Attackers hijack exposed Cairn SI pentesting agent panels: backdoors and API key theft
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
SI agents built for security are hacked the same way as ordinary exposed services, and they need to be protected with the same measures.
According to the company NorForge, since October 20 malicious tasks have been entered into Cairn platform panels exposed to the internet: add a foreign SSH key, download the Poseidon remote access trojan, and find and exfiltrate API keys and tokens. Similar tasks were found on at least 17 panels, some of which belonged to red teams and training competitions; the malware was launched on October 21 at 21:15 UTC. NorForge identified two activity clusters, AIA0009 (persistence and malware) and AIA0010 (credentials and discovery), and for now treats them as separate. Anyone who can reach a panel reachable from the network can browse projects and start and stop tasks. The company advises isolating agent tasks in containers, not exposing panels to the internet, rotating keys and checking the authorized_keys file.
Sources 1