CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CAIRN (Cisco Talos)

tool · tool:cairn-talos single-source

Cisco Talos' open-source research toolkit, released 2026-09-22, for discovering and tracking AI-integrated malware; used to find CLOSEDQUORUM (Cisco Talos, 2026-09-22). Distinct from the unrelated Gambit Security-documented autonomous exploitation engine also named Cairn (tool:cairn-exploitation-engine).

Aliases: Cognitive Artifact Intelligence Research Network

Coverage
2
first 2026-09-24 → last 2026-10-20
Latest activity
2026-10-09
Talos: malware tells the analysing LLM to skip it; the text is plain and therefore detectable
Peak priority
notable
1 notable · 1 routine
Targets
·
no sector or region stated
Sources cited
5
4 hosts
2026-09-242 appearances2026-10-09

Defender insights

What each entry about CAIRN (Cisco Talos) tells a defender to do, newest first.

2026-10-09NOTABLETalos: malware tells the analysing LLM to skip it; the text is plain and therefore detectable

Exposure · triage · detection

2026-09-24ROUTINEA malware implant treats commercial AI chatbot endpoints as its command-and-control infrastructure, no attacker server required

Triage · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

related to

Story timeline

  1. 2026-10-09Cisco Talos: malware now embeds natural-language instructions aimed at LLM triage pipelines, from a copied comment to template-sprayed prompts across four families, and a Russia-aligned group uses it too
    researchTalos: malware tells the analysing LLM to skip it; the text is plain and therefore detectable
  2. 2026-09-24CLOSEDQUORUM: Cisco Talos documents what it calls, to its knowledge, the first publicly documented Windows implant that lets a panel of four commercial LLMs vote on its next action instead of a human operator
    active-threatsA malware implant treats commercial AI chatbot endpoints as its command-and-control infrastructure, no attacker server required

Hunting pivots

Affected products
Google ChromeMicrosoft EdgeMicrosoft WindowsMozilla Firefox
Tags
ai-abuse ×2infostealervulnerabilities
ATT&CK techniques (13 across 9 tactics)

13 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • ExecutionScheduled Task/Job: Scheduled Task · Command and Scripting Interpreter: PowerShell
  • PersistenceScheduled Task/Job: Scheduled Task · Event Triggered Execution: Windows Management Instrumentation Event Subscription · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • Privilege EscalationScheduled Task/Job: Scheduled Task · Process Injection: Asynchronous Procedure Call · Process Injection: Process Hollowing · Event Triggered Execution: Windows Management Instrumentation Event Subscription · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • StealthObfuscated Files or Information · Process Injection: Asynchronous Procedure Call · Process Injection: Process Hollowing · Virtualization/Sandbox Evasion: Time Based Checks
  • Defense ImpairmentDisable or Modify Tools
  • Credential AccessOS Credential Dumping: LSASS Memory · Credentials from Password Stores: Credentials from Web Browsers
  • DiscoveryVirtualization/Sandbox Evasion: Time Based Checks
  • Command and ControlWeb Service: Bidirectional Communication
  • ExfiltrationExfiltration Over Web Service: Exfiltration Over Webhook

Execution TA0002

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1059.001Command and Scripting Interpreter: PowerShell×1

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. PowerShell can also be installed on Linux and macOS. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-10-09/talos-ai-analysis-evasion-instructions-aimed-at-llm-triage · ATT&CK page ↗

Persistence TA0003

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription×1

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Privilege Escalation TA0004

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1055.004Process Injection: Asynchronous Procedure Call×1

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1055.012Process Injection: Process Hollowing×1

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription×1

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-10-09/talos-ai-analysis-evasion-instructions-aimed-at-llm-triage · ATT&CK page ↗

T1055.004Process Injection: Asynchronous Procedure Call×1

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1055.012Process Injection: Process Hollowing×1

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1497.003Virtualization/Sandbox Evasion: Time Based Checks×1

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Credential Access TA0006

T1003.001OS Credential Dumping: LSASS Memory×1

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×1

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Discovery TA0007

T1497.003Virtualization/Sandbox Evasion: Time Based Checks×1

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Command and Control TA0011

T1102.002Web Service: Bidirectional Communication×1

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Exfiltration TA0010

T1567.004Exfiltration Over Web Service: Exfiltration Over Webhook×1

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server. Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello. When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Entries about CAIRN (Cisco Talos) (2)

