Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.
74
Malware
CLOSEDQUORUM
- Mentions · 7d0
- Mentions · 30d0
- All mentions12
- First seenSep 22, 2026
- Last mentionedSep 28, 2026
Timeline
12 articles · newest firstIn Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
74
CLOSEDQUORUM, the malware that asks four AI models what to do next
Cisco Talos says CLOSEDQUORUM lets four commercial AI models vote on credential and wallet theft.
74
This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
Talos analyzed CLOSEDQUORUM, Windows malware that lets up to four AI models vote on its next action.
68
Cisco Talos Launches CAIRN Tool to Hunt and Track AI-Integrated Malware
Cisco Talos released CAIRN, an open-source toolkit to identify AI-integrated malware by analyzing metadata for 'cognitive artifacts' from LLMs.
65
Researchers Find Malware That Uses AI Models Instead of Human Hackers for Control
Researchers find CLOSEDQUORUM, a Windows malware that uses commercial LLMs as an autonomous decision engine for post-compromise actions like credential theft.
65
New ClosedQuorum Windows malware uses AI for attack decisions
ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.
62
A New Tool for Tracking AI Malware Uncovers Malware That Operates Without Human Control
Cisco Talos releases CAIRN to track AI malware and documents CLOSEDQUORUM, an unconfirmed Windows implant steered by LLMs.
66
Researchers uncover malware that uses AI to choose its next move
Cisco Talos documents CLOSEDQUORUM, a Windows implant that lets commercial LLMs vote on its next action.
66
The Closed Quorum: Inside the first reported autonomous AI C2 implant
Cisco Talos discovered CLOSEDQUORUM, the first autonomous AI-driven malware C2 implant using multiple LLMs for independent decision-making.
75
Introducing CAIRN: Frontier tracking for AI-integrated malware
Cisco Talos releases CAIRN, an open-source framework for tracking and classifying AI-integrated malware using metadata analysis.
65
A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight
New tool uncovers CLOSEDQUORUM, malware using a hive-mind of four LLMs for autonomous command-and-control decisions.
70
Related CVEs
by mentions- CVE-2026-42542<1%7.5TDengine: In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single…
Appears with
- Cisco Talosorganization · 11
- Qwenai model · 10
- Mistralai model · 10
- DeepSeekai model · 9
- Geminiai model · 8
- LAMEHUGmalware · 4
- CAIRNproduct · 4
- MetaMaskproduct · 4
- Exodusproduct · 4
- Microsoft Edgeproduct · 4
- Windowsproduct · 4
- Googlevendor · 4
- Ciscovendor · 3
- Firefoxproduct · 3
- Chromeproduct · 3
- Discordproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.