According to CryptoSlate, citing a November 12 investigation by Palo Alto Networks' Unit 42, the research team tracked 25 campaigns targeting at least 19 organizations between August and September 2026, with the report noting that 10 of these organizations suffered system access or data exfiltration. Researchers stated that the attackers utilized a customized version of the Cairn framework combined with Zhipu AI's GLM and DeepSeek models; targets and tasks were assigned by humans, with manual guidance still applied during the operations. Unit 42 believes that AI has expanded the scale and reach of such operations rather than enhancing their technical complexity.