Talos finds AI-generated Python wiper and mass-deployment scripts in a Qilin-affected environment, identified by step-numbered comments and consistent per-step logging

Investigating a separate, Qilin-affected environment, Cisco Talos found three Python post-exploitation scripts in the operator's own staging directory that it assesses with medium-to-high confidence were generated with AI assistance rather than hand-written: deadman.py, a time-triggered wiper deployed via Group Policy Object; veeam_kill.py, which stops, disables and destroys Veeam backup infrastructure; and deploy_locker.py, a mass-deployment launcher for the ransomware payload itself (Cisco Talos, 2026-09-17). Talos's basis for the AI-generation call is stylistic rather than a direct admission or watermark: veeam_kill.py's main() function divides execution into four numbered stages, each carrying a comment and a progress-log line held to a uniform level of detail, and deadman.py's do_gpo function shows the same evenly-commented, staged structure, a pattern Talos found consistent across the scripts and consistent with specification-style docstrings rather than typical hand-written incident-response or red-team tooling. The operator's own bash history additionally references a local tool named llm_chatbot, which Talos cites as corroborating evidence for AI involvement in the scripting workflow.