Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented AI-Orchestrated C2 Implant

Key facts for ClosedQuorum and CAIRN toolkit

Detection coverage for ClosedQuorum and CAIRN toolkit

As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2615 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CLOSEDQUORUM LSASS Dump, Browser Credential & Crypto Wallet Theft Staging

Detects staging of an LSASS memory dump alongside browser credential-store copies (Chrome/Edge Login Data, Firefox logins.json) and cryptocurrency wallet data under C:\Windows\Temp, matching CLOSEDQUORUM's simultaneous 'steal' decision handler (SeDebugPrivilege + MiniDumpWriteDump for LSASS, plus MetaMask/Exodus/Ethereum wallet-file collection).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.001, T1555.003, T1552.001, T1074.001
• Data sources: sysmon, windows_security, edr_file_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  TargetFilename IN ("C:\\Windows\\Temp\\lsass.dmp","C:\\Windows\\Temp\\chrome_logins.db","C:\\Windows\\Temp\\edge_logins.db","C:\\Windows\\Temp\\firefox_logins.json") OR TargetFilename="C:\\Windows\\Temp\\crypto\\*"
| eval staged_type=case(
    match(TargetFilename,"lsass\.dmp"),"lsass_dump",
    match(TargetFilename,"chrome_logins|edge_logins"),"browser_credentials",
    match(TargetFilename,"firefox_logins"),"browser_credentials",
    match(TargetFilename,"\\\\crypto\\\\"),"wallet_theft")
| stats values(staged_type) AS staged_types, values(TargetFilename) AS files, count by Computer, User, Image, ProcessGuid
| where mvcount(staged_types) >= 1

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where (FolderPath has @"C:\Windows\Temp" and FileName in~ ("lsass.dmp","chrome_logins.db","edge_logins.db","firefox_logins.json")) or FolderPath has @"C:\Windows\Temp\crypto"
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine has_any ("MiniDumpWriteDump","SeDebugPrivilege") or FileName =~ "lsass.exe"
) on DeviceName
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine
| order by Timestamp desc

Sigma

title: LSASS Memory Dump and Browser/Wallet Credential Staging to Windows\Temp (CLOSEDQUORUM)
id: 7dab2b45-608c-4ebd-cf41-925abd7ea043
status: experimental
description: Detects staging of an LSASS memory dump alongside browser credential-store copies and cryptocurrency wallet files under C:\Windows\Temp, consistent with CLOSEDQUORUM's 'steal' decision handler.
references:
    - https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1555.003
    - attack.t1552.001
    - attack.collection
    - attack.t1074.001
logsource:
    category: file_event
    product: windows
detection:
    selection_lsass:
        TargetFilename|endswith: '\Windows\Temp\lsass.dmp'
    selection_browser:
        TargetFilename|contains:
            - '\Windows\Temp\chrome_logins.db'
            - '\Windows\Temp\edge_logins.db'
            - '\Windows\Temp\firefox_logins.json'
    selection_wallet:
        TargetFilename|contains: '\Windows\Temp\crypto\'
    condition: 1 of selection_*
falsepositives:
    - Authorized incident-response or forensic-collection tooling staging artifacts to Windows\Temp using overlapping filenames
    - Scheduled EDR-vendor memory-forensics agents performing legitimate LSASS integrity captures
level: critical

Known false positives:

• Authorized incident-response or forensic-collection tooling staging LSASS/browser artifacts under Windows\Temp using overlapping filenames
• Scheduled EDR-vendor memory-forensics agents performing legitimate LSASS integrity captures

Tuning notes: Suppress known EDR/forensic-tooling process hashes and IR-jump-box hostnames; raise severity to critical-confirmed if SeDebugPrivilege enablement or a direct MiniDumpWriteDump call against lsass.exe is observed alongside the staged files.

