VULONE exposes Cairn attacks on Asian governments using AI agents

VULONE recovered 66 project records from an attack infrastructure that used the open-source pentest tool Cairn and DeepSeek v4.1 Flash to automate reconnaissance and exploitation. Attacker-side logs show 48 projects reached session-level access or higher, including 6 with root/SYSTEM, targeting government systems in Vietnam, Taiwan, Indonesia and India.

• 66 projects recorded, 7 never started; 48 reached session-level access or higher
• 6 projects reached root/SYSTEM, 39 achieved non-root command execution
• A 16.4 GB archive of attacker /tmp directories was collected Sept 29–Oct 15, 2026
• 116 unique Kali-based workers ran DeepSeek v4.1 Flash for recon and exploitation