Strix and Cairn campaigns. The access path.
Autonomous scanning agents reached card records, then dropped 180 tables. The tooling is public and the flaws are ordinary. What changed is the price of trying.
The record
Entry point. strix, 146 scanning runs, model-driven recon.
The identity in the middle. Valid application credentials the agents obtained, used the way the application itself uses them.
What was reached. 600,000 card records read, then 180 tables dropped.
Autonomous scanning agents reached card records, then dropped 180 tables.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| strix | Entry | 146 scanning runs, model-driven recon |
| cairn | Step | 105 attack projects, 10 to 15 September |
| application | Step | sql injection, uploads, api abuse, valid credentials |
| database | Step | 600,000 unexpired card records from two companies |
| wipe | Reached | "Database Wipe After Extraction", 180 tables dropped |
Where a breakpoint would have been
The database account behind the application. Reading 600,000 records and dropping 180 tables are different permissions, and the second one is rarely needed by a running application. Splitting read from schema change closes the destructive half of the path.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the Strix and Cairn campaigns incident?
The published path starts at strix, 146 scanning runs, model-driven recon.
What did it reach?
The published path ends at 600,000 card records read, then 180 tables dropped.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.