Cisco Talos Unveils CAIRN Framework After Finding AI-Run Malware

Cybersecurity researchers at Cisco Talos have released an open-source framework for classifying and analyzing malware that incorporates artificial intelligence, and they say it has already proven useful.

The framework is called Cognitive Artifact Intelligence Research Network, or CAIRN, a nod to the stone stacks hikers use to mark trails. Using CAIRN, the researchers identified a hacking tool with fully autonomous command-and-control infrastructure. Named CLOSEDQUORUM, the Windows malware polls up to four large language models - DeepSeek, Qwen, Mistral, and Google Gemini - to reach a consensus on its next moves. If one service is unavailable, it still queries the others, leaving no mechanism for human input.

"The core idea is that AI integration has these vestiges, like fingerprints, that are left behind," said Ryan Fetterman, the Cisco Talos security researcher who led CAIRN's development.

Fetterman began the project after a retrospective last summer turned up only about nine named AI-integrated malware families, some of them research proofs of concept. After months of work with CAIRN, he found roughly 20 more examples.

CLOSEDQUORUM is designed to steal login credentials and cryptocurrency, and researchers saw links to cybercriminal forums about credit card fraud dating to 2025. They could not confirm who developed it or whether it has been used in real-world attacks.

Source: Wired