Cairn and ARTEX: AI agents hit 100+ sites and 2,250 tenants

NorForge found over 20 exposed Cairn control panels used to point autonomous agents at e-commerce, payment and pharma targets; the agents probed 1,200+ sites and reached 100+ companies including Deere, SharkNinja and Cummins, with roughly 10% success. Microsoft attributed a ConnectWise Cloud Backup supply-chain campaign to China-linked Storm-0940 using the ARTEX agent framework, which hit 2,250 tenants and generated 151,000+ failed logins.

• Cairn agents probed 1,200+ sites and reached 100+ companies, ~10% success
• Storm-0940 used ARTEX against 2,250 tenants at up to 2,900 attempts per minute
• More than 151,000 failed logins recorded between October 10 and 14
• In several cases privileged access was gained in under 3 hours