Vulone: operator ran 66 intrusions with Cairn AI-agent platform, reaching Taiwan Legislative Yuan law system and MOJ-linked systems

Vulone disclosed on Oct 18 that a China-linked, financially motivated operator built an AI-agent intrusion platform on the open-source Cairn framework and ran 66 operations between Sep 24 and Oct 14, 48 of which reached at least session-level access ^[1][2]. Taiwanese targets listed include the Legislative Yuan law system, Ministry of Justice-linked systems and an outdated CentOS host at the Investigation Bureau via a vendor app, plus China Airlines and Every8D, whose operator told iThome its environment has no such systems ^[1][2]. Organizations should check logs for connections to 202.61.139[.]15 and 202.61.139[.]137 listed in Vulone IOCs ^[1].

Industries mainly affected: Government, Technology, Transportation & logistics

1. Check firewall and proxy logs for connections to 202.61.139[.]15 and 202.61.139[.]137, listed in Vulone IOCs ^[1].