• 🔒 Sentinel: Multi-Provider Commercial LLM API C2 Polling Pattern · unlock with TL Creds
• 🔒 CLOSEDQUORUM Early Bird APC Injection & Process Hollowing · unlock with TL Creds
• 🔒 CLOSEDQUORUM Randomized 5-15 Minute Polling Jitter with Sandbox-Evasion Delay · unlock with TL Creds
• 🔒 Sigma: Multi-Provider Commercial LLM API Contact (CLOSEDQUORUM Panel) · unlock with TL Creds
• 🔒 WindowsUpdate-Masquerading Persistence Triad — Run Key, Scheduled Task, WMI Subscription · unlock with TL Creds
• 🔒 EtwEventWrite Patched with RET Instruction — ETW Telemetry Suppression · unlock with TL Creds
• 🔒 CLOSEDQUORUM Multi-Provider Commercial LLM API C2 Polling Pattern · unlock with TL Creds
• 🔒 CLOSEDQUORUM Discord Webhook Chunked Encrypted Exfiltration · unlock with TL Creds

Indicators of compromise for ClosedQuorum and CAIRN toolkit

As of 2026-09-22, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2615.

Sample indicators (3 of 19)

• Domain: api[.]deepseek[.]com
• File hash: 250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7
• Domain: api[.]mistral[.]ai

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How ClosedQuorum and CAIRN toolkit works

No confirmed in-the-wild deployment; the public distribution build ships with placeholder API keys and a dummy Discord webhook and is non-functional as distributed.

Cisco Talos published two companion research releases on 2026-09-22: 'Introducing CAIRN: Frontier tracking for AI-integrated malware' and 'The Closed Quorum: Inside the first reported autonomous AI C2 implant.' CAIRN (Cognitive Artifact Intelligence Research Network) is an MIT-licensed, open-source Python toolkit (github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network) that hunts, classifies, and tracks 'AI-integrated malware' -- malware that, in Talos's own definition, 'functionally operationalizes, explicitly targets, or exploits AI systems and their ecosystems' -- entirely from VirusTotal Intelligence scan metadata, without downloading or detonating binaries. It runs 24-27 acquisition filters (provider-api-integration, python-ai-scripts, ai-analysis-evasion, local-llm-runtime, agentic-tooling, and Chinese-provider-specific filters for BigModel/Qwen/ERNIE, among others) to pull candidate samples, then classifies them through a three-tier YARA ontology (26 total rules): Tier 1 (9 rules) flags primitive artifacts such as hardcoded LLM API endpoints, key prefixes, and prompt-instruction residue; Tier 2 (8 rules) flags behavioral co-occurrence such as shell access paired with LLM calls, or evasion paired with offensive tradecraft; Tier 3 (9 rules) performs confirmed family-level attribution. CAIRN supplements this with embedding-based semantic clustering (UMAP/HDBSCAN) to surface samples that share no string overlap, and stores findings in a local SQLite corpus with a graph-explorer UI. Using this pipeline, Talos catalogued 10 confirmed AI-integrated malware families across 11 behavioral archetypes, including CLOSEDQUORUM (A4, LLM-Tasked C2), PROMPTLOCK (A1, LLM-directed payload generation, Go/Lua), HONESTCUE (A1, .NET), TEAMPCP (A5, LLM infrastructure supply chain, Python/npm), LAMEHUG (A6/A7, credential harvester, Python), PROMPTSTEAL (A6), QUIETVAULT (A6+A8, npm SDK malware), FRUITSHELL (A3, AI-analysis evasion, PowerShell), GUARDBREAKER (A3, VBScript), and PROMPTFLUX (A1, VBScript). Talos frames the corpus as evidence of an 'autonomy escalation arc' spanning roughly one calendar year: CERT-UA's July 2025 disclosure of LAMEHUG (Qwen2.5-Coder via Hugging Face, generating Windows recon/exfiltration commands for APT28-linked phishing) established single-model, execution-time LLM tasking; ESET's August 27, 2025 disclosure of PROMPTLOCK (Go/Lua, a locally-hosted Ollama gpt-oss:20b model generating cross-platform ransomware Lua scripts on the fly) and Google GTIG's August 2025 identification of QUIETVAULT (a JavaScript/npm credential stealer that weaponizes on-host AI CLI tools to recursively hunt for wallet and secret files before exfiltrating via a public GitHub repo) extended this to autonomous code-generation and autonomous secondary-discovery, respectively; Google GTIG's November 5, 2025 disclosure of PROMPTFLUX (a VBScript dropper whose 'Thinking Robot' module queries the Gemini API hourly for fresh obfuscation/evasion code, self-rewriting to the Windows Startup folder) added autonomous self-modification. CLOSEDQUORUM, compiled roughly seven months later, is the terminus of that arc: it removes the LLM from an on-demand tool role entirely and installs it as the standing tactical decision-maker.

