Cisco Talos released CAIRN, an open-source framework that fingerprints AI-integrated malware, and used it to identify CLOSEDQUORUM, a Windows tool with fully autonomous command-and-control.
CLOSEDQUORUM queries four LLMs—DeepSeek, Qwen, Mistral and Google Gemini—to decide its next steps, giving it redundancy even if one service goes offline and eliminating human input.
Talos says CAIRN extracts AI-integration traits from malware metadata, assigns unique IDs and groups samples by shared characteristics to track trends and links across campaigns.
About 20 additional AI-enabled malware examples surfaced after Talos used CAIRN for several months, versus only about nine named families previously documented, suggesting broader experimentation than public reporting showed.
Links to 2025 cybercrime forums suggest CLOSEDQUORUM may target login credentials and cryptocurrency, though Talos could not confirm its developer or real-world deployment.