Cisco Talos releases CAIRN, an open-source framework designed to classify and analyze AI-integrated malware by tracking AI metadata and behavioral fingerprints

Malware can now operate autonomously by querying LLMs, making traditional analysis methods less effective for attribution and detection.

Cisco Talos has released CAIRN, an open-source framework designed to detect and analyze malware that integrates artificial intelligence. Named after navigational stone stacks, CAIRN works by identifying unique metadata and behavioral patterns left by AI services within malware. The framework aims to classify these AI-integrated samples and track their origins and evolving tactics. Talos researchers utilized CAIRN to identify CLOSEDQUORUM, a Windows malware that autonomously directs its actions by querying multiple large language models (LLMs) such as DeepSeek, Qwen, Mistral, and Google Gemini. This allows CLOSEDQUORUM to operate with redundant AI decision-making, lacking human intervention. The malware is engineered to steal login credentials and cryptocurrency, with potential links to credit card fraud forums in 2025, though its origin and real-world deployment remain unconfirmed. CAIRN has helped Talos uncover approximately 20 previously undocumented AI-integrated malware examples, suggesting a more complex and diverse landscape than publicly reported.

The emergence of AI-integrated malware, as highlighted by Cisco Talos's CAIRN framework and the CLOSEDQUORUM example, signifies a pivotal operational shift for threat actors. By leveraging LLMs for command-and-control and decision-making, attackers can achieve unprecedented levels of automation and resilience, reducing their reliance on human input and complex infrastructure. This move toward AI-driven malware operationalization means that future cyber threats may become more sophisticated, adaptive, and difficult to attribute, posing a significant challenge to existing defensive strategies and security postures.

CAIRN's open-source release democratizes the detection and analysis of AI-enhanced malware, enabling the broader cybersecurity community to identify and understand emerging threats. The framework's ability to track AI metadata and behavioral fingerprints provides a novel approach to classifying and correlating these new malware variants. As attackers increasingly integrate AI, tools like CAIRN are crucial for maintaining visibility into the evolving threat landscape and developing effective countermeasures against these advanced, autonomous cyber tools.