Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware

Cisco Talos on September 22, 2026 released CAIRN (Cognitive Artifact Intelligence Research Network), an open-source research toolkit for hunting, classifying, and tracking emerging AI-integrated malware. The accompanying findings series opens with CLOSEDQUORUM, which Talos described as, to its knowledge, the first publicly documented Windows implant to delegate tactical command-and-control (C2) decisions to a panel of commercial large language models (LLMs).

The toolkit was detailed in a Talos blog post authored by Ryan Fetterman. Talos defines AI-integrated malware as malware that functionally operationalizes, explicitly targets, or exploits AI systems and their ecosystems, spanning functional integration into attack chains, credential and infrastructure compromise, and ecosystem-level abuse. The methodology treats the traces that integration leaves inside attacker tooling, such as prompt templates, provider endpoints, API keys, and jailbreak terms, as cognitive artifacts that can be extracted, related, and classified without touching the underlying binary. The name references the stacked-stone markers hikers leave on trails; Talos’s premise is that attackers building this class of malware leave comparable markers of their own.

Metadata-First Architecture and Hunt Strategies

CAIRN operates entirely from metadata, with no binary downloads or execution, combining rule-based detection, semantic clustering, and relationship graph traversal. Its explorer layer builds a structured graph of cognitive artifact relationships to help defenders identify related malware families, infrastructure, and threat actors.

Candidate samples are discovered through up to 24 acquisition filters, each targeting a different type of AI-related artifact across extracted strings, sandbox behavior, and antivirus detection labels. Documented examples include provider-api-integration, which searches for LLM provider endpoint strings such as api.openai.com, api.anthropic.com, api.deepseek.com, and Generativelanguage.googleapis.com; python-ai-scripts, which matches AI framework imports including langchain, litellm, and openai; ai-analysis-evasion, which searches for text strings explicitly addressed to AI analysis systems; local-llm-runtime, which flags local inference indicators such as ollama, llama.cpp, vllm, gguf, and safetensors; and agentic-tooling, which looks for tool-call syntax co-occurring with offensive capability terms.

Acquired results are stored in a SQLite corpus, with YARA rules run automatically on import under a three-layer ontology: T1 rules establish that primitive AI artifacts are present, T2 rules add behavioral context by identifying combinations of artifacts that suggest operational use of AI, and T3 rules perform family attribution using confirmed operational fingerprints. Rather than scanning raw binaries, CAIRN builds a “scan text” for each sample from file names, antivirus detection strings, ExifTool PE resource strings, Sigma analysis results, sandbox behavioral data, and relationship objects, so every rule hit is traceable to a named VirusTotal metadata field. The repository lists 26 tiered rules (nine T1, eight T2, and nine T3) and 27 named acquisition channels, three of them disabled.

CAIRN supports four analysis strategies: acquisition filters for corpus expansion, relationship-based pivoting, YARA-based triage and classification, and semantic discovery. Relationship-based pivoting expands outward from a sample of interest through metadata graphs to surface additional variants, shared infrastructure such as domains, IP addresses, certificates, and C2 servers, and companion payloads in the same campaign. After any rule change, the rescan command re-applies all three tiers offline against the full corpus without API calls or re-downloading, so a new T3 rule retroactively attributes previously acquired samples to the confirmed family. Semantic discovery encodes each sample’s scan text with embedding models and clusters the corpus using HDBSCAN and UMAP. Talos cautions that cluster co-membership is a weak similarity signal that generates leads rather than conclusions, and that every interesting cluster requires per-sample inspection.

Initial Findings and Stated Limitations

Talos said its initial CAIRN hunts have targeted active malware development dating back to July 2025, when the first AI-integrated samples were reported in the wild with LAMEHUG, documented by CERT-UA. Across the collected samples and relationships, Talos reports what it calls an autonomy escalation arc: the progression from LLM as an optional feature to a fully autonomous multi-model consensus orchestrator with no human operator filled in within a single calendar year.

Talos also traced an AI-analysis evasion technique, natural-language suppression text addressed to LLM sandboxes, to a named red team instructor, and said the technique appeared in independent actor samples within 12 months of its first confirmed in-the-wild use, crossing from interpreted scripts into compiled malware.

Talos warns that T1 and T2 hits without genuine AI integration are common, citing PyInstaller bundles, Tauri-framework applications, and certain Go PE structures as elevated noise sources, and states that final verdicts for all findings still require validation through reverse engineering. It characterizes CAIRN as a research effort rather than a pure active threat signal, describing metadata-first hunting as a scalable complement to traditional reverse engineering.

CLOSEDQUORUM: An LLM Panel as Command and Control

The first findings entry examines CLOSEDQUORUM, a 16.4MB 64-bit Windows executable compiled in Go. Instead of contacting a dedicated attacker-operated server, the implant treats up to four commercial LLM providers (DeepSeek, Qwen, Mistral, and Google Gemini) as its C2 infrastructure, delegating selection of its next action to the panel with the intent of harvesting user credentials and crypto wallets. The models are queried in sequence and their verdicts resolved by plurality voting, with a deterministic tie-breaking order that favors DeepSeek first, then Qwen, Mistral, and Gemini.

The panel is constrained to a typed JSON decision schema. The system prompt embedded in the binary, quoted in Talos’s analysis, instructs each model: “You are an advanced malware strategist. Provide ONLY executable decisions.” The decision field routes to capability modules: steal invokes LSASS memory dumping, browser credential theft against Chrome, Edge, and Firefox, and crypto wallet extraction targeting MetaMask, Exodus, and Ethereum wallets; inject routes to process hollowing or Early Bird APC injection; persist establishes persistence.

Stolen material arrives AES-256-GCM encrypted at an operator’s Discord webhook, and the implant executes at randomized 5–15-minute intervals while suppressing ETW telemetry by overwriting the EtwEventWrite function with a single RET instruction.

Talos said it has no confirmation of in-the-wild deployment. The public distribution build contains placeholder API keys and a dummy webhook and is non-functional as distributed, while development builds show the operator’s Discord webhook and LLM API keys injected at compile time. Artifacts from the binary connected the developer to criminal-forum postings related to carding dating back to 2025. If operated as assessed, Talos said, CLOSEDQUORUM amounts to a credentials-as-a-service model in which the differentiator is the autonomous LLM orchestration layer: an operator deploys the binary, and the panel runs the attack without the operator needing to be online.

Availability, License, and Safety Boundaries

CAIRN is available on GitHub under the MIT License, with copyright held by Cisco Systems. It requires Python 3.11 or later and a VirusTotal Intelligence API key, with an optional PromptIntel API key for IOC feed synchronization. The repository does not include Talos’s SQLite findings database, for copyright reasons; users with a VirusTotal API key can rebuild it from the published report hashes and acquisition filters.

Stated safety boundaries include no binary downloads, no file uploads to VirusTotal, no URL submissions or active scans, and no scheduled automatic pulls. The repository states that all published family attributions and archetype assignments are first confirmed through hands-on reverse engineering by Cisco Talos, and that no family report is published on metadata evidence alone. Its AI-malware archetype taxonomy, spanning categories A0 through A11, classifies CLOSEDQUORUM under LLM-tasked C2. Talos said it will share the full contents of its initial findings over time, and the repository notes that additional families are confirmed but withheld pending publication.