Anas SahelIdentity & security

Threat watch / Threat actors

CL-STA-1238

Unknown updated 13 Nov 2026

The name Palo Alto Networks Unit 42 gives to an activity cluster that used a customized fork of the Cairn AI penetration testing framework, run on Chinese AI models, against semiconductor, defense-policy and civil society organizations in August and September 2026.

Attribution

Unit 42 assesses "with moderate confidence" that CL-STA-1238 is a China-nexus intelligence collection campaign, based on the Chinese language of its artifacts, its exclusive use of Chinese AI models and a choice of targets that matches Chinese state intelligence priorities. It does not tie it to a named state body. [1]

Incidents in the watch

  1. Cairn: an AI pentest framework turned against 19 organizations, 10 of them breached High

← All threat actors