A New Tool for Tracking AI Malware Uncovers Malware That Operates Without Human Control
Cisco Talos releases CAIRN to track AI malware and documents CLOSEDQUORUM, an unconfirmed Windows implant steered by LLMs.
Cisco Talos released CAIRN, an open-source toolkit that hunts AI-integrated malware by scoring prompt templates, provider endpoints, API-key prefixes, libraries, and sandbox metadata without downloading or executing binaries. Its launch describes CLOSEDQUORUM, called the first publicly documented Windows implant to delegate tactical decisions to a panel of commercial models: DeepSeek, Qwen, Mistral, and Google Gemini. Static analysis shows prompts that can select LSASS dumping, browser-password and cryptocurrency-wallet theft, process hollowing, APC injection, persistence, and encrypted exfiltration through Discord. Talos has not confirmed real-world use, and the public build is nonfunctional.
- CAIRN classifies AI-malware artifacts from strings and metadata without executing samples.
- CLOSEDQUORUM asks up to four commercial LLMs and uses plurality voting.
- Described actions include credential theft, injection, persistence, and Discord exfiltration.
- Talos has not confirmed deployment, and the public build is nonfunctional.
- Clusters are investigative leads, not attribution.
- ATT&CK
- T1003.001 LSASS MemoryT1555.003 Credentials from Web BrowsersT1055.012 Process HollowingT1055.004 Asynchronous Procedure CallT1567 Exfiltration Over Web Service
- Vendors
- Cisco
- Products
- CAIRN
- Malware
- CLOSEDQUORUMLAMEHUG
- Organizations
- Cisco Talos
From the original article
3 min read at cybersecuritynews.com
Cisco Talos has released CAIRN, an open-source toolkit designed to hunt, classify, and track AI-integrated malware by examining the digital markers developers leave behind. The Cognitive Artifact Intelligence Research Network searches for prompt templates, provider endpoints, API-key prefixes, jailbreak terms, and orchestration logic without downloading or executing binaries.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.