CLOSEDQUORUM (renamed from an earlier internal designation, BALZAK, on 2026-07-03) is that end state. It is a 16.4MB, 64-bit Go-compiled Windows executable that Talos characterizes as the first publicly documented implant to delegate tactical C2 action selection to a panel of commercial LLMs rather than to a human operator or an attacker-run C2 server. On execution, after a 5-minute initial delay and thereafter on randomized 5-15 minute polling cycles, the implant gathers host context (hostname, OS architecture, CPU count, Windows version, administrative privilege state, and current target process) and substitutes it into a `TARGET:%s` prompt template. It queries up to four providers -- DeepSeek, Qwen (accessed via the openrouter.ai proxy rather than a direct Alibaba endpoint), Mistral, and Google Gemini -- each primed with the system prompt 'You are an advanced malware strategist. Provide ONLY executable decisions.' Each provider must return a response conforming to a strict JSON schema constrained to a small decision vocabulary; the implant tallies responses and the plurality winner executes, with ties broken by a fixed priority order (DeepSeek > Qwen > Mistral > Gemini). The decision space comprises: `steal` (simultaneous LSASS memory dumping via SeDebugPrivilege + MiniDumpWriteDump, browser credential theft from Chrome/Edge Login Data and Firefox logins.json, and cryptocurrency wallet theft from MetaMask's Chrome-extension storage plus Exodus and generic Ethereum wallet files); `inject` (operator/model-selectable Early Bird APC injection -- suspend a process, write shellcode, queue it via NtQueueApcThread, resume -- or classic process hollowing of a suspended process's image base); `persist` (Windows Registry Run-key creation under a `WindowsUpdate` value name, a `schtasks.exe`-created scheduled task, and a permanent WMI `__EventFilter` subscription named `WindowsUpdateFilter` that re-triggers a dropped `C:\Windows\Temp\wmi.ps1` PowerShell script every 60 seconds); and `move` (present in the schema but unimplemented) plus a `consensus` fallback that triggers a sleep/retry when no clear plurality forms. Collected artifacts are staged under `C:\Windows\Temp\` before being AES-256-GCM encrypted (key derived from the current date), Base64-encoded, split into 1,900-byte chunks, and posted at one-second intervals to an operator-specific Discord webhook, which also serves as a live channel for reporting the LLM panel's chosen action back to the operator. For defense evasion, the implant overwrites `EtwEventWrite` with a single RET instruction to suppress ETW telemetry, keeps a secondary payload encrypted with a time-derived key (recoverable only within an expected temporal window), and uses its randomized polling delay specifically to reduce exposure to short-lived sandbox analysis; persistence artifact names are deliberately styled to masquerade as legitimate Windows Update activity.

Critically, the publicly available distribution build ships with placeholder credentials (`dummy_api_key`, `dummy_webhook_url`); real provider API keys and a real Discord webhook URL are injected per-operator at compile time via Go linker flags (`-ldflags`), consistent with a credentials-as-a-service distribution model. Talos found no confirmation of in-the-wild deployment. Attribution is limited: development-build compilation artifacts cluster within an approximately 7-day window in mid-June 2026, and separate developer-linked criminal-forum posts discussing carding activity date to 2025, but no named threat actor, intrusion set, or nation-state sponsor is identified -- this is assessed as financially motivated crimeware infrastructure, not espionage tradecraft. Talos explicitly frames CLOSEDQUORUM as evidence of 'effort displacement': unlike prior AI-malware coverage that used a single model to augment attacker speed or scale (e.g., LAMEHUG), CLOSEDQUORUM removes the human-in-the-loop bottleneck entirely, enabling continuous, unattended, self-directed operation. For detection, Talos recommends correlating anomalous multi-provider LLM API traffic (bearer tokens presented to four competing vendors from one process within a short window, on a fixed 5-15 minute cadence -- described as having 'no benign analogue') with simultaneous LSASS access, process injection, persistence changes, and Discord webhook communication; CAIRN's own YARA detection keys on unstripped Go symbols (`main.interModelDiscussion`, `main.lsassDump`) and the hardcoded system-prompt string. A BeaconBeagle domain/config search against the implant's Discord CDN indicator (cdn.discordapp.com) returned zero matches, consistent with Talos's finding that CLOSEDQUORUM uses no dedicated attacker-controlled C2 infrastructure at all -- every network touchpoint is a legitimate commercial SaaS endpoint (LLM provider APIs, Discord CDN), which is itself the core detection challenge the CAIRN release is meant to address.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers

