Known malicious kitlowother

Cairn consoles reachable from the internet

family: cairn-console-2026-11

Tracks internet-reachable consoles of Cairn, an open-source engine that coordinates AI agents on multi-step goals and was validated first on autonomous penetration testing. Public reports describe it in intrusions against government networks and in a server takeover, and describe attackers hijacking exposed panels, because the console has no authentication by default. Matches the console's own page code, which forks keep when they rename it, and its stock favicon. A match identifies the software, not how it is used: red teams and CTF players run it too.

Anchors

SMQL queryrun
hunting_rule:Cairn_Console OR favicon_hash:762324858

Provenance

Added: 2026-11-02 19:07
The console listens on port 8000 by default, served by uvicorn. Forks appear under other titles such as VulnFlow IoT, WorkerAnt, Zero and cf作战平台; some are separate products built on Cairn. The title Cairn alone is no use as a search term, because it also names unrelated sites. Confirm unauthorized use before treating a sighting as hostile.

Sightings (3)Atom feed

HostScanScriptMatchScanned
8.216.41.6066f06249…—query2026-11-02 19:03
123.57.3.71c1fa950b…—query2026-11-02 19:03
156.240.236.6805e0642…—query2026-11-02 17:37