2026-10-09 · view entry permalink →

NOTABLENATOB2

Cisco Talos: malware now embeds natural-language instructions aimed at LLM triage pipelines, from a copied comment to template-sprayed prompts across four families, and a Russia-aligned group uses it too

Talos, which tracks AI-integrated malware in its CAIRN toolkit, calls the class "AI-analysis evasion": malware that embeds natural-language instructions to influence automated analysis, aimed at the layer above packers and anti-debug checks, the pipeline that extracts text from a sample and submits it to a language model for triage, classification or reverse-engineering help (Cisco Talos, 2026-10-08). It traces four families and 84 samples collected from January 2025 to July 2026: a PowerShell reverse shell (FRUITSHELL) carrying a two-line comment that says there is no need to analyze the file, a comment later reused verbatim in nine further scripts from at least four actors, among them a script set that adds an AMSI bypass and runtime compilation (Cisco Talos, 2026-10-08). PLOTSAFE generates the sentence from a template and keeps it alive in Go builds with a dummy function that references the strings; HOLLOWCLAD repeats one refusal instruction across seven LLM chat-template formats so one copy may match the scanner's own template, and adds fake honeypot and licence warnings; MANTLEMAZE claims invented government contracts and certifications (Cisco Talos, 2026-10-08).

ESET found the technique in the hands of a named group: the Russia-aligned UAC-0099 put a decoy request for guidance on building a nuclear weapon into the comment of a VBScript, aiming to trip the safety guardrails of an LLM-powered code scanner so it stops before the malicious code that downloads the MATCHBOIL loader (ESET, 2026-09-10). Talos tested the strings against five local models, 135 matched pairs per string: its headline figure is that the best techniques steered the outcome in the attacker's favour in about 35% of runs, a net rate (pairs shifted toward benign minus pairs shifted toward malicious, over all pairs), while the cheapest technique, a direct instruction to ignore the sample, worked almost universally and the more complex ones had little effect or backfired by making models more suspicious; Talos calls the overall impact a mixed bag (Cisco Talos, 2026-10-08). It says core conventional detection is unaffected (Cisco Talos, 2026-10-08).

Triage: Talos' discriminator is that legitimate software has no reason to embed instructions telling an analyzer to refuse analysis, invoke copyright law or claim government contracts (Cisco Talos, 2026-10-08).

malware that embeds natural-language instructions to influence automated analysis

Legitimate software has no reason to embed instructions telling an analyzer to refuse analysis, invoke copyright law, or claim government contracts.

Cisco Talos 2026-10-08

no single LLM engine should have the sole authority to decide that a piece of code is safe

ESET 2026-09-10

Builds on: macOS.Gaslight, a DPRK-aligned Rust backdoor that targets the LLM-assisted analyst

research09 Oct 03:44Zmulti-sourceOpen finding →
Sources: Cisco Talos · ESET

2026-09-24 · view entry permalink →

ROUTINEupdatedNATOB2

CLOSEDQUORUM: Cisco Talos documents what it calls, to its knowledge, the first publicly documented Windows implant that lets a panel of four commercial LLMs vote on its next action instead of a human operator

Cisco Talos disclosed CLOSEDQUORUM on 2026-09-22, a 16.4MB, 64-bit Go-compiled Windows implant it calls, "to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control" (Cisco Talos, 2026-09-22). Instead of a dedicated attacker-operated server, its ModelOrchestrator component queries up to four commercial LLM providers (DeepSeek, Qwen, Mistral and Google Gemini) each cycle, with a system prompt instructing each model to "provide ONLY executable decisions" alongside host context (hostname, OS version, admin status) and the current target process. Each provider must respond with a fixed JSON schema naming one of four actions; interModelDiscussion() tallies the providers' decisions by plurality vote and executes the winner, discarding any malformed or off-schema response. On a tie, a hardcoded preference order settles it: "DeepSeek holds the deciding vote in any tie" (Cisco Talos, 2026-09-22), followed by Qwen and then Mistral; if every provider fails to return a usable decision, the implant sleeps and retries rather than falling back to a default action.

