# Cisco Talos unveils CAIRN tool that detects AI‑driven closedquorum malware

Digest AI · Research · published 2026-09-22T10:00:00Z

Canonical: https://digestai.news/story/cisco-talos-unveils-cairn-tool-that-detects-aidriven-closedquorum-malw

## Summary

Cisco Talos researchers introduced CAIRN, a framework that flags AI‑integration traits in malware by analyzing metadata fingerprints and assigning unique IDs. Lead researcher Ryan Fetterman says the system looks for “fingerprints” left by AI services, helping the defensive community track emerging threats.

Using CAIRN they identified a Windows tool called CLOSEDQUORUM that polls up to four large language models—DeepSeek, Qwen, Mistral and Google Gemini—to decide its next actions, operating without any human input. The malware is designed to steal login credentials and cryptocurrency and shows links to credit‑card‑fraud forums dating back to 2025. Researchers could not confirm who built it or whether it has been used in real‑world attacks.

The team also references earlier LAMEHUG malware that used Qwen2.5‑Coder‑32B‑Instruct via a Hugging Face API. Fetterman estimates CAIRN has now uncovered about 20 additional AI‑integrated malware samples, suggesting the threat landscape is more complex than previously reported.

## Key points

- Cisco Talos released CAIRN, a framework that tags AI‑integrated malware by analyzing metadata fingerprints.
- CAIRN uncovered CLOSEDQUORUM, Windows malware that polls DeepSeek, Qwen, Mistral and Google Gemini for autonomous commands.
- Researchers found roughly 20 more AI‑driven malware examples but cannot confirm developers or real‑world use.

## Why it matters

Detecting AI‑driven malware gives defenders early warning as attackers automate campaigns with LLMs, potentially expanding credential theft and crypto theft.

## Sources

1. [A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight](https://wired.com/story/a-tool-for-tracking-ai-integrated-malware-uncovered-an-autonomous-command-system) (Wired AI, 2026-09-22)

## Cite

Digest AI, "Cisco Talos unveils CAIRN tool that detects AI‑driven closedquorum malware", 22 September 2026, https://digestai.news/story/cisco-talos-unveils-cairn-tool-that-detects-aidriven-closedquorum-malw

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/cisco-talos-unveils-cairn-tool-that-detects-aidriven-closedquorum-malw.json