---
title: Hunt: Cairn AIA0001-style AI-agent e-commerce compromise — uploader webshells, Magento StyleSmuggler PoCs, AS56594 panels, staging 199.247.25.25 / 199.247.27.2 | ctxsec
url: https://ctxsec.com/items/hunt-cairn-uploader-shell-aia0001
description: ""
status: "confirmed (NorForge IOCs / TTPs)"
published: 2026-10-19
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-cairn-uploader-shell-aia0001.md)

confirmed (NorForge IOCs / TTPs)

2026-10-19

### Hunt: Cairn AIA0001-style AI-agent e-commerce compromise — uploader webshells, Magento StyleSmuggler PoCs, AS56594 panels, staging 199.247.25.25 / 199.247.27.2

From NorForge's Oct 19 Cairn report (cluster AIA0001): look for newly created PHP uploaders that are deliberately not command-exec webshells (HTML form + `move_uploaded_file`, often named like normal app files). Agent tooling observed on one worker included Playwright/Chromium, PHPGGC, StyleSmuggler / CVE-2026-75650 Magento PoC, ffuf, Amass, dnsrecon, nmap, rockyou. Panel hosting for AIA0001 clustered on AS56594 (Cgi Global); AIA0002 preferred AS20473/Vultr. Unredacted staging IPs NorForge published: `199.247.25.25` and `199.247.27.2` (AIA0002). Panels commonly listened on high ports (examples redacted but pattern `*:8000`). Also hunt open Cairn/Hermes/Strix-style agent UIs on your own attack surface and in customer internet scans — exposed panels leak target lists, harvested creds, and sometimes attacker staging SSH. Validate claimed shells before assuming compromise; NorForge independently fetched at least one live uploader on a hardware-parts vendor site.

Sources: [NorForge: Inside Cairn (Oct 19)](https://norforge.com/blog/inside_cairn)