Collection

T1005 Data from Local System; T1074.001 Local Data Staging

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.004 Asynchronous Procedure Call; T1055.012 Process Hollowing; T1480.001 Environmental Keying; T1497.003 Time Based Checks

Exfiltration

T1030 Data Transfer Size Limits; T1567.004 Exfiltration Over Webhook

Persistence

T1053.005 Scheduled Task; T1546.003 Windows Management Instrumentation Event Subscription; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell

Command and Control

T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography

defense-impairment

T1685 Disable or Modify Tools

Remediation for ClosedQuorum and CAIRN toolkit

Immediate actions

• Alert on and investigate any single host/process presenting API bearer tokens to multiple distinct commercial LLM providers (DeepSeek, Qwen/OpenRouter, Mistral, Google Gemini) within a short time window on a repeating 5-15 minute cadence -- Talos describes this pattern as having no benign analogue.
• Correlate any multi-provider LLM API traffic with concurrent LSASS access, SeDebugPrivilege/MiniDumpWriteDump calls, process injection (suspended-process creation + NtQueueApcThread, or process hollowing), Registry Run-key writes, WMI permanent event subscriptions, or scheduled-task creation on the same host.
• Hunt for EtwEventWrite patched with a RET instruction (ETW telemetry suppression) and for outbound Discord webhook POST traffic from unexpected processes in 1,900-byte chunked patterns.
• Deploy YARA/EDR signatures for unstripped Go binary symbols main.interModelDiscussion and main.lsassDump, and for the hardcoded system-prompt string "You are an advanced malware strategist. Provide ONLY executable decisions."

Workarounds

• Where feasible, restrict or monitor egress to api.deepseek.com, api.mistral.ai, openrouter.ai, and generative-AI provider endpoints from hosts/processes with no approved business use for commercial LLM APIs.
• Monitor and alert on Discord webhook/CDN traffic (cdn.discordapp.com) originating from non-approved applications, particularly when correlated with credential-access or persistence indicators above.

Longer-term hardening

• Run Cisco Talos's open-source CAIRN toolkit (or an equivalent cognitive-artifact scanner) against internal binary corpora and VirusTotal Intelligence telemetry to proactively hunt for AI-integrated malware artifacts (prompt templates, LLM provider endpoints, API-key prefixes, jailbreak terminology, orchestration logic).
• Build behavioral detection content around 'LLM-as-decision-engine' malware patterns generally, since CAIRN's corpus documents 10 distinct AI-integrated families across 11 archetypes beyond CLOSEDQUORUM alone.
• Extend browser-credential-store and cryptocurrency-wallet-file monitoring (Chrome/Edge Login Data, Firefox logins.json, MetaMask/Exodus/Ethereum wallet paths) given this implant's steal-action targets.

