一名网络犯罪分子利用三个开源AI框架攻击了数百家在线零售商及其他公司，窃取了超过60万条信用卡记录并安装了盗卡程序——而这一切的成本微乎其微。
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®
人工智能安全公司Gambit恢复了该人类操作员的暂存服务器，并利用该权限重建了这起数据窃取行动。受害者包括一家财富500强酒店企业、一家美国主要航空公司、一家美国大型私营工业用品分销商以及一家美国在线时尚零售商。
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®
Gambit威胁情报总监埃亚尔·塞拉（Eyal Sela）在周二的一份预警中写道，在9月10日至9月15日期间，这名犯罪分子发起了至少105次攻击，并“不同程度地”危害了至少27家公司。
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®
这名说中文的操作员使用三个不同的开源AI框架——Strix、Cairn和Hermes——来运行近乎自主的攻击，每天打击“数十家”公司。
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®
塞拉写道：“在获得访问权限的地方，通常不到一天，许多情况下只需几个小时。”“我们还在攻击者的操作手册中检测到一些指令，这些指令可能会因代理运行的数据删除或清理程序而中断公司的运营——在某些入侵事件中，这种情况确实发生了。”
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®
该操作员还使用OpenRouter来访问AI模型。根据8月25日的账户余额显示，他们在前四周花费了7,005.71美元。随后，他们又继续进行了三周的攻击，其模型调用的每日吞吐量达到先前的两倍。
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®
Gambit估计，此次行动的总成本在12,000美元到18,000美元之间。操作员自身的成本审查显示，在101次已完成的扫描中，平均花费为25.46美元。最便宜的扫描仅花费3.13美元，最贵的一笔账单则高达79.31美元。
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®
这三个AI框架各自承担了不同的角色，其中Hermes充当了此次行动的协调器。
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®
这款始终处于运行状态的人工智能助手能够独立执行多步骤任务并管理工作流程；它还能够自行编写和修改自身的功能/技能。人类操作者在名为“Hermes”的系统中为该人工智能助手加载了一个名为“SOUL - Red Team Operator”的中文角色，该角色拥有共计121项功能/技能，其中78项属于攻击性技能。其中有一项技能甚至能够绕过人工智能系统的内容安全过滤机制。Hermes使用了Anthropic公司的Claude Opus 4.6模型来进行攻击操作；不过较新的模型拒绝了这些攻击请求。人类操作者在260次会话中使用了1,951条中文指令来指导人工智能助手的攻击行为。这些指令的内容包括：“检查报告中的文件上传内容是否允许代码执行”、“阅读漏洞报告并先测试sudo密码”、“查看报告中是否有值得利用的漏洞”、“尝试入侵系统的Web后端接口”等。攻击者使用了开源渗透测试工具Strix来寻找目标组织中的可利用漏洞；他们分别在GLM 5.2系统和DeepSeek v4 Pro系统中运行了Strix工具。从8月23日到31日，该操作者共使用了146次Strix工具对138个目标主机进行了攻击，累计扫描时间为633小时（实际操作时间为195小时）。在发现漏洞后，Strix会将后续的攻击任务交给另一款名为Cairn的自动化渗透测试工具来执行；Cairn运行在DeepSeek v4.1系统上，其攻击目标包括在目标系统中部署shell脚本或获取管理员权限等。Sela指出：“Cairn会根据实际情况实时选择攻击路径，并通过多次尝试来实施攻击，因此不同受害者的攻击方式往往各不相同。”在其中一个案例中，人工智能攻击者利用SQL注入攻击手段获取了目标系统的明文一次性密码，随后成功入侵了该系统的Web管理界面。
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®
从那里开始，该智能体上传了一个Web Shell，通过配置错误的sudo规则提升了权限，并访问了AWS凭证，最终导出了46个机密，总计102KB。在其中两次近乎自主的攻击中，这些AI仅从两家受害公司就窃取了超过60万条信用卡记录。在网店的结账页面中注入窃取信用卡的勒索脚本（skimmer），是该人类操作员在此次行动中的另一个主要目标。据Gambit透露，这名恶意分子下令对至少27个点名的受害者部署勒索脚本，并确认有19个网站存在这些脚本。安全研究员Varys还协助检测到了与此次行动相关的100多个其他受感染网站。虽然攻击者使用了各种方法来注入和部署勒索脚本，但最常见的方法是将代码附加到现有的JavaScript文件中。Gambit认为，这场攻击表明，修复时钟——即企业检测入侵和修复漏洞所需的时间——已经急剧缩短。“这些攻击程序的运行节奏是任何人类操作员都无法维持的，人类沦为了在自主运行间隙下达简短指令的角色，”Sela说道。“当漏洞利用在暴露后数小时内就会发生时，打补丁的速度已不再是唯一的应对手段，问题转变为企业赖以生存的服务能够以多快的速度恢复。” ®
A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost. AI security company Gambit recovered the human operator’s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, “to varying degrees,” at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote in a Tuesday alert. The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the near-autonomous attacks and hit “tens” of companies each day. “Where access was achieved, it usually took less than a day, and in many cases just a few hours,” Sela wrote. “We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.” The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator's own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31. Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills. The human operator loaded a Chinese system persona titled “SOUL - Red Team Operator” on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness. Hermes used Anthropic’s Claude Opus 4.6 - Gambit reports that newer models refused the attack requests - and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: See whether the file upload in the report can give code execution Read the vulnerability report, test the sudo password first Read the report, is there anything worth doing here Get into the web backend Can it get code execution? The attacker used Strix, an open source penetration testing tool, to search for vulnerabilities to exploit at targeted organizations. They ran Strix through OpenRouter on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and 31, the operator ran Strix 146 times in “deep mode” against 138 hosts, totaling 633 hours of scanner time in 195 hours of clock time. After finding vulnerabilities, Strix handed the next stage of the attack off to Cairn, another autonomous penetration testing AI tool, running on DeepSeek v4.1 Flash. Cairn receives target domains and an attack objective - like deploy a shell, or achieve admin access. It then runs until it either achieves the objective, times out, or is stopped by a human. Between September 10 and 15, Cairn launched 105 attack projects. The AI chose each attack path “in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims,” Sela wrote. In one instance, the AI agent used SQL injection, obtained a plaintext one-time password and then accessed a web panel. From there the agent uploaded a web shell, escalated privileges through a misconfigured sudo rule, and accessed AWS credentials, ultimately dumping 46 secrets, totaling 102KB. In two of these near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from just two victim companies. Injecting card-stealing skimmer scripts into the checkout pages of online shops was another one of the human operator’s primary goals for the campaign. According to Gambit, the malfeasant ordered skimmer deployment against at least 27 named victims, with scripts confirmed as present on 19 websites. Security researcher Varys also helped detect more than 100 additional infected websites linked to this campaign. While the attacker used various methods to inject and deploy skimmers, the most common involved appending the code to an existing JavaScript file. Gambit argues that this campaign shows how the remediation clock - how much time organizations have to detect an intrusion and remediate vulnerabilities - has dramatically shortened. “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs,” Sela said. “When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.” ®