The four possible actions are steal (simultaneous LSASS memory dumping via SeDebugPrivilege and MiniDumpWriteDump, Chrome/Edge/Firefox saved-credential harvesting, and MetaMask/Exodus/Ethereum wallet data collection), inject (Early Bird APC injection into a suspended process by default, or PEB-walk process hollowing when a model selects that exploit type), persist (establishes three mechanisms: a Windows-Update-themed Registry Run-key value, a scheduled task, and a permanent WMI event subscription that fires a script every 60 seconds), and move, which has no handler in the public build. The implant suppresses ETW telemetry by overwriting EtwEventWrite with a single RET instruction (Cisco Talos, 2026-09-22). Every model decision, its stated reasoning, and staged or stolen data are relayed to the operator through a Discord webhook, with exfiltrated files AES-256-GCM encrypted, base64-encoded and posted in roughly 1,900-byte chunks at one-second intervals. Talos found the binary via CAIRN, an open-source research toolkit for tracking AI-integrated malware that it released the same day, and its static analysis is dated 2026-06-17, under a prior alias, BALZAK, that was renamed on 2026-07-03. Talos's CAIRN toolkit is not the autonomous exploitation engine also named Cairn that Gambit Security documented in a separate 2026 campaign against online retailers (Gambit Security, 2026-09-22). Talos states plainly "we do not have confirmation of in-the-wild deployment," though artifacts in the binary connect its developer to carding-forum postings dating back to 2025 (Cisco Talos, 2026-09-22). The publicly distributed build ships with placeholder API keys and a dummy Discord webhook, so Talos has not observed a complete end-to-end execution; Talos assesses the actual distribution model puts a developer generating a customised binary with an individual operator's credentials injected at compile time, meaning any live deployment would run on infrastructure Talos has not seen.

Talos frames the finding as evidence of "effort displacement": an entire phase of an intrusion handed to a model rather than merely AI-assisted tooling. The Hacker News, reporting on the disclosure, draws its own comparison to LAMEHUG, malware Ukraine's CERT-UA reported in July 2025 that asked an AI model to write commands for a task already set in its code, contrasting it with CLOSEDQUORUM asking the models to choose the task itself (The Hacker News, 2026-09-23). Talos adds that handing the decision to models introduces weaknesses: "Provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas, and dependence on commercial APIs all create failure modes and defensive opportunities"; of these, only the tie behavior is one it calls "fully deterministic" (Cisco Talos, 2026-09-22).

exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.

CLOSEDQUORUM represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement.

CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets. It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI.

DeepSeek holds the deciding vote in any tie

Provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas, and dependence on commercial APIs all create failure modes and defensive opportunities.

The tie behavior is fully deterministic and biased toward DeepSeek.

Cisco Talos 2026-09-22
Correctionrun 2026-10-11T1307Z-audittitlebodyclassificationverificationtechniquesreferencessources

Talos calls CLOSEDQUORUM, "to our knowledge", the first publicly documented Windows implant to apply this model to tactical command and control; the superlative is Talos's hedged assessment. The 2026-06-17 date is that of Talos's static analysis, not of a build. Talos says only that the implant suppresses ETW telemetry by overwriting EtwEventWrite with a single RET instruction, and it adds a five-minute initial delay and randomized 5 to 15 minute polling intervals to evade short-lived sandbox analysis (Cisco Talos, 2026-09-22).

Correctionrun 2026-10-20T0835Z-auditbodyevidencesummary

Talos does not call the implant's failure modes deterministic, and it does not present the sleep-and-retry response to total provider failure as a defender opportunity. Its list of weaknesses is "Provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas, and dependence on commercial APIs", which it says "all create failure modes and defensive opportunities"; the only behavior it calls "fully deterministic" is the tie-break, biased toward DeepSeek (Cisco Talos, 2026-09-22).

Builds on: Three off-the-shelf AI agents ran almost the entire card-theft campaign, from discovery to…

threat24 Sep 04:45Zsingle-sourceOpen finding →
Sources: Cisco Talos · The Hacker News · Gambit Security

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1
  • Research1

Source distribution

  • blog.talosintelligence.com2 (40%)
  • gambit.security1 (20%)
  • thehackernews.com1 (20%)
  • welivesecurity.com1 (20%)
All cited sources (5)