry aliases
tool: ARTEX — open-source multi-agent LLM penetration-testing framework (Go backend, Next.js frontend, works with any AI model). Released July 2026 for legitimate testing; went closed-source in October 2026 after misuse reports
agents do: run an engagement from reconnaissance through exfiltration with little human interaction, try several breach paths at once, and record findings in a graph of assets and vulnerabilities
tool: ARTEX — open-source multi-agent LLM penetration-testing framework (Go backend, Next.js frontend, works with any AI model). Released July 2026 for legitimate testing; went closed-source in October 2026 after misuse reports
agents do: run an engagement from reconnaissance through exfiltration with little human interaction, try several breach paths at once, and record findings in a graph of assets and vulnerabilities
ARTEX is not a script. It is a team that never sleeps: agents plan, probe, adapt, and hand off to each other, around the clock. That is why the numbers below look inhuman — they are.
entry: the ConnectWise Cloud Backup supply-chain compromise (public reports from Oct 15, ConnectWise advisory Oct 16). Before Oct 15 the actor controlled identities of multiple ConnectWise multi-tenant cloud applications. Neither Microsoft nor ConnectWise has said how those identities were obtained
spray: Oct 10–14, from 144.172.64[.]99 — 151,000+ failed logons against 327 accounts at 8 organizations, peaking at 2,900 failures per minute on Oct 11. Nearly 98% ended in lockouts. None succeeded
downstream: app-only sign-ins to 2,250+ Microsoft 365 tenants at up to 2,900 attempts per minute, using the stolen application identities — no interactive user sign-in required, because the OAuth trust was already granted
follow-on: in some tenants, Microsoft Graph and directory reconnaissance, application credential changes for persistence, and changes to identities, groups, and privileged roles — including one application assigning itself the Global Administrator role
speed: in several environments, initial targeting to privileged cloud access in under 3 hours
spray: Oct 10–14, from 144.172.64[.]99 — 151,000+ failed logons against 327 accounts at 8 organizations, peaking at 2,900 failures per minute on Oct 11. Nearly 98% ended in lockouts. None succeeded
downstream: app-only sign-ins to 2,250+ Microsoft 365 tenants at up to 2,900 attempts per minute, using the stolen application identities — no interactive user sign-in required, because the OAuth trust was already granted
follow-on: in some tenants, Microsoft Graph and directory reconnaissance, application credential changes for persistence, and changes to identities, groups, and privileged roles — including one application assigning itself the Global Administrator role
speed: in several environments, initial targeting to privileged cloud access in under 3 hours
The spray failed and the campaign still worked, because the spray was never the point. The point was the OAuth trust: a compromised vendor application does not need a password, a user, or MFA — it walks in through a door the customer already opened. And the persistence trick is the ugliest part: credential and privilege changes made by the attacker’s applications “can remain active as a backdoor” even after the original application is remediated, per Microsoft.
# the pattern — why two different campaigns belong in one post
# what to do — in order of leverage
1. Inventory everything you own. Every website, subdomain, forgotten microsite, and old support page — the Cairn targets were ordinary e-commerce sites, not flagships. If you cannot list it, you cannot patch it.
2. Audit third-party OAuth applications. Every vendor app holding delegated Microsoft 365 permissions is a Storm-0940-style door. Review service-principal sign-ins, application credential changes, and privilege assignments — especially any application granting itself an admin role.
3. Never leave a control panel exposed. Agent dashboards, admin panels, and monitoring UIs go behind authentication, always. Cairn’s operator was caught by his own open panel.
4. Keep lockouts and MFA on. They are why 151,000 spray attempts produced zero successes.
5. Watch for persistence, not just entry. After any vendor-app incident, hunt credential additions and role changes — they survive remediation of the original app. Keep compromised app connections disabled until the vendor’s restoration guidance lands.
6. Alert on velocity. 2,900 sign-ins a minute is not a human. Rate-based alerting is the tripwire for machine-speed campaigns.
2. Audit third-party OAuth applications. Every vendor app holding delegated Microsoft 365 permissions is a Storm-0940-style door. Review service-principal sign-ins, application credential changes, and privilege assignments — especially any application granting itself an admin role.
3. Never leave a control panel exposed. Agent dashboards, admin panels, and monitoring UIs go behind authentication, always. Cairn’s operator was caught by his own open panel.
4. Keep lockouts and MFA on. They are why 151,000 spray attempts produced zero successes.
5. Watch for persistence, not just entry. After any vendor-app incident, hunt credential additions and role changes — they survive remediation of the original app. Keep compromised app connections disabled until the vendor’s restoration guidance lands.
6. Alert on velocity. 2,900 sign-ins a minute is not a human. Rate-based alerting is the tripwire for machine-speed campaigns.
# the bigger lesson — the bottleneck moved
For years the defender’s quiet advantage was that attacks took human time: an operator could only work so many targets, so many hours, before fatigue or mistakes. Both October campaigns removed that constraint from opposite ends — a lone criminal with patient agents, a nation-state with parallel ones. The cost of trying fell to $50 and the pace rose to thousands of attempts a minute. What did not change is the surface that matters: forgotten sites, trusted vendor applications, and exposed panels. Those were the doors in both campaigns, and they are all inventory problems. The agents are new. The doors are old.
Microsoft’s own caveats deserve repeating: most Storm-0940 targeting was unsuccessful, and an affected application or a successful sign-in does not by itself prove data was accessed. The story is not that AI agents are unstoppable. It is that they made the attempt cheap enough to try everywhere, all the time — and the defenses that held were the unglamorous ones: lockouts, inventories, and closed panels.
Sources (public, at time of writing): Reuters (Oct 19, 2026) and NorForge research on the Cairn campaign; Microsoft Security Blog (Oct 21, 2026), “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”; ConnectWise advisory (Oct 16/21, 2026). Where reports conflict or are unconfirmed — model mix, token costs, whether data was taken, how the ConnectWise identities were obtained — the post says so. All terminal examples above are genericized illustrations, not output from any real system.
Series: Under the HoodStatus: Published 25 Oct 2026