Cisco Talos has released CAIRN, an open‑source framework that systematically classifies AI‑integrated malware by extracting AI‑related traits from sample metadata. The tool assigns unique identifiers to each sample and groups them by shared characteristics, enabling rapid discovery of novel threats.
CAIRN architecture and detection methodology
- Metadata‑driven profiling: CAIRN parses static and dynamic metadata (file hashes, import tables, network indicators) to locate signatures of AI integration such as references to LLM APIs or model identifiers.
- Unique ID assignment: Each sample receives a deterministic ID that reflects its AI‑related features, facilitating cross‑campaign correlation.
- Trait‑based clustering: Samples sharing AI‑integration characteristics are automatically grouped, allowing analysts to spot families that leverage similar LLM services.
- Open‑source extensibility: The framework is published under an OSI‑approved license, encouraging community contributions to expand the AI‑malware taxonomy.
CLOSEDQUORUM: autonomous LLM‑driven command‑and‑control
CLOSEDQUORUM is a Windows‑based malware family identified through CAIRN. Its core innovation is a fully autonomous C2 infrastructure that polls up to four large language models—DeepSeek, Qwen, Mistral, and Google Gemini—to decide its next actions inside a compromised host.
- Decision loop: The malware sends contextual telemetry to each LLM, receives textual instructions, and selects the most favorable response, effectively outsourcing its command logic to external AI services.
- Primary objectives: Credential theft and cryptocurrency exfiltration are the stated goals, with the LLMs guiding credential‑harvesting techniques and wallet address selection.
- Operational stealth: By delegating decision‑making to public LLM endpoints, CLOSEDQUORUM reduces the need for traditional C2 traffic, complicating network‑based detection.
LAMEHUG and precedent LLM‑based payloads
In July 2025, CERT‑UA warned about a phishing campaign distributing LAMEHUG, a malware variant that communicates with the Qwen2.5‑Coder‑32B‑Instruct model via the Hugging Face API. LAMEHUG demonstrates an earlier, similar pattern of leveraging hosted LLMs for command execution, confirming that CLOSEDQUORUM is part of an emerging threat class.
Threat landscape implications
- Detection complexity: Traditional signature‑based tools struggle to flag behavior that occurs off‑device within third‑party LLM services.
- Reliance on external APIs: Malware can exploit rate‑limits, authentication mechanisms, or policy changes of LLM providers to disrupt its own operation, creating a potential defensive lever.
- Attribution challenges: The use of multiple LLM vendors obscures the malware author’s infrastructure, making forensic linking to specific threat actors more difficult.
- Ecosystem impact: Security teams must monitor outbound traffic to LLM endpoints and consider sandboxing or proxying API calls to detect anomalous query patterns.
Strategic Radar
The emergence of AI‑driven malware like CLOSEDQUORUM signals a shift from static command‑and‑control to dynamic, model‑informed attack orchestration. Organizations should augment existing detection stacks with telemetry that captures LLM API usage, enforce strict egress controls to known AI service endpoints, and contribute threat‑intel feeds back to frameworks such as CAIRN. By doing so, defenders can regain visibility into the decision layer that adversaries are increasingly outsourcing to powerful language models.