From NorForge's Oct 19 Cairn report (cluster AIA0001): look for newly created PHP uploaders that are deliberately not command-exec webshells (HTML form + move_uploaded_file, often named like normal app files). Agent tooling observed on one worker included Playwright/Chromium, PHPGGC, StyleSmuggler / CVE-2026-75650 Magento PoC, ffuf, Amass, dnsrecon, nmap, rockyou. Panel hosting for AIA0001 clustered on AS56594 (Cgi Global); AIA0002 preferred AS20473/Vultr. Unredacted staging IPs NorForge published: 199.247.25.25 and 199.247.27.2 (AIA0002). Panels commonly listened on high ports (examples redacted but pattern *:8000). Also hunt open Cairn/Hermes/Strix-style agent UIs on your own attack surface and in customer internet scans — exposed panels leak target lists, harvested creds, and sometimes attacker staging SSH. Validate claimed shells before assuming compromise; NorForge independently fetched at least one live uploader on a hardware-parts vendor site.