Affected and fixed versions

• Microsoft — Windows (client and server)
  Vulnerable versions: All supported Windows versions capable of running a 64-bit Go executable with standard WinAPI, Task Scheduler, and WMI access -- not a version-specific vulnerability, this is a Windows-targeting implant, not an exploit

Timeline of ClosedQuorum and CAIRN toolkit

• 2025-06-01 LAMEHUG, later catalogued by CAIRN as archetype A6/A7, is first observed in the wild per public reporting (exact day not disclosed; reporting places this in June 2025), predating its public disclosure by roughly six weeks.
• 2025-07-10 CERT-UA receives reports of suspicious phishing emails sent from compromised Ukrainian government accounts, opening the investigation that identifies LAMEHUG.
• 2025-07-17 CERT-UA publicly discloses LAMEHUG, the first widely reported LLM-integrated malware (used Alibaba's Qwen2.5-Coder-32B-Instruct via the Hugging Face API to dynamically generate Windows reconnaissance/exfiltration commands), attributed with medium confidence to APT28. Talos cites this as the starting point of the 'autonomy escalation arc' that culminates in locked-ioc-18.
• 2025-08-15 Google Threat Intelligence Group identifies QUIETVAULT (exact day not disclosed; reporting places this in August 2025), later catalogued by CAIRN as archetype A6+A8 (JavaScript/npm): a GitHub/NPM-token credential stealer that embeds a malicious prompt instructing on-host AI CLI tools to recursively hunt the filesystem for wallet and secret files before exfiltrating via a newly created public GitHub repository.
• 2025-08-27 ESET discloses PROMPTLOCK, later catalogued by CAIRN as archetype A1 (Go/Lua): a ransomware prototype using a locally-hosted Ollama gpt-oss:20b model to generate cross-platform, SPECK-128-encrypting Lua scripts in real time -- the first documented case of an LLM autonomously generating attack payload code rather than just recon commands.
• 2025-11-05 Google Threat Intelligence Group's 'GTIG AI Threat Tracker' discloses PROMPTFLUX, later catalogued by CAIRN as archetype A1 (VBScript): a dropper whose 'Thinking Robot' module queries the Gemini API to obtain fresh obfuscation/evasion code roughly hourly, self-rewriting its own source and re-saving it to the Windows Startup folder for persistence -- an intermediate step toward full autonomy that Talos situates between LAMEHUG's single-shot command generation and locked-ioc-18's continuous multi-model decisioning.
• 2026-06-17 Per CAIRN's own YARA rule metadata (referencing SHA256 locked-ioc-1), Talos completes its earliest static analysis of the sample under its original internal designation locked-ioc-19; the developer's build chain for the implant spans a separate, contiguous seven-day development window per Talos's compile-timestamp analysis of the six catalogued samples (exact calendar dates for that window are not disclosed).
• 2026-07-03 The implant is renamed from its earlier internal designation locked-ioc-19 to locked-ioc-18, per CAIRN's YARA rule reference metadata for the same sample.
• 2026-09-22 Cisco Talos publishes 'The Closed Quorum: Inside the first reported autonomous AI C2 implant,' disclosing full technical details of locked-ioc-18, including its plurality-vote LLM architecture, capabilities, and indicators; Talos states it found no confirmation of in-the-wild deployment and that the public distribution build is non-functional (placeholder API keys and webhook).
• 2026-09-22 Cisco Talos publishes 'Introducing CAIRN: Frontier tracking for AI-integrated malware' and open-sources the CAIRN toolkit (MIT license) on GitHub, cataloguing 10 confirmed AI-integrated malware families across 11 behavioral archetypes.

Sources cited for ClosedQuorum and CAIRN toolkit

• Introducing CAIRN: Frontier tracking for AI-integrated malware Cisco Talos · Vendor report · 2026-09-22
• The Closed Quorum: Inside the first reported autonomous AI C2 implant Cisco Talos · Vendor report · 2026-09-22
• CLOSEDQUORUM Malware Uses Commercial LLM Quorum for Autonomous C2 mallory.ai · Research · 2026-09-22
• ESET discovers PromptLock, the first AI-powered ransomware ESET WeLiveSecurity · Research · 2025-08-27
• GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools (PROMPTFLUX, QUIETVAULT) Google Cloud · Vendor report · 2025-11-05
• Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network (GitHub) GitHub · Code repository · 2026-09-22
• Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware cybersecuritynews.com · News · 2026-09-22
• Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware unite.ai · News · 2026-09-22
• CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign The Hacker News · News · 2025-07-17

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems Previous report
• ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panel Next report